Strong FY25; new product launched

In FY25 PCI Pal reported revenue growth of 25% (17% underlying), ARR growth of 25% and an adjusted EBITDA margin of 10%. Adjusted PBT of £0.8m was in line with market expectations. The company had cash of £3.9m at year-end. Post year-end, PCI Pal launched a new fraud management product in partnership with Telesign, marking the beginning of a series of adjacent product introductions that should enhance the attractiveness of the platform and increase cross-sale potential.

FY26 investment to maintain pace of ARR growth

Post the period of litigation, which diverted management attention, the company is back on the front foot. After a review of its medium-term strategy, it has decided to make incremental investment in product development and marketing in FY26 to maintain the high level of ARR growth. To deepen relationships with existing channel partners, the company is developing enhanced and additional products for the platform while standardising the deployment process to accelerate time to revenue.

Valuation: Minimal growth factored in

The stock is currently trading on EV/sales multiples of 1.2x FY26e and 1.1x FY27e, at a discount to both global CCaaS/UCaaS vendors and UK subscription software providers despite revenue and ARR growth at the higher end of the UK software group. A reverse discounted cash flow analysis shows that the market is only factoring in low single-digit revenue growth and mid-teen EBITDA margins in the medium to long term, well below the company’s targets. If we assume a higher rate of revenue growth (15% in FY28 trending down to 3% by FY35) and the EBITDA margin expanding to 30% by FY30, we arrive at a valuation of 141.6p/share.

Investment summary

Enabling secure payments for contact centres

PCI Pal is a global cloud-based provider of secure payment technology for business communications. It has developed solutions that support all contact centre communication channels (phone, email, social media, webchat, voice and chat bots) and payment methods (debit/credit card, digital wallet, buy-now-pay-later (BNPL), open banking).

Key investment considerations are as follows:

• PCI Pal is fully compliant with the Payment Card Industry Data Security Standard (PCI DSS), which means that contact centres using PCI Pal’s platform can remain outside the scope of PCI DSS. This is a significant driver of customer demand.
• The company has developed partnerships with a large majority of contact centre-as-a-service (CCaaS) and unified communications-as-a-service (UCaaS) vendors, and channel-driven sales make up 70–80% of new business every year.
• Tight integrations with contact centre environment technology reduce friction in the customer experience and help agents to successfully complete more transactions.
• PCI Pal has a track record of strong recurring revenue growth (an ARR CAGR of 36.7% for FY20–25) and recurring revenue made up 91% of FY25 revenue. The company moved into EBITDA profitability in FY24.
• Ongoing investment in product development is extending the product suite and providing opportunities for cross-selling. This includes embedding AI in products and also adapting to the use of AI within contact centres, in particular the use of conversational AI for chatbots.
• Post the several years of litigation instigated by a competitor, which has now been fully settled, management is fully focused on growing the business and driving organic ARR growth of 18–20% through to FY27 and beyond. Incremental spending on product development and marketing in FY26 is intended to support this growth.

Financials

In FY25, PCI Pal reported ARR growth of 25%, revenue growth of 25% (17% underlying) and an adjusted EBITDA margin of 10%. The company closed FY25 with net cash of £3.9m. In its end July trading update, the company confirmed that it would be increasing investment in the business to accelerate ARR growth, with a focus on product marketing, product development and marketing. Management expects to generate revenue in the range £23.5–24.0m in FY26. We forecast currency-adjusted ARR growth of 20% in FY26 and 17% in FY27 and adjusted EBITDA margins of 2.8% in FY26 (reflecting the step-up in marketing and product development spend) expanding to 8.2% in FY27. We forecast an adjusted EBIT loss of £1.2m in FY26 before moving to a small profit of £0.1m in FY27. Despite the additional investment in FY26, the company expects to be cash flow neutral in FY26, and we forecast a small increase in cash in FY27.

Valuation

The stock is currently trading on EV/sales multiples of 1.2x FY26e and 1.1x FY27e, at a discount to both global CCaaS/UCaaS vendors and UK subscription software providers despite revenue and ARR growth at the higher end of the UK software group. A reverse discounted cash flow (DCF) analysis shows that the market is only factoring in low single-digit revenue growth and mid-teen EBITDA margins in the medium to long term, well below the company’s targets. If we assume a higher rate of revenue growth (15% in FY28 trending down to 3% by FY35) and the EBITDA margin expanding to 30% by FY30, we arrive at a valuation of 141.6p per share.

Sensitivities

Our forecasts and the share price will be sensitive to the following factors: regulation and compliance (particularly in the payments industry), cybersecurity, technology shifts including the adoption of AI by customers, intellectual property protection, buying cycles, third-party infrastructure suppliers and dependence on partners’ sales strategies.

Company description

PCI Pal is a UK-based provider of secure payment technology for contact centres. Its cloud-based platform supports customers globally, with the majority of revenue currently from the UK but a growing proportion coming from North America.

Background

The company was originally founded in 1999 and listed on AIM in 2000 as County Contact Centres. In 2008, its name was changed name to IPPlus. In 2016, IPPlus sold the contact centre-related businesses (CallScripter and Ansaback) for £6.7m, paid a £1m special dividend to shareholders and changed the company name to PCI-PAL. The current CEO, James Barham, joined the company in 2008 to work in the CallScripter business and then moved to subsidiary IP3 Telecom to sell telephony services to Ansaback. From here, PCI Pal was developed by James and recently retired CISO Geoff Forsyth (who joined County Contact Centres in 1996). James was appointed to the board as COO in 2016 and the business relaunched as a provider of secure payment services to contact centres. In 2018, James moved to the US to set up the US operations and later that year was appointed CEO. PCI Pal currently has offices in London, Toronto, Charlotte (currently moving to Chicago) and Sydney and more than 130 employees.

PCI Pal raised money in March 2020 (gross proceeds of £5m from the issue of 16.7m shares at 30p per share), April 2021 (gross proceeds of £5.5m from the issue of 5.8m shares at 95p per share) and March 2024 (gross proceeds of £3.5m from the issue of 6.25m shares at 56p per share).

Strategy

The company has the stated goal to ‘enable businesses to take secure and frictionless payments in their contact centres and to step more confidently into a more digitally diverse future’. The business has grown to its current position through a focus on three areas:

• Cloud: PCI Pal was the first company to offer fully cloud-based secure payment solutions with the launch of its platform on AWS in 2017. It now supports seven cloud zones: three in the US, one in Australia and three in Europe. The company has more than 700 customers using its platform. The platform has good reliability, typically providing uptime of at least 99.999% and regularly reporting 100%-uptime quarters.
• Global: as a cloud-based business, PCI Pal can support companies around the world. In FY25, revenue was generated from EMEA (62%), North America (36%), and Australia and New Zealand (2%).
• Channel: the company has focused on selling through partnerships with companies active in the contact centre market. This includes CCaaS and UCaaS technology providers as well as payment providers. The company’s more than 50 partners drive 70–80% of new business sales. The company focuses its direct sales efforts on larger enterprise customers. Management believes it has the largest partner ecosystem in the market.

After the long-running patent litigation concluded and a new CFO was appointed last year, PCI Pal reviewed its rolling three-year plan. The conclusion was announced in July, when it confirmed that it remains focused on driving organic revenues and, to support this, it would spend an additional £1.5m (the majority in FY26) on marketing, product marketing and engineering to drive organic ARR growth of 18–20% per year through FY27 and beyond. To grow the business over the next three to five years, the company intends to focus on selling more to existing partners, either through selling the entire current product suite, through adding new features and enhancements to existing products, or, more importantly, by introducing adjacent products. In July, the company launched the first solution in its fraud detection suite, the first of several new product launches expected over the next year. By doing this, the company is targeting an increase in revenue per account. The company’s increased marketing efforts will be aimed at raising awareness of the product range with its existing partner base and attracting more direct enterprise business. To support its marketing push, the company hired US-based Kathy Varney as chief marketing officer.

In the video below, we interview CEO James Barham, who discusses the company’s progress and strategy in more depth.

Executive interview with James Barham, CEO of PCI-PAL

Source: Edison Investment Research

Management

The board consists of Non-executive Chairman Simon Wilson (appointed in November 2019), CEO James Barham, CFO Ryan Murray and Non-executive Directors Jason Starr (until 12 September), Andrew Lockwood and Carolyn Rand. The CEO is supported by the senior leadership team, which includes the CFO, Chief Technology Officer Mufti Monim, Chief Revenue Officer Darren Gill and Chief Marketing Officer Kathy Varney, and business partner functions including Chief Information Security Officer Royston Ballard, Head of People Rachael Drouet and General Counsel Adrienne Brophy.

Secure payment solutions provider

PCI Pal provides secure payment solutions to the contact centre market. The most common method of payment is by card, whether debit or credit, and the card scheme providers have strict rules to protect cardholder data via the PCI DSS. PCI Pal’s solutions have been designed to meet PCI DSS requirements and remove the contact centre from the scope of PCI DSS. This also helps manage the security implications of hybrid working, now that many contact centre agents work solely or partly from home. PCI Pal’s platform secures more than 500 million transactions per year across more than 700 customer environments.

PCI Pal’s value proposition

PCI Pal’s technology supports contact centres in the following ways:

• improves the customer experience by removing friction from the payment experience,
• enables customers to pay by channel of choice (eg phone, chat, SMS),
• improves the agent experience by removing complexity from the process,
• increases revenue by guiding the customer through the payment process, ensuring that more transactions are successfully completed,
• reduces risk by securing every transaction and maintaining PCI DSS compliance, and
• reduces costs by ensuring more transactions are completed first time, reducing interaction times and leveraging lower transactional cost payment methods.

Three main products address all communication channels

When a customer gets in touch with a contact centre to make a payment, PCI Pal’s platform supports assisted secure payments (via phone or webchat) or automated secure payments (via interactive voice response (IVR) or chat bots). PCI Pal has three core products:

1. Click to Pay: the customer receives a secure digital link, which can be used to pay via the payment method of choice. The agent is able to track all the steps taken by the customer and can guide the customer where necessary.
2. Key to Pay: the customer uses the phone keypad to type in the card details. PCI Pal’s technology masks the dual-tone multi-frequency (DTMF) tones so that contact centre workers cannot obtain card details. While the agent cannot see or hear the information, they will be shown the progress of each step so that they can guide the customer where necessary.
3. Speak to Pay: uses AI-powered natural language speech recognition to capture the card details. The agent can track each step but cannot see or hear the data being provided.

Most customers take the first two solutions, while Speak to Pay is more popular with enterprise customers that want to offer an accessible option. As well as supporting the ability to pay by card, PCI Pal has also added alternative payment functionality such as digital wallets (Apple Pay, Google Pay), buy-now-pay-later (Klarna, Affirm) and open banking (TrueLayer). PCI Pal has integrations with a wide range of customer relationship management (CRM), enterprise resource planning (ERP), CCaaS, communications platform-as-a-service (CPaaS) and UCaaS software solutions (see below for more detail).

Extensive partner integrations and relationships

PCI Pal has more than 50 partners, ranging from those with which PCI Pal’s technology is fully integrated, to solution providers that resell PCI Pal’s technology and referral and technology partners. The chart below shows key partners in each category. In FY25, 82% of new contracts and 68% of new ARR by value came through partners.

Zoom signed PCI Pal as a partner in 2023 and has since integrated PCI Pal’s technology into its Zoom Contact Centre and Zoom Phone services, available across the North America and EMEA regions. The first customers were signed and went live during FY24.

RingCentral became a partner in the second half of 2024 and PCI Pal’s technology has since been integrated into its RingEX and RingCX contact centre and communications solutions. This is now available across RingCentral’s North America and Europe regions and resulted in several customer wins towards the end of FY25.

In H225, the company signed a new agreement with a billion dollar revenue business communications company that has recently launched its own CCaaS offering alongside its well-established unified communications and meetings portfolio. PCI Pal has been selected as the preferred secure payments provider.

The company has partner managers in the main geographies, bearing in mind that the larger partners tend to be headquartered in the US, where PCI Pal sees the largest opportunity for new business. Continental Europe also presents an opportunity and the company recently hired two European-based partner managers to support the European sales operations of its global partners. In some cases, PCI Pal attends joint pitches with partners; in other cases, partners sell PCI Pal’s solution without the company’s involvement.

As well as the partnerships illustrated above, PCI Pal has integrations with a variety of CRM, desktop and web platforms including Salesforce, SAP, Microsoft Dynamics, Oracle, Civica, allpay, Epic and Pega. This means that when a payment transaction is made via PCI Pal, details about the payment can be fed automatically into the customer’s CRM system.

PCI Pal also has more than 130 payment service provider integrations including Adyen, Barclaycard, Chase Paymentech, Cybersource, Elavon, PayPal, Stripe and Worldpay.

Customers across a range of sectors

PCI Pal’s platform is currently used by more than 700 customers, with particular strength in the retail, local government and insurance markets. PCI Pal’s largest direct customer is the Department of Work and Pensions (DWP), with which it has worked since 2018. In November 2024, the company won a re-tender for the contract for another three years (worth more than £5m), with the option to renew for another three years after that on the same commercial terms. In FY25, the DWP generated 17% of PCI Pal’s revenue. Also in the UK, PCI Pal works with more than 125 local authorities, nearly 30 housing associations and other large central government agencies, including HMRC. A large proportion of the UK business comes via partners Civica, Pay360 (part of Access Group) and allpay. Exhibit 2 shows selected customers.

Recent notable contract wins include:

• In FY25, an enterprise-scale expansion sale to an existing airline customer (one of Europe’s largest carriers), expanding PCI Pal’s footprint to cover the customer’s travel agency business. The deployment is on a different CCaaS platform than the original implementation, highlighting PCI Pal’s comprehensive partner network.
• In FY25, a large US-based HVAC (heating, ventilation, air-conditioning) company with international operations and expansion potential.
• In Q126, PCI Pal displaced a competitor at one of the largest hotel chains in Spain.
• In Q126, the company signed its largest conversational AI deal to date, sold through a strategic partner. This will enable secure payments across both voice and chatbot interactions.
• In Q126, the company won its largest deal to date in Canada with a top 10 insurer, via a key partner.

Developing a broader product range

Having already partnered with the majority of significant companies in the UCaaS and CCaaS market, the company’s main focus is on deepening its relationships with its current partners. As well as selling to more of their end customers in existing and new territories, PCI Pal sees the opportunity to develop adjacent products that can be cross-sold.

New Fraud Management product recently launched

In July, PCI Pal launched the first element of its new Fraud Management Suite, a real-time AI-powered risk scoring product for early fraud detection. This is designed to protect against card-not-present fraud by delivering real-time risk insights to agents and AI bots before a payment is collected, reducing chargebacks and revenue loss without compromising the customer experience. Fraud prevention tools used in e-commerce channels, such as 3D Secure and biometric authentication, are not designed for use in the voice channel. PCI Pal is working with Telesign (a subsidiary of Belgian telecom group Proximus Global) and they have jointly developed a multi-layered AI-powered risk assessment engine. When used during an interaction, it will calculate the level of risk and recommend the best method of payment to match the risk level. So for example, a transaction scored as medium risk would direct the agent to ‘Click to Pay’, generating a link for the customer to use that would require either multi-factor or biometric authentication.

Ongoing AI-related development

Other areas of development include integrations with conversational AI (chatbot) resellers, with an application programming interface (API) now available, and in-product AI capabilities, such as intelligently recommending the best payment method for the customer.

Standardisation to simplify the deployment process

There is ongoing work to make it easier for customers to deploy PCI Pal’s technology. This serves several purposes:

• Supports self-service customers to deploy the technology without PCI Pal’s professional services involvement. This would allow PCI Pal to sell directly via its website.
• Supports partners to deploy PCI Pal’s technology to their customers with limited to no involvement from PCI Pal.
• Reduces time to revenue by reducing the period of time between contract signing and the customer going live on the platform.

Enhanced data analytics capability

The company has enhanced the data analytics capability in existing reporting packages to provide customers with better insight into their usage of the platform and to optimise opportunities for their payment and customer interactions.

Adapting to a changing market

The contact centre market

The contact centre market incorporates the technology, services and solutions that enable organisations to manage and handle customer interactions across multiple communication channels, including phone, email, chat, social media and self-service AI. Companies either run their own contact centres or outsource to specialist providers. The largest industries using contact centres include telecoms, financial services (insurance and banking), retail and e-commerce, healthcare, the public sector and utilities. Contact centres need to be able to deal with regional variations including language and regulations around privacy and card security. Based on data from various market research providers, c 2.0–2.5% of the workforce in the UK and the US is currently employed in contact centres.

Expanding out of the UK/North America presents a significant opportunity

As PCI Pal typically licenses its platform on a per-agent basis, the addressable market is best considered on this basis too. Research carried out by Omdia in 2023 (source: PCI Pal FY24 results) estimated that contact centre seats broke down as per Exhibit 3. PCI Pal estimates that c 60% of agents will handle payments, resulting in a total addressable market of 6.5 million seats globally. As PCI Pal is currently focused on the UK, the US, Canada and Australia, its addressable market totals c 4.5 million seats (Exhibit 4), which at an ARR of £100 per seat works out at a market size of c £450m per year. The company estimates that £75–100m of this market is currently served by PCI Pal or competitor technology, leaving a sizeable market still to be fought for. Adding to this, expanding into the rest of Europe, Asia-Pacific (including the Philippines and India), Latin America and South Africa would add another 2 million potential seats or £200m potential annual revenue. Clearly, there is also potential to increase revenue per seat through cross-selling as the company expands its product portfolio.

Digital transformation of contact centres

A key factor in opening up the market for PCI Pal is the ongoing digital transformation of contact centres. This includes both the increasing adoption of cloud-based technologies in the contact centre as well customers’ changing preferences for interaction. While voice calls still make up the majority of interactions, the use of digital channels such as email and web chat is growing fast. Adding in the increasing adoption of conversational AI tools to power chatbots it is clear that contact centres now have to manage a wide range of technologies and customer channels.

Contact centres require a combination of software to manage customer interactions and telecom services. The broad areas of contact centre technology are:

• CCaaS: contact centre-as-a-service. A cloud-based platform focused on customer-facing interactions. Consolidates voice, chat, email and social media into a unified system.
• UCaaS: unified communications-as-a-service. Cloud-based delivery of communication and collaboration services. Includes services such as voice calling, voice over IP (VoIP), video conferencing, messaging/chat, presence management, and file sharing and collaboration.
• CPaaS: communications platform-as-a-service. A cloud-based platform that supports developers to embed real-time communication features (voice/video/messaging) directly into applications without having to build or maintain complex back-end telecom infrastructure.
• Workforce management systems: used to forecast staffing requirements, manage schedules, monitor adherence to policies and handle time off requests.
• Workforce optimisation software: tools to analyse agent performance, ensure quality assurance and record calls for compliance and training.

PCI Pal’s platform acts as the bridge between contact centre software and services and payment processing services. PCI Pal partners with providers of the first three technologies above, providing a single repeatable integration to their public cloud platforms so that partners can deliver their solutions combined with PCI Pal’s across their entire customer base, wherever they may be located.

Conversational AI is changing the landscape

The emergence of large language model (LLM) technology based on generative pre-trained transformers (GPTs) has provided a significant boost to the development of voice and chat bots. LLM models, such as ChatGPT or Claude, make it much easier to develop bots that can converse naturally with humans. Multiple enterprise conversational AI vendors have emerged that enable customers to build their own chat bots, either voice or text-based. Major vendors include Poly AI, Cognigy (at the end of July, NiCE announced plans to acquire it for $955m), Boost.ai, kore.ai and Google (Conversational Agents). Currently, few payment transactions are made through this channel, partly due to a lack of sophistication of AI solutions and also due to some consumer issues with trusting a bot. However, this is likely to change, and we would expect a growing number of payments to be transacted via this communication channel while at the same time seeing an increase in the amount of conversations overall interacting with contact centres using AI agents. PCI Pal already has integrations with a number of leading voice and chat bot vendors, including Cognigy and PolyAI, and as discussed above in the product development section, PCI Pal has developed an API for conversational AI vendors. The company already has customers live across both voice and chat bot scenarios. As is the case for its existing customer base, using PCI Pal would enable conversational AI vendors to stay out of the scope of PCI DSS.

The rise of voice and chat bots could also present a challenge to the company’s business model, as it currently licenses its technology primarily on a per-agent basis. As the number of AI bots per contact centre increases, this is likely to reduce the total number of human agents required. The company expects the volume of customer interactions to increase significantly as a result of conversational AI, but pricing models are likely to evolve between traditional human seat licences and usage-based pricing (including usage bundling), which is seen in some AI scenarios. Management is assessing the best way to address this.

Payment technologies are evolving

The way that consumers make payments continues to evolve away from cash and cards. According to the Worldpay Global Payments Report 2025 (Exhibit 5), the majority of global e-commerce payment volumes in 2024 (c 65%) were made using digital payment methods, which include digital wallets, account-to-account (A2A: the consumer authorises payment direct from their bank account to the merchant’s account) and BNPL. Traditional methods of payment – debit/credit/prepaid cards and cash – made up c 35% of payment volumes. The large volumes of transactions processed via wallets in Asia skew the global average. In Exhibit 6, we show the breakdown for the UK. This still shows digital payment methods in the majority (c 52% in 2024) and forecasts that they will grow to c 72% of volumes by 2030.

The majority of customers who contact call centres to make payments will do so with a debit or credit card. These are governed by strict security rules – PCI DSS – mandated by the major card companies such as Visa, Mastercard and American Express. The aim of the standard is to protect cardholder data and reduce the risk of data breaches and fraud. PCI Pal’s platform has been developed to take contact centres out of the scope of PCI DSS by preventing agents from accessing cardholder data during and after the payment transaction. To support the growing number of non-card-based payment methods, PCI Pal has developed integrations to digital wallets, BNPL and A2A service providers. PCI Pal is agnostic as to the payment method used.

Contact centres have integrations with payment processors, typically companies such as Adyen, PayPal, Stripe and Worldpay, which will use the end customer’s payment details and act as the conduit between the merchant’s bank and the end customer’s bank. When a contact centre decides to use PCI Pal, PCI Pal will integrate with both the contact centre’s technology and the payment processor, acting as the bridge between the two.

Competition is mainly UK-based companies or in-house provision

As the majority of contract wins (by value and number) are via channel partners, the company is often not directly involved in competitive pitches. In some cases, two of PCI Pal’s partners may be bidding for the same contract. PCI Pal is more often sold to end customers that have decided to outsource their PCI DSS compliance rather than as a replacement to a competitor. When PCI Pal does see competition, it is from two UK-headquartered companies, Eckoh and Sycurio.

Eckoh was listed on AIM until January 2025, when it was acquired by Bridgepoint Partners. Eckoh has a larger business by revenue as it operates in areas that PCI Pal is not active in, including secure call and screen recording, self-service IVR, virtual contact centre services and browser-based agent desktop software. North America made up 48% of its FY24 revenue, rising to 51% in H125, and is the focus for new business. In FY24 (the year ended 31 March 2024), Eckoh reported revenue of £37.2m (-4% y-o-y) of which 84% was recurring, ARR of £30.8m (+1%), adjusted EBITDA of £10.2m (+8%, 27.4% margin), adjusted operating profit of £8.3m (+8%, 22.3% margin) and net profit of £4.5m. The company is in the process of shifting customers to the cloud, which reduced the level of hardware fees and set-up costs, and noted that all new customer wins in the year were for cloud deployment. For H125, ARR declined 1% y-o-y to £30.2m (flat in constant currency), with the loss of a legacy customer in the UK offsetting growth in North America. Eckoh does not disclose revenue by product. Post acquisition, Eckoh sold its US business to another company within the Bridgepoint group, but the combined FY25 revenue including continuing and discontinued operations was £34.2m, down 8% y-o-y.

Sycurio is privately owned, and was acquired by Livingbridge in 2021. Sycurio provides secure payment solutions with a hybrid offering. Its last filed accounts (for the year ended 31 December 2023) show that the company generated revenue of £20.0m (+1.6% y-o-y), adjusted EBITDA of £3.8m (-5%, 19.0% margin) and a net loss of £4.2m (this is after £4.3m in costs related to IP litigation; see Sensitivities section for more detail). Year-end ARR of £18m was flat year-on-year.

There are some smaller competitors (eg PayGuard and KeyIVR) that are solely focused on the UK, but management has confirmed that it does not see them when competing for new business.

Sensitivities

As well as the usual risks relating to competition and economic cycles, PCI Pal’s financials and share price are sensitive to the following factors:

• Regulation and compliance: the company needs to ensure the correct policies and procedures are in place and followed to maintain PCI DSS compliance. It also needs to meet national privacy requirements when dealing with customer data. Failure to do so could result in reputational damage and attract financial penalties. We note that the company was recently re-elected to the PCI Security Standards Council’s (PCI SSC’s) Board of Advisors for 2025–27, having previously served in this role for the 2023–25 period. This gives the company a voice in setting payment standards.
• Cybersecurity: as the company deals with personal and card data, it is an attractive target for hackers. The group has a chief information security officer tasked with managing this risk.
• Technology shifts: the adoption of AI presents both a risk and an opportunity. While very few payments are going through conversational AI now, this is likely to change and could drive a shift to transactional pricing rather than per seat licence revenues.
• Dependence on partner channel: around 70% of ARR comes via the partner channel. Of the top five partners, the average revenue contribution is 5–7% with no one partner making up more than 10% of ARR.
• Dependence on third-party infrastructure: PCI Pal’s cloud platform uses AWS, over which it does not have control of pricing or uptime. We note that to date, PCI Pal’s platform has performed well, with at least 99.999% uptime over the last two years. The company uses seven AWS regional instances (the UK, Ireland, Germany, the US (x3) and Australia), with redundancy in each region. If a particular regional instance fails, the company can switch operations to another region. There are other cloud providers that the company could switch to if necessary, although this would take time.
• Buying cycles: for channel sales, the company does not always have good visibility over the likelihood and timing of contract wins. For direct sales where the company is keen to target larger enterprise customers, these contracts typically have longer sales cycles.
• Intellectual property protection: PCI Pal has several patents over its technology and has been involved in a lengthy patent dispute brought by a competitor. Sycurio brought a patent infringement case in September 2021 in both the UK and the US. The High Court of England & Wales (September 2023) and the Court of Appeal (May 2024) found that Sycurio’s UK patent (2473376) was invalid due to obviousness from two sources of prior art. Even if it had been valid, PCI Pal’s Agent Assist solution would not have infringed. The High Court made an interim award of costs to PCI Pal of £1.1m, held in escrow, with Sycurio also to pay £0.2m of appeal process costs. In June 2024, PCI Pal and Sycurio settled all UK and US disputes. Separately, we believe that Sycurio had a dispute with Eckoh (neither party named the other party), described in Sycurio’s annual report as a patent licence dispute with a competitor. Sycurio paid £2.5m to the competitor with settlement in October 2024.

Financials

Business model

Customers sign up for annual or multi-year licences (typically three years) and licences are usually set up to auto-renew at the end of the term. Licence fees are invoiced annually upfront. In some cases, customers also buy telecom services from PCI Pal (which the company buys in from a third party) and the charges are included within ARR. PCI Pal charges set-up costs to deploy the platform.

Licence fees are recognised on a monthly basis across the life of the contract from the date that the performance obligations are deemed to have been met. This is the earlier of the date the service goes live or when the customer takes over the solution. Revenue for one-off set-up fees is deferred and recognised evenly over the estimated term of the contract, which is usually four years, with the same start date as licence fees. On deployment of the platform, there might be some catch-up revenue (ie the prior months’ licence revenue that has been deferred); this would all be recognised in one go but included within recurring revenue.

Income statement

In addition to standard financial metrics, the company reports the following metrics to assess performance:

• Annual recurring revenue (ARR): the annualised value of recurring revenue that is currently being recognised. This includes only contracts that have been deployed.
• Contracted ARR (CARR): this is the annualised value of recurring revenue from all signed contracts and includes those contracts that have not yet been deployed.
• Net revenue retention (NRR): for contracts live on the AWS platform, it is calculated using the opening total value of deployed contracts 12 months ago less the ARR of lost deployed contracts in the last 12 months plus the ARR of upsold contracts signed in the last 12 months, all divided by the opening total value of deployed contracts at the start of the 12- month period.
• Gross revenue retention (GRR): calculated using the ARR of retained, deployed contracts at the end of the 12-month period divided by the opening total value of deployed contracts at the start of the 12-month period.
• Adjusted EBITDA: reported operating profit before depreciation and amortisation, exchange movements charged to the profit and loss, exceptional items, non-operational costs and share-based payment charges.

The table below shows PCI-PAL’s historical financial performance and our forecasts for the next two years. The company has grown revenue from £7.4m in FY21 to £22.5m in FY25 and moved into EBITDA profitability in FY24. Trading so far in FY26 has been in line with management expectations.

• Revenue forecasts: in FY26 we assume that NRR is flat compared to FY25, increasing to 105% in FY27 as cross-selling starts to take effect. We assume that GRR improves to 95.5% in FY26 and FY27. We take the prior year-end ARR and apply the forecast NRR rate to which we also add the projects in deployment from the prior year. We separately forecast new ARR sales each year, which is divided into ARR from new customers and ARR from upselling (included within NRR). To calculate CARR, we assume that ARR from new customers goes into projects in deployment, and add this to year-end ARR. To calculate recurring revenue, we take the average of ARR at the beginning and end of the year and add an estimate for deferred licence revenue that is recognised once projects are deployed. To calculate non-recurring revenue, we assume minimal growth in professional services fees; as solutions become more standardised, we would expect self-service customers to generate lower professional services fees. Instead, we expect professional services resources to be used to deploy enterprise customer projects.
• Gross margin: we assume a gross margin of 90% in FY26 growing to 91.5% in FY27.
• Employee costs: we assume headcount increases by 25 in FY26 as the company steps up its investment in marketing and product development. For FY27, we assume only five extra heads.
• Platform costs: we assume growth of c 5% per year.
• Other costs: this includes marketing spend that is not headcount related as well as other administrative costs. We assume this increases by 20% in FY26 (as part of the incremental spending) and by 2% in FY27.
• Capitalised development costs: we expect this to increase from £1.8m in FY25 to £2.1m in FY26e and £2.3m in FY27e, reflecting the increased headcount in the engineering team.
• Tax rate: we use a rate of 30%.

The company grew ARR at the end of FY25 by 25%. We note that year-end ARR has been calculated as end-FY24 ARR plus new ARR in FY25 (measured at average exchange rates). Adjusting year-end ARR for 30 June 2025 exchange rates reduces it to c £18.8m, which equates to growth of 21% y-o-y. Using the ARR at year-end rates results in FY26e ARR growth of 20% and 17% in FY27e. The company’s increased investment is intended to drive ARR growth in the region of 18–20% per year; our forecasts are broadly in line with that.

We note that in FY25, reported revenue included £0.7m in deferred revenue that had originally been reported in FY24; adjusted for this, underlying revenue growth was 16.7%. For FY26e, the company expects to report revenue of £23.5–24.0m. Our forecast is at the top of this range; on a reported basis it equates to growth of 6.6% but once adjusted for the deferred revenue in FY25, underlying growth is forecast to be 10.0% in FY26e before rising to 13.6% in FY27e.

Taking into account our higher cost assumptions in FY26 and FY27, we forecast EBITDA margins of 2.8% in FY26e and 8.2% in FY27e.

Balance sheet and cash flow

As the company invoices for licences annually in advance, it typically has a high level of deferred income on the balance sheet. At the end of FY25, deferred income (short and long term) totalled £13.5m. Consequently, we forecast negative working capital requirements for FY26 and FY27. Capex for PPE is minimal with the bulk of capex for intangible assets, mainly capitalised development costs, which are amortised over five years.

The company had cash of £3.9m at the end of FY25, offset by a lease liability of less than £0.1m. We forecast that cash generation will be neutral in FY26 with an increase in FY27 to £5.0m.

Valuation

In Exhibit 8 and Exhibit 9, we compare PCI-PAL to global CCaaS and UCaaS vendors and UK software companies with a SaaS business model. With limited profitability in the short term, we view EV/sales as the most relevant valuation metric. PCI Pal is trading at a discount in FY26 and FY27 against both groups of peers. For UK software peers, we show in Exhibit 10 and Exhibit 11 how PCI-PAL compares in terms of recurring revenue, trailing ARR growth and forecast revenue growth (two-year CAGR). PCI Pal is at the upper end of the group in terms of recurring revenue and had the highest rate of ARR growth last year. Forecast revenue growth over the next two years is also at the upper end of the group.

It is clear that PCI Pal’s EBITDA margins are forecast to be below average for both groups over the next two years, as the company reinvests gross profit in product development and marketing and this will be weighing on the EV/sales multiple. We also undertake a DCF analysis below to capture the growth in profitability towards the company’s medium-term target, which is beyond our forecast period.

Elevated multiples for competitor acquisitions

We look at the acquisitions of PCI Pal’s closest competitors: the Eckoh deal was completed at the start of this year and Sycurio (then Semafone) was acquired in June 2021.

Bridgepoint paid 54p per share for Eckoh for a total cost of £169.3m. This represented an EV/EBITDA multiple of 15.9x adjusted EBITDA for FY24 (the year ending 31 March 2024, the last reported year), 14.5x forecast EBITDA for FY25e and an EV/sales multiple of 4.0x FY25e. When the deal was announced on 30 October 2024, forecasts were for revenue growth of 8.9% in FY25 and 7.2% in FY26 with EBITDA margins of 27.5% and 28.0% respectively. We believe that the higher than average EV/sales multiple was a reflection of the company’s profitability, as the EV/EBITDA multiples are at a much smaller premium to UK SaaS companies.

Livingbridge acquired Sycurio for £110m. Sycurio reported revenue of £17.0m in FY20 (the year ending 31 December 2020) and £18.8m in FY21 and had a cash position of £3.7m when acquired. This equates to an EV/sales multiple of 6.3x FY20 and 5.7x FY21. With adjusted EBITDA of £3.8m in FY20 and £6.0m in FY21, this equates to an EV/EBITDA multiple of 28.0x in FY20 and 17.7x in FY21. This deal was executed at a time when technology businesses in the UK were trading at their peak (the UK SaaS peer group above was trading at an average current year EV/sales multiple of 5.7x in early June 2021).

Discounted cash flow analysis highlights upside potential

To better incorporate the longer-term potential of PCI-PAL, we undertake a DCF analysis. Using a WACC of 9.1%, a long-term growth rate of 2% and our forecasts to FY27, we estimate that the share price is factoring in revenue growth of only 3% for FY28–35 and an average EBITDA margin of 13.8% over the same period, well below the company’s medium-term targets. If we assume a higher rate of revenue growth (15% in FY28, trending down to 3% by FY35) and the EBITDA margin expanding to 30% by FY30, we arrive at a valuation of 141.6p per share.