OneSpan Inc. - Quarter Report: 2011 September (Form 10-Q)

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)

OR

Commission file number 000-24389

VASCO Data Security International, Inc.

(Exact Name of Registrant as Specified in Its Charter)

1901 South Meyers Road, Suite 210

Oakbrook Terrace, Illinois 60181

(Address of Principal Executive Offices)(Zip Code)

(630) 932-8844

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.    x  Yes    ¨  No

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).    Yes  x    No  ¨

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See definition of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).     ¨  Yes    x  No

There were 38,062,305 shares of Common Stock, $.001 par value per share, outstanding at October 24, 2011.

VASCO Data Security International, Inc.

Form 10-Q

For The Quarterly Period Ended September 30, 2011

Table of Contents

This report may contain trademarks of VASCO Data Security International, Inc. and its subsidiaries, which include VASCO, the VASCO “V” design, DIGIPASS, VACMAN, aXsGUARD and IDENTIKEY.

2

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED BALANCE SHEETS

(in thousands, except per share data)

See accompanying notes to condensed consolidated financial statements.

3

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except per share data)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

4

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME/(LOSS)

(in thousands)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

5

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)

(unaudited)

See accompanying notes to consolidated financial statements.

6

VASCO Data Security International, Inc.

Notes to Condensed Consolidated Financial Statements

(All amounts are in thousands, except per share data)

(Unaudited)

Unless otherwise noted, references in this Quarterly Report on Form 10-Q to “VASCO,” “company,” “we,” “our,” and “us,” refer to VASCO Data Security International, Inc. and its subsidiaries.

Note 1 – Summary of Significant Accounting Policies

Nature of Operations

VASCO Data Security International, Inc. and its wholly owned subsidiaries design, develop, market and support hardware and software security systems that manage and secure access to information assets. VASCO has operations in Austria, Australia, Bahrain, Belgium, Brazil, China, France, India, Japan, The Netherlands, Switzerland, Singapore, the United Kingdom, and the United States (U.S.).

Basis of Presentation

The accompanying unaudited condensed consolidated financial statements include the accounts of VASCO Data Security International, Inc. and its subsidiaries and have been prepared pursuant to the rules and regulations of the Securities and Exchange Commission regarding interim financial reporting. Accordingly, they do not include all of the information and notes required by generally accepted accounting principles for complete financial statements and should be read in conjunction with the audited consolidated financial statements included in the company’s Annual Report on Form 10-K for the year ended December 31, 2010.

In the opinion of management, the accompanying unaudited condensed consolidated financial statements have been prepared on the same basis as the audited consolidated financial statements, and include all adjustments, consisting only of normal recurring adjustments, necessary for the fair presentation of the results of the interim periods presented. All significant intercompany accounts and transactions have been eliminated. The operating results for the interim periods presented are not necessarily indicative of the results expected for a full year.

Principles of Consolidation

The consolidated financial statements include the accounts of VASCO Data Security International, Inc. and its wholly owned subsidiaries. Intercompany accounts and transactions have been eliminated in consolidation.

As further described in Note 4, during January 2011 we acquired 100% of the stock of DigiNotar B.V. Effective September 20, 2011, DigiNotar B.V. was declared bankrupt in The Netherlands transferring effective control over DigiNotar B.V. to the bankruptcy trustee. Accordingly, as of September 20, 2011, the assets, liabilities and operating activities related to DigiNotar B.V. are reflected in discontinued operations.

Estimates and Assumptions

7

The preparation of financial statements in conformity with accounting principles generally accepted in the U.S. requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenue and expenses during the reporting period. Actual results could differ from those estimates.

Foreign Currency Translation and Transactions

The financial position and results of the operations of the majority of the company’s foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. Dollars using current exchange rates as of the balance sheet date. Translation adjustments arising from differences in exchange rates are charged or credited to other comprehensive income. Revenue and expenses are translated at average exchange rates prevailing during the year. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations in other income (expense).

The financial position and results of operations of our operations in Singapore and Switzerland are measured in U.S. Dollars. For these subsidiaries, gains and losses that result from foreign currency transactions are included in the consolidated statements of operations in other income (expense).

For the three and nine months ended September 30, 2011, losses resulting from foreign currency transactions were $583 and $525, respectively, compared to gains of $330 and $63, for the same periods in 2010.

Revenue Recognition

We recognize revenue in accordance with Financial Accounting Standards Board (FASB) Accounting Standards Codification (ASC) 985-605, Software – Revenue Recognition, ASC 985-605-25, Revenue Recognition – Multiple Element Arrangements and Staff Accounting Bulletin 104. Revenue is recognized when there is persuasive evidence that an arrangement exists, delivery has occurred, the fee is fixed or determinable and collection of the revenue is probable.

Effective January 1, 2011, we adopted Accounting Standards Update (ASU) 2009-13, Multiple-Deliverable Revenue Arrangements- a consensus of the FASB Emerging Issues Task Force, which amended ASC 985-605-25, and ASU 2009-14, Certain Revenue Arrangements That Include Software Elements, which amended ASC 985-605. In multiple-element arrangements, the adoption of these two ASUs will result in some of our products continuing to be accounted for under the software provisions of ASC 985-605 and others to be accounted for under the provisions that relate to the sale of non-software products.

In our typical multiple-element arrangement, the primary deliverables include:

8

Our multiple-element arrangements may also include other items that are usually delivered prior to the recognition of any revenue and incidental to the overall transaction such as initialization of the hardware device, customization of the hardware device itself or the packaging in which it is delivered, deployment services where we deliver the device to our customer’s end-use customer or employee and, in some limited cases, professional services to assist with the initial implementation of a new customer.

Effective January 1, 2011 with the adoption of ASU 2009-13 and 14 there was no change in the units of accounting, but there was a change in the method we use to allocate the revenue among the elements included in the arrangement.

In multiple-element arrangements that include a hardware client device, we allocate the selling price among all elements, delivered and undelivered, based on our internal price lists and the percentage of the selling price of that element, per the price list, to the total of the estimated selling price of all of the elements per the price list. Our internal price lists for both delivered and undelivered elements were determined to be reasonable estimates of the selling price of each element based on a comparison of actual sales made to the price list for each item delivered and to vendor specific objective evidence (VSOE) for undelivered items.

Undelivered elements primarily are PCS. The method by which we determine VSOE has validated that the price lists are reasonable estimates of the selling price for PCS. The estimated selling price of PCS items is based on an established percentage of the user license fee attributable to the specific software and is applied consistently to all PCS arrangements. The percentage we use to establish VSOE, which is also generally consistent with the percentage used in the price list, is developed using the “bell curve method”. This method relies on historical data to show that at least 80% of all our renewals are within 15% of the median renewal percentage rate.

In multiple-element arrangements that include a software client device, we continue to account for each element under the current standards of ASC 985-605 related to software. When software client device and host software are delivered elements, we use the Residual Method (ASC 605-25) for determining the amount of revenue to recognize for token and software licenses if we have VSOE for all of the undelivered elements. Any discount provided to the customer is applied fully to the delivered elements in such an arrangement. VSOE of fair value of PCS agreements is based on customer renewal transactions on a worldwide basis. In sales arrangements where VSOE of fair value has not been established, revenue for all elements is deferred and amortized over the life of the arrangement.

We do not expect a significant change in the pattern or timing of revenue recognition. The adoption of ASU 2009-13 and 14 did not have a significant impact on the recognition of revenue for the three and nine months ended September 30, 2011 and is not expected to have a material impact on the recognition of future revenues.

For transactions other than multiple-element arrangements, we recognize revenue as follows:

9

We recognize revenue from sales to distributors and resellers on the same basis as sales made directly to customers. We recognize revenue when there is persuasive evidence that an arrangement exists, delivery has occurred, the fee is fixed or determinable and collection of the revenue is probable.

For large-volume transactions, we may negotiate a specific price that is based on the number of users of the software license or quantities of hardware supplied. The per unit prices for large-volume transactions are generally lower than transactions for smaller quantities and the price differences are commonly referred to as volume-purchase discounts.

All revenue is reported on a net basis, excluding any sales taxes or value added taxes.

Cash and Cash Equivalents

Cash and cash equivalents are stated at cost plus accrued interest, which approximates fair value. Cash equivalents are high-quality short term money market instruments, with original maturities of three months or less. Cash and cash equivalents are held by a number of U.S. and non-U.S. commercial banks and money market investment funds. Cash and cash equivalents at September 30, 2011 include $77,426 in money market investment funds or demand bank deposits for which fair value is equal to cost. These investments are valued using level one inputs, as defined in ASC 820, Fair Value Measurements and Disclosures. Cash and cash equivalents also include $68 in bank certificates of deposit for which fair value was $68 at September 30, 2011. Bank certificates of deposit are valued using level two inputs, as defined by ASC 820.

Accounts Receivable and Allowance for Doubtful Accounts

The credit-worthiness of customers (including distributors and resellers) is reviewed prior to shipment. A reasonable assurance of collection is a requirement for revenue recognition. Verification of credit and/or the establishment of credit limits are part of the customer contract administration process. Credit limit adjustments for existing customers may result from the periodic review of outstanding accounts receivable. The company records trade accounts receivable at invoice values, which are generally equal to fair value.

We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make payments for goods and services. We analyze accounts receivable balances, customer credit-worthiness, current economic trends and changes in our customer payment timing when evaluating the adequacy of the allowance for doubtful accounts. The allowance is based on a specific review of all significant past-due accounts. If the financial condition of our customers deteriorates, resulting in an impairment of their ability to make payments, additional allowances may be required.

Inventories

Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the first-in-first-out (FIFO) method. We write down inventory when it appears that the carrying cost of the inventory may not be recovered through subsequent sale of the inventory. The company analyzes the quantity of inventory on hand, the quantity sold in the past year, the anticipated sales volume in the form of sales to new customers as well as sales to previous customers, the expected sales price and the cost of making the sale when evaluating the

10

valuation of our inventory. If the sales volume or sales price of a specific model declines significantly, additional write downs may be required.

Property and Equipment

Property and equipment are stated at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the related assets ranging from three to seven years. Additions and improvements are capitalized, while expenditures for maintenance and repairs are charged to operations as incurred. Gains or losses resulting from sales, disposals, or retirements are recorded as incurred, at which time related costs and accumulated depreciation are removed from the accounts.

Goodwill and Other Intangibles

We account for goodwill and indefinite-lived intangible assets in accordance with ASC Topic 350-20, Goodwill and Other . Indefinite-lived intangible assets include proprietary technology, patents, trademarks and other intangible assets. Intangible assets other than patents with definite lives are amortized over the useful life, generally three to seven years for proprietary technology. Patents are amortized over the life of the patent, generally 20 years in the U.S.

We assess the impairment of goodwill and intangible assets with indefinite lives each year-end or whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors considered important which could trigger an impairment review include significant underperformance relative to expected historical or projected future operating results, significant changes in the manner of our use of the acquired assets or the strategy for our overall business, and significant negative industry or economic trends. Once identified, the amount of the impairment is computed by comparing carrying value of the assets to fair value. Fair value for goodwill and intangible assets is determined using our stock price which is a level 1 valuation, as defined in ASC 820-10, Fair Value Measurements and Disclosures.

As further described in Note 4, the DigiNotar Events triggered an impairment review. As a result of the impairment review, we concluded that goodwill and other intangibles of DigiNotar B.V. were impaired and recorded non-cash impairment charges of $2,873 for goodwill and $2,307 for other intangibles.

Research and Development Costs

Costs for research and development, principally the design and development of hardware, and the design and development of software prior to the determination of technological feasibility, are expensed as incurred on a project-by-project basis.

Software Development Costs

We capitalize software development costs in accordance with ASC 985-20, Costs of Software to be Sold, Leased, or Marketed. Research costs and software development costs, prior to the establishment of technological feasibility, determined based upon the creation of a working model, are expensed as incurred. Our software capitalization policy defines technological feasibility as a functioning beta test prototype with confirmed manufacturability (a working model), within a reasonably predictable range of costs. Additional criteria include receptive customers, or potential customers, as evidenced by interest expressed in a beta test prototype, at some suggested selling price. Our policy is to amortize capitalized costs by the greater of (a) the ratio that current gross revenue for a product bears to the total of current and anticipated future gross revenue for that product or (b) the straight-line method over the remaining estimated economic life of the product, generally two to five years, including the period being reported on. No software development costs were capitalized during the nine months ended September 30, 2011.

11

Income Taxes

We account for income taxes under the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases and operating loss and tax credit carryforwards. We measure deferred tax assets and liabilities using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. We recognize the effect of a change in tax rates on deferred tax assets and liabilities and in income in the period that includes the enactment date.

We monitor our potential income tax exposures as required by ASC 740-10, Income Taxes.

We have significant net operating loss carryforwards in the U.S. and other countries which are available to reduce the liability on future taxable income. A valuation reserve has been provided for the U.S. and certain foreign operating loss carryforwards to offset most of these future benefits because we have not determined that their realization is more likely than not.

Fair Value of Financial Instruments

At September 30, 2011 and December 31, 2010, our financial instruments were cash equivalents, accounts receivable, accounts payable and accrued liabilities. The estimated fair value of our financial instruments has been determined by using available market information and appropriate valuation methodologies as described in Cash and Cash Equivalents above. The fair values of the financial instruments were not materially different from their carrying amounts at September 30, 2011 and December 31, 2010.

Accounting for Leases

All of our leases are operating leases. Rent expense on facility leases is charged evenly over the life of the lease, regardless of the timing of actual payments.

Warranty

Warranties are provided on the sale of certain of our products and an accrual for estimated future claims is recorded at the time revenue is recognized. We estimate the cost based on past claims experience, sales history and other considerations. We regularly assess the adequacy of our estimates and adjust the amounts as necessary. Our standard practice is to provide a warranty on our hardware products for either a one or two year period after the date of purchase. Customers may purchase extended warranties covering periods from one to four years after the standard warranty period. We defer the revenue associated with the extended warranty and recognize it into income on a straight-line basis over the extended warranty period. We have historically experienced minimal actual claims over the warranty period.

12

Note 2 – Accounts Receivable and Allowance for Doubtful Accounts

Accounts receivable represents the balance due on credit sales made to customers. The allowance for doubtful accounts is an estimate of losses that may result from customers’ inability to make payment on their outstanding balances.

Note 3 – Inventories

Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the FIFO method.

Inventories are comprised of the following:

Note 4 – DigiNotar

On January 10, 2011, we purchased all of the intellectual property of DigiNotar Holding B.V. and its subsidiaries and acquired 100% of the stock of DigiNotar B.V. and DigiNotar Notariaat B.V., each a private company organized and existing in The Netherlands (collectively, “DigiNotar”), for aggregate consideration of €10,000 ($13,253 at an exchange rate of 1.32 US Dollars per Euro) comprised of assumed debt of €64 and cash. Both transactions were effective January 1, 2011. We funded the transactions from our existing cash balances.

The consideration was allocated to assets acquired and liabilities assumed based on their respective fair values as of the acquisition date as follows:

13

Acquired identifiable intangible assets are amortized over their respective useful lives ranging from two to seven years.

Purchase consideration includes contingent consideration held in escrow payable upon the achievement of certain one year operating targets. The contingent consideration was recorded as a current asset at its estimated fair value of $861. As a result of events described below, the contingent consideration was re-measured as of September 30, 2011 resulting in an increase of $1,085 recorded in our statement of operations as discontinued operations.

In July 2011, DigiNotar B.V. detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains. On September 14, 2011, the Dutch Independent Post and Telecommunications Authority (OPTA) Commission terminated DigiNotar’s registration as a certification service provider that issues qualified certificates. As a result of the termination of its registration as a certification service provider, DigiNotar B.V. filed for bankruptcy on September 19, 2011 and the Haarlem District Court, The Netherlands declared DigiNotar B.V. bankrupt on September 20, 2011. The court appointed a bankruptcy trustee to manage all the affairs of DigiNotar B.V. as it proceeds through the bankruptcy process. The trustee took over the management of business activities of DigiNotar B.V. and responsibility for the administration and liquidation of DigiNotar B.V. (collectively, the “DigiNotar Events”).

As a result of the DigiNotar Events, the loss on operating activities, the loss on the disposal and the related assets and liabilities related to DigiNotar B.V. are reflected as discontinued operations. The income (loss) from discontinued operations, net of tax, for the quarter and nine months ended September 30, 2011 was as follows:

DigiNotar revenues of $594 and $1,764 for the three and nine months ended September 30, 2011, respectively, are included in the income (loss) from operations shown above.

The loss on disposal includes the following:

14

At September 30, 2011, remaining assets and liabilities related to DigiNotar have been classified as assets of discontinued operations and liabilities of discontinued operations, respectively, in the balance sheets and consist of the following:

Note 5 – Acquisition of Alfa & Ariss

On April 1, 2011, we acquired all of the stock of Alfa & Ariss B.V. (Alfa & Ariss), an open identity and access management specialist of Enschede, The Netherlands, in exchange for cash consideration of €1,000 ($1,410 at the exchange rate of 1.41 US Dollars per Euro). The purchase price was subject to verification of certain balances resulting in an additional payment of €36 in May 2011 (approximately $51 at an exchange rate of 1.41 US Dollars per Euro). The acquisition was funded by our existing cash balances.

Consideration was allocated to assets acquired and liabilities assumed based on their respective fair values as of the acquisition date as follows:

15

Consideration includes contingent consideration of €400 held in escrow payable ratably over four years on the anniversary date of the transaction subject to continued employment of a former officer and shareholder of Alfa & Ariss. The amount has been recorded as a prepaid expense and will be amortized ratably over the four year period.

Acquired identifiable intangible assets totaling $606 are being amortized over their respective useful lives ranging from two to five years.

The acquisition is not material to our unaudited condensed consolidated balance sheet and results of operations. The unaudited condensed financial statements include the operating results of Alfa & Ariss from the acquisition date.

Note 6 – Goodwill

Goodwill as of September 30, 2011 consisted of the following:

As further described in Notes 1, 4, and 5, additions to goodwill result from the acquisitions of DigiNotar and Alfa & Ariss and the impairment results from the DigiNotar Events. Certain portions of goodwill are denominated in local currencies and are subject to currency fluctuation.

Note 7 – Intangible Assets

Intangible asset activity for the nine months ended September 30, 2011 is detailed in the following table.

16

As further described in Notes 1, 4, and 5, Additions – DigiNotar and Additions – Alfa & Ariss result from the acquisitions of DigiNotar and Alfa & Ariss and Impairment-DigiNotar results from events related to DigiNotar. Certain intangible assets are denominated in local currencies and are subject to currency fluctuations.

Note 8 – Income Taxes

Our effective tax rate on continuing operations for the nine months ended September 30, 2011 is equal to our expected annual tax rate of 21%. This rate is lower than the U.S. statutory rate of 35%, primarily due to two factors:

In the second quarter of 2011, our effective annual tax rate was estimated to be 30%. This was lower than the U.S. statutory tax rate of 35%, primarily due to income in foreign jurisdictions taxed at lower rates, partially offset by expected losses in the U.S., where the tax benefit for these losses was fully reserved. The effective tax rate of 18% for the third quarter of 2011 reflects the decrease in the expected annual rate.

Our expected annual tax rate for the nine months ended September 30, 2010 was 32%. This was lower than the U.S. statutory tax rate of 35%, primarily due to income in foreign jurisdictions taxed at lower rates, partially offset by losses in the U.S., where the tax benefit for these losses was fully reserved. The effective tax rate for the nine months ended September 30, 2010 was 27%. This was lower than the expected annual tax rate of 32%, due to the benefit of discrete items of $282 related to the true-up of our provisions for prior year tax returns as filed and other tax adjustments. In the second quarter of 2010, our effective annual tax rate was estimated to be 35%. The effective tax rate of 28% for the third quarter of 2010 reflects the reduction in the estimated annual tax rate.

At December 31, 2010, we had U.S. net operating loss (NOL) carryforwards of $21,247. Of this amount, $14,727 would result in a benefit to earnings. The remainder represents tax deductions for employee stock option gains, the benefit for which would be credited to paid-in capital. The U.S. loss carryforwards expire in varying amounts beginning in 2020 and continuing through 2029. In addition, if certain substantial changes in the company’s ownership were deemed to have occurred, there would be an annual limitation on the amount of the U.S. carryforwards that could be utilized. At December 31, 2010, we also had foreign NOL carryforwards of $4,834. The foreign NOL carryforwards have no expiration dates. A valuation reserve has been provided for the U.S. and

17

certain foreign operating loss carryforwards to offset the future benefits because we have not determined that their realization is more likely than not.

Note 9 – Warranties

We maintain a reserve for potential warranty claims related to products sold and recognized in revenue. We regularly reassess the adequacy of our estimates and adjust the amounts as necessary. Our warranty reserve is included in other accrued expenses.

The activity in our warranty liability was as follows:

At September 30, 2011, deferred revenue from extended warranties was $66.

Note 10 – Long-Term Compensation Plan and Stock Based Compensation

Under the VASCO Data Security International, Inc. 2009 Equity Incentive Plan (2009 Equity Incentive Plan), we awarded 190 shares of restricted stock in the first quarter of 2011 consisting of 88 unissued shares subject to future performance criteria and 102 issued shares. The market value of the restricted shares was $1,588 at the date of grant and will be amortized over the respective vesting periods of one to four years.

In the second quarter of 2011, we awarded 445 shares of restricted stock under the 2009 Equity Incentive Plan consisting of 149 unissued shares subject to future performance criteria and 296 issued shares. The market value of the restricted shares was $3,684 at the date of grant and will be amortized over the respective vesting periods of three or four years.

The following table details long-term compensation plan and stock-based compensation expense for the three and nine months ended September 30, 2011 and 2010:

18

Note 11 – Common Stock and Earnings per Share

In connection with the 2009 Equity Incentive Plan described above, we issued 102 shares of restricted common stock during the three months ended March 31, 2011 and 296 shares during the three months ended June 30, 2011.

Basic earnings per share is based on the weighted average number of shares outstanding and excludes the dilutive effect of unexercised common stock equivalents. Diluted earnings per share is based on the weighted average number of shares outstanding and includes the dilutive effect of unexercised common stock equivalents to the extent they are not anti-dilutive. The details of the earnings per share calculations for the three and nine month periods ended September 30, 2011 and 2010 follow:

19

Unless otherwise noted, references in this Quarterly Report on Form 10-Q to “VASCO,” “company,” “we,” “our,” and “us” refer to VASCO Data Security International, Inc. and its subsidiaries.

Cautionary Note Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q, including Management’s Discussion and Analysis of Financial Condition and Results of Operations and Quantitative and Qualitative Disclosures About Market Risk contains forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934 and Section 27A of the Securities Act of 1933. Such forward-looking statements are subject to certain risks, uncertainties and assumptions and include, among other things, our expectations regarding the DigiNotar bankruptcy process, the impairment of our investment in DigiNotar, the timeframe in which the impairment costs will be incurred, our ability to recover amounts held in escrow, our ability to offset amounts that may be owed to DigiNotar by other VASCO affiliates against amounts owed to VASCO affiliates by DigiNotar, and our ability to effectively integrate certain intellectual property assets previously used by DigiNotar into our operations, as well as the prospects of, and developments and business strategies for, VASCO and our operations, including the development and marketing of certain new products and the anticipated future growth in certain markets in which we currently market and sell our products or anticipate selling and marketing our products in the future. These forward-looking statements (1) are identified by use of terms and phrases such as “expect”, “believe”, “will”, “anticipate”, “emerging”, “intend”, “plan”, “could”, “may”, “estimate”, “should”, “objective”, “goal”, “possible”, “potential” and similar words and expressions, but such words and phrases are not the exclusive means of identifying them, and (2) are subject to risks and uncertainties and represent our present expectations or beliefs concerning future events. Although VASCO believes that our expectations are reasonable, we can give no assurance that these expectations will prove to be correct. VASCO cautions that the forward-looking statements are qualified by important factors that could cause actual results to differ materially from those in the forward-looking statements. Factors that could cause actual results to differ materially from those contemplated above include, among others, unanticipated costs associated with DigiNotar’s bankruptcy or potential claims that may arise in connection with the hacking incidents at DigiNotar. Additional risks, uncertainties and other factors have been described in greater detail in our Annual Report on Form 10-K for the year ended December 31, 2010 and include, but are not limited to, (a) risks of general market conditions, including currency fluctuations and the uncertainties resulting from turmoil in world economic and financial markets, (b) risks inherent to the computer and network security industry, including rapidly changing technology, evolving industry standards, increasingly sophisticated hacking attempts, increasing numbers of patent infringement claims, changes in customer requirements, price competitive bidding, and changing government regulations, and (c) risks specific to VASCO, including, demand for our products and services, competition from more established firms and others, pressures on price levels and our historical dependence on relatively few products, certain suppliers and certain key customers. Thus, the results that we actually achieve may differ materially from any anticipated results included in, or implied by these statements. Except for our ongoing obligations to disclose material information as required by the U.S. federal securities laws, we do not have any obligations or intention to release publicly any revisions to any forward-looking statements to reflect events or circumstances in the future or to reflect the occurrence of unanticipated events.

General

The following discussion is based upon our consolidated results of operations for the three and nine months ended September 30, 2011 and 2010 (percentages in the discussion may be rounded to the closest full percentage point) and should be read in conjunction with our consolidated financial statements included elsewhere in this Form 10-Q and our most recent Annual Report on Form 10-K filed with the Securities and Exchange Commission.

20

We design, develop, market and support open standards-based hardware and software security systems that manage and secure access to information assets. We also design, develop, market and support patented strong user authentication products and services for e-business and e-commerce. Our products enable secure financial transactions to be made over private enterprise networks and public networks, such as the Internet. Our strong user authentication is delivered via our hardware and software DIGIPASS security products (collectively DIGIPASSES), most of which incorporate an electronic signature capability, which further protects the integrity of electronic transactions and data transmissions. Some of our DIGIPASSES are compliant with the Europay MasterCard Visa (EMV) standard and are compatible with MasterCard’s and VISA’s Chip Authentication Program (CAP). Some of our DIGIPASS units comply with the Initiative for Open Authentication (OATH). As evidenced by our current customer base, our products are purchased by companies and, depending on the business application, are distributed to either their employees or their customers. Those customers may be other businesses or, as an example in the case of Internet banking, our customer banks’ corporate and retail customers.

We offer our products either through a product sales and licensing model or through our DIGIPASS as a Service (“DPS”) product offering. DPS is our cloud-based authentication platform. By using our authentication platform, customers can deploy two-factor authentication more quickly, incur less upfront costs and be able to use strong authentication when logging onto a larger number of Internet sites and applications. We expect those applications to include business-to-business applications, business to employee applications (e.g., employees of companies logging into third party applications operated in the cloud), and business to consumer applications. While there were minimal revenues generated from this product through the first nine months of 2011, we believe that DPS has the potential for significant future growth as it will make two-factor authentication more affordable and readily available to users and application markets.

In January 2011, we acquired DigiNotar BV., an internet trusted certificate authority/provider, in a two step process, the first step being the acquisition of DigiNotar’s intellectual property and the second being the acquisition of the stock of DigiNotar. In July 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains. On September 14, 2011, the Dutch Independent Post and Telecommunications Authority (OPTA) Commission terminated DigiNotar’s registration as a certification service provider that issues qualified certificates. As a result of the termination of its registration as a certification service provider, DigiNotar filed for bankruptcy on September 19, 2011 and the Haarlem District Court, The Netherlands declared DigiNotar bankrupt on September 20, 2011.

Following the bankruptcy of DigiNotar, we do not plan to continue the certificate authority business, which was DigiNotar’s core product. We do expect, however, that we will be able to use the intellectual property acquired from DigiNotar to create our own PKI-secured applications, such as document signing, registration and storage solutions, which we expect will strengthen our core authentication product line and expand opportunities for us on our DPS platform.

In April 2011, we acquired Alfa & Ariss BV (“Alfa & Ariss”). Alfa & Ariss is an authority in the field of developing open identity and access management solutions. Alfa & Ariss brought additional important know-how and engineering capabilities in the fields of linking applications in-the-cloud. We believe that the acquisition of Alfa & Ariss will support the long-term growth strategy of our services and enterprise and application security businesses.

Our target market is any business process that uses some form of electronic interface, particularly the Internet, where the owner of that process is at risk if unauthorized users can gain access to its process and either obtain proprietary information or execute transactions that are not authorized. Our products not only increase the security associated with accessing the business process, thereby reducing the losses from unauthorized access, but also, in many cases, can reduce the cost of the process itself by automating activities that were previously performed manually.

21

Comparison of Results for the Three and Nine Months Ended September 30, 2011 and 2010

Industry Growth: We do not believe that there are any accurate measurements of the total industry’s size or the industry’s growth rate. We believe, however, that the industry will grow at a significant rate as the use of the internet increases and the awareness of the risks of using the internet grow among applications owners and consumers. We expect that growth will be driven by new government regulations, growing awareness of the impact of identity theft, and the growth in commerce that is transacted electronically. The issues driving the growth are global issues and the rate of adoption in each country is a function of that country’s culture, the competitive position of businesses operating in that country, the country’s overall economic conditions and the degree to which businesses and consumers within the country use technology.

Economic Conditions: Our revenue may vary significantly with changes in the economic conditions in the countries in which we sell products. With our current concentration of revenue in Europe and specifically in the banking/finance vertical market, significant changes in the economic outlook for the European banking market may have a significant effect on our revenue. As a result of the difficult economy in 2010 and the first half of 2011, our customers delayed the rollout of existing applications and deferred purchase decisions related to the implementation of our product in new applications. In 2010, we responded to the difficult economic conditions by focusing our sales efforts on markets that we believed to have the most near-term opportunity and by implementing cost containment initiatives, which included but was not limited to a hiring freeze. With the apparent abatement of the difficult economic conditions in the fourth quarter of 2010 in many of the countries in which we operate, we began to hire staff to support new product development and sales initiatives as well as hiring staff to mitigate risk and strengthen our position in existing markets.

We do not believe the sovereign debt crisis in Europe has had a material negative impact on our business in the first nine months of 2011. Through the first nine months of 2011, we have seen substantial growth in demand for our product from the banking vertical market even with the significant uncertainty surrounding the sovereign debt issues and the potential impact that a default by the issuers of the debt may have on banks, especially in the western European market. We believe that the growth has been driven by the banks focusing on the need to grow their retail banking business and secure their customers’ internet banking transactions. While we expect that the European leaders will find a solution to the debt issues and the resulting impact on banks holding the debt, it is possible that continued delay in finding a solution or if the solution has a strongly unfavorable impact on the banks, the demand for our products could decline significantly. Cybersecurity: See Note 4 to the financial statements for details associated with a cybersecurity incident involving DigiNotar B.V. that we experienced in July 2011.

Cybersecurity: In July 2011, we experienced a cyber incident related to DigiNotar B.V. as described in Note 4 to the financial statements. While the loss of DigiNotar B.V.’s certificate authority business was not material to our ongoing operations, the loss on the disposal of the business, which primarily reflected the write-off of a part of the cost of acquiring the business earlier in the year, was significant. The hacking incident at DigiNotar B.V. did not effect VASCO’s information systems as the two networks were not integrated. We do not expect that the cyber incident at DigNotar B.V. will have a material impact on our traditional authentication business going forward.

Our losses from discontinued operations resulting from the DigiNotar Events may be exceeded as a result of unanticipated costs associated with DigiNotar B.V.’s bankruptcy, potential claims that may arise in connection with the hacking incident, further impairment of our investment in DigiNotar B.V., the timeframe in which the impairment costs will be incurred, our inability to recover amounts held in escrow relating to our acquisition of DigiNotar, our inability to offset amounts that may be owed to DigiNotar B.V. by other VASCO affiliates against amounts owed to VASCO affiliates by DigiNotar B.V. and our inability to effectively integrate certain intellectual property assets previously used by DigiNotar B.V. into our operations.

See Note 4 to the financial statements for a description of the cybersecurity incident involving DigiNotar B.V.

See Part II. Other Information Item 1. Legal Proceedings for a description of legal proceedings related to the cybersecurity incident involving DigiNotar B.V.

See Part II. Other Information Item 1A. Risk Factors for a discussion of cybersecurity risks.

Income Taxes: Our effective tax rate reflects our global structure related to the ownership of our intellectual property (“IP”). All our IP is owned by two subsidiaries, one in the U.S. and one in Switzerland. Our two subsidiaries have entered into agreements with most of the other VASCO entities under which those other entities provide services to our U.S. and Swiss subsidiaries on either a percentage of revenue or on a cost plus basis or both. Under this structure, the earnings of our service provider subsidiaries are relatively constant. These service provider companies tend to be in jurisdictions with higher effective tax rates. Fluctuations in earnings tend to flow to the US and Swiss companies, which have lower effective tax rates which accounts for the change in our effective tax rates.

We currently have a U.S. net operating loss (“NOL”) that is fully reserved as we have not yet been able to establish that it is more likely than not that we will be able to use the NOL. As a result of the NOL and related reserve, the effective tax rate on U.S. earnings has approximated zero, excluding the impact of the alternative minimum tax (“AMT”). The AMT rate generally computes to about 2% of pretax income in the U.S. We expect that the effective tax rate on U.S. earnings will remain near

22

zero, excluding AMT, until we can establish that it is more likely than not that we will have adequate U.S. earnings such that we will be able to use the NOL. If we are able to establish that we can use the NOL in future periods, we will release the reserve on the NOL to income in the period that we make that determination and from that point forward future earnings in the U.S. are expected to be taxed at the statutory rates.

The changes in the effective rate related to foreign operations reflect changes in the geographic mix of where the earnings are realized and the tax rates in each of the countries in which it is earned. The statutory tax rate for the primary foreign tax jurisdictions ranges from 8% to 34%.

The geographic mix of earnings of our foreign subsidiaries will primarily depend on the level of our service provider subsidiaries’ pretax income, which is recorded as expense in the two entities that own our intellectual property (i.e., subsidiaries in the U.S. and Switzerland), and the benefit that is realized in Switzerland through the sales of product. The level of pretax income in our service provider subsidiaries can vary based on:

For items 1 and 2 above, there is a direct impact in the opposite direction on earnings in the U.S. and Swiss entities. Any change from item 3 is generally expected to result in a larger change in income in the U.S. and Swiss entities in the direction of the change (increased revenues expected to result in increased margins/pretax profits and conversely decreased revenues expected to result in decreased margins/pretax profits) than the change in the service provider entities.

In addition to provision of services, the intercompany agreements transfer the majority of the business risk to our U.S. and Swiss subsidiaries. As a result, the contracting subsidiaries’ pretax income is reasonably assured while the pretax income of the U.S. and Swiss subsidiaries varies directly with our overall success in the market.

Given the fact that the effective rate in the U.S. is zero and the effective rate in Switzerland is lower than in most of our other service provider subsidiaries, we believe that increases in pretax income will generally result in lower effective tax rates and decreases in pretax income will result in higher effective tax rates. Depending on our consolidated level of profits, it is possible that the consolidated effective tax rate will exceed the then applicable statutory rates in any of the countries in which we operate.

Currency Fluctuations: In the third quarter of 2011 and 2010, approximately 85% and 91%, respectively, of our revenue was generated outside the United States. For both the nine months ended September 30, 2011 and 2010, approximately 91% of our revenue was generated outside of the United States.

In addition, in the third quarter of 2011 and 2010, approximately 81% and 76%, respectively, of our operating expenses were incurred outside the United States. For the nine months ended September 30, 2011 and 2010, approximately 82% and 79%, respectively, of our operating expenses were incurred outside of the United States.

Changes in currency exchange rates, especially the Euro to U.S. Dollar, can have a significant impact on revenue and expenses. In general, to minimize the net impact of currency fluctuations, we attempt to denominate our billings in a currency such that it would provide a hedge against the operating expenses being incurred in that currency. We expect that changes in currency rates may also impact our future results if we are unable to match amounts of revenue with our operating expenses in the same currency. In periods in which the U.S. Dollar is weakening, we expect that our

23

operating earnings will increase as a result of the change in currency exchange rates. Conversely, in periods in which the U.S. Dollar is strengthening, we expect that our operating earnings will decrease as a result of the change in currency exchange rates.

The U.S. Dollar weakened by approximately 12% and 7% against the Euro for the quarter and nine months ended September 30, 2011, respectively, compared to the same periods in 2010. The U.S. Dollar weakened 18% and 15% against the Australian Dollar for the quarter and nine months ended September 30, 2011, respectively, as compared to the same periods in 2010. We estimate that the changes in the exchange rate of the U.S. Dollar to these two currencies in 2011 compared to 2010 resulted in an increase in revenue and operating expenses of approximately $2,892 and $1,919, respectively, for the quarter ended September 30, 2011 and an increase in revenue and operating expenses of approximately $5,127 and $3,325, respectively, for the nine months ended September 30, 2011 compared to the same periods in 2010.

The financial position and results of operations of most of our foreign subsidiaries, with the exception of our subsidiaries in Switzerland and Singapore (in which the functional currency is the U.S. Dollar), are generally measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. Dollars using current exchange rates as of the balance sheet date. Translation adjustments arising from differences in exchange rates are included as a separate component of stockholders’ equity. Revenue and expenses are translated at average exchange rates prevailing during the period. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations in other non-operating income (expense). Foreign exchange transaction losses aggregating $583 and $525 in the third quarter and first nine months of 2011, respectively, compares to gains aggregating of $330 and $63 in the third quarter and first nine months of 2010, respectively.

Revenue

Revenue by Geographic Regions: We classify our sales by customers’ location in four geographic regions: 1) EMEA, which includes Europe, the Middle East and Africa; 2) the United States, which for our purposes includes sales in Canada; 3) Asia Pacific; and 4) Other Countries, including Australia, Latin America and Central Asia. The breakdown of revenue for the three and nine months ended September 30, 2011 and 2010 in each of our major geographic regions follows: