Demand for Trust & Security Drives M&A Activity for Identity Services
The identity industry is deeply intertwined with RegTech and as Simon Hardie, FinTech Disruptors 2018 Lead, stated “investor appetite for RegTech is the start of a long-term trend.” Consider that banks spend in excess of $270 billion per year on compliance and regulatory obligations, which is just one of the business cases that RegTech supports. With an expectation that over 300 million pages of regulatory documents will be published by 2020, the need for technologies to keep up to date with requirements will continue to grow.
A CB Insights report stated private RegTech companies have raised almost $6.2 billion since 2013. In 2016 there were 30 RegTech exits, including 29 M&As (mergers and acquisitions) and 1 IPO (initial public offering). According to Corum Mergers and Acquisitions, in 2018 “larger players will be actively looking to add the necessary pieces needed to stay relevant and competitive” pointing to the interest of large internet and fintech companies in the sector.
One aspect of the identity services industry is providing solutions for compliance requirements, such as Know Your Customer (KYC), along with other RegTech procedures. According to a Thompson Reuters report in 2016, the average bank spends $60 million per year on KYC and related customer due diligence (CDD) compliance. With 800 financial institutions included in that survey, that extrapolates to $48 billion dollars annually spent on KYC and CDD.
KYC has traditionally been associated with banks and financial institutions. However, that is far from reality today. Other industries and business models that are obligated to meet compliance requirements include:
- Online marketplaces (e.g. Airbnb, Amazon, Udemy, ebay)
- Payment services providers (e.g. Stripe, PayPal, Square)
- Remittance and money transfer companies (e.g. WorldRemit, Moneygram)
- Online gaming and sports betting sites (e.g. Kindred, William Hill, Fanduel)
- Cryptocurrency related services (e.g. Coinbase, Binance, Kraken)
Any business, whether it’s a publicly-traded bank or a 2-person startup, that facilitates money movement between people is liable to adhere to these compliance regulations.
In addition, new beneficial ownership requirements now place more demands on banks and other institutions to perform due diligence checks on business registrations. The market for Know Your Business (KYB) services – such as business verification, beneficial ownership identification, and risk assessment for business entities and their beneficial owners – is projected to grow to $11.8 billion by 2022.
Another aspect of the identity space, the identity and access management market, is estimated to be worth $24.55 billion by 2022. The personal identity market, for the creation of physical ID documents, is expected to grow to $9.7 billion by 2021. Then there are closely associated markets in the authentication space, such as multi-factor authentication or mobile authentication, that by themselves are multi-billion-dollar markets.
One report by McKinsey & Company calculates the identity-verification-as-a-service market will grow to $16 – 20 billion by 2022. As stated by author Robert Schiff, Partner, “identity verification-as-a-service offers a way for e-commerce providers to outsource the verification function to providers with the necessary scale and security to accomplish sensitive transactions quickly, safely, and efficiently.”
Any way you sort and filter the opportunity, the total addressable market (TAM) for identity is significant.
Beyond the revenue opportunity, there are strategic reasons for M&As in the field. Identity verification is one of the first steps in successfully onboarding a new customer. A quick and seamless onboarding experience can set up a relationship that can deliver ongoing value for many years; building online trust is a foundational element to long-term growth and development. There’s also a lack of talent to do this well and meet ever-changing compliance demands. No wonder major players are jumping in with acquisitions.
Both incumbent verification companies and potential customers have been acquisitive in the space. Incumbent identity verification companies are acquiring smaller players to:
- Increase their product capabilities (see: iovation, IDScan)
- Enter new international markets (see: CallCredit)
- Add to the bottom line (see: Veda)
Customers of verification services are acquiring vendors to potentially:
- Optimize their compliance related expenses
- Gain a staff of regulatory experts
Due to the growth in the identity services market and compliance costs, we can expect to see more M&A activity in the near future.
Since 2016, there have been multiple major acquisitions in the identity space, including seven that were over $100 million.
This past May, TransUnion agreed to acquire iovation, a provider of device-based information and real-time fraud prevention products.
Another TransUnion acquisition occurred in April, with the purchase of Callcredit, a U.K.-based information solutions company that provides data, analytics and technology solutions to help businesses make smarter and informed decisions throughout the customer lifecycle. The price was reported as £1 billion.
Kicking 2018 off, social media giant Facebook purchased Confirm.io in January for an undisclosed amount. The company offers a document verification API and was founded three years ago.
To stay ahead of fraudsters online, especially via the mobile channel, American Express acquired InAuth. Similar to ThreatMetrix and Iovation, InAuth uses mobile device IDs to identify good and bad actors. They also add the capability to use biometrics for Multi-Factor Authentication.
January also saw London-based analytics company Relx Group acquire ThreatMetrix for £580 million. ThreatMetrix now operates under the LexisNexis Risk Solutions brand and provides an end-to-end platform for digital identity intelligence and trust decisioning.
Also announced in January, professional services giant KPMG acquired the Identity and Access Management (IAM) business of Silicon Valley-based Cyberinc for an undisclosed amount. Cyberinc was the largest independent IAM technology provider in the world.
The biggest deal, if it closes, will be the French aerospace and defense group Thales’s $5.5 billion bid for digital security company Gemalto announced in December, 2017. The deal requires EU approval, which is currently under review.
In September 2017, Google acquired cloud identity startup Bitium for an undisclosed amount. They provide a single sign on and password management solutions for enterprises. According to Karthik Lakshminarayanan, Director of Product Management, “As we add Bitium’s capabilities, we’ll continue to work closely with our vibrant ecosystem of identity partners so that customers are able to choose the best solutions to meet their needs.”
In September 2017, InfoZen was acquired by Mantech for $180 million. InfoZen protects crucial infrastructure by enabling the information-based screening and risk assessment of millions of people.
Also in September 2017, SAP buys customer identity management firm Gigya for (a reported) $350 million. Gigya helps online properties manage customer identities and profiles.
Fingerprint Cards acquired Delta ID for $113.1 million in June 2017. Delta ID is an iris recognition company.
Airbnb Inc. purchased background-check startup Trooly Inc. in June 2017 for an undisclosed amount. Trooly has been authenticating user identities for Airbnb since 2015 and analyzes data from public records, social media and other sources.
In February 2017, Apple bought Israeli startup RealFace, a cybersecurity and machine learning firm specializing in facial recognition technology, for an estimated $2 million.
In November 2016, Symantec acquired Lifelock for $2.3 Billion. Lifelock is a provider of proactive identity theft protection services for consumers and consumer risk management services for enterprises. Lifelock owns ID Analytics who provides verification, fraud risk management and credit decisioning.
In June 2016, GB Group acquired IDscan Biometrics for £37 million, with a further maximum £8 million payable based on financial performance. IDscan Biometrics helps authentication of documents including passports, visas, ID cards, driving licenses, utility bills and work permits whilst also capturing facial biometrics which provides proof that those documents are not stolen.
Equifax acquired the leading credit bureau in Australia Veda Group in February, 2016 for $1.9 billion “to enter an important new region through the proven abilities of a great team.”
The Future of the Identity Industry
The identity industry is a large and growing market. Add to that, identity is critical to building a safe and trustworthy global marketplace for consumers and businesses alike, the number and valuation of M&As is likely to grow.