GB Group — Letting the right one in

On an FY20 EV/EBITA of 25.8x and P/E of 33.6x, GBG trades towards the top end of its peer group. Our reverse DCF implies the shares already discount strong organic growth of 12% over the next 10 years (assuming a stable margin, in line with management’s current policy). We view the premium as justified by the quality of earnings, the internationalisation of its product sets and the increasing product and market investment that underpin organic growth prospects, while M&A adds the potential for earnings surprise.

GBG’s premium valuation should be considered in the context of the following:

GBG provides identity data intelligence services on a global basis. By combining data from a network of more than 270 partners and c 510 datasets with its proprietary technology, it enables rapid data capture and search across many third-party databases, some of which are exclusive to GBG, along with data validation and analysis and database management services.

The group’s goal is to support clients in their quest to sign up and retain customers as quickly and easily as possible, while meeting all regulatory requirements and minimising fraud. Its products and services help companies recognise and verify the relevant elements of an individual’s identity in real time, enabling more informed and faster business decisions. Revenues are derived from its fraud, risk and compliance, customer location and intelligence and employee screening solutions.

GBG is one of the largest providers in the industry, able to verify c 4.4 billion consumers globally, with KYC and AML standards reached in 65 markets and core address verification in 240 markets. GBG’s headquarters are in Chester, England, and it has c 1,000 employees in 16 countries around the world. It has more than 19,000 customers across 72 countries and in FY19 45% of revenues were generated outside the UK. Its long list of reference clients includes blue-chip names such as Barclays, eBay, Facebook and IBM.

The company has outlined its strategic priorities to deliver on its vision of becoming the global leader in identity data intelligence. Its four areas of focus are to:

Via this strategy, GBG aims to grow revenues at a double-digit organic rate and generate adjusted operating margins of at least 20% per annum.

The growth strategy incorporates acquisitions and organic initiatives in order to add data, product and market reach. With the UK market maturing, the internationalisation of its products is also a key priority. GBG has been very product-focused in the past and as it gains in scale it is shifting its focus to the customer. This includes building brand awareness, providing better customer service and joining up products where appropriate.

A particular focus of investment is on the interlinking of GBG’s product sets so that a customer can access the entire suite via a single API. On an ongoing basis GBG invests in adding datasets and product features that enable it to both increase its addressable market by targeting new industries, while also making the products stickier. GBG is increasing investment in sales in order to effectively cross-sell the new products it has developed or obtained via acquisition and has established a Customer Success function. The Loqate brand was launched in H119, incorporating all of GBG’s location-based solutions, and the group has developed its new Identity Solution, bringing together its identity and location services, which will be launched later this year.

The market for ID verification solutions remains fragmented and GBG has an active pipeline of opportunities. It targets companies that fill data gaps, bring new technology or product sets that can be rolled-out globally, can enhance its market position or help it to develop internationally.

GBG has made 12 acquisitions over the last eight years totalling £410m in enterprise value (see Exhibit 2). The two most recent acquisitions, VIX Verify1 and IDology,2 have boosted GBG’s presence in the US, Australasia and Asia-Pacific, added new multi-national customers and brought new datasets to the group. While the overall price paid based on EV/revenue multiples looks high, the average is skewed by the recent acquisition of IDology. IDology was generating EBITDA margins of 42% prior to acquisition, justifying the higher multiple. Excluding IDology, the average paid was 3.1x trailing sales.

The UK market is relatively mature with the fastest growth coming from international markets. Furthermore, as the data quality in many emerging international markets is much poorer than in the UK, the validation and verification solutions are often sold together (whereas in the UK there is less need for validation services as verification is driven off already validated postcode data).

It is becoming increasingly important to be able to support multinationals and consumers undertaking cross-border transactions. To do this, the company has expanded its operations outside of the UK over the last five years (see Exhibit 3 and 4), helped by the acquisitions of DecTech (Australia), Loqate (US), VIX Verify (Australia/NZ) and IDology (US). In FY19, 45% of revenues were generated outside of the UK (international revenues grew 56% y-o-y), and based on the inclusion of a full year of revenues for IDology and VIX Verify, we would expect the majority of revenues to be generated outside of the UK in FY20.

GBG has more than 270 partnerships with organisations that have access to data that can be used as part of the identity verification process. For example, credit reference agencies, electoral rolls, passport and national ID registers, postal services, mobile operators and retail or social media data. Its value add is in combining huge amounts of data from multiple sources around the world, analysing, cleansing and organising them so that they can be packaged for real-time access via its proprietary software. It draws on a wide spectrum of verification methods: official (passport, bank account details, driving licence, etc), attributed (address, device ID, social ID, etc), biometric (facial recognition and liveness detection) and behavioural (usage patterns, likes, cookies, etc).

Its services are used across a wide range of B2C sectors including financial (36% FY19 revenues), gaming (10%), retail & e-commerce (10%), government (8%), motor & transport (4%) and leisure (4%).

Products are sold on a subscription (SaaS) or multi-year licence basis. Pricing typically comprises a one-off set-up fee, followed by a data-as-a-service (DaaS) single or batch pricing structure flexed for volumes, feature sets and the number of users. This is also the basis on which GBG acquires third-party data, so profitability can be managed. Customers stay on average for 10 years, and the more data, feature sets and training are added, the stickier products become, with client churn risk increasing when new systems are deployed. There is high revenue visibility, with approximately 70% of revenues recurring in nature, stemming from renewals, long-term contracts or repeat business, and customer concentration is low.

Services are delivered according to customer preference, with on-premise, private cloud and public cloud options available. The sales process is largely direct, with a growing focus on adding channel partners and supporting self-service operations.

The cost of acquiring and managing data is the largest component of cost of sales. Gross margins have increased in recent years as the group benefited from scale economies in data acquisition, platform consolidation and the acquisition of IDscan, which has no acquired data requirements. The two most recent acquisitions reduce the gross margin in FY20 versus FY19, but gross margins should remain broadly flat from FY20, with scale benefits in mature markets being offset by lower margins in newer territories. Operating expenses are largely of a fixed nature and mainly relate to employees and property. GBG has offices in 20 locations; in FY19 it employed 367 people in R&D, 42 in production and a further 475 in sales, general and administrative functions.

GBG reports across two divisions: Fraud, Risk & Compliance (FRC), and Location & Customer Intelligence (LCI). Exhibit 7 details the divisional structure and key product lines within each division. GBG’s three largest service lines (Identity, Fraud and Location) are international and are the three segments that have grown most rapidly in recent years, both organically and through acquisition. The remaining segments are UK-centric. All service lines, bar Engage, have reported strong underlying growth over recent periods. We note that GBG plans to change its reporting structure to the three business lines Identity, Location and Fraud. We understand that Identity would include Employ & Comply, Location would include Engage, and Fraud would include Trace & Investigate.

The services in this business line are used by organisations to protect themselves from the growing global problem of identity theft, for money-laundering checks, or to restrict underage access to content (eg for gambling). GBG can verify the identity (at a basic level) of over 4.4 billion individuals globally, in 190 markets, while being able to perform to KYC and AML standard checks in 65 markets. GBG’s identity verification products provide a confidence score – this is the level of confidence that a person is who they say they are. GBG believes it is able to provide a confidence score 10–15% better than its competition due to the wider range of data sources it uses.

GBG ID3global is used to validate the identity of individuals by matching common personal details (name, address and age) against reference data (utility bills, electoral roll, passport, etc) at the point of registration, without the need for physical documents. In addition, it provides a valuable audit trail that demonstrates that the necessary checks have taken place, thereby helping companies comply with international legislation. No personal data are disclosed by the reference databases and, as a result, ID3global complies with data protection laws. GBG IDScan authenticates documents. It takes a snapshot of documentation, such as an ID card, passport, driving licence or other form of ID, and gives a definitive yes/no answer as to its authenticity within seconds. GBG Identity Solution combines ID3global, IDScan and GBG’s Loqate services, and is due for launch later this year.

Management is focused on growing the core domestic markets in the UK, US and Australia, with a focus on compliance-heavy industries, and is also keen to develop more channel partnerships.

Employ & Comply (5% FY19 revenues): GBG KnowYourPeople is a resource for screening and verifying new employees. UK employers, or organisations looking after vulnerable adults and children, can outsource their entire employee disclosure and barring service (DBS) checks and background screening to GBG. GBG OnlineDisclosures provides online criminal records checking.

In FY19, GBG combined its three location offerings (Matchcode360, GBG Loqate and PCA Predict) into one brand, Loqate. The division provides location data in 240 countries/territories, in 130 address formats and eight character sets. GBG can geocode almost any address worldwide, for example to enable locations to be shown on a map or to improve location databases. Loqate’s services are used for three applications: customer on-boarding and conversion; enhanced data and decisioning; and master data management. The technologies make the customer registration process smoother, faster and more accurate by capturing customer data in real time, validating it and using it to pre-populate online forms. As well as helping e-commerce retailers to reduce the rate of delivery failures (c 20% of failed deliveries are due to inaccurate address details), accurate address data are vital in software used for sales management, billing and tax purposes. Sales take a three-pronged approach: self-service (11% of revenues), direct (66%) and via c 40 channel partners (23%).

Currently Loqate is focused on customers in the UK, the US, Germany, Canada and Australia/NZ. It is putting additional investment into the US and Germany, building on VIX’s position in New Zealand (via its Mastersoft solution) and investigating the potential to expand the business in Asia.

Engage (7% FY19 revenues): GBG Marketing Services offers database creation, management and analysis to help develop a single view of a customer to support digital marketing strategies. This division is sub-scale compared to its many UK peers, and its financial performance has been relatively poor in recent periods. Management is looking to evolve the service by adding more analysis and insight while streamlining costs. However, the division sits within a strong competitive environment, with a high number of new entrants.

The majority of revenues come from GBG Activate, a customisable credit-scoring and management system used in on-boarding customers. It also has an expanding presence in the identity fraud prevention market with GBG Predator, which monitors customers’ transactions to stay alert to abnormal behaviour, and GBG Instinct, a fraud-management engine that checks customer data against globally available identity information: account numbers, previous applications, blacklists, criminal databases ,etc. It has a strong presence in South-East Asia and in the financial services industry and in H219, GBG signed up its first US domestic bank, Discover Financial Services. One of the key differentiators of the service is that it can operate in multiple languages (rather than translating into one overriding language then translating back), which increases its accuracy and hit rate in identifying anomalies. It also allows customers to set and edit their own rules for pass or rejection rate criteria. This means that any required changes can be accommodated quickly and easily, without lengthy or expensive change requests – a key differentiator in the fraud management sector where fraud prevention needs to be reactive and iterative.

The main focus markets are Australia, New Zealand, China, Singapore, Indonesia and Malaysia. Secondary markets include Hong Kong, Spain, France, South Africa, Thailand and the Philippines. The business is exploring partnerships that can provide consulting and delivery services.

Trace & Investigate (9% FY19 revenues): GBG Connexus combines GBG’s national identity register with real-time data from multiple social networks and other consented data pools, helping customers locate and contact individuals. This product is popular with the debt recovery market and police forces (GBG contracts directly with 60% of the UK’s forces) to help trace individuals or identify potential associates, in the insurance market to spot potential fraud (eg by linking people in ‘crash for cash’ schemes), for reunifying financial assets (£15bn lies unclaimed in old UK bank accounts, pensions, life assurance and investments) and by the retail industry to help identify employee-linked stock theft.

GBG’s platform is built on a micro-services architecture and is cloud native and agnostic. In FY19 the company invested in the platform to strengthen the ability to scale volumes quickly and efficiently and to provide faster response times for customers. This included the migration of some systems to the cloud (using Amazon Web Services), standardising orchestration across the group with the Kubernetes container system and the launch of a Security Operations Centre to provide continuous monitoring.

On a product basis:

Digital transformation, globalisation, regulation, and fraud and risk management continue to underpin structural growth in the identity verification industry. Various market studies point to continued strong growth. A Fuel by McKinsey report from June 2018 (ID verification as a service) estimated that the market was worth $10bn in 2017 and is expected to grow at a rate of 9–15% per annum to reach $16–20bn by 2022. A report from MarketsandMarkets estimates that the market for identity verification will be worth c $6bn in 2019 and is forecast to grow at a CAGR of 16% to $12.8bn by 2024. Based on its current geographic focus, GBG estimates that it has a total addressable market of c $2bn for its identity business and c $1bn for its location business. Below, we look at the key drivers in more detail.

Digital transformation: sustained growth in the volume of transactions made over the internet and increasingly via mobile devices is driving demand for electronic identity verification (eIDV). This includes online retail and travel, online gambling, signing up for and using digital-first bank accounts, mobile payments and the sharing economy, as well as government services such as filing tax returns or applying for a passport. We also point to the culture of change as a driving force for ID verification solutions, with individuals more frequently switching careers and service providers than previous generations.

Ubiquitous digital identities: the World Bank targets that everyone will have a digital identity by 2030 and the roll-out of digital citizen programmes around the world is a key catalyst in modernising identity verification, which remains largely paper based. The shift to digital identities is viewed as a vital factor in reducing poverty, social exclusion and inequality in developing economies and in reducing the costs of providing government services in all economies. In parallel, increasing numbers of adults are developing wider digital ID footprints: nearly half the world’s population has a social media account and according to the GSMA, more than two-thirds of the population has a mobile subscription, providing additional verification options.

Globalisation: increasingly, companies need to verify customers across borders, where customers may have a limited credit history or where the reliance on a credit check is no longer sufficient. GBG’s solutions can help to address this by combining things like geolocation (used when no formal postcodes are available) with an overview of previous activity or social network identities.

Regulation and compliance: in many industries, regulation dictates minimum identity verification requirements. KYC and AML regulations stipulate a minimum level of identity verification in all industries covered by money laundering regulations (estate agents, financial institutions, the gambling groups). Background employee checks are mandatory in many industries, eg when working with children, the police force, etc.

ID fraud: according to the Annual Fraud Indicator 2017 report, 50% of all crimes in the UK are fraud related, costing the government almost £200bn a year. Cifas, the UK’s fraud prevention service, estimates that total reported fraud cases increased 6% in 2018 to 323,660, of which 189,108 were identity fraud (+8% y-o-y). Globally, 2.8bn identity records were breached in 2017 (source: Juniper Research), up from 1.1bn in 2016. There are now more than 9bn records available on the dark web for sale for as little as $0.1 to $1.5 per item, along with an active market for scanned passports and other documents enabling bad actors to use an increasing number of tactics. The traditional tools of ID verification will remain a vital first step to ID verification. However, a more dynamic approach is needed as well – drawing on a broader range of data and methodologies such as biometrics or contextual information to forge links between IDs, locations, device and online behaviour. This complexity should play well to GBG with its global footprint, experience with a range of verification technologies and its trusted status in the industry.

Blockchain – nascent, but potentially disruptive technology: to verify an individual’s identity, institutions either obtain and store records of a client’s personally identifiable information (PII) directly, or will use a centralised body to verify information on their behalf (or both). This leads to the widespread dissemination of PII, increasing the risk of breach. The Equifax breach is an example of the risk users take when entrusting centralised authorities with PII. ID verification services, while accepted as necessary, can be found to be intrusive and add cost to institutions required to use them. For instance, it costs a bank approximately $15–20 to comply with KYC in the on-boarding process for a customer and any verification performed is only used once and cannot be shared between other companies.

Blockchain is being explored by a number of companies, including GBG, as a way to reduce customer friction and increase security. Blockchain applications could enable organisations to gain proof that an ID has been verified without ever having to see, or store, the PII themselves. In effect, it would cut out the need for a trusted intermediary to verify PII. For example, a user’s PII could be encrypted and stored locally on the user’s phone. A user would permission an institution that wants to verify its identity to make a request to the blockchain participants (the ‘verifiers’) to verify the previously audited PII. Sharing identity verification among networked partners eliminates potential weaknesses in single party ownership, and storing PII on the device, rather than centrally, makes data attacks on a mass scale more difficult. At the outset, every digital identity would still have to be verified and with more individuals and companies involved in e-contracts, volumes could increase significantly. However, in theory, once an individual has joined the blockchain service, companies would be able to trust users without the need to retrieve and store PII data. It may allow a move towards verifying ‘attributes’ instead of ‘identities’. For example, if all a company needs to know is that a customer is over 18, then it would only receive confirmation of this single attribute with no other PII provided, vastly reducing the impact of a data breach on such data. This is an active area of research for GBG, but it is still early days in terms of services being brought to market.

GBG both buys services from and sells them to major credit rating agencies (eg Experian, Equifax, FICO and TransUnion). These agencies also represent its main competition in ID verification (Exhibit 7 summarises GBG’s key competitors in each segment). Given the increasing prevalence of data breaches, institutions will only share PII with trusted partners and GBG’s place as a trusted partner in this ‘co-opetition’ ecosystem provides a significant barrier to entry.

While smaller than its main peers, GBG claims wider coverage in terms of datasets and markets. For example, the credit rating agencies (CRA), which have excellent electronic ID verification (eIDV) services, are limited to their own credit data meaning that in the majority of markets where the CRA is either owned by the government or a bank, they cannot compete. GBG, which is not regarded as a direct competitor in these markets, can acquire the data. Consequently, it can consolidate a much wider range of data points and across many more markets. This is particularly important in developing markets where customers often do not have a credit footprint and verifying identity can be difficult if restricted to one source. Management also points to the ease of integration of its products, and that its services are bespoke, using a SaaS business model with transparent pricing based on data use.

GBG also sees competition from point solution providers in the ID verification market including Jumio, Onfido and, to a lesser extent, Trulioo (all three are privately owned). US-based Jumio offers a similar service to IDScan and we estimate is the largest in terms of revenues (ARR $70m in Q218, target $100m for Q418). Although Onfido was founded in the UK, GBG only really sees them in the US; Onfido generated revenues of c $10m in CY17. Canadian-based Trulioo (c $20m revenues) is both a competitor and customer of GBG.

The final area of competition comes from businesses that continue to rely on paper and people to verify their customers’ identities. As eIDV services get easier to use, and companies look to reduce their back office costs, we would expect more to shift to using eIDV services.

Exhibit 8 shows GBG’s reported revenue growth over the last five years and our forecasts over the next three years. Organic growth in FY18 and FY19 was affected by a perpetual licence signed in H118 (GBG typically signs three-year licences). As we have previously written, if FY18 revenues are adjusted to treat the license as a typical three-year term license, organic revenue growth was 14% in FY18 and 11.5% in FY19.

The company targets double-digit organic revenue growth and adjusted operating margins of at least 20%. GBG has achieved double-digit organic revenue growth over the last five years, and has increased adjusted operating margins from 18.8% in FY15 to 22.3% in FY19 (see Exhibit 9). Typically, the company aims to support future growth by re-investing margins in excess of the 20% target. We forecast margins slightly above 20% for the next three years, with a small decline from FY20e to FY22e to reflect the mix effect of recent lower-margin acquisitions growing faster than the existing business. Our normalised EPS forecasts assume an effective tax rate of 21%, a blended mix of UK, US and Australian tax rates. We forecast EPS growth of 6.8% in FY20e, increasing to 11.7% in FY21e and 10.5% in FY22e. Our forecasts are unchanged from our last note on 6 June.

The company has limited working capital requirements and expects to be able to convert EBITDA to pre-tax operating cash flow (excluding exceptional cash flows) at a rate of c 95% (Exhibit 11). GBG does not capitalise development costs so capex mainly consists of premises and IT equipment. To acquire IDology, the company put in place a £110m credit facility with a £30m accordion and interest payable at Libor plus 1.5%. By the end of FY19 it had used £85.4m of this facility, with £54m still available for future acquisitions, resulting in a net debt position of £66m at the end of FY19 (Exhibit 12). We are forecasting strong cash generation over the next three years, which absent any further acquisitions should move the company back to a net cash position by the end of FY22.

In the table below, we show GBG’s financial performance and valuation metrics versus four peer groups: identity management companies (IDM), identity access management companies (IAM), cyber-security companies and UK software companies with a market cap above £100m.

GBG trades at a premium to the UK software sector, in our view due its higher revenue growth combined with the high level of recurring revenues. Within the IDM market, the charts below show that GBG trades towards the upper end, reflecting its strong forecast revenue growth.

Our reverse DCF (8.4% WACC, 3% perpetuity growth after 10 years) implies that the current share price is discounting organic revenue growth of approximately 12% over the next 10 years, assuming a stable EBITDA margin (in line with management’s current policy). While this growth rate is fairly high, GBG’s growing scale, widened product sets and international presence should support the current level of organic growth over the medium term, and the investments made in product development and customer services have the potential to add new revenue streams further down the line.

GB Group’s forecasts and share price are sensitive to the following factors: