GB Group — Well positioned in dynamic ID Intelligence market

On a FY19 EV/EBITA of 20.9x and P/E of 30.8x, GBG trades in the middle of its peer group. However, on a PEG basis, it trades towards the top end of peers, and our reverse DCF implies the shares already discount strong organic growth of 12-13% over the next 10 years (assuming a stable margin, in line with management’s current policy). We view the premium as justified by the quality of earnings, the internationalisation of its product sets and the increasing product and market investment underpin organic growth prospects, while M&A adds the potential for earnings surprise.

GBG’s premium valuation should be considered in the context of the following:

GBG provides identity data intelligence services on a global basis. By combining data from a network of c 200 partners and over 400 datasets with its proprietary technology, it enables rapid data capture and search across many third-party databases, some of which are exclusive to GBG, along with data validation and analysis and database management services.

Its products and services help companies recognise and verify the relevant elements of an individual’s identity in real time, enabling more informed and faster business decisions. The majority of revenues are derived from its fraud, risk and compliance, customer location and intelligence and employee screening solutions.

It is one of the largest providers in the industry, able to verify c 4.4 billion consumers globally, with KYC and AML standards reached in 65 markets and core address verification in 190 markets. GBG’s headquarters are in Chester, England, and it has teams in 24 locations around the world. It has more than 15,000 customers across 71 countries and 29% of revenues were generated outside the UK in H118. Its long list of reference clients include blue-chip names such as HSBC, Betfair and Sky.

GBG has partnerships with organisations that have access to data which can be used as part of the identity verification process. For example, credit reference agencies, electoral rolls, passport and national ID registers, postal services and retail or social media data. Its value add is in combining huge amounts of data from multiple sources around the world, analysing, cleansing and organising them so that they can be packaged for real-time access via its proprietary software. It draws on a wide spectrum of verification methods: official (passport, bank account details, driving licence etc), attributed (address, device ID, social ID etc), biometric (facial currently used) and behavioural (usage patterns, likes, cookies etc).

Its services are used across a wide range of B2C sectors including financial (36% H118 revenues), gaming (7%), government (7%), e-commerce (6%) and leisure (3%).

Products are sold on a subscription (SaaS) or multi-year licence basis. Pricing typically comprises a one-off set up fee, followed by a data as a service (DaaS) single or batch pricing structure flexed for volumes, feature sets and the number of users. This is also the basis on which GBG acquires third-party data, so profitability can be managed. Customers stay on average for 10 years, and the more data, feature sets and training are added, the stickier products become, with client churn risk increasing when new systems are deployed. There is high revenue visibility, with approximately 70% of revenues recurring in nature, stemming from renewals, long-term contracts or repeat business and customer concentration is low. GBG’s largest four customers account for less than 5.5% of group revenues.

The cost of acquiring and managing data is the largest component of cost of sales. Gross margins have increased in recent periods as the group benefited from scale economies in data acquisition, platform consolidation and, more recently, the acquisition of IDscan, which has no acquired data requirements. We expect gross margins to remain broadly flat moving forward, with scale benefits in mature markets being offset by lower margins in newer territories. Operating expenses are largely of a fixed nature and mainly relate to employees and property. GBG has offices in 24 territories and employs 280 people across sales, marketing and products, with a further 370 in technology, and 140 in general and administrative functions. The sales process is largely direct, although the acquisition of Loqate in April 2015 also added new channel partnerships with IBM and Oracle.

GBG reports across two divisions: Fraud, Risk & Compliance (FRC), and Location & Customer Intelligence (LCI). Exhibit 2 details the new divisional structure and key product lines within each division.

GBG’s three largest service lines (managing risk, registering identities and fighting fraud) are international (shown in green in Exhibit 3 below) and are the three segments that have grown most rapidly in recent years – both organically and through acquisition. The remaining segments are UK centric (in grey). All categories, bar ‘building relationships’, have reported strong underlying growth over recent periods.

GBG has three complementary offers in this area, giving it one of the most complete offers in the industry: Matchcode360, GBG Loqate (acquired in 2015) and PCA Predict (acquired in May 2017), each targeting a different segment of the market (Exhibit 4). The technologies make the customer registration process smoother, faster and more accurate by capturing customer data in real time, validating it and using it to pre-populate online forms. Not only does this ensure more accurate data, it can reduce considerably ‘cart abandonment’ by reducing the time it takes to fill out forms. For example, Moneysupermarket.com uses Matchcode360 to match gas and electricity meters to postcode data, which enables customers to switch accounts instantly. The acquisition of Loqate in 2015 means GBG can geocode almost any address worldwide, for example to enable locations to be shown on a map or to improve location databases.

GBG ID3global is used to validate the identity of individuals by matching common personal details (name, address and age) against reference data (utility bills passport etc) at the point of registration, without the need for physical documents. In addition, it provides a valuable audit trail which demonstrates that the necessary checks have taken place, thereby helping companies comply with international legislation. No personal data are disclosed by the reference databases and, as a result, ID3global complies with data protection laws.

The service is used by organisations to protect themselves from the growing global problem of identity theft, for money-laundering checks, or to restrict underage access to content (eg for gambling). It can verify the identity (at a basic level) of over 4.4 billion individuals globally, in 190 markets, while being able to perform to KYC and AML standard checks in 65 markets.

The majority of revenues come from GBG Activate, a customisable credit-scoring and management system used in on-boarding customers. It also has an expanding presence in the identity fraud prevention market with GBG Predator, which monitors customers' transactions to stay alert to abnormal behaviour and GBG Instinct, a fraud-management engine that checks customer data against globally available identity information: account numbers, previous applications, blacklists, criminal databases etc. It has a strong presence in South-East Asia, particularly China (where it has over 40 customers), Malaysia, Indonesia and Australia, and in the financial services industry. One of the key differentiators of the service is that it can operate in multiple languages (rather than translating into one overriding language then translating back), which increases its accuracy and hit rate in identifying anomalies. It also allows customers to set and edit their own rules for pass or rejection rate criteria. This means that any required changes can be accommodated quickly and easily, without lengthy or expensive change requests – a key differentiator in the fraud management sector where fraud prevention needs to be reactive and iterative.

Locating people (10% FY18e revenues): GBG Connexus combines GBG’s national identity register with real-time data from multiple social networks and other consented data pools, helping customers locate and contact individuals. This product is popular with the debt recovery market and police forces (GBG contracts directly with 60% of the UK’s forces) to help trace individuals or identify potential associates, in the insurance market to spot potential fraud (eg by linking people in ‘crash for cash’ schemes), for reunifying financial assets (£15bn lies unclaimed in old UK bank accounts, pensions, life assurance and investments) and by the retail industry to help identify employee-linked stock theft.

Employee background screening (6% FY18e revenues): GBG Know Your People is a resource for screening and verifying new employees. UK employers, or organisations looking after vulnerable adults and children, can outsource their entire employee disclosure and barring service (DBS) checks and background screening to GBG.

Building relationships (9% FY18e revenues): GBG Marketing Services offers database creation, management and analysis to help develop a single view of a customer to support digital marketing strategies. This division is sub-scale compared to its many UK peers, and its financial performance has been relatively poor in recent periods. Management is looking to evolve the service by adding more analysis and insight while streamlining costs. However, the division sits within a strong competitive environment, with a high number of new entrants.

GBG both buys services from and sells them to major credit rating agencies (eg Experian, Equifax, FICO and Callcredit Marketing Solutions). These agencies also represent its main competitors in ID verification (Exhibit 2 summarises GBG’s key competitors in each segment). Given the increasing prevalence of data breaches, institutions will only share PII with trusted partners and GBG’s place as a trusted partner in this ‘co-opetition’ ecosystem provides a significant barrier to entry.

While smaller than its main peers, GBG claims wider coverage in terms of datasets and markets. For example, the credit rating agencies (CRA), which have excellent e-IDV services are limited to their own credit data meaning that in the majority of markets where the CRA is either owned by the government or a bank, they cannot compete. GBG, which is not regarded as a direct competitor in these markets, can acquire the data. Consequently, it can consolidate a much wider range of data points and across many more markets. This is particularly important in developing markets where customers often do not have a credit footprint and verifying identity can be difficult if restricted to one source. Management also points to the ease of integration of its products, and that its services are bespoke, using a SaaS business model with transparent pricing based on data use.

Digital transformation, globalisation, regulation, and fraud and risk management continue to underpin structural growth in the consumer identity and access management industry which, in its wider remit, is forecast to grow at around 17% pa to $24bn by 2022 (source: MarketsandMarkets).

There also appears to be a trend towards the increasing use of more dynamic verification, something we believe plays well to GBG given its diverse datasets, technologies and wide geographic reach. ID on the Blockchain initiatives, while nascent, is something that we believe in time will be commercialised in this industry, which could prove disruptive to traditional vendors. In more detail:

Ubiquitous digital Identities: The World Bank targets that everyone will have a digital identity by 2030 and the roll-out of digital citizen programmes around the world is a key catalyst in modernising identity verification, which remains largely paper based. The UK.gov/verify service is just one example of hundreds of e-government ID schemes. In parallel, increasing numbers of adults are developing wider digital ID footprints: almost two thirds of the adult population now have social media accounts and a mobile bank account, providing additional verification options.

Digital transformation: transacting over the internet, stimulated by the prevalence of things like mobile payments and the internet of things, serves to increase the demand for ID verification. We also point to the culture of change as a driving force for ID verification solutions, with individuals more frequently switching careers and service providers than previous generations.

Globalisation: increasingly, companies need to verify customers across borders, where customers may have a limited credit history or where the reliance on a credit check is no longer sufficient. GBG’s solutions can help to address this by combining things like geolocation (used when no formal postcodes are available), with an overview of previous activity or social network identities.

Regulation and compliance: in many industries, regulation dictates minimum identity verification requirements. Know your customer (KYC) and anti-money laundering (AML) regulations stipulate a minimum level of identity verification in all industries covered by money laundering regulations (estate agents, financial institutions, the gambling groups). Background employee checks are mandatory in many industries eg when working with children, the police force etc.

ID fraud: according to the Annual Fraud Indicator report, 50% of all crimes in the UK are fraud related, costing the government almost £200bn a year. The majority of these crimes are identity related (Cifas), with 88% perpetrated online. Globally, 2.8bn identity records were breached in 2017 (source: Juniper Research), up from 1.1bn in 2016. There are now c 9bn records available on the dark web for sale for as little as $0.1 to $1.5 per item, along with an active market for scanned passports and other documents enabling bad actors to use an increasing number of tactics. The traditional tools of ID verification will remain a vital first step to ID verification. However, a more dynamic approach is needed as well – drawing on a broader range of data and methodologies such as biometrics or contextual information to forge links between IDs, locations, device and on-line behaviour. This complexity should play well to GBG with its global footprint, experience with a range of verification technologies and its trusted status in the industry.

Blockchain – nascent, but potentially disruptive technology: to verify an individual’s identity, institutions will either obtain and store records of a client’s PII directly, or will use a centralised body to verify information on their behalf (or both). This leads to the widespread dissemination of PII, increasing the risk of breach. The Equifax breach is an example of the risk users take when entrusting centralised authorities with PII. ID verification, while accepted as necessary, can be found to be intrusive and adds cost to institutions required to use them. For instance, it costs a bank approximately $15-20 to comply with KYC in the on-boarding process for a customer and any verification performed is only used once and cannot be shared between other companies.

Blockchain is being explored by a number of companies, including GBG, as a way to reduce customer friction and increase security.

Blockchain applications could enable organisations to gain proof that an ID has been verified without ever having to see, or store, the PII themselves. In effect, it would cut out the need for a trusted intermediary to verify PII. For example, a user’s PI could be encrypted and stored locally on the user’s phone. A user would permission an institution that wants to verify its identity to make a request to the blockchain participants (the ‘verifiers’) to verify the previously audited PII. By sharing identity verification amongst networked partners, it eliminates potential weaknesses in single party ownership and by storing PII on the device, rather than centrally, it makes data attacks on a mass scale more difficult. At the outset, every digital identity would still have to be verified and with more individuals and companies involved in e-contracts, volumes could increase significantly. However, in theory, once an individual has joined the blockchain service, companies would be able to trust users without the need to retrieve and store PII data. It may allow a move towards verifying ‘attributes’ instead of ‘identities’ eg if all a company needs to know is that a customer is over 18, then it would only receive confirmation of this single attribute with no other PII provided, vastly reducing the impact of a data breach on such data.

Chris Clark replaced the previous long-standing Richard Law as CEO on 1 April 2017. Clark joined from Experian (a customer, supplier and competitor of GBG) where he was MD of the UK, Ireland and EMEA division, before which he worked for 20 years at BT running various international technology based businesses. The COO and CFO, Dave Wilson, has been with GBG since March 2009 and the chairman, David Rasche, has been with GBG since September 2010.

The growth strategy incorporates acquisitions and organic initiatives in order to add data, product and market reach. With the UK market maturing, the internationalisation of its products is also a key priority. Clark continues to evolve this strategy and he is also pivoting the company more towards the customer; GBG has been very product-focused in the past and as it gains in scale, management is placing greater emphasis on building brand awareness as well as customer service.

Increasing organic investment: a particular focus of investment is on the interlinking of GBG’s product sets so that a customer can access the entire suite via a single API. On an ongoing basis GBG invests in adding datasets and product features that enable it to both increase its addressable market by targeting new industries, while also making the products stickier.

Active M&A strategy: the market for ID verification solutions remains fragmented and GBG has an active pipeline of opportunities. It targets companies that fill data gaps, bring new technology or product sets that can be rolled-out globally, can enhance its market position, or help it to develop internationally. Areas explored include predictive analytics technologies especially in the fraud prevention, social media and decision-making arenas.

GBG has made six acquisitions over the last five years, including the most recent one, PCA Predict, in May 2017. PCA Predict complements GBG’s position in the address registration market, extending its reach to SMEs.

GBG has a good track record in integrating acquisitions. For example, since acquisition, DecTech’s revenue growth has accelerated significantly and Loqate was brought to break-even six months earlier than planned. The integration of GBG’s data into the PCA Predict service has gone to plan and the roll-out in the US and Germany of the Loqate and PCA address intelligence services has been accelerated.

Internationalisation: the UK market is relatively mature with the fastest growth coming from international markets. Furthermore, as the data quality in many emerging international markets is much poorer than in the UK, the validation and verification solutions are often sold together (whereas in the UK there is less need for validation services as verification is driven off already validated postcode data). Management expects c 50% of revenues to be from international markets by 2020. GBG is using the acquisitions of DecTech and Loqate as a platform to enter new markets and to cross-promote services among its client base. New international client wins during 2017 include CitiBank and The Development Bank of Singapore in Asia-Pacific and BNP Paribas in Europe.

Financial performance has been strong and consistent. Double-digit organic growth has been reported over the last four years, and again in H118 (18%, or 12% excluding a one-off perpetual licence receipt). EBITA margins have benefited from a growing gross margin as well as the scale effects discussed earlier. Despite placing approximately 30m shares over the last two years (20% of the current share capital), we expect a three-year CAGR in adjusted EPS to FY18e (March) of 27%.

The revenue visibility and operational gearing characteristics of GBG could support a higher EBITA margin. However, management plans to keep margins at approximately 20% over the next few years, in order to reinvest a growing share of revenues in product and market development. These initiatives, together with the supportive market backdrop from the rising requirement for security, compliance and data management demanded by a globalising online community, should support a continued strong organic performance for the group. Additionally, over the last few years, GBG has strengthened its position in higher growth and international segments (eg fraud management, biometrics) and these segments now contribute c 75% to revenues (FY14 60%).

Revenues tend to be H2 weighted. However, in H118 organic growth of 18% included the sale of a perpetual licence for £3.5m within IDscan. Consequently, the H1-H2 split in FY18 is likely to be more even and the H119e organic growth rate will be affected by the strong comparative.

For now, we retain our forecast 20% average tax rate, although we note that an increasing share of GBG’s revenues are derived in the US, and it should benefit from the recent tax changes.

Consequently, we expect the double-digit growth in revenue to drop through to earnings. We make no change to our forecast EPS growth of 20% in FY18e (to 11.8p), 15% in FY19e (13.5p) and introduce a forecast increase in FY20e of 10% to 14.9p.

The majority of R&D costs are expensed and we forecast a run rate of total capital expenditure of around £2.7m over the next few years. The working capital profile has been slightly negative over the last few years, largely a function of the group’s increasing exposure to Asia-Pacific, where payment cycles are generally longer.

GBG reported net cash of £4.1m at the interims in September 2017, having raised £58m in equity via a placing of 17.1m shares at 340p in May to part finance the £66m acquisition of PCA Predict. Over the last four years, the group has raised approximately £90m with new shares and spent approximately £130m on acquisitions. Over the same period, operating cash conversion has averaged 90% of EBITDA, which has funded the balance of acquisition payments.

Given the growth opportunities available to the group, we expect management to continue to retain a relatively low dividend payout ratio of c 20% of adjusted earnings. The company made the final earn-out payment for Loqate in H218, consequently we expect net debt of £2.8m at the FY18 (from net cash of £4.1m at the interim), but with a 90% conversion of EBITDA to operating cash, and assuming no further acquisitions, we forecast net cash of £11.9m in FY19e increasing to £28.3m in FY20e.

GBG also has access to a £50m revolving credit facility (incorporating a £20m accordion option), giving the necessary flexibility for bolt on acquisitions, although for larger targets additional funds may be required.

We summarise our divisional forecast below, and present it in full in Exhibit 17 at the back of this report.

Given the proximity to most companies’ FY17 (or March 2018) year ends, we look to multiples for the next forecast year (ie the year to December 2018 or March 2019).

On an EV/EBIT of 21x, and a P/E of 31x, the shares trade towards the middle of its wider peer set (Exhibit 11). However, due to GBG’s strategy to re-invest a growing share of revenues, which supress margins over the forecast period, on a three-year PEG basis the shares are towards the top end of the peer group (Exhibit 16).

Our reverse DCF (8.4% WACC, 3% perpetuity growth after 10 years) implies that the current share price is discounting organic revenue growth of approximately 12% over the next 10 years, assuming a stable EBITDA margin (in line with management’s current policy). While fairly high, GBG’s growing scale, widened product sets and international presence should support the current level of organic growth over the medium term, and the investments made in product development and customer services have the potential to add new revenue streams further down the line.

While the rating is already reflecting strong organic prospects, there are a number of catalysts that we believe could lead to further upside.

M&A: earnings upgrades following GBG’s acquisition of PCA Predict and IDscan mean that despite a 33% increase in the share price over the last year, GBG’s FY2 P/E rating is little changed compared to a year ago. The global market for identity data intelligence services remains fragmented, particularly internationally and in advanced authentication. We expect this to provide GBG with a steady pipeline of acquisition opportunities, supporting further earnings expansion on top of existing organic growth.

Strategic value: identity registration and verification is a key enabler in the digital economy. GBG has leading positions in a number of its divisions, has a global presence and may hold strategic value for other data management groups. The pool of interest is very wide; for instance, during 2017 companies including Accenture, Symatec, SAP, Oracle, AWS and Gemalto acquired in areas where GBG is active. The largest recent announcement is the €4.8bn bid for Gemalto by Thales in December 2017.

Brexit and General Data Protection Regulations (GDPR): GBG should be fairly resilient to the impact of Brexit. Approximately 70% of revenues are recurring in nature and we consider growth to be more structural than cyclical. 29% of H118 sales were generated overseas and a 10% depreciation of sterling would add approximately 1% to pre-tax profit. One of the consequences of GDPR, which takes effect in May this year, is that European businesses will be held responsible for the protection of the data they process. We expect this to make organisations even more wary about who they deal with when it comes to sourcing data, which plays well into GBG’s strengths as a trusted partner in the ecosystem. All of GBG’s divisions are GDPR compliant.

The extent/timing of market take-up of electronic ID verification: while the market for electronic ID verification has continued to grow at a strong pace, in the UK it is fairly mature and is experiencing some pricing pressure. Much of GBG’s organic growth is coming from international markets, where the pace of uptake may be affected by the timing of GBG’s roll-out to new geographies, or major client wins.

GOV.UK Verify: in 2016 GBG launched a federated ID service for the GOV.UK Verify service. The initial take up of the service has been slow and GBG is not currently recognising revenues, but it is absorbing its costs through the income statement. A change in the outlook for this product could affect the margins of the group.

Competition from the major established credit-checking players: GBG’s largest competitors grew out of credit checks for the financial services sector, where they have strong relationships with the major banks. They are broadening their offerings, and are significant current and potential competitors in the identity-checking market.

Competition from newer players in the social media sector: the market is dynamic and fragmented and as discussed, new technologies and competitors could disrupt the market.

Changes in regulation/legislation in the ID verification market: changes in regulation and legal requirements across a wide range of industries and market sectors can enhance or adversely affect operations. For example, the 2014 Right to Work regulation in the UK which introduced fines for employers found to be in breach stimulated growth in GBG’s Checking Employees business.

Acquisition strategy: GBG has a good track record in integrating acquisitions. However, as the group grows in scale, for M&A to have the same impact deals will probably need to become larger. This potentially increases risk, and the likelihood of additional fund-raising would impact forecasts.

Disruption to and/or changes in sourcing data from suppliers and partners: as well as its own data, GBG relies on data from external sources to maintain its databases. Disruption to and/or changes in access to some or all these, particularly the larger vendors (for instance if they felt that GBG was becoming a threat), could affect the group’s prospects.

Technology: disruptive technologies, such as machine learning, AI and blockchain, could result in pricing pressure.

Currency: 29% of revenues are derived internationally. GBG does not actively hedge its currency exposure, although there is an element of natural hedge via the operating cost bases in these international markets and via cash deposits.

Brexit view: GBG should be fairly resilient to the impact of Brexit. Approximately 70% of revenues can be considered recurring, providing good revenue visibility during times of economic uncertainty. We consider growth to be more structural than cyclical and GBG is executing well on its strategy to gain share in this growing market. Earnings visibility is good, which should enable it to manage any signs of weakness to defend margins. A 10% depreciation of sterling would add approximately 1% to pre-tax profit.