Business context and reporting period
The filing is a Form 10-Q for the quarter ended September 30, 2012. The registrant named in the filing is VASCO Data Security International, Inc. (not Onespan Inc.); it designed and sold hardware and software authentication and access-security products and services. Unless stated otherwise, financial amounts below are in U.S. dollars in millions; the filing reports amounts in thousands.
Financial performance and position
| Metric | Q3 2012 | Q3 2011 | Nine months 2012 | Nine months 2011 |
|---|---|---|---|---|
| Revenue | $36.3 | $41.4 | $115.2 | $119.6 |
| Gross profit / margin | $23.9 / 65.8% | $27.8 / 67.1% | $75.2 / 65.2% | $76.1 / 63.6% |
| Operating income | $6.3 | $7.4 | $17.5 | $15.7 |
| Continuing-operations net income | $4.7 | $5.9 | $14.1 | $12.9 |
| Net income, including discontinued operations | $4.5 | $2.2 | $13.6 | $7.4 |
| Diluted EPS | $0.12 | $0.06 | $0.35 | $0.19 |
- Q3 revenue fell 12%; nine-month revenue fell 4%. Q3 operating margin was 17.3% versus 18.0%; the nine-month margin improved to 15.2% from 13.2%.
- Continuing-operations net income declined 21% in Q3 but increased 9% for the nine-month period. Total net income benefited from smaller DigiNotar discontinued-operation losses: $0.2 million in Q3 2012 and $0.5 million for nine months, versus $3.7 million and $5.6 million, respectively, in 2011.
- Nine-month operating cash flow from continuing operations was $13.3 million, compared with $8.2 million. Investing cash use was $0.9 million versus $9.4 million; cash used by discontinued operations was $0.8 million versus $6.3 million. Cash rose to $96.1 million from $84.5 million at year-end 2011.
- At September 30, cash was $96.1 million, working capital $123.8 million, total assets $178.1 million and total liabilities $26.8 million. No borrowings or other debt are reported on the balance sheet. Cash and equivalents were substantially greater than current liabilities of $26.5 million.
Material changes versus the prior comparable period
- Q3 revenue declined $5.1 million. Banking revenue fell 11% and enterprise and application security revenue fell 16%. For the first nine months, banking revenue fell 6%, while enterprise and application security revenue rose 8%.
- Regional results diverged: Q3 EMEA revenue decreased 31% and U.S. revenue decreased 63%, while Asia Pacific revenue increased 213%. EMEA represented 53% of Q3 revenue and 61% of nine-month revenue.
- Management attributed the EMEA decline mainly to order and shipment timing and the stronger U.S. dollar, rather than a measurable deterioration in the economic environment. It estimated currency movements reduced revenue by $1.5 million in Q3 and $3.4 million year to date.
- Q3 gross margin declined 1.3 percentage points year over year; management estimated it would have been about 1.3 points higher absent exchange-rate changes. Nine-month gross margin rose 1.6 points, aided by lower transport costs and a lower share of card-reader sales.
- Operating expenses decreased 13% in Q3 and 4% year to date. The Q3 comparison included currency benefits and reversals of incentive compensation accruals after performance targets were deemed improbable.
Outlook, commentary, risks and unusual items
- No specific financial guidance was provided. Management expected cash resources to cover operating needs for the next 12 months. It expected DIGIPASS as a Service (DPS) to contribute only limited revenue in 2012, while describing it as a potential longer-term growth opportunity.
- Management cited lower Q3 order intake than in Q3 2011, although order intake for the first nine months was stronger than the prior-year period. It cautioned that customers could defer orders in uncertain global economic conditions and that prolonged delays could require workforce or other restructuring measures.
- Key risks include concentration in Europe and banking, order timing and dependence on large orders, foreign-exchange exposure, competition and pricing pressure, changing security technology and cyberattacks. Management identified particular reputational and business risks if a cyber incident affected newer hosted or cloud services.
- The effective tax rate was 22% for the first nine months, compared with 21% a year earlier; Q3 rate was 24%. Management noted that tax rates may vary with the geographic mix of earnings.
- DigiNotar B.V., the Dutch subsidiary declared bankrupt in 2011, remained in discontinued operations; a court-appointed trustee manages its liquidation. The FTC told the company in March 2012 that its investigation of DigiNotar hacking incidents was complete and had not alleged wrongdoing by VASCO.
- The company added a risk concerning SEC conflict-minerals disclosure rules, which it believed were likely to apply and could increase compliance costs or affect component sourcing, availability and pricing. Management reported effective disclosure controls and no material change in internal control over financial reporting.
Important facts for investors to verify
- Confirm the issuer identity and corporate-history link between the filing’s VASCO Data Security International, Inc. and Onespan Inc.
- Track whether the sharp Q3 declines in EMEA and U.S. revenue were temporary shipment timing and currency effects or reflected sustained demand weakness.
- Review order intake, revenue concentration in EMEA and banking, and the pace of growth in Asia Pacific and higher-margin non-hardware offerings.
- Assess cash generation and liquidity alongside foreign-cash repatriation tax exposure, working-capital changes and any continuing DigiNotar liquidation obligations.
- Monitor performance against management’s longer-term DPS opportunity and the associated cybersecurity, reputation and investment risks; the filing gives no quantified DPS outlook.