How to Value a Commercial Locksmith & Access Control Business in 2026

The locksmith business most people picture — a guy in a van rekeying house locks for $85 a pop — is not the business that gets bought at a premium. The businesses that command 5-6x EBITDA are commercial access control specialists: the shops installing Salto, HID, Kantech, and Brivo systems into office buildings, hospitals, and universities, with recurring monitoring and software revenue behind them.

I've watched this industry consolidate fast over the last five years. ADT Commercial, Convergint, Securitas Technology (the old Stanley Security), and a handful of PE-backed roll-ups like Pye-Barker and ONEiO are actively buying mid-market access control shops. If you own one, this is the best window to sell that I've seen in a decade.

The Two Kinds of Locksmith Businesses

Before we talk multiples, you need to understand which business you actually own, because buyers value them completely differently.

Residential/retail locksmith — rekeys, lockouts, automotive keys, safe work. High volume, low ticket, almost no recurring revenue. These businesses are lifestyle operations. They trade at 1.5-2.5x SDE and the buyer pool is mostly other individual locksmiths using SBA 7(a) financing. A shop doing $600K in revenue with $180K SDE sells for $300-$420K, full stop.

Commercial access control integrator — electronic access control, video surveillance integration, master key systems, managed credentials, and monitoring contracts. These businesses get valued on EBITDA at 3-6x, with the top of the range reserved for shops with 30%+ recurring revenue and 15%+ EBITDA margins.

A commercial shop doing $4M in revenue with $700K EBITDA and $900K/year in recurring monitoring contracts is a genuinely different animal than the residential van operation. I've seen those businesses trade at 5.5-6x ($3.5-$4.2M), while a similarly-sized residential shop with no recurring revenue would struggle to clear $1.2M.

Why Recurring Monitoring Changes Everything

The reason commercial access control is such a hot category right now is the recurring revenue stack that wraps around the hardware install. When you install a Brivo or Openpath cloud-based access system, you're not just billing for the readers and controllers — you're signing the customer to a monthly SaaS subscription, a managed services agreement, and usually an annual service contract.

That recurring revenue is valued separately from the project work. Install revenue (hardware plus labor) trades at 3-4x EBITDA because it's lumpy and project-based. Monitoring and managed credential revenue trades at 8-12x EBITDA because it looks like SaaS to a buyer. The math matters — in a $5M revenue shop with $800K recurring, the recurring stream alone can justify $1.5-$2M of the total purchase price.

If your shop is still quoting electronic access as one-time hardware installs and handing the customer an RMR contract from a third-party central station, you're giving away the most valuable revenue on your P&L. Cloud-native platforms like Brivo, Openpath, and Kisi let you keep the RMR in-house at 70-80% gross margins.

What Strategic Buyers Actually Pay

The strategic buyer pool for commercial access control has tightened into a few serious players, and each has a different appetite.

• Convergint Technologies: Buys platform-sized shops ($20M+ revenue), pays 6-8x EBITDA, and wants geographic fill-in around existing branches.
• Securitas Technology (formerly STANLEY Security): Active acquirer of shops with strong enterprise accounts. Typically 5-7x for shops above $10M revenue.
• Pye-Barker Fire & Safety: PE-backed roll-up (Altas Partners, Leonard Green). Buys smaller shops — $3M-$15M revenue — at 4-6x EBITDA, with earn-outs tied to RMR retention.
• Everon (formerly ADT Commercial): GTCR-backed, focused on national accounts and enterprise commercial. Pays 5-7x for access control specialists with strong MSAs.
• Local/regional integrators: The most realistic buyer for shops under $3M revenue. These trade at 3-4.5x EBITDA.

The cliff between a $2.5M revenue shop and a $5M revenue shop is real. Below $3M, you're selling to other regional integrators or a search fund. Above $5M with decent EBITDA margins, the national platforms start picking up the phone.

Key Value Drivers (What I Look at First)

When I evaluate a commercial locksmith or access control business for a client, here's the order I go in.

RMR as a percentage of revenue. Anything under 15% is a project shop with a van and a ladder. 20-30% RMR is the sweet spot where strategics get interested. Above 35%, you're getting valued partially as a security services company, which is a materially higher multiple.

Contracted customer base, not just a customer list. A written master services agreement (MSA) with a hospital system or a property management company is worth 3x what an informal "we've done their work for 10 years" relationship is worth. Buyers pay for contractual certainty.

Technician bench depth. Commercial access control requires certified technicians — IPVM-trained, manufacturer-certified on Lenel, Software House, Genetec, or whatever platforms you sell. A shop with 6 certified techs is far more valuable than a shop with 2 techs and a backlog, because buyers know they can't just hire their way out of a tech shortage in 2026.

Manufacturer authorizations. Being a certified dealer for ASSA ABLOY, dormakaba, Allegion, Honeywell, or Axis is an asset that transfers in the sale. Tier-1 authorizations take years to earn and open doors to enterprise bids.

Project backlog and pipeline. A signed backlog of $1M+ going into the sale gives buyers confidence that revenue won't collapse the day after closing. Buyers will typically pay 30-50 cents on the dollar for signed backlog on top of the EBITDA multiple.

What Destroys Value

Owner is the senior technician and senior salesperson. This is the number one killer in this industry. If you're quoting every job, programming every controller, and holding every customer relationship, there is no business to buy — there's a job. Buyers will discount 30-40% or push the deal into a multi-year earn-out.

Concentration in one or two general contractors. Shops that get 80% of their work through a single GC have negative leverage and thin margins. I tell these owners to spend 18 months diversifying before going to market.

Legacy hardware with no migration path. If half your installed base is running discontinued panels (old Kantech KT-300s, EOL Software House iStar Classic), a buyer sees a capex nightmare instead of an upgrade opportunity. Start migrating customers to current-gen platforms before you sell.

No central station relationship or sloppy RMR billing. If your monitoring revenue isn't on auto-billing with clean attrition reporting, the buyer's diligence team will tear your RMR number apart and discount it 20%+.

How to Maximize Your Exit

If you're 18-24 months from selling, focus on three things in order.

First, convert every install to a managed access contract. Even adding $200K of net new RMR in a year can move your multiple up a half-turn and add $300K-$500K to your sale price.

Second, hire or promote an operations manager so the business runs without you in the middle of every job. This is the single biggest valuation lever for most owner-operators.

Third, clean up your financials. Get reviewed statements for the last three years, separate install revenue from service revenue from RMR in your GL, and track gross margin by revenue type. Buyers want to see the recurring revenue waterfall, not a blended P&L. A CPA-reviewed set of books with clean RMR reporting is worth the $15K you'll spend on it many times over.

The Bottom Line

Commercial locksmith and access control is one of the more interesting niches in home services right now because the strategic buyers have capital, the recurring revenue story is real, and most owners still run their business like it's 2010. If you can get your RMR above 25%, get yourself out of daily operations, and put together clean financials, you'll sell for meaningfully more than the residential locksmith down the street — even if your revenue is comparable. The buyers are out there; the question is whether your business looks like a platform or a van.