Incode Technologies

1.1 Company Identity and Business Model

Incode Technologies, Inc. was founded on June 17, 2015 by Ricardo Amper in San Francisco, California, where the company remains headquartered at 101 Mission Street, Suite 900. Additional offices are maintained in Mexico City and Belgrade. Incode's core mission is to power a world of trust through AI-driven biometric identity verification, enabling enterprises to authenticate users via facial recognition, liveness detection, document analysis, and optical character recognition across the full identity lifecycle — customer onboarding (KYC/AML compliance), continuous authentication, and fraud prevention. The company serves financial services, telecommunications, government, healthcare, hospitality, and e-commerce sectors under a B2B SaaS model, monetizing through enterprise software licensing and API usage. Incode began as a consumer photo-sharing application before pivoting to AI-based biometric identity in 2018 when management recognized a larger market opportunity. This pivot proved timely as COVID-19 accelerated digital onboarding demand globally. Incode has earned significant independent recognition: Gartner named it a Leader in its inaugural Magic Quadrant for Identity Verification; it ranks in the NIST top ten for facial recognition accuracy in multiple categories; and it is the first provider globally to achieve iBeta Level 3 passive liveness detection certification on iOS and Android with zero errors. Compliance credentials include SOC 2 Type II, ISO/IEC 27001, ISO/IEC 30107-3 alignment, and Kantara IAL2, directly supporting regulated government and enterprise verticals.[CO001, CO002, CO003, CO004, CO032, CO033]

1.2 Funding History, Investors, and Valuation

Incode has raised approximately $260 million across three substantive rounds. A $10 million Seed in October 2019 (led by DILA Capital) provided first institutional validation. A $25 million Series A in March 2021 from DN Capital, 3L Capital, and Walter Ventures funded U.S. and LatAm expansion. The pivotal event was the December 7, 2021 Series B of $220 million, co-led by General Atlantic and SoftBank's LatAm Vision Fund with J.P. Morgan, Capital One Ventures, Coinbase Ventures, and SVCI — granting unicorn status at a $1.25 billion post-money valuation. As of November 2025, Bloomberg reported Incode was seeking $150–300M at a valuation of up to $3 billion, citing approximately $170M ARR and expanded market position following the AuthenticID acquisition and U.S. government contract wins. PremierAlts lists a market-implied valuation of $3 billion as of 2026, though no completed round has been publicly confirmed. A conflicting total-raised figure of $407M on PremierAlts versus the $260M reported by Tracxn and Crunchbase raises an unresolved diligence question about undisclosed tranches or secondary activity. The new round remaining unconfirmed is a material gap for valuation entry-point analysis.[CO010, CO011, CO012, CO013, CO023, CO035]

1.3 Scale, Customers, and Market Traction

Incode's customer penetration in blue-chip financial services and telecom underscores its enterprise credentials. As of the August 2025 post-acquisition combined entity, Incode serves 8 of the 10 largest U.S. banks, 8 of the top 9 North American telcos, 4 of the top 5 Latin American banks, and all 3 of the world's top neobanks. Named or publicly inferable Latin American customers include BBVA and Banorte. The platform processed 4.1 billion identity checks in 2024. Revenue metrics show strong growth: ARR was reported at approximately $86.7 million in 2023 and climbed to approximately $170 million by mid-2025 — roughly 96% cumulative growth over two years. The company claimed 80% year-on-year organic growth at the AuthenticID acquisition announcement in August 2025. With approximately 650–668 employees as of 2026 across San Francisco, Mexico City, and Belgrade, Incode maintains a lean headcount relative to revenue scale, implying high revenue productivity per employee. Financial metrics remain largely company-claimed or third-party estimated, as no audited financials are publicly available for this private company.[CO005, CO014, CO015, CO016, CO017, CO018]

1.4 Key Milestones and Strategic Events

Incode's trajectory illustrates a company that moved from a consumer photo-sharing startup in 2015 to a global AI identity infrastructure provider in under a decade. Key inflection points include the 2018 strategic pivot to biometric identity, the 2021 unicorn round that injected $220M and blue-chip investor validation, and the August 2025 AuthenticID acquisition that roughly doubled the combined customer footprint without disclosing financial terms. U.S. government ambitions accelerated in late 2025: FedRAMP Ready certification was achieved in November 2025, followed by a $37.4 million Login.gov contract in December 2025. On the partnership front, Okta (February 2025), Experian (August 2025), and Interac (May 2026, with exclusive Canadian rights) extend distribution reach into enterprise IAM, global fraud prevention, and the Canadian market. The milestone table below provides the authoritative chronology of all dated events, including adverse ones.[CO022, CO024, CO025, CO029, CO030, CO031]

1.5 Risks and Adverse Events

Incode faces several material risks that diligence must weigh alongside its commercial momentum. The most concrete adverse event is the BIPA class action lawsuit (Aspel v. Incode Technologies, Case No. 2023LA59), in which Incode settled for $4 million — without admitting wrongdoing — allegations that it collected facial geometry data from Illinois residents without proper BIPA consent between November 2018 and August 2024. This signals a compliance gap in core biometric data collection workflows. As biometric privacy regulations expand across U.S. states and internationally, Incode's consent and disclosure practices will face ongoing scrutiny, creating material enterprise procurement risk in privacy-sensitive sectors. Key-person concentration on founder and CEO Ricardo Amper is a structural concern: he is the public face, fundraising lead, and product architect. Board composition and succession planning remain opaque for this private company. Headcount estimates vary across sources ($556 to $668), raising questions about post-acquisition integration of the AuthenticID team. The unconfirmed $150–300M fundraise at a $3B target — versus the last confirmed $1.25B — represents a 140% valuation step-up with limited independent corroboration. PremierAlts' conflicting $407M total-raised figure further underlines the need for full cap-table disclosure before a new investment closes.[CO005, CO026, CO027, CO028, CO040]

1.6 Exhibits

2.1 Market Definition and Boundary

The identity verification market encompasses solutions that authenticate a person's real-world identity through digital channels. Included spend covers document validation (passports, national IDs, driver's licenses), biometric liveness detection, facial recognition, fingerprint scanning, iris capture, automated e-KYC onboarding workflows, and AI-driven fraud screening at account opening. Adjacent spend includes anti-money laundering (AML) transaction monitoring, open banking consent infrastructure, and ongoing perpetual-KYC (pKYC) refresh services. Excluded from the core market boundary are general cybersecurity platforms unrelated to identity proofing, physical branch-based notarization, credit scoring engines, and payment gateway infrastructure itself. Incode competes primarily in the biometric liveness and e-KYC segments of this market, with a pronounced focus on LATAM financial institutions. Financial services (BFSI) accounts for approximately 30–33% of total identity verification spend and is the dominant demand engine. Cloud-based deployment now commands a 65–69% market share, enabling rapid API integration and continuous model updates—characteristics central to Incode's platform architecture. Status-quo substitutes include manual branch KYC, outsourced BPO identity review, and older rule-based document verification tools that lack real-time biometric liveness. [CM001, CM002, CM003, CM004]

2.2 Market Sizing: TAM, SAM, and Estimation Uncertainty

Analyst estimates for the global identity verification market in 2026 range from USD 14.1 billion (Future Market Insights) to USD 17.3 billion (Business Research Company), with CAGR projections spanning 11% to 17% depending on market scope. Mordor Intelligence, publishing a conservative estimate, sizes the 2026 market at USD 15.78 billion with an 11.18% CAGR through 2031. Grand View Research projects a broader digital identity solutions market reaching USD 33.93 billion by 2030 at 16.7% CAGR from 2023. Market Research Future, updated as of June 17 2026, puts the 2026 figure at USD 16.89 billion with a 12.18% CAGR through 2035. The spread across estimates reflects differences in scope—some firms include only core document and biometric solutions while others incorporate adjacent fraud analytics and open banking authentication layers. The e-KYC sub-segment alone is valued at USD 948.8 million in 2025 by IMARC Group, growing at 16.35% CAGR through 2034. Within the global market, BFSI retains approximately 32–33% of revenue share, implying a financial services SAM of approximately USD 5 billion in 2026. No major analyst publishes a standalone LATAM-only identity verification market size; regional SAM estimates must be derived by applying LATAM fintech/banking market share proxies to the global TAM—a meaningful evidence gap that constrains precise SOM calculation. [CM005, CM006, CM007, CM008, CM009, CM010]

2.3 Buyer Segmentation and Adoption Patterns

The primary buyers of identity verification solutions cluster into five segments with distinct budget ownership and adoption triggers. Tier-1 LATAM commercial banks—including Incode customers BBVA Mexico, Banorte, and Santander Mexico—procure through annual IT and compliance budgets, driven by AML mandates and fraud cost reduction ROI. LATAM neobanks and digital lenders such as Kueski, Clip, and Nubank adopt through agile engineering budgets, motivated by onboarding conversion rates and drop-off reduction. Telcos such as Telcel, another disclosed Incode customer, are compelled by regulatory SIM fraud mandates. Government e-platforms require citizen identity proofing for benefit distribution and public services—a segment energized by Mexico's Biometric CURP launch in February 2026. US and cross-border financial institutions face FinCEN's Corporate Transparency Act (CTA) beneficial ownership requirements, expanding the addressable market northward. Veriff's published LATAM case studies with Kueski, Comun, Solventa, and Juancho te Presta corroborate that LATAM fintechs require IDV solutions that balance onboarding conversion against fraud prevention at scale. Budget ownership lies with CTO and CRO roles at banks and with compliance and legal leadership at cross-border institutions. Adoption is event-driven: regulatory changes, fraud surges, or new digital product launches typically open procurement cycles. [CM015, CM016, CM017, CM018, CM019, CM022]

2.4 Growth Drivers and Regulatory Tailwinds

Four structural forces are expanding the identity verification market. First, AI-generated deepfake fraud has increased by over 2,100% in three years as of 2026; 62% of organizations experienced a deepfake incident in the prior 12 months (Gartner n=302), and deepfakes now constitute approximately 7% of all global fraud attempts tracked by identity platforms. Global biometric identity check infrastructure spending surpassed USD 4.8 billion in 2024, driven by urgency to comply with FATF's revised CDD requirements. Second, regulatory mandates are becoming outcome-focused and prescriptive: FATF's October 2025 update emphasizes demonstrable KYC effectiveness over checkbox compliance; the EU's AMLA—operational since July 2025—must deliver RTS by July 2026; FinCEN's CDD Final Rule mandates four-pillar KYC for US institutions; and global AML enforcement actions in 2024 exceeded USD 4.3 billion, the highest on record. Third, LATAM's digital banking expansion creates structural demand: Brazil's PIX achieves approximately 90% adoption, Mexico's digital credit volume grew 900% to MX$450 billion since 2020, and the LATAM fintech ecosystem has grown 340% since 2017. Mobile technology contributes USD 600 billion to LATAM's economy (8.6% of GDP), with GSMA forecasting USD 700 billion by 2030. Fourth, Mexico's Biometric CURP launch (February 2026) establishes a national identity infrastructure, with analysts estimating digital identity adoption could lift Mexico's GDP by up to 13% through fraud reduction and greater financial inclusion. Material constraints include high implementation costs for SMEs, Mexico's persistent cash preference (85%+ of sub-MX$500 transactions remain cash), fragmented interoperability across LATAM platforms, and a trust deficit driven by the 77% surge in identity-theft fraud losses to MX$11.3 billion in 2024. [CM020, CM021, CM023, CM024, CM025, CM026]

2.5 Exhibits

3.1 Competitive Landscape Overview

The identity verification (IDV), KYC, and biometric authentication market of 2026 features more than 100 vendors across multiple competitive tiers: pure-play IDV specialists (Jumio, Veriff, Sumsub, Persona, Entrust/Onfido), AI-native fraud decisioning platforms (Socure), biometric specialists (iProov, AU10TIX), compliance-first data platforms (Trulioo, Mitek), and government/enterprise incumbents (IDEMIA, Thales). The 2024 inaugural Gartner Magic Quadrant for Identity Verification placed 11 vendors across four quadrants; Leaders were Sumsub, Socure, Entrust, Jumio, and Incode Technologies. In 2025, with 11 vendors again evaluated, Persona rose from Challenger to Leader (holding the highest Ability to Execute score), Sumsub gained the furthest Completeness of Vision, and Incode retained Leader status for the second consecutive year. Market consolidation is accelerating — Entrust acquired Onfido in April 2024 — and competition is bifurcating between full-platform orchestrators and point solutions for specific use cases. AI-generated fraud (deepfakes, synthetic identities, injection attacks) is reshaping buying criteria toward independent liveness certification, agentic AI defense, and end-to-end orchestration. IDEMIA and Thales compete primarily in government identity and border control and do not appear in the commercial IDV Magic Quadrant. Mitek Systems is the market's only public-company pure-play IDV provider (NASDAQ: MITK). The competitive positioning map below situates the key players on geographic breadth versus platform integration completeness.[CP024, CP032, CP015, CP014, CP010]

3.2 Key Competitor Profiles

Jumio is a PE-backed IDV leader processing 120 transactions per second with 5,000+ document types, 300+ patents, and an Identity Graph of 30 million+ known identities for continuous fraud intelligence. Entrust/Onfido, formed by Entrust's April 2024 acquisition, offers the broadest identity-centric security portfolio: AI-powered liveness, 2,500 document types across 195 countries, no-code workflow orchestration, and an installed base of 1,200+ global customers at $140M+ in annual revenue at acquisition. Sumsub is the smallest funded among major Leaders but leads on Gartner Completeness of Vision (2025), covering 14,000+ document types, end-to-end AML/KYC/transaction monitoring, and non-document verification compliant in 20+ countries in as little as 4.5 seconds. Veriff analyzes 1,000+ signals per session with 6-second average decisions across 230+ countries and 12,500+ government documents, underpinned by $192M+ in funding at a $1.5B valuation. Persona raised $200M Series D at $2B valuation (April 2025) and holds the highest Ability to Execute in the 2025 Gartner MQ, processing 300M+ verifications in 2024 with doubled revenue and customer count year-over-year. Socure dominates the US market with $340M+ ARR in Q1 2026 (+62% YoY), a $4.5B valuation, 134% net dollar retention, 18 of 20 top US banks, and a FedRAMP-authorized AI decisioning platform (RiskOS). AU10TIX performs 180+ automated checks per identity and operates consortium fraud detection across 60+ companies, having authenticated 1B+ identities and prevented over $24B in fraud. iProov is the world's first independently certified deepfake-resilient passive liveness provider (CEN/TS 18099 High + Ingenium Level 4) but offers no document verification, making it a complementary rather than full-stack competitor. Mitek (NASDAQ: MITK) serves 7,000+ organizations, was recognized as a Market Leader by Datos Insights in January 2026, and grew its Fraud and Identity Solutions segment 30% YoY in Q1 FY26. Trulioo leads on global data breadth — 450+ data sources, 195 countries, 5B+ addressable consumers — but lacks biometric and liveness capabilities. IDEMIA Public Security and Thales operate in government-grade identity programs (600+ agencies and 115+ countries respectively) and compete in high-assurance government tiers, not the commercial SaaS IDV market.[CP001, CP002, CP003, CP004, CP005, CP006]

3.3 Capability and Pricing Comparison

Document verification depth, passive liveness certification, AML/watchlist screening, no-code workflow orchestration, and LATAM-specific document support are the primary buying criteria for enterprise IDV buyers evaluating Incode and its peers. The feature matrix table shows the main vendors on these dimensions using Yes / Partial / No / Unknown designations based on fetched product pages and public documentation. Sumsub and Entrust/Onfido lead on AML coverage and no-code orchestration breadth. Persona leads on modular workflow customizability and agentic AI orchestration, with the deepest configurability for enterprise compliance teams. Socure leads on predictive fraud scoring and US identity network data depth. Incode leads on LATAM document coverage and biometric accuracy for regional ID formats, with proprietary passive liveness built for low-connectivity mobile environments that are prevalent in Latin America. iProov is the highest-independently-certified liveness provider but offers no document verification, requiring buyers to integrate a second vendor. Trulioo leads on global data coverage but lacks biometric and liveness capabilities entirely. On pricing, few vendors publicly disclose rates. Sumsub is an exception with stated rates of $1.35–$1.85 per verification (basic/compliance tiers). Veriff is estimated at $1.50–$3+ at scale. Jumio, Socure, and Entrust operate on custom enterprise contracts without public list pricing. Incode's pricing is not publicly disclosed. The capability map figure provides a scored comparison of six key vendors across five competitive dimensions.[CP020, CP021, CP025, CP033, CP034, CP036]

3.4 Incode Differentiation and Positioning

Incode differentiates from the competitive field on three durable vectors. First, LATAM-first identity infrastructure: no Gartner Leader competitor has built comparable LATAM product depth and distribution. Bitso — the leading digital financial services platform in Latin America — selected Incode as its regional identity infrastructure partner across Mexico, Argentina, Colombia, and Brazil, citing Incode's ability to deliver seamless experiences without compromising security. US-centric rivals including Socure (18 of 20 top US banks) and Persona (customers led by OpenAI, LinkedIn, Block) serve primarily US and global-north fintechs; their LATAM document support and regional compliance integration lag Incode. Second, end-to-end orchestration: the 2025 Gartner recognition highlighted Incode's deep connectivity to authoritative biometric issuing sources and vision-language models for document assessment as differentiating innovations, positioning Incode beyond a point solution into a Leader platform category. Third, proprietary passive liveness with deepfake defense: Incode processes 7B+ identity validations annually and observes automated AI-driven attacks rising from 3% of detected fraud in 2024 to 40% in the most recent quarter, underscoring the urgency of its liveness and deepfake defense investments. While iProov holds the highest independent liveness certification (CEN/TS 18099 High), iProov requires a separate document verification vendor — Incode's integrated single-platform approach reduces operational complexity for LATAM banks and fintechs deploying at scale.[CP007, CP015, CP018, CP019, CP023, CP033]

3.5 Moat Durability and Competitive Risks

Incode's competitive moat rests on LATAM customer lock-in, proprietary biometric models trained on regional data, and an end-to-end platform that reduces the number of vendors banks need to manage. Multiple risks threaten durability. Better-funded competitors — Persona ($418M total raised), Socure ($650–$744M), Trulioo ($477M) — could materially increase LATAM go-to-market investment, leveraging larger balance sheets to subsidize customer acquisition. Platform convergence is accelerating: Sumsub gained the furthest Completeness of Vision in Gartner 2025 and Socure's 62% ARR growth signals formidable global expansion ambition. Commoditization is a real threat: AI cost reductions are compressing per-verification economics, reducing barriers to entry and squeezing per-transaction margins across the sector. iProov's CEN/TS 18099 High liveness certification could become a procurement standard that all biometric vendors — including Incode — will be required to match. Multi-homing is common in enterprise IDV: procurement teams frequently deploy 2–3 vendors to cover regional document gaps, limiting Incode's ability to displace incumbents in markets where Jumio or Entrust are already embedded. The absence of independent audited financials limits investors' ability to validate Incode's $170M ARR claim, margin structure, and customer concentration, representing a meaningful diligence gap. The moat durability register below maps each moat claim to its primary threat, severity, and diligence path.[CP005, CP008, CP009, CP017, CP019, CP036]

3.6 Exhibits

4.1 Revenue Model and Monetization Mechanics

Incode's revenue architecture is a B2B SaaS model that monetises identity verification volume through tiered enterprise contracts. The primary mechanism is a usage-based API model — enterprise clients pay per verification "check" processed, with volume tiers offering declining per-unit costs at higher volumes. Contracts are typically structured as annual or multi-year commitments with minimum annual spend thresholds, anchoring a recurring-revenue base that drives ARR. The company does not publish list pricing; all deals are closed via direct sales with custom quotes based on projected verification volume, feature scope (liveness, document verification, KYC/AML orchestration, deepfake detection), and integration complexity. Incode operates across three product families: Incode Smile (banking, payments, retail — digital onboarding and authentication), Incode Guard (law enforcement and physical security via smart glasses and body cameras), and a consumer photo-sharing product (Flashback/legacy pre-pivot). The enterprise identity platform is the dominant revenue contributor, with Incode Smile powering financial services and telecom clients including BBVA and Banorte. Government identity proofing has emerged as a distinct and growing revenue stream following the FedRAMP Ready certification in November 2025 and the $37.4M Login.gov subcontract in December 2025. The Interac exclusive Canadian partnership (May 2026, Q3 2026 rollout) adds a partner-mediated channel, licensing Incode's liveness and deepfake-detection technology to Canadian financial institutions. Revenue mix between these streams is not publicly disclosed.[CI018, CI034, CI035, CI032, CI036]

4.2 Growth Trajectory and Revenue Performance

Incode's ARR trajectory is the strongest data point in its financial profile. GetLatka recorded $86.7M ARR in December 2023, and in June 2025 Incode hit $170M ARR — a cumulative 96% gain in approximately 18 months. The company's own press materials citing the August 2025 AuthenticID acquisition attributed 80% year-on-year organic growth to the platform prior to inorganic contribution, which is consistent with the observed trajectory. Biometric Update and Bloomberg independently corroborated the $170M ARR figure in November 2025 fundraising coverage. The company processed 4.1 billion identity checks in calendar year 2024, rising to 7.1 billion total trust checks by March 2026 — a volume scale that underscores the durability of the per-check revenue model at enterprise pricing. Revenue per employee is estimated at approximately $305,000 (based on $170M ARR / 556 employees per GetLatka), which is at or above best-in-class benchmarks for enterprise SaaS companies at comparable revenue scale. The absence of audited financials, GAAP revenue recognition disclosures, or trailing-twelve-month (TTM) revenue figures for a later period limits the ability to validate whether ARR momentum has continued into 2026.[CI001, CI002, CI003, CI017, CI029, CI030]

4.3 Capital Adequacy and Funding Profile

The Company Overview chapter documents the full funding chronology. In summary: Incode raised a $10M Seed (October 2019, DILA Capital), a $25M Series A (March 2021, DN Capital / 3L Capital / Walter Ventures), and a $220M Series B (December 2021, General Atlantic and SoftBank LatAm Vision Fund co-lead, with J.P. Morgan, Capital One Ventures, Coinbase Ventures, and SVCI). Total confirmed capital raised is approximately $255M ($10M + $25M + $220M). Tracxn independently reports $260M total raised (near-match for the three disclosed rounds). PremierAlts carries a conflicting $407M figure — a material discrepancy with no public explanation, possibly reflecting undisclosed tranches, debt facilities, or secondary activity. In November 2025, Bloomberg reported Incode was in preliminary talks to raise $150M–$300M at an implied valuation of up to $3B. The secondary database Gaebler (sourcing VentureDeal) records a $300M round as "secured" on November 20, 2025, naming General Atlantic, Capital One, and Coinbase Ventures as backers. No formal press release or SEC Form D filing has been located confirming a closed round, and Bloomberg's original reporting used the language "in talks" and "preliminary." This conflict is material: if the round closed as Gaebler states, Incode's total raised rises to approximately $555M and the $3B valuation may be set; if still open, capital adequacy is more uncertain. With approximately $255M raised through the 2021 Series B and four-plus years elapsed, the key capital adequacy question is monthly cash consumption relative to the residual Series B balance. No public cash position, burn rate, or runway figures exist. The strong ARR growth trajectory suggests reduced burn dependency if the business is approaching cash-flow breakeven, but no such confirmation has been made.[CI004, CI005, CI006, CI007, CI008, CI009]

4.4 Unit Economics and Operating Efficiency

Incode does not publicly disclose gross margin, customer acquisition cost (CAC), net revenue retention (NRR), or churn figures. As a private company the only quantifiable unit-economics proxy available externally is revenue-per-employee — approximately $305K — which is competitive with enterprise SaaS benchmarks for companies above $100M ARR. Gross margin is structurally favorable given the primarily software-based delivery model with no hardware manufacturing or meaningful physical inventory; analyst benchmarks for comparable identity-verification SaaS companies suggest gross margins in the 70–80% range, but these are estimates, not reported figures. Customer acquisition cost and CAC payback period are unknown. The enterprise direct-sales motion targeting large banks and telcos implies long sales cycles (a SWOT analysis independently identifies this as a weakness) and potentially high selling costs per deal; counterbalancing this is the durability of multi-year contracts and expansion potential within large enterprise accounts. NRR is a critical unknown: with 8 of the top 10 U.S. banks and 8 of the top 9 North American telcos as customers, the cohort suggests high retention, but without disclosed data, no NRR estimate can be responsibly stated. All unit-economics cells remain null and are flagged as evidence gaps requiring data-room access.[CI015, CI016, CI019, CI020, CI021, CI022]

4.5 Government Contracts and Institutional Revenue

Incode's federal revenue stream crystallised in late 2025. In November 2025 Incode achieved FedRAMP Ready status, clearing a key prerequisite for U.S. federal procurement. In December 2025, Incode served as subcontractor to Diamond Capture Associates on a $37.4M contract awarded by the General Services Administration (GSA) Technology Transformation Services (TTS) under the Login.gov Next Generation Identity Proofing Blanket Purchase Agreement (NG BPA). The task order covers Remote Unsupervised Identity Proofing Solutions for the Login.gov digital identity platform, which provides access to participating government services for millions of U.S. citizens. The Incode share of the $37.4M total is not separately disclosed; as subcontractor the per-party split is a diligence gap. The contract nevertheless represents the most concrete evidence of U.S. government revenue to date, and the FedRAMP authorization level achieved supports expanded federal pipeline development in 2026 and beyond. Outside the United States, the May 2026 Interac exclusive partnership introduces a quasi-governmental channel through Canada's national payment network, covering government-sector use cases for digital identity verification across the Canadian market. Together these institutional contracts establish a diversified public-sector revenue base that reduces dependence on private-sector banking and telecom customers.[CI012, CI013, CI023, CI024]

4.6 Financial Risk and Adverse Assessment

The most significant financial risk is valuation multiple compression. Incode's $3B target valuation represents approximately 17.6x its $170M ARR — a multiple materially above typical enterprise SaaS public comps (which traded at 8–12x in 2024–2026) and above best-in-class private- market benchmarks for companies at this ARR scale. The 140% step-up from the confirmed 2021 valuation of $1.25B is justified by ARR nearly doubling, but requires sustained growth well above 50% annually to avoid multiple compression at exit. A SWOT analysis of Incode identifies the following structural weaknesses: brand awareness lagging Jumio and Onfido; long enterprise sales cycles that strain resources and delay revenue; pricing pressure from lower-cost alternatives; and heavy reliance on financial services and telecom verticals, which are susceptible to macro-driven budget cuts. The deepfake-driven commoditization threat — where big-tech players bundle liveness detection into cloud platforms at near-zero marginal cost — could erode Incode's pricing power. Profitability timing is unknown: the company does not disclose whether it is EBITDA positive, cash-flow positive, or still burning capital from the 2021 Series B. Burn rate uncertainty is material. If the $300M new round has not closed, Incode may be approaching the end of its 2021 Series B runway in 2026. No layoff signals, restructuring notices, or credit-facility disclosures have been identified, which is a mild positive indicator — but the absence of adverse signals for a private company does not constitute positive evidence of a strong cash position.[CI011, CI025, CI026, CI027, CI028, CI031]

4.7 Exhibits

5.1 Platform Overview & Orchestration

Incode Omni is a unified, end-to-end identity verification and fraud prevention platform built around a central no-code orchestration layer. The platform centralizes document verification, facial biometrics, liveness detection, device risk analysis, KYC, and AML compliance into a single configurable workflow hub accessible through a drag-and-drop flow builder. Customers configure multi-step verification journeys by combining modules, business rules, and conditional logic without engineering involvement for common use cases; a full SDK and REST API surface supports deep custom integration. The orchestration dashboard provides real-time decisioning, case management, fraud analytics, and performance reporting in one place. Incode Omni positions itself as the single system of record for identity across the entire customer and employee lifecycle — from initial onboarding and KYC through ongoing authentication, reverification, and workforce helpdesk automation. The company claims 7.1 billion trust checks processed across its customer base as of mid-2026, including 4.1 billion identity verifications completed in calendar year 2024. Trusted deployments span eight of the ten largest U.S. banks, eight of nine top U.S. telecom providers, and the three largest global neobanks. [CE001, CE002, CE003, CE025, CE026, CE042]

5.2 Core Biometric Technology Stack

Incode's biometric engine comprises three foundational pillars: facial recognition, liveness detection, and document verification. For facial recognition, proprietary deep learning models compare live selfie captures against ID document photos or government biometric databases, with facial matching completing in 20 milliseconds and a claimed 0.01% false match rate. In the 2024 NIST Face Recognition Technology Evaluation (FRTE) 1:N identification test, Incode ranked first among all full-solution identity verification providers across multiple gallery types including Visa-Border, Mugshot-Webcam, and Visa-Kiosk datasets, evaluated against 1.6 million identity subjects with a False Positive Identification Rate threshold of 0.003. Liveness detection supports both active (user-prompted action) and passive (fully automated) modes. The passive liveness system was claimed to be the first globally to achieve iBeta's ISO 30107-3 Level 2 evaluation, a test covering advanced spoofing attacks including 3D masks and AI-generated deepfakes. Document verification uses proprietary OCR that Incode claims is 25% more accurate than open-source alternatives in competitive testing, combined with NFC chip reading for e-passports and other biometric documents. The platform supports direct government system of record (GSOR) integrations via AAMVA Driver License Data Verification (DLDV) and state DMV connections, enabling deterministic real-time credential checks against authoritative issuing sources. [CE005, CE007, CE008, CE009, CE010, CE011]

5.3 AI/ML Model Infrastructure

At the core of Incode's technical differentiation is an in-house machine learning factory. Alex Golunov, VP of ML Engineering, has publicly stated that Incode operates more than 100 proprietary machine learning models that authenticate every onboarding session, trained on a proprietary dataset exceeding 10 terabytes and spanning hundreds of millions of data points including images, video, structured text, and tabular datasets. Incode manages this infrastructure through ClearML's MLOps platform, using dynamic GPU allocation across AWS EC2 instances and on-premises GPU hardware through automated autoscaling. The latest model generation includes a Vision-Language Model (VLM) trained on global identity and document data across 200-plus regions, capable of few-shot adaptation to new attack types and unseen document formats; a Fraud LLM trained on proprietary fraud datasets, behavioral sequences, and device signals; and Reasoning Agents for risk intelligence. The VLM has demonstrated key performance improvements in production benchmarks: 67% fewer errors in fake ID detection, 4% gain in document tampering accuracy, 25% fewer errors in signature fraud detection, approximately 80% faster training cycles, and 0% Attack Presentation Classification Error Rate (APCER) on a challenging liveness benchmark dataset. Incode also operates a dedicated Internal Fraud Lab with 35-plus specialized AI models focused on document and biometric fraud patterns, continuously trained with real-world data from across Incode's network of customer deployments. [CE005, CE006, CE032, CE033, CE034, CE035]

5.4 Anti-Fraud & Deepfake Defense

Incode's Deepsight product is the company's multi-layered deepfake defense system. An independent benchmark by Shu Hu, Assistant Professor and Director of the Purdue Machine Learning Lab, evaluated nine major commercial deepfake detection systems and found Incode's detector achieved the highest accuracy, with a 68x better false-positive rate and 2.5x lower false-acceptance rate compared to the next-best commercial system. Deepsight defends across four attack surfaces: (1) injection attack prevention via native SDKs that block virtual cameras and device emulation before the capture process begins; (2) perception-layer analysis of biometric signals including blurriness, iris presentation, light reflection, and texture anomalies to identify synthetic images and videos; (3) deterministic verification against government systems of record to provide authoritative cross-checks; and (4) continuous model retraining via Incode's in-house R&D team and Fraud Lab. The platform detects a broad taxonomy of attacks: 2D masks, 3D silicone masks, paper printouts, video replays, face swaps, face morphs, 2D synthetic AI-generated assets, and face reenactment videos. The Risk AI Agent, a complementary product, provides session-level holistic fraud decisioning by evaluating all risk signals in context without manual threshold configuration, adapting automatically to each customer's specific fraud and conversion patterns. Incode reports a 21x surge in deepfake fraud attempts over the three years prior to mid-2026 as a key market driver for these capabilities. [CE012, CE016, CE029, CE030, CE031, CE040]

5.5 Developer Integration & SDK Ecosystem

Incode provides a comprehensive developer integration surface spanning web, mobile, and server environments. The Web SDK is published on npm as @incodetech/welcome, which had reached version 1.90.0 with over 2,128 published versions as of June 2026. The SDK is TypeScript-compatible and provides three method categories: configuration and initialization, data capture (camera-based ID and selfie capture), and process data methods (ID validation, Face Match, and government validation calls). For mobile, Incode offers native SDKs for Android (minimum API level 23, covering 98.4% of Android devices) and iOS (minimum iOS 13, covering 99.6% of iOS devices). A React Native package (@incode-sdks/react-native-incode-sdk) supports optional NFC, Face Login, and video-call variants. iOS dependencies are distributed through a private GitHub Packages registry with credential-based access. Example integration repositories are maintained publicly at github.com/Incode-Technologies-Example-Repos, including a Next.js example showcasing core onboarding flows. The developer hub at developer.incode.com provides structured documentation for full SDK integration, low-code and no-code paths, API reference, and language-specific quickstarts. All integrations are required to run over HTTPS, and session tokens must be managed server-side to protect API keys. Webviews and social-media in-app browsers are explicitly unsupported for the Web SDK. [CE013, CE014, CE015, CE041]

5.6 Compliance, Certifications & Trust

Incode maintains one of the broadest compliance portfolios among identity verification providers. As of June 2026, its trust center (trust.incode.com) confirms active certifications and attestations covering: SOC 2 Type II (security, availability, and confidentiality controls), ISO/IEC 27001 (information security management), ISO/IEC 30107-3:2023 (biometric presentation attack detection aligned with the iBeta test methodology), ISO/IEC 42001:2023 (AI management systems), HIPAA, and Kantara Identity Assurance Level 2 (IAL2). In November 2025, Incode achieved FedRAMP Ready status at the High Baseline level, completing a Readiness Assessment by a FedRAMP-accredited 3PAO with findings reviewed by the FedRAMP Program Management Office. This status enables Incode to pursue contracts with U.S. federal agencies and positions the company to seek full FedRAMP Authorization to Operate. Incode has also partnered with Carahsoft, the government IT solutions distributor, to bring its identity platform to the U.S. public sector. In both the 2024 and 2025 Gartner Magic Quadrant for Identity Verification, Incode was recognized as a Leader, placing furthest for Completeness of Vision in the 2024 edition. Incode's stateless architecture option supports zero data retention, meaning no personally identifiable information or biometric images need be stored after a verification is complete, addressing data minimization and privacy regulatory requirements globally. [CE017, CE018, CE019, CE020, CE021, CE022]

5.7 Roadmap & Emerging Capabilities

Incode's most significant product extension in late 2025 was Agentic Identity, announced in October 2025 and entering pilot programs in Q4 2025. This system applies deepfake-resistant biometrics to verify autonomous AI agents, binding each agent to a verified human owner through biometric-backed cryptographic scope tokens with programmable expiration and revocation. The system enables continuous behavioral monitoring of agent activity, detecting anomalies or compromised agents and triggering automated or human responses. Agentic Identity integrates with Incode's existing identity suite and supports MCP and other agentic protocols, addressing enterprise concerns about AI agent impersonation, unauthorized transactions, and accountability in autonomous workflows. Chief Product Officer Roman Karachinsky described the goal: enabling enterprises to deploy AI agents "without compromising on fraud prevention or compliance." The Risk AI Agent capability provides complementary session-level holistic decisioning for human verification journeys, learning continuously from each customer's fraud and conversion patterns without requiring manual rule configuration. On the compliance roadmap, FedRAMP Ready status positions Incode to work toward full Authorization to Operate through an agency sponsor in 2026. The government sector roadmap is further supported by the Login.gov contract (announced December 2025) for next-generation identity proofing, delivered through subcontractor Diamond Capture Associates. These capabilities signal a deliberate expansion from private-sector financial services into regulated government and workforce identity markets. [CE036, CE037, CE040, CE045]

5.8 Exhibits

6.1 Customer Base and Vertical Segmentation

Incode serves six primary verticals — financial services/banking, telecommunications, government, hospitality, gaming/iGaming, and fintech/crypto marketplaces — with banking as the dominant segment by both revenue weight and public evidence depth. In Mexico and broader LATAM, major banks including Banorte (Mexico's second-largest), Citibanamex (second-largest by assets), and Banco Dondé (social-inclusion focus) are documented production customers using Incode Omni for remote account opening, biometric onboarding, and fraud prevention. In the United States, Incode claims to power eight of the top ten US banks and seven of the top eight telecom providers, a statement corroborated by FedRAMP press materials and multiple official press releases. Government customers span Mexico's INE (Instituto Nacional Electoral) biometric verification, the US federal Login.gov program ($37.4M contract), and at least one unnamed LATAM nation that used Incode for secure remote electronic voting. Hospitality deployments include Jumeirah Group (4 properties in the Middle East), while gaming deployments include MaxBet in Eastern Europe and Aristotle Integrity in the US iGaming sector. The Banco Dondé partnership targets financial inclusion for underserved populations in Mexico, demonstrating Incode's reach beyond tier-1 institutions. Channel partners including NTT Data, Carahsoft, Optiv, and SHI International extend Incode's reach to enterprise and government buyers in North America and globally.[CU001, CU002, CU006, CU007, CU011, CU018]

6.2 Named Customer Deployments and Proof of Adoption

Incode maintains a set of publicly documented case studies across its core verticals. The Citibanamex deployment is the most quantitatively rich public case study: Citi Mexico's second-largest bank achieved an 80% reduction in onboarding costs, increased new accounts, and reduced fraud attempts after deploying Incode Omni with face recognition, OCR, and iBeta Level 2 passive liveness detection. Citibanamex selected Incode ahead of competitors for its in-house developed core technology, orchestration capabilities, full automation, and edge computation. The Banorte integration, announced in November 2022, enabled customers to open accounts and sign up for financial products entirely via mobile using the Banorte Mobil app — the first such remote account registration capability at a major Mexican bank. Marcos Ramírez Miguel, CEO of Grupo Financiero Banorte, confirmed: "We offer users the possibility of becoming Banorte customers in a completely digital way, from their cell phones and with immediate access to a bank account without limits." The Jumeirah Group partnership (December 2021) covers 4 luxury hotel properties in the Middle East where biometric check-in is deployed, achieving check-in times as fast as 1.5 minutes; Sanjay Sharma, Head of IT at Jumeirah, cited "seamless and secure guest experience, setting a new standard for the industry." In gaming, MaxBet (Eastern Europe) became the first gambling operator in the region to deploy Incode's AI-powered passive liveness detection for player onboarding across physical and online properties, covering over 4,600 document types. Aristotle Integrity integrated Incode into its AutoDoc platform, which is licensed in 22 US states and powers onboarding for most of the largest US gambling operators. Banco Dondé, a Mexico social-inclusion bank, deployed Incode for remote biometric Level 4 account opening across nearly 400 branches, with CEO Eduardo Dondé confirming Incode met all security, accuracy, and scalability requirements. At federal scale in the United States, Incode won a $37.4M contract with Diamond Capture Associates to support Login.gov's Next Generation Identity Proofing initiative via the GSA's Technology Transformation Services.[CU007, CU008, CU009, CU010, CU011, CU018]

6.3 Customer Scale, Retention Signals, and Satisfaction

At the aggregate level, Incode processed over 4 billion identity checks annually as of late 2025, with 7 billion global verifications completed across 2025 according to the Axis Negocios interview. Mexico alone accounted for 2,000 million (2 billion) of those validations in 2025 — a figure that underscores the LATAM concentration and the depth of integration with Mexican financial institutions. Between 1% and 3% of verifications involve direct fraud attempts, indicating high-stakes use across Incode's customer base. Retention data is not disclosed publicly by Incode (a private company), but proxy signals are strongly positive: G2 reports a perfect 5.0/5.0 average from 52 verified reviews as of November 2025 (Winter 2026 badges cycle), with 100% five-star ratings. Incode earned 19 G2 badges in the Winter 2026 reports — 12 in Identity Verification, 4 in Age Verification, 3 in Anti-Money Laundering — leading in both mid-market and enterprise segments. Gartner recognized Incode as a Leader in its inaugural 2025 Magic Quadrant for Identity Verification, reflecting enterprise buyer confidence. Customer reviews highlight fraud prevention quality, ease of integration, and responsive support. Minor adverse signals include G2 mentions of cost being elevated for smaller operations (3 mentions), integration complexity for teams without prior KYC experience (2 mentions), and a Gartner Peer Insights critical review in March 2026 noting APIs are "not agnostic enough" and require excess client-side decision-making. Churn among large enterprise customers is unobserved in the public record; the Citibanamex, Banorte, Jumeirah, and MaxBet deployments remain active based on continued press and case study availability as of 2026.[CU003, CU004, CU005, CU012, CU013, CU014]

6.4 Go-to-Market Architecture and Channel Partnerships

Incode's go-to-market operates through three primary channels: direct enterprise sales, channel/reseller partnerships, and platform integrations with major enterprise software vendors. On the channel side, documented partners include NTT Data (global SI for financial services, healthcare, and public sector), Carahsoft Technology (US public sector IT aggregator for federal, state, and local government), Optiv (cybersecurity solutions integrator), SHI International (Fortune 1000 IT procurement), and Guidepoint Security (enterprise security VAR). Platform integrations bring Incode's biometric engine into Experian's Ascend Platform (servicing 1,800+ global clients across financial services, automotive, healthcare), Temenos (core banking onboarding), HubSpot CRM, and Verifone/Digital Check hardware verification terminals. The Okta integration adds biometric workforce IAM capabilities to the enterprise security stack. Interac (Canada's debit network) holds exclusive Canadian rights to deliver Incode-powered document verification, targeting a Q3 2026 phased launch. This ecosystem strategy enables Incode to reach accounts it would not close through direct sales — particularly US government (via Carahsoft), and LATAM enterprise (via NTT Data and regional SIs). The FedRAMP Ready milestone (November 2025) and the Login.gov contract together validate Incode's US federal government addressability. Revenue from channel partners is not disclosed but the breadth of the ecosystem suggests meaningful indirect revenue contribution. The Experian partnership quote from SVP Marika Vilen — "empowering organizations to make faster, smarter decisions while tailoring their fraud and risk strategies" — signals partner confidence in the platform.[CU016, CU017, CU019, CU026, CU027, CU034]

6.5 Concentration Risk and Adverse Evidence

Incode's customer base carries identifiable concentration risk along two axes: geographic and vertical. Mexico alone accounted for 2 billion of the 7 billion global verifications in 2025 (approximately 29%), and the LATAM banking vertical — particularly Banorte, Citibanamex, and Banco Dondé — represents the deepest evidenced customer relationships. In a market where banking sector concentration is structurally high (a small number of large banks dominate), loss of a single tier-1 bank relationship could represent a material volume decline. S&P Global's 2026 Banking Risk review notes that LATAM banks are increasingly reliant on third-party fintech vendors for digital transformation, amplifying systemic risk if a key provider experiences disruption. The meritra.co LatAm Banking Risk 2026 analysis documents that fraud and cyber now rank as the top two board-level risks for LATAM banks, creating both opportunity and dependency risk for Incode. On product integration risk, G2 reviewers note that Incode's pricing is "expensive for smaller operations" (3 mentions) and that integration complexity can be a barrier for teams unfamiliar with KYC processes (2 mentions). A March 2026 Gartner Peer Insights review criticized Incode's APIs for not being "agnostic enough," requiring excess client-side decision logic — a signal that may increase switching costs in some deployments but could also drive churn at the mid-market tier. No major enterprise churn events are documented in the public record. Rappi, frequently cited as an Incode customer in marketing, has no publicly confirmed production deployment documented by either party as of June 2026.[CU004, CU005, CU020, CU021, CU022, CU024]

6.6 Exhibits

7.1 Regulatory and Legal Risk

Incode operates in one of the most heavily regulated niches of enterprise software: biometric identity verification at scale in financial services. The company has already incurred direct legal exposure: in 2024 it settled Aspel v. Incode Technologies, Inc. (N.D. Ill. 1:23-cv-17093) for $4 million, resolving allegations that it captured Illinois residents' facial geometry without the written consent required by BIPA. The case class covered users from November 2018 through August 2024, indicating a multi-year period during which consent workflows may have been insufficient. Looking forward, the regulatory landscape is tightening on every geographic front relevant to Incode. In the United States, Illinois BIPA continues to generate over 100 new class-action filings per year, and while the 2024 BIPA amendment limits "per-scan" damages, courts remain divided on retroactivity. The Seventh Circuit will issue a binding ruling in 2026 that could dramatically reshape pending-case exposure across the industry. Texas CUBI (Tex. Bus. & Com. Code §503.001), reinforced by the June 2025 TRAIGA AI law, now explicitly applies to AI systems that capture biometric identifiers, adding civil penalties up to $25,000 per violation enforced by the Texas Attorney General. The FTC, via its 2023 biometric policy statement, has committed to Section 5 FTC Act enforcement against unfair or deceptive biometric practices—and has already banned Rite Aid from facial recognition use for five years. In the EU, the AI Act becomes fully enforceable on August 2, 2026. Any real-time biometric identification in public spaces by law enforcement is banned; high-risk biometric systems face conformity assessments, risk documentation, and fines reaching €35 million or 7% of annual global turnover. Mexico—Incode's largest revenue geography—overhauled its LFPDPPP in March 2025 and dissolved the independent regulator INAI, transferring enforcement to the executive-branch SABG. Biometric data remains explicitly sensitive data requiring specific, informed, and free consent. Secondary regulations from SABG are still pending, creating compliance uncertainty. The Clearview AI precedent ($51.75M BIPA settlement via equity stake) demonstrates that class-action exposure can approach company-ending levels for biometric firms with large user populations. Incode's identity checks on behalf of bank and telco customers create a continuous pipeline of potentially exposed Illinois residents.[CR001, CR002, CR003, CR004, CR005, CR006]

7.2 Technology Risk — Deepfakes, Liveness Spoofing, and Accuracy Bias

Incode's core value proposition is biometric accuracy and fraud prevention, making technology risks that undermine accuracy an existential threat to customer confidence. Two categories dominate: generative-AI presentation attacks and demographic accuracy bias in face recognition. Deepfake and synthetic-identity fraud has grown at extraordinary rates. Deepfake attacks to bypass biometric liveness checks surged 700%+ between 2021 and 2023, and injection attacks—where a fraudster replaces the live camera feed with a pre-rendered deepfake video—rose 40% year-on-year by 2025. Synthetic identity fraud losses exceeded $35 billion globally in 2023. A 2025 arXiv survey of 408 professionals found a stark paradox: while the public trusts biometrics for convenience, experts express "grave concerns" about the spoofing of static modalities like face and voice. Human reviewers correctly identify high-quality AI-generated fake documents only ~50% of the time, meaning AI-assisted detection is no longer optional. For Incode, which processes 4.1 billion identity checks annually, even a small bypass rate represents millions of fraudulent onboardings that could damage bank customers and trigger contractual liability. NIST FRVT data (last updated March 2025) confirms that demographic differentials in face recognition error rates persist across all submitted algorithms. False negative rates (failures to match the same person) are elevated for dark-skinned individuals in poor lighting conditions—exactly the conditions prevalent in mobile onboarding flows in LATAM. False positive differentials (incorrect matches) also vary by age, sex, and race. These differentials create regulatory risk under anti-discrimination law (the FTC has cited bias as a core concern), litigation risk, and reputational risk if deployed systems produce disparate outcomes at scale. The arms race between deepfake generators and liveness detectors is accelerating. Incode has invested in passive liveness and agentic AI detection, but the deepfake technology ecosystem is democratized: tools are available for as little as $20, and Fraud-as-a-Service platforms distribute ready-to-use spoofing kits at volume. Maintaining detection accuracy ahead of the threat curve requires continuous R&D investment and can never be declared permanently resolved.[CR017, CR018, CR019, CR020, CR021, CR022]

7.3 Market, Competitive, and Financial Risk

Incode's financial profile carries several compounding risks that could challenge its $3 billion valuation ambition (as of November 2025, still unconfirmed as of mid-2026). The company's ARR of approximately $170 million (2025) implies an ARR multiple of ~17.6x at the $3B target—a valuation stretched relative to public-market comps for SaaS companies, and exposed to multiple compression in a risk-off funding environment. Geographic and customer concentration is the most material market risk. Incode built its initial scale in LATAM, primarily Mexico, serving major banks including BBVA, Banorte, Santander Mexico, and telcos including Telcel. While the MetaMap acquisition in 2024 expanded the customer base from fewer than 200 to 1,000+ accounts across 100+ markets, LATAM banking remains the revenue backbone. A macro shock to Mexico's banking sector, a major bank insourcing IDV, or a currency devaluation could disproportionately impact revenue. The Mexican banking system is stable but faces low-growth pressures and US tariff/trade policy uncertainty, as White Case noted in its 2025 LatAm finance outlook. Competition is intense. The IDV market has 2,600+ competitors by Tracxn count, with well-funded specialists including Jumio, Onfido, Socure, and Mitek, plus new entrants from platform orchestrators. Incode's brand recognition lags Jumio and Onfido per industry analysis. Long enterprise sales cycles strain operating cash flow. The deeper threat is commoditization: Google, Microsoft, and Apple already embed identity-adjacent features in operating systems and cloud platforms, and as AI capabilities commoditize, differentiation on biometric accuracy alone may erode. CEO Ricardo Amper is a key-person risk. Amper is the co-founder, public face, and strategic architect—he authored Incode's acquisition rationale for MetaMap and AuthenticID, drives the FedRAMP government strategy, and is cited in nearly all investor and press materials. Succession or departure risk is unquantifiable but material for a unicorn still defining its category in LATAM.[CR025, CR026, CR027, CR028, CR029, CR030]

7.4 Operational, Infrastructure, and Execution Risk

Incode's operational risks are dominated by the intersection of digital infrastructure dependence, rapid geographic expansion, and the challenge of scaling compliance operations across fragmented regulatory regimes. Cloud infrastructure concentration is inherent to any SaaS identity platform. Incode relies on public cloud (primarily AWS) for compute, storage, and global low-latency delivery. Any significant AWS outage, pricing change, or service-level breach would directly affect Incode's ability to serve real-time bank onboarding flows—a mission- critical workflow where even minutes of downtime can cost financial customers millions. Incode's FedRAMP Ready status (achieved November 2025) opens US federal contracts but has not yet reached FedRAMP Authorized, which constrains the most sensitive federal agency deployments and creates a multi-year procurement cycle. The MetaMap and AuthenticID acquisitions introduce integration and culture risk. Merging three AI-engineering organizations with different technology stacks, compliance histories, and geographic footprints simultaneously is operationally demanding. Any biometric data leak, system error, or customer support failure during the integration window could damage the Incode brand at the moment it is seeking to justify a $3B valuation. LATAM execution risk includes Mexican and broader regional digital fraud, which topped 14,500 million MXN in losses in 2024 alone per reported data. As Incode serves financial institutions across this environment, the company bears reputational risk when fraud slips through and contractual risk if service-level commitments are not met. ACLU and EFF have characterized biometric surveillance broadly as prone to systematic error with racial and demographic disparities, creating advocacy and media risk if Incode's technology is associated with high-profile failures.[CR037, CR040, CR041, CR042, CR043]

7.5 Risk Synthesis and Investment Implications

Incode's risk profile is elevated relative to a typical enterprise SaaS company, reflecting three compounding factors: (1) it operates at the intersection of biometrics and financial-services compliance—two sectors that attract the most regulatory and litigation attention; (2) it is concentrated geographically in LATAM/Mexico, which creates country and currency risk on top of operational risk; and (3) it is seeking capital at a premium valuation (~17.6x ARR) in a market where multiple compression is a live threat. The regulatory risk vector is the most structurally unavoidable. The EU AI Act, Mexico LFPDPPP, BIPA, Texas CUBI, and FTC enforcement constitute an expanding multi-jurisdictional compliance burden that will increase in cost and complexity regardless of Incode's internal choices. The BIPA settlement demonstrates this is not a theoretical risk: Incode has already paid $4M and agreed to compliance improvements. Future exposure from new BIPA filings (100+ per year), from Texas CUBI/TRAIGA, or from an EU AI Act enforcement action could be materially larger. The technology risk from deepfakes is simultaneously a threat and a market opportunity—Incode competes on its ability to defeat fraud, and the worse the fraud environment becomes, the more valuable a proven solution is. However, this creates an asymmetric reputation risk: one high-profile bypass that enables significant fraud at a major bank customer could trigger customer churn and regulatory scrutiny simultaneously. Thesis-break triggers for investors include: a new material biometric class action in Illinois (especially if post-2024 BIPA amendment retroactivity is resolved adversely); an EU AI Act enforcement action citing Incode for high-risk system non-compliance; a major bank customer churn event; evidence that the $3B valuation fundraise closed at a down-round to the 2022 Series B; or a documented high-volume deepfake bypass of Incode's liveness system.[CR001, CR010, CR027, CR028, CR044]

7.6 Exhibits

8.1 Valuation Context and Current Entry Point

Incode's last externally price-setting event was its December 2021 Series B: $220 million raised at a $1.25 billion post-money valuation co-led by General Atlantic and SoftBank's LatAm Vision Fund. That marks an approximately 4.5-year gap to the current fundraise discussions. In November 2025 Bloomberg reported, and multiple outlets confirmed, that Incode was in preliminary talks to raise $150–300 million at a valuation of up to $3 billion, citing approximately $170 million in annual recurring revenue. The $3B/$170M ARR arithmetic implies an EV/ARR multiple of approximately 17.6x — a 140% step-up from the 2021 mark. Secondary-market data aggregator PremierAlts lists Incode's market-implied valuation at $3.0 billion as of 2026, consistent with the Bloomberg figure. Latka independently reports ~$170M ARR. However, no audited financials have been published, no completed round has been announced, and the round's structure (including preference terms) is undisclosed. The company also carries two secured debt obligations: J.P. Morgan Chase Bank was granted a security interest on Incode's assets on July 1, 2024, and TriplePoint Capital LLC recorded a further security interest on July 18, 2025 — both visible in USPTO patent assignment records. These debt tranches create prior claims on assets that reduce net equity value and are not reflected in the headline $3B talk valuation. Total capital raised ($262M per Crunchbase/Tracxn vs. $407M per PremierAlts) also remains unreconciled, suggesting possible undisclosed tranches or secondary activity.[CV001, CV002, CV003, CV004, CV005, CV006]

8.2 Comparable Transactions and Market Benchmarks

No perfect IDV comparable exists at Incode's exact scale and growth rate, but four private-round comps and two public-company comps bound the analysis. On the private-growth side, Persona's April 2025 Series D at $2.0 billion on roughly $141 million ARR implies 14.2x EV/ARR — the most recent and structurally closest analog (B2B IDV SaaS, AI-native, high-growth). This makes Persona the anchor comp. Incode's 17.6x ask carries a ~24% premium to Persona, which must be justified by higher growth certainty, deeper moat, or better margin profile — none of which are fully documented publicly. Socure's $4.5B Series E in November 2021 at an implied ~60x ARR is too dated and priced at peak-ZIRP to serve as a live benchmark. Veriff's $1.5B at January 2022 also embeds a dated vintage multiple (~36x on 2024 ARR) that does not reflect current market conditions. On the M&A exit side, Entrust's April 2024 acquisition of Onfido for confirmed $650 million — on more than $140 million in annual revenue — implies a ~4.6x EV/Revenue multiple. That is the clearest recent exit comp and underscores that M&A exit multiples for IDV are roughly 4–5x ARR, far below the growth-round ask of 17.6x. The spread between exit and growth-round multiples is typical but creates meaningful exit risk: if Incode cannot IPO or finds only strategic acquirers, the exit multiple could compress materially. Among public comps, Mitek Systems (MITK) trades at roughly 4.3x price/revenue on $179.7 million in FY2025 revenue and a ~$775 million market cap. CLEAR Secure (NYSE: YOU) trades at roughly 7.6x on $900.8 million in FY2024 revenue and a ~$7 billion market cap. Both are public and liquid, but CLEAR is a consumer biometrics company and Mitek is slower-growing (4% YoY) — neither directly captures Incode's high-growth AI-native profile. The public SaaS sector median EV/Revenue fell to 3.4x in March 2026, reflecting macro-driven multiple compression from AI disruption fears and slowing growth rates. Only AI-native, high-NRR, Rule of 40-passing companies sustain multiples above 9–12x in private deals, and even that top quartile sits below Incode's target of 17.6x.[CV013, CV014, CV015, CV016, CV017, CV018]

8.3 Bull, Base, and Bear Valuation Scenarios

Three scenarios bound the range of outcomes under different assumptions about ARR growth, multiple, and exit path. In the bull case, Incode continues at 40%+ growth, reaches $250–300 million ARR by 2027, secures large U.S. federal government contracts via the $37.4M Login.gov award (with follow-on), and IPO conditions reopen at 12–14x forward ARR — implying a $3.5–4.5 billion enterprise value and supporting the $3B entry price. This requires multiple dependent catalysts: sustained growth above peer median, audited financials that validate current ARR, and an IPO window that has remained largely closed for private SaaS since 2022. In the base case, growth normalizes to 20–30% YoY, ARR reaches $200–220M by 2027, and the company prices a round in the 12–16x ARR range — consistent with Persona's April 2025 comp — implying a $2.4–3.2B valuation. The current $3B ask sits at the high end of the base range but is not unreachable if near-term execution holds. In the bear case, growth slows below 15% (sector macro compression), public SaaS multiples remain at 3–5x, and M&A acquirers price exits at 5–8x ARR, implying a $0.9–1.5B valuation — a potential down-round from the $1.25B 2021 mark. The bear scenario is non-trivial given that: (a) the round has not yet closed; (b) ARR is company-claimed and unaudited; and (c) debt holders (JPMorgan, TriplePoint) have prior claims if the company needed a restructuring.[CV038, CV039, CV040, CV036, CV041, CV044]

8.4 Investment Thesis and Anti-Thesis

The bull thesis rests on four compounding facts: Incode is growing fast in a structurally expanding market (identity fraud expected to grow 20%+ annually), has blue-chip customer proof (8 of 10 largest U.S. banks, 8 of 9 top North American telcos), has the only iBeta Level 3 passive liveness certification globally, and has demonstrated inorganic execution via the AuthenticID acquisition. The U.S. government pipeline — FedRAMP Ready status and the $37.4M Login.gov contract — represents a new growth surface that could push ARR significantly above the current $170M. If growth continues above 40% and Incode reaches $250M+ ARR with improving unit economics, the $3B entry becomes retrospectively attractive. The anti-thesis centers on valuation discipline. The 17.6x EV/ARR is ~5x above the public SaaS median (3.4x), ~25% above the freshest private IDV comp (Persona 14.2x), and 3.8x above the most recent IDV M&A exit (Onfido at 4.6x). Revenue is unaudited. The fundraise has not closed. Debt obligations from J.P. Morgan (2024) and TriplePoint (2025) create secured claims ahead of new equity. The company has not disclosed its path to profitability, EBITDA margin, or NRR — all of which are essential inputs for underwriting a 17.6x multiple. The competitive landscape is intensifying (Persona's $200M fresh round, Socure's ecosystem expansion, Veriff's authentication volume surge) and customers may push back on single-vendor concentration. Any significant macro SaaS multiple compression would bring the fair value of an entry at $3B underwater within 12–18 months.[CV001, CV005, CV033, CV034, CV036, CV038]

8.5 Exit Readiness and Final Diligence Asks

Incode is not publicly listed and has no disclosed IPO timeline. The company's strong revenue growth, blue-chip customer base, and government contract wins are positive signals for eventual public market readiness, but several structural prerequisites are absent. First, no audited financial statements are publicly available, making independent verification of the $170M ARR and 80% growth claim impossible from public sources. Second, the preference stack from the 2021 Series B plus the 2024 J.P. Morgan and 2025 TriplePoint debt obligations creates a complex capital structure that could require significant disclosure in an S-1 filing. Third, Rule of 40 metrics, NRR, gross margin, and CAC payback — the key inputs that IPO investors and late-stage buyers scrutinize — are all undisclosed. Without these metrics, the $3B ask is difficult to underwrite with high conviction. The most credible exit path is a strategic acquisition by a large enterprise security player (Entrust, Microsoft, Ping Identity/Thales, or a payments network) or a late-stage private buyout. The Onfido precedent (4.6x ARR) suggests M&A exits in this segment trade at a significant discount to growth-round multiples. An IPO would require audited financials, demonstrated profitability path, and an IPO window that favors SaaS — conditions that have been intermittent since 2022.[CV007, CV008, CV017, CV042, CV044, CV045]

8.6 Recommendation and Conviction

Recommendation: TRACK / research-more. Confidence: Medium. Risk rating: High. Valuation stance: Stretched. Incode is a genuine category leader in AI-powered biometric identity verification with strong customer proof, impressive growth claims, and expanding U.S. government traction. However, the $3B target at 17.6x EV/ARR is priced for perfection — well above the public SaaS median, the freshest private IDV comp (Persona at 14.2x), and the last IDV M&A exit (Onfido at 4.6x). The multiple compression that has hit public SaaS since early 2026 (median EV/Revenue now 3.4x) increases the risk that the round closes at a lower valuation or not at all. The recommendation is not avoid: Incode has the growth, customer quality, and market position to eventually justify a valuation in this range. But conviction at $3B requires audited financials confirming the $170M ARR and growth rate, full transparency on the preference overhang and debt terms, Rule of 40 metrics, and NRR data. Absent those disclosures, entry at $3B provides limited margin of safety. Investors who can negotiate a lower entry price (e.g., 12–15x ARR = $2.0–2.5B) or structured downside protection would face a materially different risk/return. Monitor the round close for terms and the next annual revenue update for growth-rate confirmation before upgrading to buy.[CV001, CV005, CV033, CV036, CV037, CV038]

8.7 Exhibits