Description

Quick Summary:

Infovine (115310:KS) is a growing, high-margin, subscription-based business selling for 6.5x earnings, and only 2x earnings net of cash.  The company’s unique UBIkey solution has captured 96% of the Mobile Certificate Storage Service (MCSS) market in South Korea, which currently accounts for about 10% of the total certificate storage market (defined by the number of users making electronic payments that require authentication).  While technological change may eventually render the service obsolete in the long run, significant barriers to entry and a favorable regulatory environment should keep the business going long enough to make the current share price look significantly undervalued.  The founding management team owns a significant stake in the company (three founders collectively own 42%) and is well incentivized to return capital to shareholders in through dividends and share repurchases.

South Korean Certificate Authentication Market Background:

In Korea, a certificate (electronic identification) is required for many online transactions, including online banking, securities trading, e-commerce transactions over $300, and e-government services.  Although this method has been used for some time in many other countries for authentication purposes, South Korea was the only country in the world that mandated the use of certificates for many electronic financial transactions.  In April 2010, the government announced that alternatives to certificates would be allowed as long as they offered the same level of security as the certificate system; however, an alternative solution (such as biometric scanning) has yet to materialize.  Due to the government’s policy of mandatory certificate usage, the total certificate user base grew rapidly since 2000.  In 2011, the number of certificates issued surpassed the economically active population and currently stands at approximately 28 million (total South Korea population: 50 million).

Certificates are issued by 5 institutions: KFTC (Korea Financial Telecom and Clearings Institute), KOSCOM (Korea Securities Computing Corp), KICA (Korea Information Certificate Authority), Crosscert, and Tradingsign.  These are government organizations which issue basic certificates for free, but an annual service fee of $4 per year is charged if the certificate is used for certain functions such as online banking authentication.  Banks and securities trading companies are able to act as intermediaries to issue certificates from these institutions to their customers.

There are four main ways in which users store their certificate:

PC – 70% of certificate users store their certificate on their PC hard drive.  The Korean government has expressed concern about the security of this method due to vulnerability to hacking.  The government has given notice that it will prepare legislation for banning certificate storage on PC, but no legislation has been passed yet.  Users with more than one PC (home and work, for example) require a more mobile solution in order to perform tasks that require authentication on both devices.

USB Key – This is a safer solution compared to PC and does not require an additional service fee.  However, an embedded hacking program on a PC could theoretically scan the USB and duplicate the certificate and password.  Some people may have a difficult time keeping track of the extra piece of hardware, which could be easily lost.

HSM (secure token) – In terms of security, this is the strongest way to protect the certificate.  However, this method requires relatively high upfront hardware cost, and only one bank offers this solution (Nonghyup Bank).

Mobile Phone (feature phone and smartphone) – The certificate is stored on the user’s mobile phone via one of several services (UBIkey, Mobisign, Mobilekey, PCro) and can be transferred to the device (PC, tablet) that requires authentication.  This method is safer than PC and USB since the data transferred through the mobile network from the phone to the PC is encrypted.  It presents a more convenient solution than the USB key, as users generally keep their mobile phone with them at all times.  If the user’s mobile phone is lost or stolen, the certificate service can be quickly cancelled.

MCSS Competitive Analysis

UBIkey

This is Infovine’s solution, which commands a 96% share of the MCSS market.  The service was the first mobile certificate storage service to be launched 8 years ago, and it started securing contracts with financial institutions in February 2007.

How to Use: When a website requires authentication, it will prompt the user to select a storage media.  To transfer a certificate from a mobile phone to a PC for an online transaction using UBIkey, the user simply selects mobile phone, and enters the 16-digit code that is received on their phone via SMS.  The certificate is then temporarily stored in the PC and automatically deleted after use.

Cost: KRW 900/month ($0.80), revenue shared with the operator

Compatibility: UBIkey has signed contracts with 20 commercial banks, 68 other financial institutions, 20 government services, and 30 other institutions, for a total of 138 institutions.  These institutions will link users who wish to use MCSS to UBIkey directly from their websites.  UBIkey is compatible with both feature phones and smartphones.

Mobisign

Mobisign is the most similar service and closest competitor to UBIkey.  It was launched in 2010 in alliance with KFTC and Lumen Soft.

How to Use:  The user experience is similar to that of UBIkey, but the certificate is never physically stored in the PC.  Instead, the user is prompted to enter a password into the mobile phone, which then communicates directly with the institution.

Cost: KRW 900/month

Compatibility:  Mobisign has signed contracts with 3 commercial banks, 14 other financial institutions, and 16 government agencies, for a total of 33 institutions.  Mobisign’s significantly smaller network of institutions makes it far less attractive to users than UBIkey.  According to Infovine, the financial institutions do not have any incentive to add additional vendors other than UBIkey, as it will cause confusion to their customers without any additional benefit to financial institutions. 

Mobilekey

Mobilekey is a service provided by KICA, one of the certificate issuers.

How to Use: Mobilekey uses SMS to communicate between mobile phone and PC and creates a virtual hard drive in the PC.  This eliminates the need for contracts with institutions but is inconvenient for users who have to go through the extra step of going to the Mobilekey homepage to store their certificate in a virtual drive.

Cost: KRW 600/month

Compatibility:  Due to the use of a virtual hard drive in the PC, Mobilekey does not need to sign contracts with the relevant financial institutions.  Mobilekey is NOT compatible with smartphones, which puts the service at a significant competitive disadvantage.

PCro

PCro is a recently launched service operated by security software company Dream Security.

How to Use: Similar to Mobilekey, PCro transfers certificate to PC in advance and does not require contracts with institutions.  However, the application requires an additional free application called “Olleh Certificate.”  After completing a transaction, the user must return to the PCro website and delete the certificate in the PC, creating an additional layer of complexity.

Cost: Free, temporary promotion to attract new users

Compatibility: PCro does not need contracts with financial institutions.  PCro is ONLY compatible with smartphones.

UBIkey’s Natural Monopoly

Users ultimately choose the UBIkey service over other competing services for the following reasons:

Security: MCSS is currently the most secure option available to the user in most instances.

Portability: MCSS or USB allows users to take their certificate with them to use on multiple PCs.

Convenience: MCSS wins out over USB since users will always carry their mobile phone with them.

Once users decide to use MCSS, they choose a service based on the following points:

Ease of Use:  UBIkey and Mobisign are easier to use than Mobilekey and PCro because there are fewer steps involved (users don’t have to copy the certificate to PC then manually delete it).

Compatibility with Phone: UBIkey and Mobisign are compatible with both FP and SP, while Mobilekey is only compatible with FP and PCro is only compatible with SP.

Compatibility with Institutions:  UBIkey has a much larger network of institutions that have integrated their solution than Mobisign.  Mobilekey and PCro are compatible with all institutions as their solutions involve authentication through a copied certificate on a PC; however, the solutions are not integrated into the institutions’ authentication processes, which requires users to go through additional steps to complete a transaction.

Price:  UBIkey and Mobisign are KRW900/month, Mobilekey is KRW600/month, and PCro is temporarily free.

UBIkey’s early entrance into the market has created high barriers to entry for competing services.  It has proven to be quite difficult for Mobisign to sign contracts with institutions that have already integrated their authentication process with UBIkey.  The institutions have little incentive to spend time on adding an additional MCSS option.  As Mobilekey and PCro are not integrated with the institutions, their solutions are more complicated, and as a result they have no choice but to compete with UBIkey on price.  However, UBIkey’s continued dominance of the market suggests that users are not price sensitive at only $0.80/month.  Users are willing to pay a small monthly fee for the simplest solution that is compatible with the largest network of institutions.

The Company does not report churn numbers, but given the high market share and continued user base growth, we assume churn is quite low.  The stickiness of the service is likely due to the low cost ($0.80 is hardly noticeable when lumped in with a monthly phone bill), and the users’ familiarity with the service.  Users have little incentive to try another more complicated service once they have become comfortable with UBIkey.

Threats to UBIkey

Transition from Feature Phone to Smartphone

The Korean mobile market is rapidly transitioning from feature phones to smartphones, with smartphone penetration reaching 76% at the end of 2012:

Smartphone Subscriptions and Penetration

November 2009: 0.5 million (1% penetration)

December 2010: 7.2 million (14.2%)

December 2011: 23.5 million (44.3%)

December 2012: 42.8 million (76.2%)

December 2013 (est.): 52.5 million (90.5%)

Infovine does not regularly publish their user base split between feature phones and smartphones.  In our most recent conversation with the company last year, we were told that the split was about 50/50, and that users were downloading the application again after switching phones.  The continued user base growth in 2010-2012 in the context of rapidly falling feature phone penetration suggests that smartphone users must make up a significant portion of the overall user base. 

The transition to smartphone presents several challenges to the Company’s business model:

Application Download and Billing System

Feature phone users previously downloaded the UBIkey software from the UBIkey website, and users were billed monthly through the mobile operator.  Now there are two alternative download/billing models, depending on whether a user is using Apple or Android:

Android

There are three Android markets run by mobile operators: T-Store, Olleh Market, and U+ Appmarket.  Users download the application through these app stores and are billed monthly through the operators, exactly as before.  Android enjoys its highest market share of any country in South Korea, close to 90%, due to the prevalence of Samsung smartphones.

Apple

Apple users present more of a problem for UBIkey, as downloads and payments have to go through the App Store.  The application is initially free to download, but in order to activate it users have to pay $8.99 for a year of service upfront. 

The UBIkey application generally has many unfavorable ratings and comments in both Apple and Android app stores, which center around three points.  One, the users misunderstand the service as either issuing a certificate (as opposed to storing) or using smartphone banking (which does not require a certificate).  Two, the application is free to download but charges users to activate it.  The Company clearly states the billing scheme, but some people download it before reading carefully.  Three, some Apple users complain that $8.99 is too expensive.  In actuality, this works out to be cheaper than the monthly fee of $0.80, but it may seem quite high to those users that didn’t understand the service in the first place.

Smartphone Banking, etc.

Many banks, financial institutions, government services, and other institutions that require authentication now offer smartphone applications, where transactions can be done directly using a certificate stored on a smartphone without the use of a service such as UBIkey or Mobisign.  Not surprisingly, the use of these services is growing rapidly along with smartphone penetration.  If users start to exclusively use their smartphones for all transactions requiring authentication, this will pose a significant threat to UBIkey.  However, as long as users continue to conduct transactions on multiple devices, UBIkey’s service will remain relevant.

Valuation

Revenue growth slowed to high single digits in the past two years, but the company has maintained exceptionally high EBIT margins, consistently north of 60%:

The company has a very strong cash position, with little in the way of liabilities or working capital requirements:

Management has increased the dividend per share for 3 years in a row since listing through an IPO in 2010, and repurchased stock in 2010 and 2011 at an average price of KRW16,460 per share, which was between 1x and 2x EV/EBIT at the time.  The repurchased shares are being held as treasury shares, but the company currently does not intend to cancel them.  The current dividend yield is 3.3%, and there is a lot more room for dividend increases as the payout ratio is only 23%.

If we assume that revenue growth slows to 3%, cash piles up, the company maintains a payout ratio of 20%, and we are able to exit at an EV/EBIT of 4x at some point in the next three years, we get the following returns:

Even in a worst-case scenario where revenues flatten out and start shrinking, net cash should exceed the current market cap in less than 3 years, making it very unlikely that long-term investors will lose money.  In a best-case scenario, government regulation banning the storage of certificates in PCs could push more users toward the UBIkey solution, resulting in a significant boost in revenues and profitability and a stock rerating.

Risks

• Poor Capital Allocation - Management have been good stewards of shareholder capital thus far, but there is always a risk they splurge on a shiny new headquarters or something of that nature.  Based on our impressions from our meetings with management in Seoul, we think this is unlikely.
• Technological change occurs more rapidly than we anticipate.  A new authentication method appears or users start to conduct all electronic commerce on smartphones instead of PCs.
• Adverse developments occur without our knowledge due to language barrier.
• Users become more price sensitive and migrate towards cheaper alternatives.

Catalyst