OneSpan Inc. - Quarter Report: 2016 September (Form 10-Q)

Table of Contents

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)

FOR THE QUARTERLY PERIOD ENDED SEPTEMBER 30, 2016

OR

FOR THE TRANSITION PERIOD FROM                      TO                     

Commission file number 000-24389

VASCO Data Security International, Inc.

(Exact Name of Registrant as Specified in Its Charter)

1901 South Meyers Road, Suite 210

Oakbrook Terrace, Illinois 60181

(Address of Principal Executive Offices)(Zip Code)

(630) 932-8844

(Registrant’s telephone number, including area code)

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.    ☒  Yes    ☐  No

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate Web site, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).    Yes  ☒    No  ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer or a smaller reporting company. See definition of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act.

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).    ☐  Yes    ☒  No

There were 40,196,944 shares of Common Stock, $.001 par value per share, outstanding at October 26, 2016.

Table of Contents

VASCO Data Security International, Inc.

Form 10-Q

For The Quarterly Period Ended September 30, 2016

Table of Contents

This report contains trademarks of VASCO Data Security International, Inc. and its subsidiaries, which include VASCO, the VASCO “V” design, DIGIPASS as a Service, MYDIGIPASS.COM, DIGIPASS, VACMAN, aXsGUARD, IDENTIKEY, CRONTO, and eSignLive

2

Table of Contents

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED BALANCE SHEETS

(in thousands, except per share data)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

3

Table of Contents

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except per share data)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

4

Table of Contents

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME

(in thousands)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

5

Table of Contents

VASCO Data Security International, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)

(unaudited)

See accompanying notes to condensed consolidated financial statements.

6

Table of Contents

VASCO Data Security International, Inc.

Notes to Condensed Consolidated Financial Statements

(All amounts are in thousands, except per share data)

(Unaudited)

Unless otherwise noted, references in this Quarterly Report on Form 10-Q to “VASCO,” “company,” “we,” “our,” and “us,” refer to VASCO Data Security International, Inc. and its subsidiaries.

Note 1 - Summary of Significant Accounting Policies

Nature of Operations

VASCO Data Security International, Inc. (“VASCO”) and its wholly owned subsidiaries design, develop, market and support hardware and software security systems that manage and secure access to information assets. VASCO has operations in Austria, Australia, Belgium, Brazil, Canada, China, France, India, Japan, The Netherlands, Singapore, Switzerland, the United Arab Emirates, the United Kingdom, and the United States (“U.S.”).

Basis of Presentation

The accompanying unaudited condensed consolidated financial statements include the accounts of VASCO and its subsidiaries and have been prepared pursuant to the rules and regulations of the Securities and Exchange Commission regarding interim financial reporting. Accordingly, they do not include all of the information and notes required by generally accepted accounting principles for complete financial statements and should be read in conjunction with the audited consolidated financial statements included in the company’s Annual Report on Form 10-K for the year ended December 31, 2015.

In the opinion of management, the accompanying unaudited condensed consolidated financial statements have been prepared on the same basis as the audited consolidated financial statements, and include all adjustments, consisting only of normal recurring adjustments, necessary for the fair presentation of the results of the interim periods presented. All significant intercompany accounts and transactions have been eliminated. The operating results for the interim periods presented are not necessarily indicative of the results expected for a full year.

Principles of Consolidation

The consolidated financial statements include the accounts of VASCO and its wholly owned subsidiaries. All significant intercompany accounts and transactions have been eliminated in consolidation.

During 2011, our wholly-owned Dutch subsidiary, DigiNotar B.V., was declared bankrupt. The court-appointed trustee is responsible for the business activities, administration and liquidation of DigiNotar B.V. Accordingly, related assets, liabilities and activities are reflected in discontinued operations.

Estimates and Assumptions

The preparation of financial statements in conformity with accounting principles generally accepted in the U.S. requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenue and expenses during the reporting period. Actual results could differ from those estimates.

Foreign Currency Translation and Transactions

The financial position and results of the operations of the majority of the company’s foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. Dollars using current exchange rates as of the balance sheet date. Revenue and expenses are translated at average exchange rates prevailing during the year. Translation adjustments arising from differences in exchange rates are charged or credited to other comprehensive income. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations in other income (expense).

The financial position and results of operations of our operations in Canada, Singapore and Switzerland are measured in U.S. Dollars. For these subsidiaries, gains and losses that result from foreign currency transactions are included in the consolidated statements of operations in other income (expense).

For the three and nine months ended September 30, 2016, foreign currency transactions resulted in a loss of $110 and gains of $152, respectively, compared to losses of $294 and $1,062 for the same periods in 2015.

7

Table of Contents

Revenue Recognition

We recognize revenue in accordance with Financial Accounting Standards Board (FASB) Accounting Standards Codification (ASC) 985-605, Software – Revenue Recognition, ASC 985-605-25, Revenue Recognition – Multiple Element Arrangements, and Staff Accounting Bulletin 104.

Revenue is recognized when there is persuasive evidence that an arrangement exists, delivery has occurred, the fee is fixed or determinable and collection of the revenue is probable.

In multiple-element arrangements, some of our products are accounted for under the software provisions of ASC 985-605 and others under the provisions that relate to the sale of non-software products.

In our typical multiple-element arrangement, the primary deliverables include:

Our multiple-element arrangements may also include other items that are usually delivered prior to the recognition of any revenue and incidental to the overall transaction, such as initialization of the hardware device, customization of the hardware device itself or the packaging in which it is delivered, deployment services where we deliver the device to our customer’s end-use customer or employee and, in some limited cases, professional services to assist with the initial implementation of a new customer.

In multiple-element arrangements that include a hardware client device, we allocate the selling price among all elements, delivered and undelivered, based on our internal price lists and the percentage of the selling price of that element, per the price list, to the total of the estimated selling price of all of the elements per the price list. Our internal price lists for both delivered and undelivered elements were determined to be reasonable estimates of the selling price of each element based on a comparison of actual sales made to the price list for each item delivered and to vendor specific objective evidence (“VSOE”) for undelivered items.

Undelivered elements primarily are PCS. The method by which we determine VSOE has validated that the price lists are reasonable estimates of the selling price for PCS. The estimated selling price of PCS items is based on an established percentage of the user license fee attributable to the specific software and is applied consistently to all PCS arrangements. The percentage we use to establish VSOE, which is also generally consistent with the percentage used in the price list, is developed using the “bell curve method”. Under this method, we conclude VSOE exists when a substantial majority of PCS renewals are within a narrow range of pricing.

In multiple-element arrangements that include a software client device, we account for each element under the standards of ASC 985-605 related to software. When software client device and host software are delivered elements, we use the Residual Method (ASC 605-25) for determining the amount of revenue to recognize for token and software licenses if we have VSOE for all of the undelivered elements. Any discount provided to the customer is applied fully to the delivered elements in such an arrangement. VSOE of fair value of PCS agreements is based on customer renewal transactions on a worldwide basis. In sales arrangements where VSOE of fair value has not been established, revenue for all elements is deferred and amortized over the life of the arrangement.

For transactions other than multiple-element arrangements, we recognize revenue as follows:

We recognize revenue from sales to distributors and resellers on the same basis as sales made directly to customers. We recognize revenue when there is persuasive evidence that an arrangement exists, delivery has occurred, the fee is fixed or determinable and collection of the revenue is probable.

8

Table of Contents

For large-volume transactions, we may negotiate a specific price that is based on the number of users of the software license or quantities of hardware supplied. The per unit prices for large-volume transactions are generally lower than transactions for smaller quantities and the price differences are commonly referred to as volume-purchase discounts.

All revenue is reported on a net basis, excluding any sales taxes or value added taxes.

Cash and Cash Equivalents

Cash and cash equivalents are stated at cost plus accrued interest, which approximates fair value. Cash equivalents are high-quality short term money market instruments and commercial paper, with original maturities of three months or less. Cash is held by a number of U.S. and non-U.S. commercial banks and money market investment funds.

Short Term Investments

Short term investments are stated at cost plus accrued interest, which approximates fair value. Short term investments consist of bank certificates of deposit and high quality commercial paper with original maturities of more than three and less than twelve months.

Accounts Receivable and Allowance for Doubtful Accounts

The creditworthiness of customers (including distributors and resellers) is reviewed prior to shipment. A reasonable assurance of collection is a requirement for revenue recognition. Verification of credit and/or the establishment of credit limits are part of the customer contract administration process. Credit limit adjustments for existing customers may result from the periodic review of outstanding accounts receivable. The company records trade accounts receivable at invoice values, which are generally equal to fair value.

We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make payments for goods and services. We analyze accounts receivable balances, customer credit-worthiness, current economic trends and changes in our customer payment timing when evaluating the adequacy of the allowance for doubtful accounts. The allowance is based on a specific review of all significant past-due accounts. If the financial condition of our customers deteriorate, resulting in an impairment of their ability to make payments, additional allowances may be required.

Inventories

Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the first-in-first-out (FIFO) method. We write down inventory when it appears that the carrying cost of the inventory may not be recovered through subsequent sale of the inventory. The company analyzes the quantity of inventory on hand, the quantity sold in the past year, the anticipated sales volume in the form of sales to new customers as well as sales to previous customers, the expected sales price and the cost of making the sale when evaluating the valuation of our inventory. If the sales volume or sales price of a specific model declines significantly, additional write downs may be required.

Property and Equipment

Property and equipment are stated at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the related assets ranging from three to seven years. Additions and improvements are capitalized, while expenditures for maintenance and repairs are charged to operations as incurred. Gains or losses resulting from sales, disposals, or retirements are recorded as incurred, at which time related costs and accumulated depreciation are removed from the accounts.

Goodwill and Other Intangibles

We account for goodwill and other intangible assets in accordance with ASC Topic 350-20, Goodwill and Other. Indefinite-lived intangible assets include patents and definite-lived intangible assets include proprietary technology, trademarks and other intangible assets. Intangible assets other than patents with definite lives are amortized over the useful life, generally three to seven years for proprietary technology. Patents are amortized over the life of the patent, generally 20 years in the U.S.

9

Table of Contents

We assess the impairment of goodwill and intangible assets with indefinite lives each November or whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors considered important which could trigger an impairment review include significant underperformance relative to expected historical or projected future operating results, significant changes in the manner of our use of the acquired assets or the strategy for our overall business, and significant negative industry or economic trends. In accordance with ASC 350, we consider the company to be one reporting unit. Fair value is determined using a market approach using our stock price which is a level 1 valuation, as defined by ASC 820, Fair Value Measurements. The amount of the impairment is computed by comparing carrying value of the assets to fair value. We did not recognize any impairment for the three and nine months ended September 30, 2016 as the fair value of our reporting unit substantially exceeded our carrying amount.

Research and Development Costs

Costs for research and development, principally the design and development of hardware, and the design and development of software prior to the determination of technological feasibility, are expensed as incurred on a project-by-project basis.

Software Development Costs

We capitalize software development costs in accordance with ASC 985-20, Costs of Software to be Sold, Leased, or Marketed. Research costs and software development costs, prior to the establishment of technological feasibility, determined based upon the creation of a working model, are expensed as incurred. Our software capitalization policy defines technological feasibility as a functioning beta test prototype with confirmed manufacturability (a working model), within a reasonably predictable range of costs. Additional criteria include receptive customers, or potential customers, as evidenced by interest expressed in a beta test prototype, at some suggested selling price. Our policy is to amortize capitalized costs by the greater of (a) the ratio that current gross revenue for a product bears to the total of current and anticipated future gross revenue for that product or (b) the straight-line method over the remaining estimated economic life of the product, generally two to five years, including the period being reported on. No software development costs were capitalized during the three and nine months ended September 30, 2016.

Income Taxes

We account for income taxes under the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases and operating loss and tax credit carryforwards. We measure deferred tax assets and liabilities using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. We recognize the effect of a change in tax rates on deferred tax assets and liabilities in income in the period that includes the enactment date.

We monitor our potential income tax exposures as required by ASC 740-10, Income Taxes.

We have significant foreign tax credit, net operating loss, and other deductible carryforwards in certain jurisdictions available to reduce the liability on future taxable income. A valuation reserve has been provided to offset some of these future benefits because we have not determined that their realization is more likely than not.

Fair Value of Financial Instruments

At September 30, 2016 and December 31, 2015, our financial instruments were cash equivalents, short term investments, accounts receivable, accounts payable and accrued liabilities. The estimated fair value of our financial instruments has been determined using level one inputs as defined in ASC 820, Fair Value Measurements and Disclosures. The fair values of the financial instruments were not materially different from their carrying amounts at September 30, 2016 and December 31, 2015.

Accounting for Leases

All of our leases are operating leases. Rent expense on facility leases is charged evenly over the life of the lease, regardless of the timing of actual payments.

Stock-Based Compensation

We have stock-based employee compensation plans, described in Note 9. ASC 718-10, Stock Compensation requires us to estimate the fair value of restricted stock granted to employees, directors and others and to record compensation expense equal to the estimated fair value. Compensation expense is recorded on a straight-line basis over the vesting period.

10

Table of Contents

Warranty

Warranties are provided on the sale of certain of our products and an accrual for estimated future claims is recorded at the time revenue is recognized. We estimate the cost based on past claims experience, sales history and other considerations. We regularly assess the adequacy of our estimates and adjust the amounts as necessary. Our standard practice is to provide a warranty on our hardware products for either a one or two-year period after the date of purchase. Customers may purchase extended warranties covering periods from one to four years after the standard warranty period. We defer the revenue associated with the extended warranty and recognize it into income on a straight-line basis over the extended warranty period. We have historically experienced minimal actual claims over the warranty period.

Recently Issued Accounting Pronouncements

In November 2015, the FASB issued Accounting Standards Update No. 2015-17, Balance Sheet Classification of Deferred Taxes, (ASU 2015-17), requiring deferred tax liabilities and assets be classified as non-current in a classified statement of financial position. The ASU is effective for annual periods beginning after December 15, 2015 and interim periods within such annual periods. We have adopted ASU 2015-17 prospectively in our consolidated financial statements as of January 1, 2016. Prior periods were not retrospectively adjusted.

In September 2015, the FASB issued Accounting Standards Update No. 2015-16, Simplifying the Accounting for Measurement-Period Adjustments, (ASU 2015-16), which eliminates the requirement for an acquirer to retrospectively adjust the financial statements for measurement-period adjustments that occur in periods after a business combination is consummated. The ASU is effective for annual periods beginning after December 15, 2015 and interim periods within such annual periods and applies prospectively to adjustments to provisional amounts that occur after the effective date. We have adopted ASU 2015-16 in our consolidated financial statements as of January 1, 2016. Measurement period adjustments identified subsequent to December 31, 2015, for the eSignLive Acquisition, further described in Note 4 to the Consolidated Financial Statements, will be recorded and disclosed in accordance with ASU 2015-16.

In May 2014, the FASB issued Accounting Standards Update No. 2014-09, Revenue from Contracts with Customers (ASU 2014-09), which supersedes nearly all existing revenue recognition guidance under U.S. GAAP. The core principle of ASU 2014-09 is to recognize revenues when promised goods or services are transferred to customers in an amount that reflects the consideration to which an entity expects to be entitled for those goods or services. ASU 2014-09 defines a five step process to achieve this core principle and, in applying such process, more judgment and estimates may be required within the revenue recognition process than are required under existing U.S. GAAP.

ASU 2014-09 is effective for annual periods beginning after December 15, 2016, and interim periods within such annual periods, using either of the following transition methods: (i) a full retrospective approach reflecting the application of the standard in each prior reporting period with the option to elect certain practical expedients, or (ii) an approach with the cumulative effect of initially adopting ASU 2014-09 recognized at the date of adoption (which includes additional footnote disclosures).

In August 2015, the FASB issued Accounting Standards Update No. 2015-14, Revenue from Contracts with Customers: Deferral of Effective Date deferring the new revenue standard one year and allowing adoption as of the original effective date.

We are currently evaluating the impact of our pending adoption of ASU 2014-09 and ASU 2015-14 on our consolidated financial statements and have not yet determined the method by which we will adopt the standard.

On March 17, 2016, the FASB issued Accounting Standards Update No. 2016-08, Revenue from Contracts with Customers - Principal versus Agent Considerations (Reporting Revenue Gross versus Net) (ASU 2016-08), which provides guidance on assessing whether an entity is a principal or an agent in a revenue transaction and whether an entity reports revenue on a gross or net basis. On April 14, 2016, the FASB issued Accounting Standards Update No. 2016-10, Revenue from Contracts with Customers - Identifying Performance Obligations and Licensing (ASU 2016-10), which provides guidance on identifying performance obligations and accounting for licenses of intellectual property. The effective date and transition requirements for ASU 2016-08 and ASU 2016-10 are the same as the effective date and transition requirements of ASU 2014-09. We are evaluating the effect that ASU 2016-08 and ASU 2016-10 will have on our consolidated financial statements and related disclosures

In February 2016, The FASB issued Accounting Standards Update No. 2016-02, Leases, which among other things, requires lessees to recognize most leases on the balance sheet. ASU 2016-02 is effective for annual and interim periods in fiscal years beginning after December 15, 2018 and mandates a modified retrospective transition method. We are currently evaluating the impact of ASU 2016-02 on our consolidated financial statements.

On March 30, 2016, the FASB issued ASU 2016-09, Improvements to Employee Share-Based Payment Accounting, to improve accounting for share-based payment transactions as part of the FASB’s simplification initiative. The ASU changes certain aspects of accounting for share-based payment award transactions, including: (1) recognition of excess tax benefits and tax deficiencies as

11

Table of Contents

income tax expense or benefit instead of additional paid-in capital; (2) classification of excess tax benefits on the statement of cash flows. The other provisions of ASU 2016-09 are immaterial to the Company. ASU 2016-09 is effective for fiscal years beginning after December 15, 2016. Early adoption is permitted. We have early adopted ASU 2016-09 in our consolidated financial statements as of January 1, 2016 and applicable aspects described were adopted prospectively. Prior periods were not retrospectively adjusted.

The adoption of ASU 2016-09 had no impact on results for the three months ended September 30, 2016. For the nine months ended September 30, 2016 adoption of ASU 2016-09 resulted in an increase to the tax provision of $184 that would have otherwise been credited to additional paid in capital. Similarly, for the nine months ended September 30, 2016, as a result of the adoption of ASU 2016-09, cashflows from operating activities decreased $184 and cash flows from financing activities increased by the same amount. The impact of this ASU on future periods is dependent on our stock price at the time restricted stock awards vest.

Note 2 - Inventories

Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the FIFO method.

Inventories are comprised of the following:

Note 3 – Discontinued Operations

During 2011, our wholly-owned Dutch subsidiary, DigiNotar B.V., was declared bankrupt. The court-appointed trustee is responsible for the business activities, administration and liquidation of DigiNotar B.V. Accordingly, related assets, liabilities and activities are reflected in discontinued operations.

The loss from discontinued operations, net of tax, for the three and nine months ended September 30, 2016 was $16 and $17, respectively, compared to $4 and $42 for the same periods in 2015.

At September 30, 2016 and December 31, 2015, assets of discontinued operations consist of the following:

Note 4 – Acquisition of eSignLive

On November 25, 2015, the Company completed its acquisition of Silanis Technology, Inc. (“eSignLive”), a privately-held provider of electronic signature and digital transaction solutions used to sign, send, and manage documents. Pursuant to the arrangement agreement, we acquired all of the issued and outstanding shares of eSignLive for an aggregate purchase price of $75,000. The aggregate purchase price may be subject to further adjustment as provided in the arrangement agreement.

12

Table of Contents

Upon acquisition, eSignLive became our wholly-owned subsidiary. The acquisition is accounted for as a business combination using the acquisition method accounting in accordance with FASB ASC Topic No. 805, Business Combinations, whereby the net assets acquired are recognized based on their estimated fair values on the acquisition date.

Aggregate Purchase Price Allocation

The Company initially recognized the acquired assets and liabilities based on preliminary estimates of acquisition date fair values. The initial aggregate purchase price allocation is described in Note 4 of our Audited Consolidated Financial Statements for the year ended December 31, 2015. As additional information becomes known concerning the acquired assets and assumed liabilities, management may make adjustments to the opening balance sheet of the acquired company up to the end of the measurement period, which is no longer than a one-year period following the acquisition date. The determination of the fair values of the acquired assets and liabilities assumed (and the related determination of estimated lives of depreciable tangible and identifiable intangible assets) requires significant judgment. As of September 30, 2016, the Company has not completed its fair value analysis and calculations in sufficient detail necessary to arrive at the final estimates of the fair value of certain working capital and non-working capital acquired assets and assumed liabilities, including the allocations to goodwill and intangible assets, deferred revenue and resulting deferred taxes. All information presented with respect to certain working capital and non-working capital acquired assets and liabilities assumed as it relates to these acquisitions is preliminary and subject to revision pending the final fair value analysis.

As of September 30, 2016, the estimated acquisition-date fair value preliminary estimated purchase price allocation is summarized in the following table:

In the three months ended March 31, 2016, a measurement period adjustment was recorded related to the valuation allowance for acquired deferred tax assets. The valuation allowance was reduced from amounts previously reported as of December 31, 2015 by $9,146 thereby reducing goodwill by the same amount. The measurement period adjustment resulted in a provision for income taxes of $311 for the three months ended March 31, 2016. Had the change in the valuation allowance been recorded as of the acquisition date, the provision for income taxes of $311 would have been recorded in prior periods.

The excess of purchase consideration over net assets assumed was recorded as goodwill, which represents the strategic value assigned to eSignLive, including expected benefits from synergies resulting from the acquisition, as well as the knowledge and experience of the workforce in place. In accordance with applicable accounting standards, goodwill is not amortized and will be tested for impairment at least annually, or more frequently, if certain indicators are present. Goodwill and intangible assets related to this acquisition are not deductible for tax purposes.

Based on preliminary estimates of the acquisition valuation, $30,000 of the purchase price has been allocated to identifiable intangible assets. The following table summarizes the major classes of intangible assets, as well as the respective estimated weighted-average amortization periods:

13

Table of Contents

Note 5 – Goodwill

Goodwill activity for the nine months ended September 30, 2016 consisted of the following:

Certain portions of goodwill are denominated in local currencies and are subject to currency fluctuations.

Note 6 – Intangible Assets

Intangible asset activity for the nine months ended September 30, 2016 is detailed in the following table.

14

Table of Contents

Certain intangible assets are denominated in local currencies and are subject to currency fluctuations.

Note 7 – Income Taxes

Our effective tax rate for 2016 before discrete items is expected to be 28%. This is lower than the U.S. statutory rate primarily due to income in foreign jurisdictions taxed at lower rates, partially offset by valuation allowances on taxable losses. Discrete items related to the 2015 federal tax return, the measurement period adjustment described in Note 4, and changes to tax rates on deferred tax liabilities increase the full-year 2016 effective rate to 37%. The effective tax rate for the third quarter was 61%.

Our effective tax rate for the three and nine months ended September 30, 2015 was 17% and 15%, respectively. The tax rate was lower than the U.S. statutory rate primarily due to income in foreign jurisdictions taxed at lower rates partially offset by valuation allowances on taxable losses.

At December 31, 2015, we had foreign tax credit carryforwards of $2,835 for future U.S. tax returns. These foreign tax credits expire in 2023. We have not provided a valuation reserve for the foreign tax credits as we believe it is more likely than not that they will be realized.

At December 31, 2015, we had Canadian net operating loss (NOL) carryforwards of $28,691 and other Canadian deductible carryforwards of $21,682. The Canadian NOL carryforwards expire from 2027 to 2035 and the other deductible carryforwards have no expiration. At December 31, 2015, we had a valuation allowances of $7,379 for the NOL carryforwards and $4,184 for the other deductible carryforwards.

At December 31, 2015, we had other foreign NOL carryforwards of $3,850, other foreign deductible carryforwards of $2,846, and U.S. state NOL carryforwards of $4,853. The foreign NOL carryforwards have no expiration. The other deductible carryforwards expire from 2016 to 2021. The U.S. state NOL carryforwards expire from 2019 to 2027. At December 31, 2015, we had a valuation allowance of $2,023 for certain foreign deferred tax assets and $133 for a U.S. state NOL carryforward.

Note 8 – Warranties

We maintain a reserve for potential warranty claims related to products sold and recognized in revenue. We regularly reassess the adequacy of our estimates and adjust the amounts as necessary. Our warranty reserve is included in other accrued expenses.

15

Table of Contents

The activity in our warranty liability was as follows:

At September 30, 2016, deferred revenue from extended warranties was $43.

Note 9 – Long-Term Compensation Plan and Stock Based Compensation

Under the VASCO Data Security International, Inc. 2009 Equity Incentive Plan (“2009 Equity Incentive Plan”), we awarded 264 shares of restricted stock in the first nine months of 2016 consisting of 234 unissued shares subject to future performance criteria and 30 issued shares. The market value of the 30 issued restricted shares of $500 at the date of grant is being amortized over the respective vesting periods of one to four years. The 234 unissued shares subject to performance criteria have a market value of $3,891 at the date of grant and vesting periods of one to three years.

The following table details long-term compensation plan and stock-based compensation expense for the three and nine months ended September 30, 2016 and 2015:

Note 10 – Common Stock and Earnings per Share

In connection with the 2009 Equity Incentive Plan, during the nine months ended September 30, 2016, we issued 90 total shares of restricted common stock, 30 shares for awards granted in the first nine months of 2016 and 60 performance shares related to awards provisioned in prior years.

Basic earnings per share is based on the weighted average number of shares outstanding and excludes the dilutive effect of common stock equivalents. Diluted earnings per share is based on the weighted average number of shares outstanding and includes the dilutive effect of common stock equivalents to the extent they are not anti-dilutive. The details of the earnings per share calculations for the three and nine months ended September 30, 2016 and 2015 follow:

16

Table of Contents

Note 11 – Contingencies

During the second quarter of 2015, our management became aware that certain of our products which were sold by our European subsidiary to a third-party distributor may have been resold by the distributor to parties in Iran, potentially including parties whose property and interests in property may be blocked pursuant to Executive Order 13224, Executive Order 13382 or that may be identified under Section 560.304 of 31 C.F.R. Part 560 as the “Government of Iran”.

We ceased shipping to such distributor. In addition, the Audit Committee of the Company’s Board of Directors initiated an internal review of this matter with the assistance of outside counsel. As a precautionary matter, concurrent initial notices of voluntary disclosure were submitted on June 25, 2015 to each of the U.S. Department of the Treasury, Office of Foreign Assets Control (“OFAC”), and the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”).

The Audit Committee with the assistance of outside counsel has completed their review. On December 15, 2015, we filed a letter with BIS (Office of Export Enforcement) with the conclusion that the products supplied to the distributor were not subject to United States Export Control jurisdiction. The Office of Export Enforcement issued a “no action” letter, concluding the voluntary self-disclosure process under the Export Administration Regulations.

On January 13, 2016, we filed a letter with OFAC, with the conclusions that VASCO and its subsidiaries made no direct sales to Iran or any party listed by OFAC as a Specially Designated National over the five-year period under review (i.e., June 1, 2010 to June 30, 2015). The letter further noted that the investigation did not identify any involvement on the part of senior management officials of VASCO, and to the contrary, noted that VASCO executive management officials had sought to implement procedures and provided notices to VASCO’s sales personnel to prevent the diversion of VASCO products to unauthorized destinations and end users.

We have not received any response to the letter to OFAC and we cannot predict when OFAC will conclude their review of our voluntary self-disclosures. Based upon the OFAC guidelines for monetary penalties, in the fourth quarter of 2015, we accrued $900 for potential penalties if they are assessed by OFAC. Ultimately no penalty may be assessed or the penalty may be less or greater than the accrual, but in any event we do not believe that the final settlement will have a material adverse impact on our business.

17

Table of Contents

On July 28, 2015 a putative class action complaint was filed in the United States District Court for the Northern District of Illinois, captioned Linda J. Rossbach v. Vasco Data Security International, Inc., et al., case number 1:15-cv-06605, naming VASCO and certain of its current and former executive officers as defendants and alleging violations under the Securities Exchange Act of 1934, as amended. The suit was purportedly filed on behalf of a putative class of investors who purchased VASCO securities between February 18, 2014 and July 21, 2015, and seeks to recover damages allegedly caused by the defendants’ alleged violations of the federal securities laws and to pursue remedies under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 promulgated thereunder. The complaint seeks certification as a class action and unspecified compensatory damages plus interest and attorneys’ fees. Pursuant to a September 1, 2015 scheduling order entered by the court, the lead plaintiff, once appointed, will have sixty days to file an amended complaint or notify the defendants that the lead plaintiff intends to rely on the current complaint. The defendants will then have sixty days to answer or otherwise respond to the operative complaint. To date, the court has not made any rulings with respect to the appointment of the lead plaintiff. Although the ultimate outcome of litigation cannot be predicted with certainty, the Company believes that this lawsuit is without merit and intends to defend against the action vigorously.

On October 9, 2015, a derivative complaint was filed in the United States District Court for the Northern District of Illinois, captioned Elizabeth Herrera v. Hunt, et al., case number 1:15-cv-08937, naming VASCO’s Board of Directors and certain of its current and former executive officers as individual defendants and the Company as a nominal defendant. Two additional derivative complaints, captioned Beth Seltzer v. Hunt, et al., case number 2015-ch-15541 and William Hooper v. Hunt, et al., case number 2016-ch-04054, were filed on October 22, 2015 and March 22, 2016, respectively, in the Circuit Court of Cook County, Illinois naming the same defendants.

The complaints assert, among other things, that the individual defendants breached their fiduciary duties by making material misstatements in, and omitting material information from, the Company’s public disclosures and by failing to maintain adequate internal controls and properly manage the Company. Among other things, the complaints seek unspecified compensatory damages and injunctive relief. On February 23, 2016, the court in Herrera granted a stay of the action pending the resolution of a certain motion to dismiss that the parties anticipate to be filed in Rossbach. On October 29, 2015, a defendant removed the Seltzer action to the United States District Court for the Northern District of Illinois. Thereafter, the plaintiff led a motion to remand the action back to the Circuit Court of Cook County, Illinois, which was denied on February 3, 2016. On February 9, 2016, the court granted an agreed motion for voluntary dismissal of the Seltzer action, which dismissed the action with prejudice as to the named plaintiff’s individual claims. As for the Hooper action, the court granted a stay on June 8, 2016 on the same terms governing the stay in the Herrera action.

18

Table of Contents

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations (in thousands, except headcount, ratios, time periods and percentages)

Unless otherwise noted, references in this Quarterly Report on Form 10-Q to “VASCO,” “company,” “we,” “our,” and “us” refer to VASCO Data Security International, Inc. and its subsidiaries.

Cautionary Note Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q, including Management’s Discussion and Analysis of Financial Condition and Results of Operations and Quantitative and Qualitative Disclosures About Market Risk contains forward-looking statements within the meaning of Section 21E of the Securities Exchange Act of 1934, as amended and Section 27A of the Securities Act of 1933, as amended concerning, among other things, our expectations regarding the prospects of, and developments and business strategies for, VASCO and our operations, including the development and marketing of certain new products and services and the anticipated future growth in certain markets in which we currently market and sell our products and services or anticipate selling and marketing our products or services in the future. These forward-looking statements (1) are identified by use of terms and phrases such as “expect”, “believe”, “will”, “anticipate”, “emerging”, “intend”, “plan”, “could”, “may”, “estimate”, “should”, “objective”, “goal”, “possible”, “potential”, “projected” and similar words and expressions, but such words and phrases are not the exclusive means of identifying them, and (2) are subject to risks and uncertainties and represent our present expectations or beliefs concerning future events. VASCO cautions that the forward-looking statements are qualified by important factors that could cause actual results to differ materially from those in the forward-looking statements. These additional risks, uncertainties and other factors have been described in greater detail in our Annual Report on Form 10-K for the year ended December 31, 2015 and include, but are not limited to, (a) risks of general market conditions, including currency fluctuations and the uncertainties resulting from turmoil in world economic and financial markets, (b) risks inherent to the computer and network security industry, including rapidly changing technology, evolving industry standards, increasingly sophisticated hacking attempts, increasing numbers of patent infringement claims, changes in customer requirements, price competitive bidding, and changing government regulations, and (c) risks specific to VASCO, including, demand for our products and services, competition from more established firms and others, pressures on price levels and our historical dependence on relatively few products, certain suppliers and certain key customers. These risks, uncertainties and other factors include the risk that VASCO will not integrate eSignLive into the business of VASCO successfully and the amount of time and expense spent and incurred in connection with the integration; the risk that the revenue synergies, cost savings and other economic benefits that VASCO anticipates as a result of the acquisition are not fully realized or take longer to realize than expected. Thus, the results that we actually achieve may differ materially from any anticipated results included in, or implied by these statements. Except for our ongoing obligations to disclose material information as required by the U.S. federal securities laws, we do not have any obligations or intention to release publicly any revisions to any forward-looking statements to reflect events or circumstances in the future or to reflect the occurrence of unanticipated events.

General

The following discussion is based upon our consolidated results of operations for the three and nine months ended September 30, 2016 and 2015 (percentages in the discussion, except for returns on average net cash balances, are rounded to the closest full percentage point) and should be read in conjunction with our consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

We design, develop, market and support both proprietary and open standards-based hardware and software security systems that manage and secure access to information assets. We also design, develop, market, and support patented strong user authentication products and services for e-business and e-commerce. Our products enable secure financial transactions to be made over private enterprise networks and public networks, such as the Internet. Our strong user authentication is delivered via our hardware and software DIGIPASS security products (collectively “DIGIPASSES”), many of which incorporate an electronic and digital signature capability, which further protects the integrity of electronic transactions and data transmissions. Many of our software DIGIPASSES are focused on the mobile platform and can be downloaded directly to mobile devices, such as DIGIPASS for Mobile, while others are integrated directly into mobile applications (using DIGIPASS for Apps) that are downloaded onto mobile devices. Some of our DIGIPASSES are compliant with the Europay MasterCard VISA (“EMV”) standard and are compatible with MasterCard’s and VISA’s Chip Authentication Program (“CAP”). Some of our DIGIPASSES comply with the Initiative for Open Authentication (“OATH”). As evidenced by our current customer base, most of our products are purchased by businesses and, depending on the business application, are distributed to either their employees or their customers. Those customers may be other businesses or, as an example in the case of Internet and mobile banking, our customer banks’ corporate and retail customers. Our target market is any business process that uses some form of electronic interface, particularly the Internet, where the owner of that process is at risk if unauthorized users can gain access to its process and either obtain proprietary information or execute transactions that are not

19

Table of Contents

authorized. Our products can not only increase the security associated with accessing the business process, thereby reducing the losses from unauthorized access, but also, in many cases, can reduce the cost of the process itself by automating activities that were previously performed manually.

We offer our products either through: (a) a product sales and licensing model or (b) through our services platform, which includes our cloud-based service offering, DIGIPASS as a Service (“DPaaS”) or MYDIGIPASS (“MDP”) or together (“DPaaS/MDP”). Our product license and sales model is expected to be used in situations where the application owner wants to control all of the critical aspects of the authentication process. We expect that our services platform will be used by: (a) companies lacking technical resources or expertise to implement a full authentication process or preferring to focus their primary attention on other aspects of their business rather than on the authentication process or (b) companies that want to verify identities through our platform or (c) consumers that are aware of the dangers posed by identity theft.

Industry Growth: We do not believe that there are any accurate measurements of the total industry’s size or the industry’s growth rate. We believe, however, that the industry using our product sales and licensing model will grow at a significant rate as the use of the internet increases and the awareness of the risks of using the internet become more prevalent among application owners. We also believe that a market will develop for our cloud-based service offering and grow at a significant rate as business owners and consumers become more aware of the risks involved in conducting business over the internet. We expect that growth will be driven by new government regulations, growing awareness of the impact of cyber-crime, and the growth in commerce that is transacted electronically. The issues driving the growth are global issues and the rate of adoption in each country is a function of that country’s culture, the competitive position of businesses operating in that country, the country’s overall economic conditions and the degree to which businesses and consumers within the country use technology.

Economic Conditions: Our revenue may vary significantly with changes in the economic conditions in the countries in which we currently sell products. With our current concentration of revenue in Europe and specifically in the banking and finance vertical market, significant changes in the economic outlook for the European Banking market may have a significant effect on our revenue.

There continues to be significant global economic uncertainty, including Europe, our most important market. While the European Union and European Central Bank continue to implement programs in response to changing economic conditions, Europe continues to struggle with sovereign debt issues and weakening currencies. As a result, Europe may continue to face difficult economic conditions in 2016. Should the sovereign debt issue escalate, economic difficulties may negatively impact the global economy and our business.

We believe economic conditions in Europe may limit our growth opportunities in the Enterprise and Application Security market.

During June 2016, voters in the United Kingdom passed a referendum providing for withdrawal from the European Union. While customer revenues from the United Kingdom and transactions denominated in British pounds are not significant, uncertainty surrounding withdrawal of the United Kingdom from the European Union may be a negative influence on normal ordering patterns within the European Banking market.

The European Banking market has been challenged by weak economic conditions and increased regulatory and risk mandates. Strategic priorities of many banks include improving efficiencies, and addressing regulatory and risk issues. To improve efficiencies, many banks have significantly reduced headcount while pursuing enhanced online and mobile customer services. Bank regulation periodically addresses enhanced cyber and data security. We believe our products are well positioned for online and mobile offerings and provide enhanced security, however, economic conditions, reduced headcount, and the transitioning of priorities may cause disruption in normal ordering patterns.

In the three and nine months ended September 30, 2016, revenue from our Europe, Middle East and Africa (“EMEA”) region, accounted for 54% and 50%, respectively of total revenue as compared to 66% and 70% for the same periods of 2015. The decrease in revenue from our EMEA region in the third quarter and first nine months of 2016 reflected delivery of a significant amount of card readers using our CRONTO technology to Rabobank in 2015.

Cybersecurity: Our use of technology is increasing and is critical in three primary areas of our business:

We believe that the risks and consequences of potential incidents in each of the above areas are different.

20

Table of Contents

In the case of the information systems we use to help us run our business, we believe that an incident could disrupt our ability to take orders or deliver product to our customers, but such a delay in these activities would not have a material impact on our overall results. To minimize this risk, we actively use various forms of security and monitor the use of our systems regularly to detect potential incidents as soon as possible.

In the case of products that we have traditionally sold, we believe that the risk of a potential cyber incident is minimal. We offer our customers the ability to either create the secret numbers themselves or have us create the numbers on their behalf. When asked to create the numbers, we do so in a secure environment with limited physical access and store the numbers on a system that is not connected to any other network, including other VASCO networks, and similarly, is not connected to the internet.

In the case of our new products and services, which involve the active daily processing of the secret numbers on our servers or servers managed by others in a hosted environment, we believe a cyber incident could have a material impact on our future business. We also believe that these products may be more susceptible to cyber-attacks than our traditional products since it involves the active processing of transactions using the secret numbers. While we do not have a significant amount of revenue from these products today, we believe that these products have the potential to provide substantial future growth. A cyber incident involving these products in the future could substantially impair our ability to grow the business and we could suffer significant monetary and other losses and significant reputational harm.

To minimize the risk, we regularly review our security procedures. Reviews include current processes and software programs, new forms of cyber incidents, and software programs that mitigate risk of incidents. Certain insurance coverages may apply to certain cyber incidents. Overall, we expect the cost of securing our networks will increase in future periods, whether through increased staff, systems or insurance coverage.

Income Taxes: Our effective tax rate reflects our global structure related to the ownership of our intellectual property (“IP”). All our IP is owned by three subsidiaries, one in the U.S., one in Switzerland, and one in Canada. The U.S. and Swiss subsidiaries have entered into agreements with most of the other VASCO entities under which those other entities provide services to our U.S. and Swiss subsidiaries on either a percentage of revenue or on a cost plus basis or both. Under this structure, the earnings of our service provider subsidiaries are relatively constant. These service provider companies tend to be in jurisdictions with higher effective tax rates. Fluctuations in earnings tend to flow to the U.S. company and the Swiss company. Earnings flowing to the U.S. company are expected to be taxed at a rate of 34% to 40%, while earnings flowing to the Swiss company are expected to be taxed at a rate ranging from 10 % to 12%. The Canadian subsidiary currently sells and services directly to global customers.

With the majority of our revenues being generated outside of the U.S., our consolidated effective tax rate is strongly influenced by the effective tax rate of our foreign operations. Changes in the effective rate related to foreign operations reflect changes in the geographic mix of where the earnings are realized and the tax rates in each of the countries in which it is earned. The statutory tax rates for the primary foreign tax jurisdictions range from 8% to 34%.

The geographic mix of earnings of our foreign subsidiaries will primarily depend on the level of our service provider subsidiaries’ pretax income, which is recorded as an expense by the U.S. and Swiss subsidiaries and the benefit that is realized in the U.S. and Switzerland through the sales of product. The level of pretax income in our service provider subsidiaries is expected to vary based on:

For items 1 and 2 above, there is a direct impact in the opposite direction on earnings of the U.S. and Swiss entities. Any change from item 3 is generally expected to result in a larger change in income in the U.S. and Swiss entities in the direction of the change (increased revenues expected to result in increased margins/pretax profits and conversely decreased revenues expected to result in decreased margins/pretax profits).

In addition to the provision of services, the intercompany agreements transfer the majority of the business risk to our U.S. and Swiss subsidiaries. As a result, the contracting subsidiaries’ pretax income is reasonably assured while the pretax income of the U.S. and Swiss subsidiaries varies directly with our overall success in the market.

In November 2015, we acquired Silanis Technology Inc. (“eSignLive”), a foreign company with substantial IP and net operating loss and other tax carryforwards. The tax benefit of the carryforwards, net of deferred tax liabilities, has been fully reserved as realization has not been deemed more likely than not. In the event eSignLive continues to generate losses, the impact will be to increase our effective tax rate.

21

Table of Contents

Comparison of Results for the Three and Nine Months Ended September 30, 2016 and 2015

Currency Fluctuations: In the third quarter and first nine months of 2016, approximately 85% and 88%, respectively of our revenue was generated outside the United States. While the majority of our revenues are generated outside of the United States, the majority of our revenue in the third quarter and first nine months of 2016 were denominated in U.S. Dollars. We estimate that 64% and 71% of our revenues were denominated in U.S. Dollars in the third quarter and first nine months of 2016. In addition, in the third quarter and first nine months of 2016, approximately 78% and 79%, respectively, of our operating expenses were generated outside of the United States. As a result, changes in currency exchange rates, especially from the Euro to U.S. Dollar, can have a significant impact on revenue and expenses.

In general, to minimize the net impact of currency fluctuations on operating income, we attempt to denominate an amount of billings in a currency such that it would provide a hedge against the operating expenses being incurred in that currency. We expect that changes in currency rates may also impact our future results if we are unable to match amounts of revenue with our operating expenses in the same currency. If the amount of our revenue in Europe denominated in Euros continues as it is now or declines, we do not expect that we will be able to balance fully the exposures of currency exchange rates on revenue and operating expenses.

The Euro, on average, strengthened against the U.S. Dollar approximately 0.6% for the quarter, and weakened 0.8% for the nine months ended September 30, 2016, as compared to the same periods in 2015. We estimate that the change in currency rates in 2016 compared to 2015 resulted in an increase in revenue of approximately $165 and decrease of approximately $281 for the quarter and nine months ended September 30, 2016, respectively, compared to the same periods in 2015 and a decrease in operating expenses of approximately $7 for the quarter and $638 for the nine months ended September 30, 2016, respectively, compared to the same periods in 2015.

The financial position and the results of operations of most of our foreign subsidiaries, with the exception of our subsidiaries in Canada, Switzerland, and Singapore, are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. Dollars using current exchange rates as of the balance sheet date. Revenues and expenses are translated at average exchange rates prevailing during the period. Translation adjustments arising from differences in exchange rates generated other comprehensive gains of $7 and losses of $425, for the third quarter and first nine months of 2016, respectively, compared to losses of $10 and $2,272 for the same periods in 2015. These amounts are included as a separate component of stockholders’ equity. The functional currency for our subsidiaries in Canada, Switzerland and Singapore is the U.S. Dollar.

Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations in other non-operating income (expense). Foreign exchange transaction losses aggregating $110 in the third quarter of 2016 compare to exchange losses of $294 in the third quarter of 2015. Foreign exchange transaction gains aggregating $152 in the first nine months of 2016 compare to transaction losses of $1,062 in the first nine months of 2015.

Revenue

Revenue by Geographic Regions: We classify our sales by customers’ location in four geographic regions: 1) EMEA, which includes Europe, the Middle East and Africa; 2) the United States, which for our purposes includes sales in Canada; 3) Asia Pacific; and 4) Other Countries, including Australia, Latin America and India. The breakdown of revenue in each of our major geographic areas was as follows:

22

Table of Contents

Total revenue in the third quarter of 2016 decreased $16,379, or 27%, from the third quarter of 2015. For the first nine months of 2016, total revenue decreased $45,848 or 24% from the first nine months of 2015. These differences are largely attributed to revenues from card readers sold to Rabobank during the third quarter and first nine months of 2015. Revenues from all other customers, excluding eSignLive, decreased 5.1% for the third quarter of 2016 as compared to the third quarter of 2015, and increased by 2% for the first nine months of 2016 as compared to the same period in 2015.

Please see the discussion below under “Revenue by Target Market” for additional information regarding the changes in revenue from the Banking and the Enterprise and Application Security markets.

Revenue generated in EMEA during the third quarter of 2016 was $22,829, or 42%, lower than the third quarter of 2015. For the first nine months, revenue generated in EMEA was $71,915, or 46% lower than the first nine months of 2015. The decrease in revenues in both the third quarter and first nine months of 2016 compared to the same periods in 2015, results from the sale of card readers to Rabobank discussed above are recorded as EMEA revenue. Revenues from all other customers increased $1,469, or 7% for the third quarter of 2016 as compared to the third quarter of 2015, and decreased $3,402, or 5% for the first nine months of 2016 as compared to the same period in 2015.

Revenue generated in the United States for the third quarter was $6,559, or 160%, higher than the third quarter of 2015. For the first nine months, revenue generated in the United States was $16,773, or 104% higher than the first nine months of 2015. Excluding the impact of the eSignLive acquisition, revenues increased $315, or 12% for the third quarter of 2016 as compared to the third quarter of 2015, and decreased $282, or 3% for the first nine months of 2016 as compared to the same period in 2015.

Revenue generated in the Asia Pacific region during the third quarter of 2016 was $11,548, or 5%, lower than the third quarter of 2015. For the first nine months of 2016 revenue was $45,126, or 31% higher than the first nine months of 2015.

Revenue generated from Other Countries during the third quarter of 2016 was $2,712, or 54%, lower than the third quarter of 2015. For the first nine months of 2016 revenue was $10,893, or 30%, lower than the first nine months of 2015.

Revenue by Target Market: Revenue is generated currently from two primary markets, Banking and Enterprise and Application Security, through the use of both direct and indirect sales channels. The Enterprise and Application Security market includes products used by employees of corporations to secure their internal networks (i.e., enterprise security market) and business-to-business, business-to-consumer, e-commerce, e-government, e-gaming and other vertical applications (i.e., the application security market) that are not related to banking or finance. In addition, revenue from services-related activities, such as maintenance and support are included in the Enterprise and Application Security markets. Management currently views the Enterprise and Application Security market as one market because the same products are sold through the same channels to both customer groups. Sales to the Enterprise Security and Application market are generally for smaller quantities and higher prices than sales made to the Banking market. The breakdown of revenue between the two primary markets was as follows:

23

Table of Contents

Revenue in the third quarter of 2016 from the Banking market decreased $22,716, or 43%, from the third quarter of 2015 and revenue from the Enterprise and Application Security market increased $6,337, or 89%, in the same period. Revenue for the first nine months of 2016 from the Banking market decreased $58,250, or 35%, compared to the first nine months of 2015, while revenue from the Enterprise and Application Security market increased $12,402 or 55% in the same period. Revenues from the Banking market for the three and nine months ended September 30, 2016 compared to the same periods in 2015, excluding revenues from the sale of card readers to Rabobank, decreased 14% and 1%, respectively.

The respective changes in revenue in both markets reflects the transactional nature of our business where the absolute amount of revenue reported in any given period is a reflection of transactions closed in that period. Because of the volatility in our business, we believe that the overall strength of our business is best evaluated over a longer term where the impact of transactions being recorded in any given period are not as significant as they appear to be in a quarter-over-quarter comparison.

Also, given the sustainable, repeatable nature of our revenue model, we believe growth over a longer period of time reflects growth in our customer base, which we expect will lead to increases in future revenues, albeit with uneven annual growth.

Gross Profit and Operating Expenses

The following table sets forth, for the periods indicated, certain consolidated financial data as a percentage of revenue from continuing operations for the three and nine months ended September 30, 2016 and 2015:

24

Table of Contents

Gross Profit

Consolidated gross profit for the quarter ended September 30, 2016 was $32,101, a decrease of $4,171, or 12%, from the quarter ended September 30, 2015. Gross profit as a percentage of revenue (gross profit margin) was 74% for the quarter ended September 30, 2016, as compared to 60% for the quarter ended September 30, 2015. The increase in gross profit as a percentage of revenue for the third quarter of 2016 compared to 2015 primarily reflects:

Consolidated gross profit for the nine months ended September 30, 2016 was $104,554, a decrease of $7,890, or 7%, from the comparable period in 2015. Gross profit as a percentage of revenue (gross profit margin) was 72% for the nine months ended September 30, 2016 and 59% for the nine months ended September 30, 2015. The increase in gross profit as a percentage of revenue for the first nine months of 2016 compared to 2015 primarily reflects the same factors noted above for the comparison of the third quarter of 2016 to the third quarter of 2015.

25

Table of Contents

The gross margins generated from the banking market in any specific period will vary based on a number of factors including, but not limited to, the products sold, the quantity sold, the geographic location of the sales and competition based on product or geography. Generally, we experience significant competition when the sale involves card readers. Card readers generally have a gross profit margin that is approximately 25 to 35 percentage points lower than other hardware-related margins due to competitive pricing pressures. There are a number of competitors in the EMV (Europay, Mastercard and VISA) market that produce card reader products with fewer features at a lower cost than our products. Card readers represented 7% and 11% of our total revenue in the third quarter and first nine months of 2016, respectively, as compared to 35% and 40% of our total revenue in the third quarter and first nine months of 2015.

The majority of our inventory purchases are denominated in U.S. Dollars. Our sales are denominated in various currencies including the Euro. As the U.S. Dollar weakened against the Euro in the third quarter of 2016 compared to the third quarter of 2015, revenue from third quarter sales made in Euros increased, as measured in U.S. Dollars, without a corresponding change in the cost of goods sold. For the first nine months of 2016, the U.S. Dollar strengthened against the Euro compared to the first nine months of 2015. The impact from changes in currency rates are estimated to have increased revenue by approximately $165 in the third quarter and decreased revenue by approximately $281 in the first nine months of 2016. Had the currency rates in 2016 been equal to the rates in 2015, the gross profit margin would have been approximately 0.1 percentage points lower for the third quarter of 2016 and 0.1 percentage points higher for the first nine months of 2016.

The increase in the percentage of revenue from the Enterprise and Application Security market reflected revenue increases of 89% and 55% for the third quarter and first nine months of 2016, respectively. Revenue from the Banking market decreased 43% and 35% in the third quarter and first nine months of 2016, respectively, compared to the same periods in 2015. Revenue from our Enterprise and Application Security market, which generally has margins that are 30 to 40 percentage points higher than the Banking market, was 31% and 24% of our total revenue in the third quarter and first nine months of 2016, respectively, compared to 12% of total revenue in the third quarter and first nine months of 2015.

Similarly, revenue from our non-hardware products generally has margins that are 30 to 40 percentage points higher than our hardware products. The amount of revenue from our non-hardware products increased 57% and 41% in the third quarter and first nine months of 2016, respectively, compared to the comparable periods of 2015. Non-hardware revenues as a percentage of total revenue increased from 21% and 20% in the third quarter and first nine months of 2015, respectively, to 46% and 38% of revenue in the third quarter and first nine months of 2016, respectively.

Operating Expenses

Our operating expenses are generally based on anticipated revenue levels and the majority of such expenses are fixed over short periods of time. As a result, small variations in the amount of revenue recognized in any given quarter could cause significant variations in the quarter-to-quarter comparisons of either the absolute amounts of operating income or operating income as a percentage of revenue.

Generally, the most significant factor driving our operating expenses is our headcount. Direct compensation and benefit plan expenses generally represent between 55% and 65% of our operating expenses. In addition, a number of other expense categories are directly related to headcount. We attempt to manage our headcount within the context of the economic environments in which we operate and the investments we believe we need to make for our infrastructure to support future growth and for our products to remain competitive. For the third quarter and first nine months of 2016, average headcount was 61% and 56% higher, respectively, than the same periods in 2015. On a consolidated basis, our operating expenses for the quarter and nine months ended September 30, 2016 were $31,189 and $97,142, respectively, an increase of $8,372, or 37%, from the third quarter of 2015, and an increase of $29,983, or 45%, from the nine months ended September 30, 2015. The increase in consolidated operating expenses for the third quarter and first nine months of 2016 compared to the same periods in 2015 was primarily related to:

Historically, operating expenses can be impacted by changes in foreign exchange rates. As noted above, we estimate that the change in currency rates in 2016 compared to 2015 resulted in a decrease in operating expenses of approximately $7 for the three months ended Septermber 30, 2016 and $638 for the nine months ended September 30, 2016, compared to the same periods in 2015.

26

Table of Contents

The comparison of operating expenses can also be impacted significantly by costs related to our stock-based and long-term incentive plans. Operating expenses for the third quarter and first nine months of 2016 included $1,579 and $5,457, respectively, of expenses related to long-term incentive plan costs compared to $1,558 and $4,108 of long-term incentive plan costs for the third quarter and first nine months of 2015, respectively.

Sales and Marketing Expenses

Sales and marketing expenses for the quarter ended September 30, 2016 were $14,535, an increase of $5,693, or 64%, from the third quarter of 2015. Consolidated sales and marketing expenses for the nine months ended September 30, 2016, were $45,266, an increase of $16,650, or 58%, from the same period of 2015. This increase for both periods reflects the inclusion of eSignLive’s sales and marketing operating expenses, as well as increased headcount.

Average full-time sales, marketing, support, and operating employee headcount for the three and nine months ended September 30, 2016 was 299 and 285, respectively compared to 185 and 184 for the three and nine months ended September 30, 2015, respectively. Headcount was 62% higher for the third quarter of 2016 compared to the third quarter of 2015 and 55% higher for the nine months ended September 30, 2016 when compared to the same period in 2015.

Research and Development Expenses

Research and development expenses for the quarter ended September 30, 2016, were $6,776, an increase of $2,398, or 55%, from the third quarter of 2015. Research and development costs for the nine months ended September 30, 2016, were $20,179, an increase of $6,714, or 50%, from the same period of 2015. The increase in research and development for both periods reflected the impact of eSignLive and increased headcount.

Average full-time research and development employee headcount for the three and nine months ended September 30, 2016 was 232 and 224 compared to 138 for the third quarter and 136 for the nine months ended September 30, 2015. Headcount was approximately 68% and 65% higher for the third quarter and first nine months of 2016, respectively, when compared to the same periods in 2015.

General and Administrative Expenses

General and administrative expenses for the quarter ended September 30, 2016, were $7,682, a decrease of $824, or 10%, from the third quarter of 2015. Consolidated general and administrative expenses for the nine months ended September 30, 2016, were $25,074, an increase of $3,344, or 15%, compared to the same period of 2015. The decrease in general and administrative expenses in the third quarter of 2016 compared to the third quarter of 2015 primarily reflected a decrease in professional fees partially offset by an increase in headcount and expenses associated with eSignLive. The increase in general and administrative expenses for the first nine months of 2016 compared to the same period in 2015 primarily reflected increased headcount and expenses associated with eSignLive.

Average full-time general and administrative employee headcount for the three and nine months ended September 30, 2016 was 84 and 82 compared to 60 and 58 for the three and nine months ended September 30, 2015, respectively. Average headcount for the third quarter of 2016 was 40% higher than the third quarter of 2015 and approximately 41% higher for the first nine months of 2016 compared to the same period in 2015.

Amortization of Intangible Assets

Amortization of intangible assets for the three and nine months ended September 30, 2016 was $2,196 and $6,623, respectively, compared to $1,091 and $3,348 for the same periods of 2015. The increase in amortization expense largely relates to amortization of intangibles acquired in the eSignLive acquisition.

Interest Income

Interest income was $229 and $504 for the three and nine months ended September 30, 2016 as compared to $107 and $284 for the same periods of 2015. The increase in interest income for 2016 compared to the same periods in 2015 primarily reflects an increase in the average interest rate earned on the invested balances partially offset by a decrease in the average invested balance.

Other Income (Expense), Net

Other income (expense) primarily includes exchange gains (losses) on transactions that are denominated in currencies other than our subsidiaries’ functional currencies, subsidies received from foreign governments in support of our research and development in those countries and other miscellaneous non-operational, non-recurring expenses.

27

Table of Contents

Other income for the three and nine months ended September 30, 2016 was $134 and $749 compared to losses of $25 and $28 for the same periods of 2015. Other income included exchange losses of $110 and gains of $152 for the three and nine months ended September 30, 2016, respectively, compared to exchange losses of $294 and $1,062 for the same periods in 2015.

Income Taxes

Income tax expense for the three and nine months ended September 30, 2016 was $781 and $3,145, respectively, a decrease of $1,570 and $3,686 from the same periods 2015. The decrease in tax expense in 2016 from 2015 is primarily attributable to lower pretax income partially offset by an increase in the effective tax rate.

Our estimated annual tax rate for 2016 before discrete items is expected to be 28%. This is lower than the U.S. statutory rate primarily due to income in foreign jurisdictions taxed at lower rates, partly offset by valuation allowances on taxable losses. Discrete items related to changes in estimates upon completion of tax filings, the measurement period adjustment described in Note 4 and changes to tax rates on deferred tax liabilities increased the full-year 2016 effective rate to 37%.

Our effective tax rate for the three and nine months ended September 30, 2015 was 17% and 15%, respectively. The tax rate was lower than the U.S. statutory rate primarily due to income in foreign jurisdictions taxed at lower rates.

At December 31, 2015, we had foreign tax credit carryforwards of $2,835 for future U.S. tax returns. These foreign tax credits expire in 2023. We have not provided a valuation reserve for the foreign tax credits as we believe it is more likely than not that they will be realized.

At December 31, 2015, we had Canadian net operating loss (NOL) carryforwards of $28,691 and other Canadian deductible carryforwards of $21,682. The Canadian NOL carryforwards expire from 2027 to 2035 and the other deductible carryforwards have no expiration. At December 31, 2015, we had valuation allowances of $7,379 for the NOL carryforwards and $4,184 for the other deductible carryforwards.

At December 31, 2015, we had other NOL carryforwards of $3,850, other foreign deductible carryforwards of $2,846, and U.S. state NOL carryforwards of $4,853. The foreign NOL carryforwards have no expiration. The other deductible carryforwards expire from 2016 to 2021. The U.S. state NOL carryforwards expire from 2019 to 2027. At December 31, 2015, we had a valuation allowance of $2,023 for certain foreign deferred tax assets and $133 for a U.S. state NOL carryforward.

Loss from Discontinued Operations

We reported after-tax losses from discontinued operations of $16 and $17 for the three and nine months ended September 30, 2016, respectively, compared to losses of $4 and $42 for the comparable periods in 2015. The losses include ongoing expenses related to the bankruptcy and discontinuation of the DigiNotar business in the first quarter of 2011.

Liquidity and Capital Resources

At September 30, 2016, we had net cash balances (total cash, cash equivalents and restricted cash less bank borrowings) of $31,457 and short-term investments of $110,082. At December 31, 2015, we had net cash balances of $78,522 and short-term investments of $44,961. We had no outstanding debt or restricted cash at September 30, 2016, or December 31, 2015.

Short-term investments at September 30, 2016, and December 31, 2015, consisting of high quality commercial paper with maturities of less than six months, were held by our U.S. and Swiss entities and issued by domestic and foreign corporations.

Our working capital at September 30, 2016 was $136,913, an increase of $9,238 or 7% from $127,675 at December 31, 2015. The increase in the combined balance of cash and short-term investments as well as the increase in working capital at September 30, 2016 from December 31, 2015 primarily reflects the benefit from the cash flow from operations for the first nine months of 2016.

As of September 30, 2016, we held $24,063 of cash and short-term investments in banks outside of the United States. Of that amount, $22,934 is not subject to repatriation restrictions, but may be subject to taxes upon repatriation.

We believe that our financial resources are adequate to meet our operating needs over the next twelve months.

28

Table of Contents

Recently Issued Accounting Pronouncements

In November 2015, the FASB issued Accounting Standards Update No. 2015-17, Balance Sheet Classification of Deferred Taxes, (ASU 2015-17), requiring deferred tax liabilities and assets be classified as non-current in a classified statement of financial position. The ASU is effective for annual periods beginning after December 15, 2015 and interim periods within such annual periods. ASU 2015-17 may be applied either prospectively to all deferred tax liabilities and assets or retrospectively to all periods presented. We have adopted ASU 2015-17 prospectively in our consolidated financial statements as of January 1, 2016.

In September 2015, the FASB issued Accounting Standards Update No. 2015-16, Simplifying the Accounting for Measurement-Period Adjustments, (ASU 2015-16), which eliminates the requirement for an acquirer to retrospectively adjust the financial statements for measurement-period adjustments that occur in periods after a business combination is consummated. The ASU is effective for annual periods beginning after December 15, 2015 and interim periods within such annual periods and applies prospectively to adjustments to provisional amounts that occur after the effective date. Measurement period adjustments identified subsequent to December 31, 2015, for the eSignLive Acquisition, further described in Note 4 to the Consolidated Financial Statements, will be recorded and disclosed in accordance with ASU 2015-16.

In May 2014, the FASB issued Accounting Standards Update No. 2014-09, Revenue from Contracts with Customers (ASU 2014-09), which supersedes nearly all existing revenue recognition guidance under U.S. GAAP. The core principle of ASU 2014-09 is to recognize revenues when promised goods or services are transferred to customers in an amount that reflects the consideration to which an entity expects to be entitled for those goods or services. ASU 2014-09 defines a five step process to achieve this core principle and, in applying such process, more judgment and estimates may be required within the revenue recognition process than are required under existing U.S. GAAP.

ASU 2014-9 is effective for annual periods beginning after December 15, 2016, and interim periods within such annual periods, using either of the following transition methods: (i) a full retrospective approach reflecting the application of the standard in each prior reporting period with the option to elect certain practical expedients, or (ii) a retrospective approach with the cumulative effect of initially adopting ASU 2014-09 recognized at the date of adoption (which includes additional footnote disclosures).

In August, 2015, the FASB issued Accounting Standards Update No. 2015-14, Revenue from Contracts with Customers: Deferral of Effective Date, which allowed companies to defer implementation of ASU 2014-9 one year but also allowed early adoption as of the original effective date.

We are currently evaluating the impact of our pending adoption of ASU 2014-09 and Update No. 2015-14 on our consolidated financial statements and have not yet determined the method by which we will adopt the standard.

In February 2016, The FASB issued Accounting Standards Update No. 2016-02, Leases, which among other things, requires lessees to recognize most leases on balance sheet. ASU 2016-02 is effective for annual and interim periods in fiscal years beginning after December 15, 2018 and mandates a modified retrospective transition method. We are currently evaluating the impact of ASU 2016-02 on our consolidated financial statements.

On March 30, 2016, the FASB issued ASU 2016-09, Improvements to Employee Share-Based Payment Accounting, to improve accounting for share-based payment transactions as part of the FASB’s simplification initiative. The ASU changes certain aspects of accounting for share-based payment award transactions, including: (1) recognition of excess tax benefits and tax deficiencies as income tax expense or benefit instead of additional paid-in capital; (2) classification of excess tax benefits on the statement of cash flows. The other provisions of ASU 2016-09 are immaterial to the Company. ASU 2016-09 is effective for fiscal years beginning after December 15, 2016. Early adoption is permitted. We have early adopted ASU 2016-09 in our consolidated financial statements as of January 1, 2016 and applicable aspects described were adopted prospectively. Prior periods were not retrospectively adjusted.

The adoption of ASU 2016-09 had no impact on results for the three months ended September 30, 2016. For the nine months ended September 30, 2016 adoption of ASU 2016-09 resulted in an increase to the provision for income taxes of $184 that otherwise would have been credited to additional paid in capital. Similarly, for the nine months ended September 30, 2016, as a result of the adoption of ASU 2016-09, cashflows from operating activities decreased $184 and cashflows from financing activities increased by the same amount. The impact of this ASU on future periods is dependent on our stock price at the time restricted stock awards vest.

From time to time, new accounting pronouncements are issued by the FASB or other standard setting bodies that are adopted by us as of the specified effective date. Unless otherwise discussed, our management believes that the impact of recently issued standards that are not yet effective will not have a material impact on our consolidated financial statements upon adoption.

Item 3. Quantitative and Qualitative Disclosures about Market Risk

There have been no material changes in our market risk during the three and nine months ended September 30, 2016. For additional information, refer to “Item 7A. Quantitative and Qualitative Disclosures about Market Risk”, included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2015.

29

Table of Contents

Item 4. Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, who, respectively, are our principal executive officer and principal financial officer, conducted an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) and Rule 15d-15(e) under the Securities Exchange Act of 1934, as amended, (the “Exchange Act”)) as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that as of the end of the period covered by this Quarterly Report on Form 10-Q our disclosure controls and procedures were effective to provide reasonable assurance that (i) the information required to be disclosed by us in our reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms, and (ii) information required to be disclosed by us in our reports that we file or submit under the Exchange Act is accumulated and communicated to our management, including our principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

Changes in Internal Controls

Except for implemented controls over eSignLive, there were no changes in our internal control over financial reporting (as that term is defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act) during the three and nine months ended September 30, 2016, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. On November 25, 2015, we acquired Silanis Technology, Inc. (eSignLive). As a result, in our Annual Report on Form 10-K for the period ended December 31, 2015, eSignLive was excluded from our assessment of internal control over financial reporting. We are in the process of documenting and testing the internal controls over financial reporting of eSignLive, and will include it in our annual assessment of internal control over financial reporting for our fiscal year ending December 31, 2016. eSignLive is a wholly-owned subsidiary. Assets of eSignLive represent 28 percent of total consolidated assets. eSignLive revenues represent 9 percent and 6 percent of consolidated revenues for the three and nine months ended September 30, 2016, respectively.

Inherent Limitations on the Effectiveness of Controls

Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their objectives. However, our management, including our Chief Executive Officer and Chief Financial Officer, do not expect that our disclosure controls and procedures or internal control over financial reporting will prevent all error and all fraud. A control system, no matter how well designed and implemented, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within a company are detected. The inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple errors or mistakes. Controls can also be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Projections of any evaluation of controls’ effectiveness to future periods are subject to risks. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and may not be detected.

PART II. OTHER INFORMATION

Item 1. Legal Proceedings.

In addition to the legal matters described below, we are, from time to time, involved in routine legal matters incidental to the conduct of our business, including legal matters such as to protect our intellectual property rights and resolve employment claims. We believe that the ultimate resolution of any such current routine matter will not have a material adverse effect on our continued financial position, results of operations or cash flows.

On January 10, 2011, we purchased our wholly-owned subsidiary, DigiNotar B.V., a private company organized and existing in The Netherlands from the shareholders (“Sellers”). On September 19, 2011, DigiNotar B.V. filed a bankruptcy petition under Article 4 of the Dutch Bankruptcy Act in the Haarlem District Court, The Netherlands. On September 20, 2011, the court declared DigiNotar B.V. bankrupt and appointed a bankruptcy trustee and a bankruptcy judge to manage all affairs of DigiNotar B.V. through the bankruptcy process. The trustee took over management of DigiNotar B.V.’s business activities and is responsible for the administration and liquidation of DigiNotar B.V. In connection with the bankruptcy of DigiNotar B.V., subsequent to September 20, 2011, a number of claims and counter-claims have been filed with the courts in The Netherlands (collectively, the “Court”) related to discontinued assets and discontinued liabilities and other available remedies.

30

Table of Contents

On July 30, 2014, the Court issued a judgment in the DigiNotar case in favor of VASCO for €4,108 ($5,176 at an exchange rate of 1.26 U.S. Dollars per Euro, all amounts in thousands) plus interest related to the Sellers’ failure to achieve earn-out targets established in the purchase agreement, breach of certain representations and warranties under the share purchase agreement and reimbursement of certain costs incurred by VASCO as a result of such breach. The judgment was subject to additional legal proceedings.

In November 2014, all matters with the Sellers related to the sale and bankruptcy of DigiNotar B.V. were settled for €2,263 ($2,854 at an exchange rate of 1.26 U.S. Dollars per Euro, all amounts in thousands). The funds were applied first in full satisfaction of the previously recorded contingent consideration due from escrow included in assets of discontinued operations and the remainder of $1,088 recorded as income from discontinued operations net of tax of $108.

In January 2015, we received a notice of potential claim by the trustee against all of the individuals who served as Directors of DigiNotar, both before and after our acquisition of DigiNotar. T. Kendall Hunt, Jan Valcke, and Clifford K. Bown were the Directors of DigiNotar following its purchase by VASCO. The basis for the potential claim from the trustee appears to be based primarily on the same arguments that VASCO presented in its case against the sellers, which were adjudicated in VASCO’s favor. While we believe that we have strong defenses against the claim, we have also notified our provider of director and officer insurance should a claim be filed and we do not expect the resolution of the potential claim to have a material adverse effect on our business, financial condition or results of operations. VASCO is indemnifying Messrs. Hunt, Valcke, and Bown for this matter.

On July 28, 2015 a putative class action complaint was filed in the United States District Court for the Northern District of Illinois, captioned Linda J. Rossbach v. Vasco Data Security International, Inc., et al., case number 1:15-cv-06605, naming VASCO and certain of its current and former executive officers as defendants and alleging violations under the Securities Exchange Act of 1934, as amended. The suit was purportedly filed on behalf of a putative class of investors who purchased VASCO securities between February 18, 2014 and July 21, 2015, and seeks to recover damages allegedly caused by the defendants’ alleged violations of the federal securities laws and to pursue remedies under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b-5 promulgated thereunder. The complaint seeks certification as a class action and unspecified compensatory damages plus interest and attorneys’ fees. Pursuant to a September 1, 2015 scheduling order entered by the court, the lead plaintiff, once appointed, will have sixty days to file an amended complaint or notify the defendants that the lead plaintiff intends to rely on the current complaint. The defendants will then have sixty days to answer or otherwise respond to the operative complaint. To date, the court has not made any rulings with respect to the appointment of the lead plaintiff. Although the ultimate outcome of litigation cannot be predicted with certainty, the Company believes that this lawsuit is without merit and intends to defend against the action vigorously.

On October 9, 2015, a derivative complaint was filed in the United States District Court for the Northern District of Illinois, captioned Elizabeth Herrera v. Hunt, et al., case number 1:15-cv-08937, naming VASCO’s Board of Directors and certain of its executive officers as individual defendants and the Company as a nominal defendant. Two additional complaints captioned Beth Seltzer v. Hunt, et al., case number 2015-ch-15541 and William Hooper v. Hunt, et al., case number 2016-ch-04054, were filed on October 22, 2015 and March 22, 2016, respectively, in the Circuit Court of Cook County, Illinois naming the same defendants.

The complaints assert, among other things, that the individual defendants breached their fiduciary duties by making material misstatements in, and omitting material information from, the Company’s public disclosures and by failing to maintain adequate internal controls and properly manage the Company. Among other things, the complaints seek unspecified compensatory damages and injunctive relief. On February 23, 2016, the court in Herrera granted a stay of the action pending the resolution of a certain motion to dismiss that the parties anticipate to be filed in Rossbach. On October 29, 2015, a defendant removed the Seltzer action to the United States District Court for the Northern District of Illinois. Thereafter, the plaintiff filed a motion to remand the action back to the Circuit Court of Cook County, Illinois, which was denied on February 3, 2016. On February 9, 2016, the court granted an agreed motion for voluntary dismissal of the Seltzer action, which dismissed the action with prejudice as to the named plaintiff’s individual claims. As for the Hooper action, the court granted a stay on June 8, 2016 on the same terms governing the stay in the Herrera action.

ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS.

(c) The following table provides information about purchases by the Company of its shares of common stock during the three month period ended September 30, 2016:

31

Table of Contents

Item 5. Other Information.

During the second quarter of 2015, VASCO management became aware that certain of its products which were sold by a VASCO European subsidiary to a third-party distributor may have been resold by the distributor to parties in Iran, potentially including parties whose property and interests in property may be blocked pursuant to Executive Order 13224, Executive Order 13382 or that may be identified under Section 560.304 of 31 C.F.R. Part 560 as the “Government of Iran”.

We ceased shipping to such distributor. In addition, the Audit Committee of the Company’s Board of Directors initiated an internal review of this matter with the assistance of outside counsel. As a precautionary matter, concurrent initial notices of voluntary disclosure were submitted on June 25, 2015 to each of the U.S. Department of the Treasury, Office of Foreign Assets Control (“OFAC”), and the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”).

The Audit Committee with the assistance of outside counsel has completed their review. On December 15, 2015, we filed a letter with BIS (Office of Export Enforcement) with the conclusion that the products supplied to the distributor were not subject to United States Export Control jurisdiction. The Office of Export Enforcement issued a “no action” letter, concluding the voluntary self-disclosure process under the Export Administration Regulations.

On January 13, 2016, we filed a letter with OFAC, with the conclusions that VASCO and its subsidiaries made no direct sales to Iran or any party listed by OFAC as a Specially Designated National over the five-year period under review (i.e., June 1, 2010 to June 30, 2015). The letter further noted that the investigation did not identify any involvement on the part of senior management officials of VASCO, and to the contrary, noted that VASCO executive management officials had sought to implement procedures and provided notices to VASCO’s sales personnel to prevent the diversion of VASCO products to unauthorized destinations and end users.

We have not received any response to the letter to OFAC and we cannot predict when OFAC will conclude their review of our voluntary self-disclosures. Based upon the OFAC guidelines for monetary penalties, we have recorded a reserve of $900,000 for potential penalties if they are assessed by OFAC. Ultimately no penalty may be assessed or the penalty may be less or greater than the reserve, but in any event we do not believe that the final settlement will have a material adverse impact on our business.

Item 6. Exhibits.

Exhibit 31.1 - Rule 13a-14(a)/15d-14(a) Certification of Principal Executive Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

32

Table of Contents

Exhibit 31.2 - Rule 13a-14(a)/15d-14(a) Certification of Principal Financial Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 32.1 - Section 1350 Certification of Principal Executive Officer pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 32.2 - Section 1350 Certification of Principal Financial Officer pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 101.INS – XBRL Instance Document

Exhibit 101.SCH – XBRL Taxonomy Extension Schema Document

Exhibit 101.CAL – XBRL Taxonomy Extension Calculation Linkbase Document

Exhibit 101.LAB - XBRL Taxonomy Extension Label Linkbase Document

Exhibit 101.PRE – XBRL Taxonomy Extension Presentation Linkbase Document

Exhibit 101.DEF – XBRL Taxonomy Extension Definition Linkbase Document

33

Table of Contents

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this Report to be signed on its behalf by the undersigned, thereunto duly authorized, on November 3, 2016.

34

Table of Contents

EXHIBIT INDEX

Exhibit 31.1 - Rule 13a-14(a)/15d-14(a) Certification of Principal Executive Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 31.2 - Rule 13a-14(a)/15d-14(a) Certification of Principal Financial Officer pursuant to Section 302 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 32.1 - Section 1350 Certification of Principal Executive Officer pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 32.2 - Section 1350 Certification of Principal Financial Officer pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, dated November 3, 2016.

Exhibit 101.INS – XBRL Instance Document

Exhibit 101.SCH – XBRL Taxonomy Extension Schema Document

Exhibit 101.CAL – XBRL Taxonomy Extension Calculation Linkbase Document

Exhibit 101.LAB - XBRL Taxonomy Extension Label Linkbase Document

Exhibit 101.PRE – XBRL Taxonomy Extension Presentation Linkbase Document

Exhibit 101.DEF – XBRL Taxonomy Extension Definition Linkbase Document

35