Onespan Inc. annual report, FY2012

Business context and reporting period

The filing is VASCO Data Security International, Inc.’s Form 10-K for the fiscal year ended December 31, 2012; it reports the fourth quarter as well as full-year results. The source filing names VASCO, not Onespan Inc. VASCO develops and sells hardware and software authentication and security products, principally to banking customers, and offers cloud services DIGIPASS as a Service (DPS) and MYDIGIPASS.COM (MDPC). Amounts below are U.S. dollars; financial figures are in millions unless stated otherwise.

Financial results and liquidity

Fourth-quarter 2012 revenue was $38.8 million, versus $48.5 million in Q4 2011; operating income was $3.5 million versus $9.1 million, and net income was $2.0 million versus $10.8 million. Diluted EPS was $0.05 versus $0.28.

At year-end, cash and equivalents were $106.5 million, working capital was $129.5 million and the current ratio was 5.3. The company reported no debt. Total assets were $186.5 million and stockholders’ equity was $156.3 million. Capital expenditures were $1.3 million. Cash provided by operations increased from $17.9 million in 2011 to $23.0 million in 2012.

Changes versus the prior comparable period

• Revenue declined 8% year over year, chiefly because hardware sales fell in both principal markets and the stronger U.S. dollar reduced reported foreign-currency revenue. Banking revenue fell 9% to $124.7 million; Enterprise and Application Security revenue fell 6% to $29.4 million.
• Gross margin edged up to 64.6% from 64.3%, supported by a higher non-hardware revenue mix, fewer card readers and lower shipping costs. Inventory obsolescence provisions rose to $2.2 million from $1.6 million.
• Operating income fell 15%, while net income declined 14%. The effective tax rate rose to 25% from 6%, mainly because 2011 benefited from U.S. net operating loss utilization and a valuation-reserve reversal.
• Cash increased by $22.0 million during 2012. Working capital rose 19% from $108.6 million. Non-U.S. banks held $80.0 million of cash; most was not subject to significant repatriation restrictions, but repatriation could result in taxes.
• Backlog at year-end was approximately $45 million, up from $33 million, and management expected substantially all of it to ship in 2013. Management also said 2012 order intake was the company’s best to date, while cautioning that backlog is not necessarily predictive of results.

Outlook, risks and unusual items

• Management expected DPS/MDPC to begin contributing in 2013, although these services generated no meaningful revenue in 2011 or 2012. It planned to hire 25–35 employees in 2013, primarily in sales and business development. No specific revenue or earnings guidance was provided.
• Management expected Europe to remain economically difficult in 2013. It said this could constrain Enterprise and Application Security growth, while anticipating no significant impact on Banking absent worsening conditions; a severe European or global disruption could materially harm results.
• Foreign exchange is significant: approximately 93% of 2012 revenue was generated outside the U.S. The company did not hold forward exchange contracts. Management estimated currency movements reduced 2012 revenue by about $4.0 million and noted an adverse effect on gross margin.
• Customer, product and supply concentration remain important risks. The Banking market generated 81% of revenue; the top ten customers generated 37%, and the largest customer approximately 10%. Hardware manufacturing relies on a limited supplier base, including a key processor source and contract assemblers.
• Purchase obligations totaled $31.6 million, including $9.8 million for processors designated end-of-life; $6.1 million of such processors were already in inventory. Management expects to use the stock over several years while assessing redesign alternatives, creating demand-forecast and obsolescence risk.
• DigiNotar’s 2011 security breach led to loss of its certification-provider registration and bankruptcy. VASCO recorded a $0.6 million discontinued-operations loss in 2012, primarily for ongoing legal and third-party costs. Related claims and counterclaims remained; the company disclosed uncertainty around potential costs and recoveries. The FTC investigation was completed without alleging wrongdoing by VASCO.
• Other risks include intense competition and pricing pressure, long and uneven sales cycles, cyberattacks, intellectual-property claims, taxes and regulations, and potential inventory write-downs. Management and the auditor reported effective disclosure controls and internal control over financial reporting; the financial-statement audit opinion was unqualified.

Important facts for investors to verify

• Whether the $45 million backlog shipped as expected in 2013 and whether order intake converted into revenue and cash.
• Whether DPS/MDPC gained paying customers and made a material revenue contribution, given minimal revenue through 2012.
• Whether the revenue decline, particularly in Banking and EMEA, continued or reversed, and how much future performance depends on large customer orders.
• Whether foreign-exchange effects, processor end-of-life commitments and inventory obsolescence affected margins or cash conversion.
• Developments in DigiNotar-related claims, contingent consideration and recoverability of balances classified as discontinued-operation assets.
• The usability and tax implications of overseas cash, and the effect of changing geographic earnings mix on the effective tax rate.