On Croma's ($AIM.CSSG) Vigilant Divestiture

Croma will receive half its market cap in cash over the next 3yrs after divesting ~80% of its revenue, but uncertainties remain around these deferred payments and management's capital allocation

Company and Situation Overview

Croma Security ("Croma", "$AIM.CSSG", or "the Company") is an owner-operated, £10m market cap security solutions company in the midst of a significant transition.

Through inbounds/referrals and 16 retail locations (operated under multiple brands) throughout the UK, the Company provides locksmithing and electronic security solutions to a local, loyal, and often recurring customer base. While detailed breakouts are not available, we know the customer base includes residential, commercial (e.g. Odeon Cinemas, Hilton), and government/public (e.g. NHS) customers. Importantly, no customer makes up more than 10% of revenue.

The above is a typical Croma location (this one is in Bournemouth) - You'll note that Croma's locations don't look particularly special, but they are staples of their local communities. Just take the Company's Google reviews - Customers are often very satisfied when interacting with the Company (I've randomly selected three locations below, but overall reviews all tend to be in the ~4.5+ range):

Croma's operations can be split into two divisions:

• Croma Locksmiths ("Locks"; ~57% of FY23 (YE 6/30) revenue, ~43% FY23 gross margin) - Specializes in locksmith services related to physical security, including basic key-cutting services, 24hr emergency opening/repair services, and installation of locks, safes, padlocks, etc.

  • Minimal contractual revenue, but, for what it's worth, WH Ireland estimates that as much as 75% of Locks revenue may be described as 'evergreen' (i.e. repeat but not contractually tied-in revenue)

• Croma Fire and Security ("F&S", ~43% of FY23 revenue, ~48% FY23 gross margin) - Provides a full range of electronic security solutions, including CCTVs, intruder alarms, access control systems, etc., and associated maintenance, monitoring, and other services. 90%+ of division sales are security-focused (vs. fire) and >2/3s of revenues are commercial

  • Monitoring, maintenance, and services revenue (which I assume to be recurring and largely attributable to F&S) makes up 17% of total F&S revenue/7% of total revenue. Maintenance contracts have a very high retention rate of 90%

To help visualize Croma's services, you can read about some of the Company's case studies here.

In June 2023, the Company divested its third and largest division, Vigilant (focused on manned guarding services for high-end clients), representing >80% of Croma's revenue and >30% of segment operating profits. Vigilant, which merged with the now remaining operations of Croma in FY12, was a lower-margin, more competitive business. In addition, Croma was unable to successfully cross-sell manned guarding services with its locksmithing and electronic security solutions (due to existing contract constraints, geographical separation, etc.).

Vigilant was sold for ~£6.5m to its two founders (who were both former Croma directors). Importantly, ~£5.4m of the Vigilant sale price is deferred (~83% of the total). The transaction was structured so that Croma will receive 10 quarterly payments from March 2024 (£400-500k each time) and a one-time payment of £1.3m in June 2024. These deferred proceeds are not currently reflected in the Company's cash balances (held as A/R on the books), but represent ~50% of the Company's current market cap.

That's great, but the cash means nothing if it will be wasted in the future. Croma seems to have a specific plan with regard to the Vigilant proceeds - Pursuing a locksmith roll-up strategy devised by CEO/owner-operator Roberto Fiorentino (who owns ~28% of shares outstanding; Fiorentino's father started the original Croma locksmith store in Southampton in the 1970s). To this end, the Company replaced the CFO and the Board following the Vigilant divestiture, allowing the Company to focus on its core higher-margin Locks and F&S divisions and M&A.

Since 2019, the Company has been looking to acquire mom-and-pop locksmith businesses and convert them into comprehensive 'security centers' that can cross-sell higher-margin, more recurring electronic security solutions and services (i.e. F&S products) through in-store displays. The Company's ultimate goal is to build a recognized brand where clients can have all their security needs met by one service provider. 6 locksmiths have been acquired since FY21.

The locksmith industry has a few characteristics that make it an attractive roll-up opportunity. Firstly, the industry is highly fragmented, with 6,500 locksmiths in the UK, many of which are small/sole props. Secondly, locksmiths are relatively boring businesses with loyal customers and reoccurring revenue bases. And thirdly, the industry faces substantial succession issues and has few natural acquirers.

As a result, locksmith businesses are available at relatively cheap multiples. Croma is targeting 5-6 locksmith acquisitions/year with an EV/EBITDA target of 1.5-3.0x (in line with where recent Croma transactions have taken place). The Company has indicated a 15% ROI (after-tax) from its last two acquisitions, although the target ROI going forward is 10%.

How is this ROI achieved? The acquisition strategy takes advantage of low professionalization in the market (by integrating the Company's proprietary software), economies of scale (bulk purchasing rebates of ~5% once stores are brought into the Company), and larger commercial contracts from a national presence, all of which drive growth and margins.

Analysis

The Croma pitch is relatively simple:

• If all goes according to plan, Croma will receive cash representing ~50% of its current market cap over the next 3yrs

• Management expects to fully deploy this cash into locksmith M&A, which should be doable given high levels of industry fragmentation. To the extent opportunities are not available, management has indicated special dividends will be paid to shareholders

• Locksmiths can be acquired at EV/EBITDA multiples of ~1.5-3.0x, representing a significant discount vs. where Croma trades in the public market. Said differently, every £1 spent on locksmith M&A in the private market is immediately valued at >£1 by the public market. This multiple arbitrage (as long as it continues) means that acquisitions should be immediately accretive to shareholder value

Croma's existing operation is also a relatively good business. While only a small portion of revenue is explicitly contractually recurring (I estimate 5-10% while WH Ireland estimates 15-20%), a much larger portion of revenue is clearly evergreen/reoccurring (although difficult to quantify). For example, once locks are installed in a client's factory, that client is inclined to return to Croma for key cutting, etc.

Croma is of course impacted by macro factors in the short term such as housing demand, client budgets, etc., but many of its offerings are seen as non-discretionary purchases, driving consistent profitability for both the Locks and F&S segments over the past 10yrs. The Company has been able to drive strong organic growth (21% YoY in FY23 and 7% and 3% YoY, respectively, for Locks and F&S in H1 FY24) through new contract wins (e.g. recent contract wins with the NHS) and new, innovative products (e.g. iLOQ, a digital access solution that allows you to open locks through your phone), however it's important to keep in mind this isn't a rapidly growing industry - I would expect more normalized organic growth to be in the low-single-digit to mid-single-digit range.

Another important thing to keep in mind is that Croma has favorable working capital dynamics, being partially funded by its clients. While the Locks business has working capital dynamics typical of a retailer (with inventory turning every ~90 days), the Company's installation and maintenance revenue streams (which are not broken out but are presumably substantial in the F&S business) are paid 50-100% upfront by customers.

What is a company with these characteristics worth? My calculation of the Company's enterprise value and valuation multiples can be seen below. Note that I've excluded the Company's ~£1.4m in property (book value of land and buildings from its retail locations) from the calculations, given these realistically couldn't be sold without the Company incurring incremental lease costs. These properties could, however, be mortgaged for liquidity purposes.

Note: EBITDA is adjusted for IFRS-16 (lease payments are deducted from operating profits). Normalized FY23 EBITDA adjusts for Vigilant disposal costs. Normalized FY23 EBITDA estimated to be ~£0.8m (~10.0% margin vs. ~9.5% margin in H1 FY24). Normalized FY23 FCF estimated to be ~£250-400k (30-50% FCF conversion; high-end of the range in line with actual FY23 FCF assuming Vigilant disposal add-backs)

Assuming all Vigilant payments are received, Croma trades at something like a ~9% FCF yield at the midpoint of my estimates. That's cheap, but not as cheap as some other companies I've profiled like Orbit or SPAR (although this doesn't account for the deployment of Vigilant deferred payments into locksmith M&A). More importantly, the Company doesn't seem cheap at all if you assume the Vigilant payments aren't received, reducing the margin of safety for this investment.

This is the single biggest risk with Croma - While the Vigilant valuation seemed fair, >80% of the consideration was seller-financed, which is not favorable or standard at all (which is a questionable point against management). As with any seller-financed deal, there's the potential that payments are not actually received from the other party.

Is this realistic? It's very hard to know, but I wouldn't put this at a 0% probability. While Vigilant is founder-led, the whole reason the Company wanted to get out of the manned guarding business was because it has low margins and high competition, whereas the remaining operations were more cashflow generative.

As a mitigant to this risk, the Company has a board representative at Vigilant and receives monthly management info (although it's not clear what level of control Croma actually has). Additionally, in the event of a defaulted payment, the Company gets step-in rights at Vigilant, which from my understanding, functionally allows Croma to take over the business. My sense though is that, in the event of a default, Vigilant would be a very difficult business to turn around anyway (low margins, competitive, heavily reliant on the founder's relationships with clients, etc.).

Even if all Vigilant payments were to be received, there's still the question of the Company's M&A strategy. Croma is targeting 5 to 6 locksmith acquisitions/year going forward with £300-500k in annual turnover per store. With an EV/EBITDA target of 1.5-3.0x, that equates to a target of ~£1m deployed annually into M&A at the high-end (assuming 6 locksmiths are acquired each year and that each location has £500k in revenue and 10% EBITDA margins).

I have two major concerns with the Company's M&A strategy - First, it is relatively unproven, having only really ramped in earnest in FY23. Given available disclosures, it's difficult to get a sense of how successful these acquisitions have been from a cross-selling and margin perspective (although the multiples have appeared quite cheap). Second, with >£2m expected from Vigilant payments this year alone, management may feel the need to rush and deploy excess capital into either more but lower-quality locksmiths or larger, more expensive locksmiths.

Croma is a pass for me for now given these issues - This is one I'll be tracking as we get more clarity on Vigilant payments as they are received and further locksmith M&A is completed.