SEC Filing | OneSpan

- -------------------------------------------------------------------------------- - -------------------------------------------------------------------------------- UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 ------------------------ FORM 10-K FOR ANNUAL AND TRANSITION REPORTS PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 (MARK ONE) /X/ ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE FISCAL YEAR ENDED DECEMBER 31, 1999 OR / / TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE TRANSITION PERIOD FROM ______________ TO ______________ COMMISSION FILE NUMBER 000-24389 ------------------------ VASCO DATA SECURITY INTERNATIONAL, INC. (Exact Name of Registrant as Specified in Its Charter) DELAWARE 36-4169320 (State or Other Jurisdiction of (IRS Employer Incorporation or Organization) Identification No.) 1901 SOUTH MEYERS ROAD, SUITE 210 OAKBROOK TERRACE, ILLINOIS 60181 (Address of Principal Executive Offices)(Zip Code) Registrant's telephone number, including area code: (630) 932-8844 Securities registered pursuant to Section 12(b) of the Act: NONE Securities registered pursuant to Section 12(g) of the Act: COMMON STOCK, PAR VALUE $.001 PER SHARE Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes /X/ No / / Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of registrant's knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K. - -------------- As of March 8, 2000, 26,865,964 shares of Common Stock, $.001 par value per share ("Common Stock"), were outstanding. On that date, the aggregate market value of voting and non-voting common equity (based upon the last sale price of the Common Stock as reported on the NASD Electronic Bulletin Board on March 14, 2000) held by non-affiliates of the registrant was $264,166,280 shares at $22.88 per share). DOCUMENTS INCORPORATED BY REFERENCE Portions of the registrant's definitive proxy statement for the Annual Meeting of Stockholders to be held in June 2000 are to be incorporated by reference into Part III of this Form 10-K. - -------------------------------------------------------------------------------- - --------------------------------------------------------------------------------

PART I CAUTIONARY STATEMENT FOR PURPOSES OF THE "SAFE HARBOR" PROVISIONS OF THE PRIVATE SECURITIES LITIGATION REFORM ACT OF 1995 This Annual Report on Form 10-K, including the "Management's Discussion and Analysis of Financial Condition and Results of Operations," contains "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995 concerning, among other things, the prospects, developments and business strategies for the Company (as defined) and its operations, including the development and marketing of certain new products and the anticipated future growth in certain markets in which the Company currently markets and sells its products or anticipates selling and marketing its products in the future. These forward-looking statements (i) are identified by their use of such terms and phrases as "expected," "expects," "believe," "believes," "will," "anticipated," "emerging," "intends," "plans," "could," "may," "estimates," "should," "objective" and "goals" and (ii) are subject to risks and uncertainties and represent the Company's present expectations or beliefs concerning future events. The Company cautions that the forward-looking statements are qualified by important factors that could cause actual results to differ materially from those in the forward-looking statements, including (a) risks of general market conditions, including demand for the Company's products and services, competition and price levels and the Company's historical dependence on relatively few products, certain suppliers and certain key customers, and (b) risks inherent to the computer and network security industry, including rapidly changing technology, evolving industry standards, increasing numbers of patent infringement claims, changes in customer requirements, price competitive bidding, changing government regulations and potential competition from more established firms and others. Therefore, results actually achieved may differ materially from expected results included in, or implied by, these statements. ITEM 1--DESCRIPTION OF BUSINESS GENERAL DESCRIPTION OF BUSINESS VASCO Data Security International, Inc. was incorporated in Delaware in 1997 and is the successor to VASCO Corp., a Delaware corporation. Our principal executive offices are located at 1901 South Meyers Road, Suite 210, Oakbrook Terrace, Illinois 60181 and the telephone number at that address is (630) 932-8844. Our principal offices in Europe are located at Koningin Astridlaan 164, B-1780 Wemmel (Belgium) and the telephone number at that address is 32(0)2/456-98-10. Unless otherwise noted, specifically in the section entitled Management's Discussion and Analysis of Financial Condition and Results of Operations, references in this prospectus to "VASCO," "company," "we," "our," and "us" refer to VASCO Data Security International, Inc., its predecessor, VASCO Corp., and its subsidiaries. The Company, through its operating subsidiaries, designs, develops, markets and supports open standards-based hardware and software security systems which manage and secure access to information assets. 1998 REORGANIZATION--EXCHANGE OFFER On March 11, 1998, we successfully completed an offer to exchange VASCO Corp.'s outstanding shares, options, and warrants for our shares, options and warrants (the "Exchange Offer"). Because we were a non-operating subsidiary of VASCO Corp. prior to the completion of the Exchange Offer, the discussion of results contained herein relates to the results of VASCO Corp. and its subsidiaries for periods prior to March 11, 1998 and to us after March 11, 1998. VASCO Corp. was merged into us effective October 28, 1998. - ------------------------ THIS REPORT CONTAINS THE FOLLOWING TRADEMARKS OF THE COMPANY, SOME OF WHICH ARE REGISTERED: VASCO, ACCESSKEY, VACMAN SERVER AND VACMAN/CRYPTAPAK, AUTHENTICARD AND DIGIPASS. 2

FINANCIAL INFORMATION RELATING TO FOREIGN AND DOMESTIC OPERATIONS AND EXPORT SALES See Note 10 to VASCO Notes to Consolidated Financial Statements for certain information about foreign and domestic operations and export sales. NARRATIVE DESCRIPTION OF THE BUSINESS GENERAL We design, develop, market and support security products and services which manage and secure access to computer systems of corporate and government customers. Additionally, we enable secure financial transactions made over private enterprise networks and public networks, such as the Internet. We believe that our software and hardware products provide organizations with strong, flexible and effective Internet and enterprise security solutions and they compete favorably against those of our competitors. Our IdentiSoft division primarily designs and markets products under the Digipass brand. Our Digipass product line provides greater flexibility and a more affordable means than competing products of authenticating to any network, including the Internet. The Digipass family of user authentication devices, all of which incorporate an electronic digital signature capability to guarantee the integrity of electronic transactions and data transmissions, are commonly referred to as security tokens. Our IntelliSoft division is responsible for open standards-based software products, including our SnareWorks and VACMAN product lines which provide enterprise-wide solutions to secure Internet, client/server and mainframe applications. Our security solutions are sold worldwide through our direct sales force, as well as through distributors, resellers and systems integrators. We currently have approximately 450 customers in more than 47 countries. Representative customers of our products include: ABN AMRO Bank, University of Gronigen, HondaEurope, SNS Bank, Rabobank Nederland, SE Banken, Telindus and Pekao Informatyka. INDUSTRY BACKGROUND The growth in electronic banking and electronic commerce, and the increasing use and reliance upon proprietary or confidential information by businesses, government and educational institutions that is remotely accessible by many users, has made information security a paramount concern. We believe that enterprises are seeking solutions which will continue to allow them to expand access to data and financial assets while maintaining network security. According to Datamonitor, the global market for security products is expected to grow from $2.3 billion in 1998 to over $8 billion in 2003, a compound annual growth rate of 28%. INTERNET AND ENTERPRISE SECURITY. With the advent of personal computers and distributed information systems in the form of wide area networks, intranets, local area networks and the Internet, as well as other direct electronic links, many organizations have implemented applications to enable their work force and third parties, including vendors, suppliers and customers, to access and exchange data and perform electronic transactions. As a result of the increased number of users having direct and remote access to such enterprise applications, data and financial assets have become increasingly vulnerable to unauthorized access and misuse. INDIVIDUAL USER SECURITY. In addition to the need for enterprise-wide security, the proliferation of personal computers, personal digital assistants and mobile telephones in both the home and office settings, combined with widespread access to the Internet, have created significant opportunities for electronic commerce by individual users such as electronic bill payment, home banking and home shopping. Fueled by recent and well-publicized incidents including misappropriation of credit card information and denial of service attacks, there is a growing perception among many consumers that there is a risk involved in transmitting information via the Internet. These incidents and this perception may hamper the development of consumer-based electronic commerce. Accordingly, we believe that electronic commerce 3

will benefit from the implementation of improved security measures that accurately identify users and reliably encrypt data transmissions over the Internet. COMPONENTS OF SECURITY. Data and financial asset security, and secured access to and participation in on-line commerce, generally consist of the following components: - ENCRYPTION: Maintains data privacy by converting information into an unreadable pattern and allowing only authorized parties to decrypt the data. Encryption can also maintain data integrity by creating digital signatures for transmitted data, enabling the recipient to check whether the data has been changed since or during transmission. - IDENTIFICATION AND AUTHENTICATION: Serves as the foundation for other security mechanisms by verifying that a user is who he or she claims to be. Identification and authentication mechanisms are often employed with encryption tools to authenticate users, to determine the proper encryption key for encrypting/decrypting data or to enable users to digitally "sign" or verify the integrity of transmitted data. - ACCESS CONTROL: Software that provides authentication, authorization and accounting functions, controlling a user's access to only that data or the financial assets which he or she is authorized to access, and which keep track of a user's activities after access has been granted. - ADMINISTRATION AND MANAGEMENT TOOLS: Software which sets, implements and monitors security policies, the access to which is typically regulated by access control systems. These tools are extremely important to the overall effectiveness of a security system. The most effective security policies employ most, if not all, of the above components. Most companies, however, only implement a patchwork of these components, which can result in their security systems being compromised. THE VASCO SOLUTION To date, most approaches to network security, including Internet security, have been limited in scope and have failed to address all of the critical aspects of data security. We believe that an effective enterprise-wide solution must address and assimilate issues relating to the following: - speed and ease of implementation, use and administration; - reliability; - interoperability with diverse enterprise environments, existing customer applications and their diverse security infrastructures; - scalability; and - overall cost of ownership. Accordingly, we have adopted the following approach to data security: - In designing our products, we have sought to incorporate all industry-accepted, open and non-proprietary protocols. This permits interoperability between our products and the multiple platforms, products, and applications widely in use. - We have designed our products and services to minimize the integration effort with, and disruption of, existing legacy applications and security infrastructures, such as public key infrastructure, known as PKI. We provide customers with easier implementations and a more rapid means of implementing security across the enterprise, including the Internet. With security being a critical enabling technology for online business initiatives, speed and ease of security implementation has become crucial to an organization's success. 4

- We design our products and services to have a lower total cost of security ownership than competing products and services. We have found that product improvements and tools that lower a customer's total cost of ownership create differentiating sales and marketing tools, and also help in the development of a highly loyal customer base that is open to new solutions that we offer. As a result of this approach, we believe that we are positioned to be a leading provider of our open standards-based software and hardware security solutions. VASCO'S STRATEGY We believe we have one of the most complete lines of security products and services available in the market today and we intend to become a leading worldwide provider of these products and services. A key element of our growth strategy is to demonstrate to an increasing number of distributors, resellers and systems integrators that by incorporating our security products into their own products they can more effectively differentiate themselves in their marketplaces and increase the value of their products. In addition, we demonstrate to our corporate users that our products provide mission critical security to their internal and external security infrastructures. Following this aggressive marketing and promotion effort, we work with these resellers and integrators to support their sales of solutions which include our products. Also, we plan to expand our direct sales marketing program to new and existing blue chip customers. For example, Novell, S-1, Brokat and Intel Network Services (formerly Shiva) have all built support for our products. We currently market to the distribution channels of these companies and are already recognizing increasing revenue as these channels sell our solutions to their end customers. In addition, our IntelliSoft division has a base of customers we market to directly, such as Duke University. We are aggressively expanding the use of this strategy world wide. Further, we intend to: INCREASE SALES AND MARKETING EFFORTS WORLDWIDE. We intend to increase sales of our security products and services in our firmly established European markets and to aggressively increase our sales and support presence and marketing efforts in North America, South America and Asia. We plan to: - market new services and products to our existing customers by providing testimonial evidence of user experiences from other customers; - launch a worldwide marketing campaign to raise awareness of our solutions among the decision makers in the security products industry; - form additional strategic relationships with resellers and vendors of complementary, innovative security products and systems; and - develop a marketing and sales infrastructure in new markets, initially including Hong Kong and Argentina. CONTINUE INNOVATION. We intend to continue to enhance and broaden our line of security products to meet the changing needs of our existing and potential customers by: - building on our core software and hardware security expertise, such as expanding our technology for use on different platforms (like mobile phones and personal digital assistants) and incorporating biometrics into our products; - acquiring complementary technologies or businesses; and - developing additional applications for our products in areas which may include securing the exchange of data in the healthcare field and providing security for Internet gambling and lottery transactions, among others. 5

VASCO'S PRODUCTS We operate as two worldwide divisions: IdentiSoft and IntelliSoft. Each division has its own sales, research and development, and support structures, while both divisions take advantage of global corporate services such as marketing, administration, public relations and finance. However, there is considerable and growing cross-product sales, marketing and development between the divisions. The IdentiSoft division is responsible for the development, sales and support of our Digipass and Cryptech product lines. The IntelliSoft division is responsible for the development, sales and support of our SnareWorks and VACMAN product lines. THE IDENTISOFT DIVISION Our IdentiSoft division offers software and handheld hardware security products that provide strong user authentication, thus eliminating the weakest link in any security scheme, the isolated use of a static password. Over 3,500,000 of our tokens have been sold to over 450 customers. Our largest customer is Rabobank, which has over 500,000 tokens in use, demonstrating the scalability of our product. We believe this is the largest token-based installation of its kind. IDENTISOFT'S DIGIPASS PRODUCT LINE Our Digipass product line, which exists as a family of authentication devices as well as extensive software libraries, provides a flexible and affordable means of authenticating users to any network, including the Internet. Security can be broken into three factors: - What you have (the Digipass device itself); - What you know (the PIN code to activate the Digipass); and - Who you are (biometrics). The Digipass family is currently based on the first two factors. We are developing voice technology to incorporate the third factor into the Digipass. Using the Digipass system, in order to enter a remote system or to digitally sign data one needs: - the hardware device (the token) itself so that if you do not physically have the token, you will not be able to log on to the system; and - the PIN code for the token so if you do not know the appropriate code the user will not be able to use the applications stored inside. Both of these factors help to make sure that a natural person is authenticating (or signing), instead of a computer or another device. These factors also enable extremely high portability for security anytime, anywhere and anyhow. Digipasses calculate dynamic passwords, also known as one-time passwords, to authenticate users on a computer network and for a variety of other applications. There are several versions of the Digipass, the 50, 100, 300, 500, 600 and 700, each of which has its own distinct characteristics depending on the platform that they use and the functions they perform. However, the Digipass family is designed to work together and customers can switch their users' devices without requiring any changes to the customers existing infrastructure. In addition, these devices can be used to calculate digital signatures, also known as electronic signatures or message authentication codes, to protect electronic transactions and guarantee the integrity of the contents of these transactions. In addition, the Digipass 50 is designed to be used on other platforms such as mobile phones and personal digital assistants. 6

DIGIPASS AT WORK [CHART] [Graphic appears here. Description of contents described in paragraph below.] The above illustration shows the various steps in the Digipass initialization process. In the first step the devices are initialized with their unique set of secrets and keys per device. These secrets are stored in an encrypted way on a diskette that is sent to the application owner (for example, the information technology manager in a company or the security department of a bank). These floppy disks are one way of safely transporting the Digipass secrets to the host computer. The files on the floppy disks will be used to read all the necessary secrets and other data from the delivered Digipasses into a database. Then the application owner will assign those Digipass secrets to the end-users. This assignment is based on the serial number of the Digipass and the identity of the end-user. The Digipass is then shipped to the end-user together with a manual and, the protected PIN-code on a secure PIN-mailer is sent by a separate shipment. 7

Using a Digipass requires a connection to the host (server) computer that knows the parameters of the end-user's Digipass. Every time the user sends a dynamic password or digital signature to the host computer, the computer will retrieve all the necessary information from the database and will check the validity of the password or signature. After the host has checked the validity of the dynamic password or signature, it will notify the end-user of the correctness or incorrectness of the validity check. Digipass security devices are not terminal dependent and do not require any specific software platform since they only interact with a person. Currently, the Digipass is used in many applications, the largest of which is banking. Different banking applications are: - corporate banking through direct dial-up, as well as over the Internet and - retail banking to secure transactions made through the use of a dial-up connection with a personal computer, the traditional phone system, the Internet, and wireless phones and other communication devices such as personal digital assistants. Another significant application for the Digipass is to secure access to corporate networks for home-based, traveling and other remote users. Finally, Digipasses are increasingly being used in a variety of e-commerce applications where the user is part of a pre-defined user group. We intend to expand the use of the Digipass to other groups of users and applications, including electronic commerce transactions directed at the general public. IDENTISOFT'S CRYPTECH PRODUCT LINE. IdentiSoft has a product line that produces cryptographic microprocessor chips. These chips are used to encrypt data for use in ATMs, fax machines, modems and security servers at high speeds using DES and RSA algorithms. THE INTELLISOFT DIVISION Our IntelliSoft division, consisting of SnareWorks and VACMAN, offers enterprise-wide security software that provides encryption, access control and administration and management tools. Through the product architecture, the software can be configured to provide security for mainframe, client/server and Internet applications. INTELLISOFT'S SNAREWORKS PRODUCT LINE SnareWorks is uniquely positioned to provide the security bridge between the existing software infrastructure of legacy mainframe and client-server applications that are powering large enterprises, and the world of the Web, e-commerce and business-to-business on the Internet. The critical differentiating benefit of SnareWorks is that it fits into existing computing environments transparently because no new programming is required. Not a single line of application code needs to be modified. As a result of its unique design, the SnareWorks product line is the only one in the industry that spans all three architectures (Web, client-server and mainframe) and enables rapid, low-cost, widespread deployment of true, end-to-end security. We believe that our competitors' products generally require extensive customization and integration which requires a complex and time-consuming deployment effort. In comparison, SnareWorks products are different because of the following key factors: - PROTOCOL SUPPORT MODULES. These are small segments of computer code that represent the knowledge modules that describe the application protocol to SnareWorks. With these small knowledge modules it is possible to teach SnareWorks how to apply state-of-the-art security features to existing applications without requiring any retooling of the applications themselves. 8

- RAPID AND FLEXIBLE AUTHENTICATION. SnareWorks enables an enterprise to deploy rapidly a variety of authentication mechanisms, including those available from competitors, on the desktop. - TRUE SECURE SINGLE SIGN-ON. Once initial authentication is achieved, SnareWorks provides single sign-on to a variety of applications, including web-based and desktop-based applications. In the case of Web-servers, a user will not have to log into more than a single web server or application. SnareWorks is different from other competing products because it can adapt to all commonly deployed authorization and authentication methodologies. Additional key features and benefits of the SnareWorks product line are as follows: - TRANSPARENT ENCRYPTION. SnareWorks enables strong encryption of all TCP/IP network traffic on every computer in a network simply by installing it. When SnareWorks is involved in the transfer of data, the default is automatically to encrypt all data. - EASY INSTALLATION. SnareWorks client or desktop software can be downloaded and installed on desktop computers and web browsers in a matter of minutes, and do not require additional software or alterations to existing application software programs. For Internet-based applications that require only the use of a browser, there is no software to be installed on, or downloaded to, the user's desktop. This feature significantly reduces the time, cost and inconvenience to the customer of securing their networks. - AUTOMATED USER REGISTRATION. SnareWorks provides an automated process to register new users by providing them with their network identity along with their public key certificates without the assistance of a human administrator. This feature allows large companies to deploy SnareWorks more rapidly than it would normally take to deploy a solution of this scope. - SCALABLE AUTHORIZATION. Users or groups of related users can be granted access to different portions or applications on a network based upon their SnareWorks profile. SnareWorks is scalable, allowing a virtually unlimited number of groups and users to be efficiently handled by the software. Common groupings of users are made on the basis of their members, roles, locations and/or time of day, among other factors. - LOG FILES BASED AUDITING. SnareWorks provides "log files" or detailed records of the activity surrounding a data transfer, including identity of user, time, application accessed and date transferred. These log files are used to monitor and audit network activity by administrators. SnareWorks can create these files even if the applications or software programs do not provide for the creation of log files. - USE OF DIGITAL SIGNATURES. A distinctive feature of SnareWorks is its ability to significantly enhance the reliability of applications and data through the use of digital signatures. A digital signature is an authentic piece of data attached to an object. The recipient as well as a third party can verify that the object to which the signature is attached has not been altered since it was signed. - DISTRIBUTED MANAGEMENT. SnareWorks can be managed from a central location or from over a dozen graphical management editors and viewers to provide a comprehensive view of security in the enterprise. - STANDARDS BASED. SnareWorks supports a wide variety of standard encryption devices, including DES, 3DES and SSL, digital signatures (RSA), message integrity (MD5), key management (DCE/ Kerberos, RSA), digital certificates (X.509), access control (POSIX) and strong authentication (RADIUS). 9

SNAREWORKS AT WORK Below is a graphical rendition of how SnareWorks is implemented followed by a description of each of the elements. [CHART] [Graphic appears here. Description of contents described in paragraph below.] SnareWorks Desktop Client is a thin, ultra-lightweight customer package that provides a complete security environment for Internet-based applications residing on a user's desktop. It enables rapid deployment of a comprehensive security solution to thousands of users across multiple server and operating system environments. It provides commercial off-the-shelf products and legacy applications with: - strong network encryption; - pluggable authentications; - a scalable access control model; - secure single sign-on; - enforcement of auditing; and - digital signatures. SnareWorks Web enables existing Web-based applications to utilize a single network identity for authentication and true single sign-on. It delivers secure authorization using a proven access control model, which enables administrators to control even the most detailed aspects of the Web. SnareWorks Web can be distributed to multiple Web servers across the enterprise and managed from one central node through a sophisticated graphical user interface. The SnareWorks Certificate Server Security Infrastructure provides certificate management services to the SnareWorks security framework. These services include issuance, revocation, query and reporting services for X.509-based certificates. The Certificate Server supports both Web and command line access to the certificate repository. 10

SnareWorks Rule Server provides the security services necessary to integrate both Web and non-Web applications into the SnareWorks Framework. These services include: - network authentication; - secure single sign-on; - fine-grain access control; - network data encryption; - auditing; - event notification; and - enforcement of numerous other security policies. The SnareWorks Software Development Kit is a set of library files that a developer can use to build extensions to the SnareWorks framework. It is used to develop protocol support modules which enable SnareWorks servers to analyze the behavior and the operation of legacy applications without requiring these applications to be modified. Protocol support modules can provide advanced security features to new or legacy applications. With the SnareWorks Software Development Kit developers can extend SnareWorks to perform a variety of functions for these applications, including: - automatic login and secure single sign-on; - operation-to-rule mapping; - object-to-rule mapping; - identity transformation; - digital signatures; - application verification; - auditing; - automated keystroke capture; - chargeback accounting; and - authorization products interface. The SnareWorks Security Server is a highly scalable authentication service that combines the best of security technologies, supporting both secret as well as public key authentication. It provides signed network credentials that form the basis for an enterprise-wide authorization infrastructure that can be applied uniformly to all applications. The Security Server also includes a distributed database for users, groups, roles, policies, passwords and security attributes. It also provides encryption services, key generation and password-strength facilities. The SnareWorks Administration Console is the control center for the SnareWorks framework. It enables security administrators to perform remote management of SnareWorks servers and is also the primary interface for creating connection and object rules. These rules govern the behavior of all applications and the access rights to all data throughout the SnareWorks framework. The Administration Console includes numerous graphical editors, which enable administrators to control virtually all aspects of SnareWorks from anywhere in the enterprise. 11

INTELLISOFT AND PUBLIC KEY INFRASTRUCTURE Many corporations are increasingly relying upon digital certificates to authenticate and identify users on a network, including the Internet. In addition, digital certificates are used to transmit data in an encrypted format over a network. The issuance, revocation, management and policies surrounding these digital certificates is commonly referred to as public key infrastructure or PKI. Like any other new comprehensive technology infrastructure, large companies need to integrate PKI into their legacy and new applications. This takes time, money, and specialized, hard-to-find personnel. While there may be significant commercial potential for PKI, the process of integrating PKI into other enterprise wide applications has proven so difficult that few companies have existing PKI deployments beyond the pilot stage. For companies that are using certificate authority vendors such as Entrust, Baltimore, or Verisign, SnareWorks interoperates and allows for easy integration of PKI. In addition, for companies that have not committed to a particular certificate authority vendor, SnareWorks provides its own certificate authority capabilities. Finally, as described above, SnareWorks can work with non-PKI related authentication such as tokens, smart cards, and passwords. We also have patent pending technology that allows for secure storage of a digital certificate's private key on a server that can be accessed from any network using any of our Digipass family of products. The effect of this technology is that it gives digital certificates the portability of PKI deployed on smartcards, without the cost or infrastructure development required for deploying smartcards and their associated smartcard readers. INTELLISOFT'S VACMAN PRODUCT LINE IntelliSoft's VACMAN product line provides organizations with access control software to manage secure remote access to computer networks. The product line consists of the VACMAN Radius Server, the VACMAN Programmer, the VACMAN OPTIMUM and the VACMAN controller. Key features of the VACMAN product line are: - interoperability with a wide range of commercially standard products and protocols including ODBC databases or any server supporting the RADIUS standard; - the ability to program Digipass tokens, giving customers complete control of the initialization, customization and maintenance processes; and - the allowance of quick integration of Digipass Authentication software into industry standard platforms such as Sun Solaris and UNIX. INTELLECTUAL PROPERTY AND PROPRIETARY RIGHTS AND LICENSES We rely on a combination of patent, copyright, trademark and trade secret laws, as well as employee and third-party non-disclosure agreements to protect our proprietary rights. In particular, we hold several patents in the United States and a corresponding patent in certain European countries, which cover certain aspects of our technology. The majority of our patents cover our Digipass family of security tokens. The U.S. patents expire between 2003 and 2010 and the European patent expires in 2008. We believe these patents to be valuable property rights and we rely on the strength of our patents and on trade secret law to protect our intellectual property rights. To the extent that we believe our patents are being infringed upon, we intend to assert vigorously our patent protection rights, including but not limited to, pursuing all available legal remedies. On March 25, 1998, we entered into an arm's-length license agreement with Lernout & Hauspie Speech Products N.V. pursuant to which we received a five-year world-wide, non-exclusive, non-transferable license to use certain speaker verification software in access control applications. For this license, we 12

agreed to pay a royalty of 10% of revenue associated with the software which will be credited against royalty prepayments aggregating $800,000. On December 31, 1998, the license was extended for an additional five years and we made additional royalty prepayments to reach an aggregate of $1.7 million. In addition, the revised agreement also provides for the initiation of a co-marketing and co-sales effort. Further, in connection with sales of our SnareWorks product, we offer a SnareTools tool kit pursuant to a perpetual license agreement with Computer Associates dated December 2, 1996, pursuant to which we pay a 2% royalty based on net sales of the product. SnareWorks also contains infrastructure software which is provided by IBM under an original equipment manufacturing agreement dated October 6, 1999, and by Gradient Technologies under an original equipment manufacturing agreement dated July 13, 1999. Both of these agreements are for three-year terms and also provide for small royalty payments based on how our product is configured with the end users. In the ordinary course of our business we have entered, and may periodically enter, into license agreements with software providers, as needed. RESEARCH AND DEVELOPMENT Our research and development efforts historically have been, and will continue to be, concentrated on product enhancement, new technology development and related new product introductions. We employ 24 full-time engineers and, from time to time also engage independent engineering firms to conduct non- strategic research and development efforts on our behalf. For the fiscal years ended December 31, 1997, 1998 and 1999, we expended $2,313,756, $2,459,477 and $3,587,483, respectively, on research and development, representing approximately 17.5%, 14.9% and 18.5% of consolidated revenues for 1997, 1998 and 1999, respectively. While management is committed to enhancing our current product offerings and introducing new products, we cannot be certain that our research and development activities will be successful. Furthermore, we may not have sufficient financial resources to identify and develop new technologies and bring new products to market in a timely and cost effective manner, and we cannot ensure that any such products will be commercially successful if and when they are introduced. PRODUCTION Our security hardware products are manufactured by third parties pursuant to purchase orders that we issue. Our hardware products are made primarily from commercially available electronic components which are purchased globally. Our software products are produced either in-house or by several outside sources in North America and Europe. The security tokens utilize commercially available programmable microprocessors, or chips. We use two microprocessors, made by Samsung and Epson, for the various hardware products we produce. The Samsung microprocessors are purchased from Samsung Semiconductor in Belgium, and the Epson microprocessors are purchased from Alcom Electronics NV/SA, also located in Belgium. The microprocessors are the only components of our security tokens that are not commodity items readily available on the open market. While there is an inherent risk associated with each supplier of microprocessors, we believe having two sources reduces the overall risk to a commercially acceptable level. Orders of microprocessors and some other components generally require a lead time of 12 to 16 weeks. We attempt to maintain a sufficient inventory of all parts to handle short-term increases in orders. Large orders that would significantly deplete our inventory are typically required to be placed with more than 12 weeks of lead time, allowing us to attempt to make appropriate arrangements with our suppliers. We purchase the majority of our product components and arrange for shipment to third parties for assembly and testing in accordance with our design specifications. Our security token products are assembled exclusively by two independent companies, each of which is based in Hong Kong. Purchases from one of the companies are made on a purchase order by purchase order basis. Purchases from the 13

other company are under a contract that extends to January 21, 2001, with automatic one-year renewals and subject to termination on six months notice. Each of these companies assembles our security tokens at facilities in mainland China. One of the companies also maintains manufacturing capacity in Hong Kong. Equipment designed to test product at the point of assembly is supplied by us and periodic visits are made by our personnel for purposes of quality assurance, assembly process review and supplier relations. There can be no assurance that we will not experience interruptions in the supply of either the component parts that are used in our products or fully-assembled token devices in general. In the event that the flow of components or finished product was interrupted there could be a considerable delay in finding suitable replacement sources for those components, as well as in replacement assembly subcontractors with the result that our business and results of operations could be adversely affected. For further information about our suppliers, refer to the "Risk Factors" section. COMPETITION The market for computer and network security solutions is very competitive and, like most technology-driven markets, is subject to rapid change and constantly evolving products and services. With respect to Digipass, our main competitor is RSA Security Inc., and with respect to our SnareWorks and VACMAN product lines, our main competitor is Netegrity, Inc. There are many other companies such as Computer Associates International, Inc., AXENT Technologies, Inc., ActivCard and Gradient Technologies, Inc. which offer hardware, software and services that range from simple locking mechanisms to sophisticated encryption technologies. We believe that competition in this market is likely to intensify as a result of increasing demand for security products. We believe that the principal competitive factors affecting the market for computer and network security products include the strength and effectiveness of the solution, technical features, ease of use, quality/reliability, customer service and support, name recognition, distribution channels and price. Although we believe that our products currently compete favorably with respect to such factors, other than name recognition in certain markets, there can be no assurance that we can maintain our competitive position against current and potential competitors, especially those with significantly greater financial, marketing, service, support, technical and other competitive resources. Many of our present and potential competitors have significantly greater financial, technical, marketing, purchasing and other resources than we do, and as a result, may be able to respond more quickly to new or emerging technologies and changes in customer requirements, or to devote greater resources to the development, promotion and sale of products, or to deliver competitive products at a lower end user price. Current and potential competitors have established or may establish cooperative relationships among themselves or with third parties to increase the ability of their products to address the needs of our prospective customers. Accordingly, it is possible that new competitors or alliances may emerge and rapidly acquire significant market share. Our products are designed to allow authorized users access to a computing environment, in some cases using patented technology as a replacement for the static password. Although certain of our security token technologies are patented, there are other organizations that offer token-type password generators incorporating challenge-response or response-only approaches that employ different technological solutions and compete with us for market share. For additional information regarding our competition, please refer to the section titled "Risk Factors." SALES AND MARKETING Our security solutions are sold worldwide through our direct sales force, as well as through distributors, resellers and systems integrators. A sales staff of 24 coordinates our sales through both our sales channels and these strategic partners' sales channels and makes direct sales calls either alone or with sales personnel of vendors of computer systems. Our sales staff also provides product education seminars to 14

sales and technical personnel of vendors and distributors with whom we have working relationships and to potential end-users of our products. Part of our expanded selling effort includes approaching our existing strategic partners to find additional applications for our security products. In addition, our marketing plan calls for the identification of new business opportunities that may require enhanced security over the transmission of electronic data or transactions where we do not currently market our products. Our efforts also include the preparation and dissemination of white papers prepared by our support engineers which explain how we believe our security products can add value or otherwise be beneficial. Early in the fourth quarter of 1999, we expanded our relationship with Saatchi & Saatchi to spearhead our worldwide marketing campaign. This worldwide campaign will include print and media advertising to targeted sectors, as well as interactive web-based promotional activity. CUSTOMERS AND MARKETS Customers for our products include some of the world's most recognized names. Customers of Digipass tokens include: BANKING EDUCATION OTHER - ------- --------- ----- ABN AMRO Bank University of Gronigen Honda Europe SNS Bank Telindus Rababank Nederland Pekao Infomatyka SE Banken In addition, a growing number of businesses are using SnareWorks and VACMAN. These include: Duke University. Cryptech customers are primarily original equipment manufacturers. In 1999, Concord Eracam Nederland NV accounted for 18% of our revenues. In addition, we have four other customers who each accounted for 5% or more of our revenues. We are aware of the risks associated with this degree of customer concentration and expect to further minimize our reliance on these customers. EMPLOYEES As of March 14, 2000, we employed 85 full-time employees, and 1 part-time employee. Of these, 43 were located in North America and 43 were located in Europe. Of the total, 44 were involved in sales, marketing and customer support, 21 in product production, research and development and 21 in administration. We organize internal and external training programs for our employees and reward employees for obtaining training which benefits their work performance. We had a total of 80, 60 and 46 employees at the end of the years ended December 31, 1999, 1998 and 1997, respectively. Our employees are not represented by unions and we have never experienced a work stoppage. We believe our relationship with our employees is good. ITEM 2--PROPERTIES Our corporate offices and North American administrative, sales and marketing, research and development and support facilities are located in the United States in an office complex in Oakbrook Terrace, Illinois, a suburb of Chicago. These facilities are leased through November 30, 2004, and consist of approximately 9,000 square feet. We believe that the Oakbrook Terrace facilities will be adequate for our present growth plans. 15

Our European administrative, sales and marketing, research and development and support facilities are located in a suburb of Brussels, Belgium. These facilities consist of approximately 23,500 square feet of office space which are occupied under a lease expiring in September 30, 2005. We believe that these facilities are adequate for our present growth plans. ITEM 3--LEGAL PROCEEDINGS During 1998, the Company was served with a lawsuit filed against it by Security Dynamics Technologies, Inc. and RSA alleging patent infringement. On April 6, 1999, Security Dynamics Technologies, Inc., RSA, the Company and VASCO Data Security, Inc. announced a settlement on confidential terms of the claims that each of the companies had raised in litigation filed last year. In addition, the Company is from time to time involved in litigation incidental to the conduct of its business. The Company is not a party to any other lawsuit or proceeding which, in the opinion of management, is likely to have a material adverse effect on the Company's business, financial condition or results of operations. ITEM 4--SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS No matter was submitted to a vote of security holders during the fourth quarter of 1999, through solicitation of proxies or otherwise. PART II ITEM 5--MARKET FOR REGISTRANT'S COMMON EQUITY AND RELATED STOCKHOLDER MATTERS There was no established public market for the Common Stock in 1997. On March 20, 1998, the Common Stock was approved for trading on the NASD Electronic Bulletin Board system under the symbol "VDSI." On March 14, 2000, the closing sale price for the Common Stock on the NASD Electronic Bulletin Board was $22.88 per share. Such market quotations reflect inter-dealer prices, without retail mark-up, mark-down or commission and may not necessarily represent an actual transaction. On March 8, 2000, there were approximately 111 holders of record of our Common Stock. Prior to March 23, 1998, shares of VASCO Corp. Common Stock were quoted on the over-the-counter market under the symbol "VASC." Since March 23, 1998, the Common Stock has been quoted on the NASD Electronic Bulletin Board under the symbol "VDSI." The following table sets forth the high and low closing bid quotations for the securities and periods indicated within the past two fiscal years. The Common Stock has been quoted on the NASD Electronic Bulletin Board since March 23, 1998. The following table sets forth the high and low closing bid quotations for the Common Stock for the periods indicated. HIGH LOW -------- -------- 1998 First Quarter (from March 23, 1998)......................... 5.50 4.00 Second Quarter.............................................. 8.31 4.25 Third Quarter............................................... 7.00 3.50 Fourth Quarter.............................................. 4.00 2.50 1999 First Quarter............................................... 5.38 2.97 Second Quarter.............................................. 4.88 3.50 Third Quarter............................................... 3.78 2.94 Fourth Quarter.............................................. 8.75 2.94 16

The Company has not paid any dividends on its Common Stock since incorporation. Dividends were paid relating to the Company's Series B Preferred Stock, which was converted to Common Stock in September 1997. Restrictions or limitations on the payment of dividends may be imposed under the terms of credit agreements or other contractual obligations. In the absence of such restrictions or limitations, the declaration and payment of dividends will be at the sole discretion of the Board of Directors of the Company and subject to certain limitations under the General Corporation Law of the State of Delaware. The timing, amount and form of dividends, if any, will depend, among other things, on the Company's results of operations, financial condition, cash requirements, plans for expansion and other factors deemed relevant by the Board of Directors. The Company intends to retain any future earnings for use in its business and therefore does not anticipate paying any cash dividends in the foreseeable future. ITEM 6--SELECTED FINANCIAL DATA (IN THOUSANDS, EXCEPT PER SHARE DATA)(1) YEAR ENDED DECEMBER 31, ---------------------------------------------------------------- 1995 1996 1997 1998 1999 -------- -------- -------- -------- -------- (UNAUDITED) ---------------------- Statement of Operations Data: Total revenues............................. $4,190 $11,265 $13,208 $16,500 $19,397 Operating loss............................. (499) (8,523)(2) (4,168)(3) (1,327) (893) Net loss available to common stockholders............................. (431) (9,215)(2) (6,242)(3) (3,782) (2,212) Basic and diluted loss per common share.... $(0.03) $ (0.47)(2) $ (0.30)(3) $ (0.17) $ (0.09) Shares used in computing per share amounts.................................. 16,817 19,533 21,106 22,431 25,559 DECEMBER 31, ------------------------------------------------------------ 1995 1996 1997 1998 1999 -------- -------- -------- -------- -------- (UNAUDITED) ---------------------------------- Balance Sheet Data: Cash...................................... $ 782 $ 1,851 $ 2,065 $ 1,662 $ 2,576 Working capital (deficit)................. 1,108 5,388 (291) (3,734) 2,473 Total assets.............................. 2,493 12,898 9,004 9,557 12,318 Long term obligations, less current portion................................. 7 9,289 8,618 8,436 8,409 Common stock subject to redemption........ 371 742 495 -- -- Stockholders' equity (deficit)............ 1,002 (843) (6,746) (9,660) (1,037) - ------------------------ (1) Prior to March 11, 1998 when an exchange offer was consummated, the financial results were those of VASCO Corp. After March 11, 1998, the financial results presented are ours. For a description of the exchange offer please refer to Management's Discussion and Analysis of Financial Condition and Results of Operations. (2) Includes a pretax charge for acquired in-process research and development of $7,351,000. (3) Includes legal, accounting and printing costs of approximately $1,218,000 related to preparing for the Exchange Offer that was completed in March 1998. ITEM 7--MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS Certain statements contained in the following Management's Discussion and Analysis of Financial Condition and Results of Operations are forward-looking statements. All forward-looking statements included herein are based on information available to the Company on the date hereof and assumptions which the Company believes are reasonable. The Company does not assume any obligation to update any such forward-looking statements. These forward-looking statements involve risks and uncertainties. The 17

Company's actual results could differ materially from those anticipated in these forward-looking statements as a result of certain factors, including those set forth elsewhere in this Form 10-K and the Company's other filings with the Securities and Exchange Commission. BACKGROUND Our predecessor company, VASCO Corp., entered into the data security business in 1991 through the acquisition of a controlling interest in ThumbScan, Inc., which we renamed VASCO Data Security, Inc. in 1993. In 1996, we began an expansion of our computer security business by acquiring Lintel Security NV/SA, a Belgian corporation, including assets associated with the development of security tokens and security technologies for personal computers and computer networks. In addition, in 1996, we acquired the stock of Digipass NV/SA, a Belgian corporation, which was also a developer of security tokens and security technologies and whose name we changed to VASCO Data Security NV/SA in 1997. All of these acquisitions were accounted for under the purchase method of accounting. On March 11, 1998, we completed a registered Exchange Offer with the holders of the outstanding securities of VASCO Corp. In the Exchange Offer, holders of the common stock and warrants, options and other rights to acquire common stock of our predecessor company exchanged their securities for the same number and kind of securities of our present company, and released any potential claims that such holders might have had against our predecessor in connection with the issuances of its securities and other corporate actions which occurred mostly during the 1980's. In the Exchange Offer, almost 98% of our predecessor's securities were tendered and accepted for exchange. In October 1998, we completed the merger of our predecessor with and into the current company and thereby eliminated all remaining outstanding securities of our predecessor and our predecessor thereby ceased to exist. Since the Exchange Offer, we have engaged in two acquisitions. In May 1999, we acquired the assets of SecureWare SA, a French company for a combination of approximately $1.4 million in our stock and cash. Our latest acquisition occurred in October of 1999 when we acquired Intellisoft Corp. for a combination of approximately $8 million in our stock and cash distributed to dissenting shareholders. This acquisition was accounted for under the pooling-of-interests method of accounting and, therefore, all of our financial information has been restated to include the results of IntelliSoft. As a result of all of our acquisitions, our legal structure includes five wholly-owned subsidiaries. Shortly after our acquisition of IntelliSoft, we organized our operations into two business divisions, IdentiSoft and IntelliSoft. OVERVIEW We design, develop, market and support security products and services which manage and protect against unauthorized access to computer systems of corporate and governmental clients. REVENUE AND EARNINGS. We sell the majority of our products in European countries with significant sales in the United States, although we intend to actively pursue additional markets outside of Europe, particularly Asia and North and South America. Revenues from sales from our Digipass family, specifically the Digipass 300 and 500 tokens, continue to represent the majority of our total revenues. In excess of 80% of our sales for 1999 were comprised of security token devices. Although we believe it is likely that sales of the Digipass family of tokens, which can be used on various platforms, will continue to account for a majority of our total revenues for the next few years, we also believe that revenues from sales of our other hardware and software data security products, including the additional product offerings made by our IntelliSoft division, will continue to increase in the future. 18

Concord-Eracom Nederland BV accounted for 15%, 12% and 18% of our sales in 1997, 1998 and 1999, respectively. It is expected that consolidated sales to other customers and markets will increase and, that the degree of concentration attributable to this major customer will decrease. RESEARCH AND DEVELOPMENT. We are devoting substantial capital and other resources to enhancing our existing security products and developing new products to provide enterprise-wide hardware and software security solutions. Costs of research and development, principally the design and development of hardware and software prior to the determination of technological feasibility, are expensed as incurred on a project-by-project basis. Our software capitalization policy currently defines technological feasibility as a functioning beta test prototype with confirmed manufacturability (a working model), within a reasonably predictable range of costs. Additional criteria include receptive customers, or potential customers, as evidenced by interest expressed in a beta test prototype, at some suggested selling price. VARIATIONS IN OPERATING RESULTS. Our quarterly operating results have in the past varied and may in the future vary significantly. Factors affecting operating results include: - the level of competition; - the size, timing, cancellation or rescheduling of significant orders; market acceptance of new products and product enhancements; - new product announcements or introductions by our competitors; - adoption of new technologies and standards; changes in pricing by us or our competitors; - our ability to develop, introduce and market new products and product enhancements on a timely basis, if at all; - component costs and availability; - our success in expanding our sales and marketing programs; - technological changes in the market for data security products; - foreign currency exchange rates; - and general economic trends and other factors. 19

In addition, we have experienced, and may experience in the future, long sales cycles due to the size of our contracts and the timing of when our customers take delivery of our products. We also experience seasonality in our business. While these seasonal trends have included higher revenue in the last quarter of the calendar year and lower revenue in the next succeeding quarter, this was not the case in 1999 as a result of our customers' year 2000 concerns and resulting purchasing decisions. We believe that revenue has tended to be higher in the last quarter due to the tendency of certain customers to implement or complete changes in computer or network security prior to the end of the calendar year. In addition, revenue has tended to be lower in the summer months, particularly in Europe, when many businesses defer purchase decisions. Because our operating expenses are based on anticipated revenue levels and a high percentage of our expenses are fixed, a small variation in the timing of recognition of revenue could cause significant variations in operating results from quarter to quarter. CURRENCY FLUCTUATIONS. The majority of our supply and sales transactions are denominated in U.S. dollars, however a significant portion of those transactions are denominated in various foreign currencies. In order to reduce the risks associated with fluctuations in currency exchange rates, we attempt to match the timing of delivery, amount of product and the currency denomination of purchase orders received from vendors with sales orders to customers. RESULTS OF OPERATIONS The following table sets forth, for the periods indicated, certain consolidated financial data as a percentage of revenues for the years ended December 31, 1997, 1998 and 1999. PERCENTAGE OF REVENUE YEAR ENDED DECEMBER 31, ------------------------------ 1997 1998 1999 -------- -------- -------- Net revenues................................................ 100.0% 100.0% 100.0% Cost of goods sold.......................................... 49.1 43.7 37.7 ----- ----- ----- Gross profit................................................ 50.9 56.3 62.3 Operating costs: Sales and marketing....................................... 27.9 28.9 30.7 Research and development.................................. 17.5 14.9 18.5 General and administrative................................ 37.0 20.5 17.7 ----- ----- ----- Total operating costs................................... 82.4 64.3 66.9 ----- ----- ----- Operating loss.............................................. (31.5) (8.0) (4.6) Interest expense............................................ (8.7) (8.8) (4.2) Other expense, net.......................................... (1.8) (1.9) (0.9) ----- ----- ----- Loss before income taxes.................................... (42.0) (18.7) (9.7) Provisions for income taxes................................. 4.6 4.2 1.7 ----- ----- ----- Net loss.................................................... (46.6) (22.9) (11.4) ===== ===== ===== The following discussion is based upon our consolidated results of operations for the years ended December 31, 1999, 1998 and 1997 (percentages in the discussion are rounded to the closest full percentage point) and should be read in conjunction with our consolidated financial statements included elsewhere in this Form 10-K. 20

1998 COMPARED TO 1999 REVENUES Our consolidated net revenues for the year ended December 31, 1999 were $19,397,000, an increase of $2,897,000, or 18%, as compared to the year ended December 31, 1998. This increase is due to a strong demand for Digipass 300 and Digipass 500 as well as SnareWorks and VACMAN. In addition to the strong demand for our products, we have had less volume discounting. COST OF GOODS SOLD Our consolidated cost of goods sold for the year ended December 31, 1999 was $7,306,000, an increase of $97,000, or 1%, as compared to the year ended December 31, 1998. Cost of goods sold has not increased at the same rate as our revenues due to efficiencies in the manufacturing process, as well as increased sales of products with a more favorable cost structure. GROSS PROFIT Our consolidated gross profit for the year ended December 31, 1999 was $12,091,000, an increase of $2,800,000, or 30%, over the year ended December 31, 1998. This represents a gross margin of 62%, as compared to 1998's consolidated gross margin of 56%. The increase in gross margin is due to efficiencies in manufacturing related to increasing volumes, an increase in the mix of sales of higher margin products, as well as less volume discounting. SALES AND MARKETING EXPENSES Consolidated sales and marketing expenses for the year ended December 31, 1999 were $5,962,000, an increase of $1,189,000, or 25%, over 1998. This increase can be attributed to increased sales efforts including, in part, increased travel costs, headcount, and an increase in marketing activities, including tradeshows. Additionally, the acquisition of IntelliSoft in October 1999 resulted in additional headcount, as the sales operations were expanded in the fourth quarter of 1999. RESEARCH AND DEVELOPMENT EXPENSES Consolidated research and development costs for the year ended December 31, 1999 were $3,587,000, an increase of $1,128,000, or 46%, as compared to the year ended December 31, 1998. This increase is, in part, related to the acquisition of SecureWare during 1999. As SecureWare is primarily a development center, the acquisition resulted in increased research and development headcount and expenditures. During 1999, the IntelliSoft division increased research and development headcount and expenditures. Additionally, during 1999, we entered into a development agreement with Intel Network Systems, Inc. related to the further enhancement of the VACMAN product line. GENERAL AND ADMINISTRATIVE EXPENSES Consolidated general and administrative expenses for the year ended December 31, 1999 were $3,435,000, an increase of $50,000, or 1%, over 1998. This increase can be attributed to growth in infrastructure needed to support our growth, as well as the impact of the acquisition of SecureWare during 1999. INTEREST EXPENSE Consolidated interest expense in 1999 was $815,000 as compared to $1,458,000 in 1998. The decrease can be attributed to a lower borrowing base being maintained during 1999 as compared to the prior year. 21

INCOME TAXES We recorded tax expense for the year ended December 31, 1999 of $322,000, which relates to one of our European subsidiaries. At December 31, 1999, we have United States net operating loss carryforwards approximating $9,100,000 and foreign net operating loss carryforwards approximating $1,500,000. Such losses are available to offset our future taxable income in the respective jurisdictions and expire in varying amounts beginning in 2002 and continuing through 2019. In addition, if certain substantial changes in our ownership are deemed to have occurred, there would be an annual limitation on the amount of the U.S. carryforwards which could be utilized. 1997 COMPARED TO 1998 REVENUES Our consolidated revenues for the year ended December 31, 1998 were $16,500,000, an increase of $3,292,000, or 25%, as compared to the year ended December 31, 1997. The European operations contributed $12,231,000 or 74% of total consolidated revenues, with the United States operations contributing the remaining $4,269,000 or 26%. This increase is due to a strong performance from international operations, as the demand for Digipass 300 and Digipass 500 continues to grow. This resulted in increased unit sales, as well as an increase of orders with smaller quantities, resulting in fewer volume discounts. In addition, we benefited from currency exchange rates. COST OF GOODS SOLD Our consolidated cost of goods sold for the year ended December 31, 1998 was $7,209,000, an increase of $720,000, or 11%, as compared to the year ended December 31, 1997. The European operations' cost of goods sold was $5,550,000 or 77% of total consolidated cost of goods sold and the United States operations' cost of goods sold was $1,659,000 or 23% of total consolidated cost of goods sold. This increase is consistent with the increase in revenues for the year. We continue to benefit from efficiencies in the manufacturing process, as well as the increasing demand for products with a more favorable cost structure. GROSS PROFIT Our consolidated gross profit for the year ended December 31, 1998 was $9,291,000, an increase of $2,572,000, or 38%, over the year ended December 31, 1997. This represents a gross margin of 56%, as compared to 1997's consolidated gross margin of 51%. The increase in gross margin is due to efficiencies in manufacturing related to increasing volumes, an increase in the mix of higher margin products, as well as increasing orders with smaller quantities, resulting in less volume discounting. SALES AND MARKETING EXPENSES Consolidated sales and marketing expenses for the year ended December 31, 1998 were $4,773,000, an increase of $1,084,000, or 29%, over 1997. This increase can be attributed to increased sales efforts including, in part, increased travel costs, headcount, and an increase in marketing activities, including the development of a VASCO logo, Internet web page and other efforts. RESEARCH AND DEVELOPMENT EXPENSES Consolidated research and development costs for the year ended December 31, 1998 were $2,459,000, an increase of $145,000, or 6%, as compared to the year ended December 31, 1997. This increase can be attributed to increased headcount and expenditures related to IntelliSoft during 1998 as compared to 1997. 22

GENERAL AND ADMINISTRATIVE EXPENSES Consolidated general and administrative expenses for the year ended December 31, 1998 were $3,385,000, a decrease of $1,499,000, or 31%, compared to 1997. This decrease can be attributed to the fact that we were preparing for the Exchange Offer during 1997, thus generating significant legal, accounting and printing expenses; the Exchange Offer was completed during March 1998. In addition, economies of scale began to be realized during 1997 as a result of the combination of the operations of Lintel Security and VASCO Data Security. In 1998, we also recorded recoveries of bad debts and a reduction of certain legal fees associated with the Exchange Offer. INTEREST EXPENSE Consolidated interest expense in 1998 was $1,458,000 compared to $1,148,000 in 1997. The increase can be attributed to average borrowings in 1998 being higher than those of the previous year. INCOME TAXES We recorded tax expense for the year ended December 31, 1998 of $687,000, which consisted of a tax benefit related to one of our European operations. DIVIDENDS We paid no dividends during the year ended December 31, 1998 and $82,000 during the year ended December 31, 1997, respectively. The 1997 dividend payments were attributable to 9,000 shares of VASCO Series B Preferred Stock issued in 1994. During 1997, all 9,000 shares of VASCO Series B Preferred Stock were converted into VASCO Data Security International, Inc. Common Stock. RECENT DEVELOPMENTS On January 27, 2000, we filed for the listing of our Common Stock on the Nasdaq National Market. Additionally, on February 11, 2000, we filed with the SEC for a public offering of our common stock for approximately $50,000,000. In connection with this offering, filings were made with the EASDAQ and the Nasdaq Stock Market. LIQUIDITY AND CAPITAL RESOURCES At December 31, 1999, our aggregate consolidated indebtedness was $9,048,000. Cash used in operating activities was $1,612,000 for the year ended December 31, 1999. During that period we used $1,483,000 in investing activities and financing activities provided $3,988,000. Capital expenditures were $895,000 for the year ended December 31, 1999. In 1996, we issued a 9% convertible note to Kyoto Securities, Ltd., a Bahamian corporation, in the amount of $5,000,000. The note provides for quarterly interest payments and is payable in full on May 29, 2001. The note is convertible into shares of our Common Stock at a conversion price of $12.00 per share, or 416,667 shares. On March 10, 2000, we received a notice to convert the note. In 1997, we entered into a convertible loan agreement with Artesia Bank N.V., formerly Banque Paribas Belgique S.A., in order to refinance the $3,400,000 payment due December 31, 1997 in connection with our acquisition of Digipass. The terms of the agreement provide that the $3,400,000 principal amount is convertible, at the option of the lender, into shares of our Common Stock. This loan bears interest at the rate of 3.25%, payable annually, and matures on September 30, 2002. After January 1, 1999, the loan is convertible at the average closing market price for shares of our Common Stock on the NASD Electronic Bulletin Board system for the 20 trading days prior to the date of the notice of conversion, less 10%. In the event a public offering is completed, the lender may at its option (by written notice within seven days after our receipt of the proceeds of the public offering) require the principal amount of the loan to be repaid in 23

cash, in which case additional special interest is payable as follows: $680,000 if repayment is on January 1, 1999 or later. As part of this transaction, Mr. T. Kendall Hunt, our former Chief Executive Officer, entered into a pledge agreement with Banque Paribas Belgique S.A., pursuant to which he pledged, as collateral for the convertible note, 1,416,666 of his shares of Common Stock, which number of shares is subject to adjustment based on the market value of the shares. The net effect of 1999 activity resulted in an increase in cash of $914,000, resulting in a cash balance of $2,576,000 at December 31, 1999, compared to $1,662,000 at the end of 1998. Our working capital at December 31, 1999 was $2,473,000, an increase of $6,207,000, or 166% from ($3,734,000) at December 31, 1998. The majority of the change is attributable to a 54% decrease in current liabilities, mainly due to the current maturities of long-term debt. Our current ratio was 1.5 to 1.0 at December 31, 1999. In April 1999, we completed a private placement of Common Stock in the amount of $11.5 million. The transaction represented a sale of our Common Stock to European institutional investors at a price of $3.50 per share. A total of 3,285,714 shares of Common Stock were issued as a part of this transaction. We believe that the proceeds that will be raised from our proposed stock offering, along with our current cash balances and anticipated cash generated from operations will be sufficient to meet our anticipated cash needs for the foreseeable future. We intend to seek acquisitions of businesses, products and technologies that are complementary or additive to ours. There can be no assurance that any such acquisitions will be made. RECENTLY ISSUED ACCOUNTING PRONOUNCEMENTS During 1998, the Financial Accounting Standards Board issued Statement of Financial Accounting Standards No. 133, "Accounting for Derivative Instruments and Hedging Activities" (as amended by SFAS No. 137, "Accounting for Derivative Instruments and Hedging Activities--Deferral of the Effective Date of FASB Statement No. 133"), which is effective for all fiscal years beginning after June 15, 2000. SFAS No. 133 establishes a comprehensive standard for the recognition and measurement of derivative instruments and hedging activities. We do not expect the adoption of the new standard to have a material effect on our consolidated financial position, liquidity, or results of operations. ITEM 7A--QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK. Approximately 63% of our business is conducted outside the United States, in Europe and Asia/ Pacific. A significant portion of our business operations are transacted in foreign currencies. As a result, we have exposure to foreign exchange fluctuations. We are affected by both foreign currency translation and transaction adjustments. Translation adjustments result from the conversion of the foreign subsidiaries' balance sheets and income statements to U.S. dollars at year-end exchange rates and weighted average exchange rates, respectively. Translation adjustments resulting from this process are recorded directly into stockholders' equity. Transaction adjustments result from currency exchange movements when a foreign subsidiary transacts business in a currency that differs from its local currency. These transactions are recorded as gains or losses in our statement of operations. Our foreign exchange exposure was minimized in 1999 as the majority of our foreign subsidiaries' business transactions were spread across approximately 40 different countries and currencies. This geographic diversity reduces the risk to our operating results. Also, we perform periodic reviews of outstanding balances and settle intercompany accounts to minimize foreign exchange transaction gains and losses. We have minimal interest rate risk. Our $8.4 million long-term debt is made up of fixed rate notes, ranging from 3.25% to 9%, which are not subject to market fluctuations. The maturities of these notes range from 2001 to 2002. 24

ITEM 8--FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA The information in response to this item is included in our consolidated financial statements, together with the report thereon of KPMG LLP, appearing on pages F-1 through F-18 of this Form 10-K, and in Item 7 under the heading "Management's Discussion and Analysis of Financial Condition and Results of Operations." ITEM 9--CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE None. PART III ITEM 10--DIRECTORS AND EXECUTIVE OFFICERS OF THE REGISTRANT The sections entitled "Election of Directors" and "Section 16(a) Beneficial Ownership Report Compliance" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held in June 2000, are incorporated herein by reference. ITEM 11--EXECUTIVE COMPENSATION The section entitled "Executive Compensation" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held in June 2000, is incorporated herein by reference. ITEM 12--SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT The section entitled "Security Ownership of Certain Beneficial Owners and Management" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held in June 2000, is incorporated herein by reference. ITEM 13--CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS None. PART IV ITEM 14--EXHIBITS, FINANCIAL STATEMENT SCHEDULES AND REPORTS ON FORM 8-K a. (1) The following consolidated financial statements and notes thereto, and the related independent auditors' report, are included on pages F-1 through F-18 of this Form 10-K: Consolidated Balance Sheets as of December 31, 1998 and 1999 Consolidated Statements of Operations for the Years Ended December 31, 1997, 1998 and 1999 Consolidated Statements of Comprehensive Loss for the Years Ended December 31, 1997, 1998 and 1999 Consolidated Statements of Stockholders' Deficit for the Years Ended December 31, 1997, 1998 and 1999 Consolidated Statements of Cash Flows for the Years Ended December 31, 1997, 1998 and 1999 Notes to Consolidated Financial Statements Independent Auditors' Report (2) The following consolidated financial statement schedule of the Company is included on page S-1 of this Form 10-K: Schedule II--Valuation and Qualifying Accounts All other financial statement schedules are omitted because such schedules are not required or the information required has been presented in the aforementioned consolidated financial statements. (3) The following exhibits are filed with this Form 10-K or incorporated by reference as set forth below: 25

EXHIBIT INDEX EXHIBIT NUMBER DESCRIPTION - --------------------- ------------------------------------------------------------ +3.1 Certificate of Incorporation of Registrant, as amended. ++3.2 Bylaws of Registrant, as amended and restated. 4.1 Intentionally Omitted. +4.2 Specimen of Registrant's Common Stock Certificate. 4.3 Intentionally Omitted. +4.4 Form of Letter of Transmittal and Release. +4.5 Form of Registrant's Warrant Agreement. +4.6 Form of Registrant's Option Agreement. +4.7 Form of Registrant's Convertible Note Agreement. +10.1 Netscape Communications Corporation OEM Software Order Form dated March 18, 1997 between VASCO Data Security, Inc. and Netscape Communications Corporation.** +10.2 License Agreement between VASCO Data Security, Inc. and SHIVA Corporation effective June 5, 1997.** +10.3 Heads of Agreement between VASCO Data Security International, Inc., VASCO Data Security Europe S.A., Digiline International Luxembourg, Digiline S.A., Digipass S.A., Dominique Colard and Tops S.A. dated May 13, 1996. +10.4 Agreement relating to additional terms and conditions to the Heads of Agreement dated July 9, 1996, among the parties listed in Exhibit 10.3. +10.5 Agreement between VASCO Data Security International, Inc., VASCO Data Security Europe SA/NV, Mario Houthooft and Guy Denudt dated March 1, 1996. +10.6 Asset Purchase Agreement dated as of March 1996 by and between Lintel Security SA/NV and Lintel SA/NV, Mario Houthooft and Guy Denudt. +10.7 Management Agreement dated January 31, 1997 between LINK BVBA and VASCO Data Security NV/SA (concerning services of Mario Houthooft). +10.8 Sublease Agreement by and between VASCO Data Security International, Inc. and APL Land Transport Services, Inc. dated as of August 29, 1997. +10.9 Office Lease by and between VASCO Data Security International, Inc. and LaSalle National Bank, not personally, but as Trustee under Trust Agreement dated September 1, 1997, and known as Trust Number 53107, dated July 22, 1985. +10.10 Lease Agreement by and between TOPS sa and Digipass sa effective July 1, 1996.

EXHIBIT NUMBER DESCRIPTION - --------------------- ------------------------------------------------------------ +10.11 Lease Agreement by and between Perkins Commercial Management Company, Inc. and VASCO Data Security, Inc. dated November 21, 1995. +10.12 Asset Purchase Agreement by and between VASCO Data Security International, Inc. and Wizdom Systems, Inc. dated August 20, 1996. +10.13 1997 VASCO Data Security International, Inc. Stock Option Plan, as amended. +10.14 Distributor Agreement between VASCO Data Security, Inc. and Hucom, Inc. dated June 3, 1997.** +10.15 Non-Exclusive Distributor Agreement by and between VASCO Data Security, Inc. and Concord-Eracom Nederland BV dated May 1, 1994.** +10.16 Banque Paribas Belgique S. A. Convertible Loan Agreement for $3.4 million. +10.17 Pledge Agreement dated July 15, 1997 by and between T. Kendall Hunt and Banque Paribas Belgique S.A. +10.18 Engagement Letter between Banque Paribas S.A. and VASCO Data Security International, Inc. dated June 20, 1997, as amended. +10.19 Financing Agreement between Generale Bank and VASCO Data Security International, Inc. dated as of June 27, 1997. +10.20 Letter Agreement between Generale Bank and VASCO Data Security International, Inc. dated June 26, 1997. +10.21 Form of Warrant dated June 16, 1997 (with Schedule). +10.22 Form of Warrant dated October 31, 1995 (with Schedule). +10.23 Form of Warrant dated March 7, 1997 (with Schedule). +10.24 Form of Warrant dated August 13, 1996 (with Schedule). +10.25 Form of Warrant dated June 27, 1996 (with Schedule). +10.26 Form of Warrant dated June 27, 1996 (with Schedule). +10.27 Convertible Note in the principal amount of $500,000.00, payable to Generale de Banque dated July 1, 1997 (with Schedule). +10.28 Agreement by and between VASCO Data Security NV/SA and S.I. Electronics Limited effective January 21, 1997.** +10.29 Agreement effective May 1, 1993 by and between Digipass s.a. and Digiline s.a.r.l. +10.30 VASCO Data Security, Inc. purchase order issued to National Electronic & Watch Co. LTD. ** +10.31 VASCO Data Security, Inc. purchase order issued to Micronix Integrated Systems.**

EXHIBIT NUMBER DESCRIPTION - --------------------- ------------------------------------------------------------ +10.32 Agreement between Registrant and VASCO Data Security International, Inc. dated as of August 25, 1997. +10.33 Convertible Note dated June 1, 1996 made payable to Mario Houthooft in the principal amount of $373,750.00. +10.34 Convertible Note dated June 1, 1996 made payable to Guy Denudt in the principal amount of $373,750.00. +10.35 Osprey Partners Warrant (and Statement of Rights to Warrant and Form of Exercise) issued June 1, 1992. +10.36 Registration Rights Agreement dated as of October 19, 1995 between certain purchasing shareholders and VASCO Data Security International, Inc. +10.37 First Amendment to Registration Rights Agreement dated July 1, 1996. +10.38 Second Amendment to Registration Rights Agreement dated March 7, 1997. +10.39 Purchase Agreement by and between VASCO Data Security International, Inc. and Kyoto Securities Ltd. +10.40 Convertible Note dated May 28, 1996 payable to Kyoto Securities, Ltd. in principal amount of $5 million. +10.41 Amendment to Purchase Agreement and Convertible Note by and between VASCO Data Security International, Inc. and Kyoto Securities, Ltd. +10.42 Executive Incentive Compensation Plan. +10.43 Letter for Credit granted by Generale de Banque to Digipass SA dated January 27, 1997. ++10.44 License Agreement dated as of March 25, 1998 by and between VASCO Data Security International, Inc., for itself and its subsidiaries, and Lernout & Hauspie Speech Products N.V. ++10.45 Loan Agreement dated as of March 31, 1998 by and between Lernout & Hauspie Speech Products N.V. and VASCO Data Security International, Inc. ++10.46 Convertible Note dated April 1, 1998 payable to Lernout & Hauspie Speech Products N.V. in the principal amount of $3 million. #10.47 Amendment I dated as of December 31, 1998 to the License Agreement dated as of March 25, 1998 by and between VASCO Data Security International, Inc., for itself and its subsidiaries, and Lernout & Hauspie Speech Products N.V. 21 Subsidiaries of Registrant. 27 Financial Data Schedule.

- ------------------------ + Incorporated by reference to the Registrant's Registration Statement on Form S-4, as amended (Registration No. 333-35563), originally filed with the Securities and Exchange Commission on September 12, 1997. ++ Incorporated by reference to the Registrant's Annual Report on Form 10-K, originally filed with the Securities and Exchange Commission on May 5, 1998. # Incorporated by reference to the Registrant's Annual Report on Form 10-K, originally filed with the Securities and Exchange Commission on April 14, 1999. ** Confidential treatment has been granted for the omitted portions of this document. VASCO DATA SECURITY INTERNATIONAL, INC. WILL FURNISH ANY OF THE ABOVE EXHIBITS TO ITS STOCKHOLDERS UPON WRITTEN REQUEST ADDRESSED TO THE SECRETARY AT THE ADDRESS GIVEN ON THE COVER PAGE OF THIS FORM 10-K. THE CHARGE FOR FURNISHING COPIES OF THE EXHIBITS IS $.25 PER PAGE, PLUS POSTAGE. (b) Reports on Form 8-K No reports on Form 8-K have been filed by the Registrant during the quarter ended December 31, 1999.

THIS PAGE INTENTIONALLY LEFT BLANK.

INDEPENDENT AUDITORS' REPORT The Stockholders and Board of Directors VASCO Data Security International, Inc.: We have audited the accompanying consolidated balance sheets of VASCO Data Security International, Inc. and subsidiaries (the "Company") as of December 31, 1998 and 1999 and the related consolidated statements of operations, comprehensive loss, stockholders' deficit, and cash flows for each of the years in the three-year period ended December 31, 1999. In connection with our audits of the consolidated financial statements, we have also audited the accompanying consolidated financial statement Schedule II--Valuation and Qualifying Accounts. These consolidated financial statements and the consolidated financial statement schedule are the responsibility of the Company's management. Our responsibility is to express an opinion on these consolidated financial statements and the consolidated financial statement schedule based on our audits. We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion. In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of VASCO Data Security International, Inc. and subsidiaries as of December 31, 1998 and 1999, and the results of their operations and their cash flows for each of the years in the three-year period ended December 31, 1999, in conformity with generally accepted accounting principles. Also, in our opinion, the related consolidated financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly, in all material respects, the information set forth therein. /s/ KPMG LLP Chicago, Illinois February 24, 2000 F-1

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED BALANCE SHEETS DECEMBER 31, DECEMBER 31, 1998 1999 ------------ ------------ ASSETS CURRENT ASSETS: Cash...................................................... $ 1,662,084 $ 2,576,494 Accounts receivable, net of allowance for doubtful accounts of $55,000 and $120,216 in 1998 and 1999....... 3,586,890 2,871,367 Inventories, net.......................................... 1,272,327 805,382 Prepaid expenses.......................................... 92,326 157,620 Deferred income taxes..................................... 83,000 83,000 Other current assets...................................... 350,765 925,334 ----------- ----------- Total current assets.................................. 7,047,392 7,419,197 Property and equipment Furniture and fixtures.................................... 580,427 1,246,555 Office equipment.......................................... 637,335 1,013,870 ----------- ----------- 1,217,762 2,260,425 Accumulated depreciation.................................. (827,602) (1,070,046) ----------- ----------- 390,160 1,190,379 Goodwill and other intangible assets, net of accumulated amortization of $2,311,000 and $3,134,000 in 1998 and 1999...................................................... 1,519,032 1,989,960 Prepaid royalties and other assets.......................... 600,000 1,718,493 ----------- ----------- Total assets................................................ $ 9,556,584 $12,318,029 =========== =========== LIABILITIES AND STOCKHOLDERS' DEFICIT CURRENT LIABILITIES: Current maturities of long-term debt...................... $ 6,703,867 $ 639,322 Accounts payable.......................................... 1,232,133 2,020,465 Unearned income........................................... 669,051 667,501 Accrued expenses.......................................... 2,175,583 1,618,739 ----------- ----------- Total current liabilities............................. 10,780,634 4,946,027 Long-term debt, including stockholder note of $5,000,000 in 1998 and 1999............................................. 8,435,903 8,408,862 STOCKHOLDERS' DEFICIT: Preferred stock, $.01 par value; 500,000 shares authorized; none issued and outstanding................. -- -- Common stock, $.001 par value; 75,000,000 shares authorized; 22,805,689 shares issued and outstanding in 1998; 26,462,083 shares issued and outstanding in 1999.................................................... 22,806 26,462 Additional paid-in capital................................ 9,891,116 20,702,387 Accumulated deficit....................................... (19,660,856) (21,873,340) Accumulated other comprehensive income-cumulative translation adjustment.................................. 86,981 107,631 ----------- ----------- Total stockholders' deficit................................. (9,659,953) (1,036,860) ----------- ----------- TOTAL LIABILITIES AND STOCKHOLDERS' DEFICIT................. $ 9,556,584 $12,318,029 =========== =========== See accompanying notes to consolidated financial statements. F-2

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF OPERATIONS FOR THE YEARS ENDED DECEMBER 31, --------------------------------------- 1997 1998 1999 ----------- ----------- ----------- Net revenues.......................................... $13,207,980 $16,499,866 $19,397,108 Cost of goods sold.................................... 6,488,798 7,209,038 7,305,672 ----------- ----------- ----------- Gross profit.......................................... 6,719,182 9,290,828 12,091,436 Operating costs: Sales and marketing................................. 3,689,373 4,773,153 5,961,970 Research and development............................ 2,313,756 2,459,477 3,587,483 General and administrative.......................... 4,883,675 3,384,853 3,434,940 ----------- ----------- ----------- Total operating costs............................. 10,886,804 10,617,483 12,984,393 ----------- ----------- ----------- Operating loss........................................ (4,167,622) (1,326,655) (892,957) Interest expense...................................... (1,148,183) (1,457,627) (814,923) Other expense, net.................................... (237,355) (310,728) (182,294) ----------- ----------- ----------- Loss before income taxes.............................. (5,553,160) (3,095,010) (1,890,174) Provision for income taxes............................ 606,579 687,002 322,310 ----------- ----------- ----------- Net loss.............................................. (6,159,739) (3,782,012) (2,212,484) Preferred stock dividends........................... (81,900) -- -- ----------- ----------- ----------- Net loss available to common stockholders............. $(6,241,639) $(3,782,012 $(2,212,484) =========== =========== =========== Basic and diluted net loss per common share........... $ (0.30) $ (0.17) $ (0.09) =========== =========== =========== Weighted average common shares outstanding............ 21,105,676 22,430,684 25,558,847 =========== =========== =========== See accompanying notes to consolidated financial statements. F-3

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS FOR THE YEARS ENDED DECEMBER 31, --------------------------------------- 1997 1998 1999 ----------- ----------- ----------- Net loss............................................... $(6,159,739) $(3,782,012) $(2,212,484) Other comprehensive income (loss)--cumulative translation adjustment............................... (65,106) 257,143 20,650 ----------- ----------- ----------- Comprehensive loss..................................... $(6,224,845) $(3,524,869) $(2,191,834) =========== =========== =========== See accompanying notes to consolidated financial statements. F-4

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF STOCKHOLDERS' DEFICIT SERIES A SERIES B PREFERRED STOCK PREFERRED STOCK COMMON STOCK ------------------- ------------------- --------------------- ACCUMULATED DESCRIPTION SHARES AMOUNT SHARES AMOUNT SHARES AMOUNT APIC DEFICIT - ----------- -------- -------- -------- -------- ---------- -------- ----------- ------------ BALANCE AT 12/31/96.......... 117,181 $ 1,172 9,000 $90 20,453,324 $20,454 $ 8,877,473 $(9,637,205) Net loss..................... -- -- -- -- -- -- -- (6,159,739) Foreign currency translation adjustment................. -- -- -- -- -- -- -- -- Cash dividends paid on preferred B................ -- -- -- -- -- -- -- (81,900) Exercise of stock options.... -- -- -- -- 189,375 189 42,281 -- Cancellation of common stock...................... -- -- -- -- (16,489) (17) -- -- Issuance of common stock..... -- -- -- -- 83,714 83 361,184 -- Conversion of Series A preferred stock............ (117,181) (1,172) -- -- 778,383 779 391 -- Conversion of Series B preferred stock............ -- -- (9,000) (90) 644,653 645 (555) -- Repurchase of common stock... -- -- -- -- -- -- -- -- -------- ------- ------ --- ---------- ------- ----------- ------------ BALANCE AT 12/31/97.......... -- $ -- -- $-- 22,132,960 $22,133 $ 9,280,774 $(15,878,844) Net loss..................... -- -- -- -- -- -- -- (3,782,012) Foreign currency translation adjustment................. -- -- -- -- -- -- -- -- Exercise of stock options.... -- -- -- -- 658,257 658 115,689 -- Exercise of stock warrants... -- -- -- -- 14,472 15 (15) -- Expiration of put option..... -- -- -- -- -- -- 494,668 -- -------- ------- ------ --- ---------- ------- ----------- ------------ BALANCE AT 12/31/98.......... -- $ -- -- $-- 22,805,689 $22,806 $ 9,891,116 $(19,660,856) Net loss..................... -- -- -- -- -- -- -- (2,212,484) Foreign currency translation adjustment................. -- -- -- -- -- -- -- -- Exercise of stock options.... -- -- -- -- 158,000 158 44,067 -- Exercise of stock warrants... -- -- -- -- 200,000 200 49,800 -- Issuance of common stock..... -- -- -- -- 3,486,308 3,486 11,468,791 -- Common stock repurchased and retired.................... -- -- -- -- (187,914) (188) (751,387) -- -------- ------- ------ --- ---------- ------- ----------- ------------ BALANCE AT 12/31/99.......... -- $ -- -- $-- 26,462,083 $26,462 $20,702,387 $(21,873,340) ======== ======= ====== === ========== ======= =========== ============ ACCUMULATED OTHER TREASURY STOCK TOTAL COMPREHENSIVE --------------------- STOCKHOLDERS' DESCRIPTION INCOME SHARES AMOUNT DEFICIT - ----------- ------------------ -------- ---------- ------------- BALANCE AT 12/31/96.......... $(105,056) -- $ -- $ (843,072) Net loss..................... -- -- -- (6,159,739) Foreign currency translation adjustment................. (65,106) -- -- (65,106) Cash dividends paid on preferred B................ -- -- -- (81,900) Exercise of stock options.... -- -- -- 42,470 Cancellation of common stock...................... -- -- -- (17) Issuance of common stock..... -- (32,504) 227,528 588,795 Conversion of Series A preferred stock............ -- (2,824) 19,768 19,766 Conversion of Series B preferred stock............ -- -- -- -- Repurchase of common stock... -- 35,328 (247,296) (247,296) --------- -------- ---------- ----------- BALANCE AT 12/31/97.......... $(170,162) -- $ -- $(6,746,099) Net loss..................... -- -- -- (3,782,012) Foreign currency translation adjustment................. 257,143 -- -- 257,143 Exercise of stock options.... -- -- -- 116,347 Exercise of stock warrants... -- -- -- -- Expiration of put option..... -- -- -- 494,668 --------- -------- ---------- ----------- BALANCE AT 12/31/98.......... $ 86,981 -- $ -- $(9,659,953) Net loss..................... -- -- -- (2,212,484) Foreign currency translation adjustment................. 20,650 -- -- 20,650 Exercise of stock options.... -- -- -- 44,225 Exercise of stock warrants... -- -- -- 50,000 Issuance of common stock..... -- -- -- 11,472,277 Common stock repurchased and retired.................... -- -- -- (751,575) --------- -------- ---------- ----------- BALANCE AT 12/31/99.......... $ 107,631 -- $ -- $(1,036,860) ========= ======== ========== =========== See accompanying notes to consolidated financial statements. F-5

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF CASH FLOWS FOR THE YEARS ENDED DECEMBER 31, --------------------------------------- 1997 1998 1999 ----------- ----------- ----------- Cash flows from operating activities: Net loss............................................. $(6,159,739) $(3,782,012) $(2,212,484) Adjustments to reconcile net loss to net cash used in operating activities: Depreciation and amortization.................... 1,216,000 1,027,431 1,066,144 Interest paid in shares of common stock.......... 418,279 -- -- Deferred income taxes............................ 200,000 -- -- Loss on disposition of fixed assets.............. -- 5,013 -- Gain on sale of fixed assets..................... -- -- (13,318) Changes in assets and liabilities, net of acquisition: Accounts receivable, net....................... 1,124,443 (1,045,440) 715,523 Inventories, net............................... 1,181,449 (271,033) 466,945 Prepaid expenses............................... 258,420 231,660 (65,294) Other current assets........................... 292,963 (18,624) (574,569) Prepaid royalties and other assets............. -- (600,000) (1,118,493) Accounts payable............................... (853,005) 105,045 788,332 Unearned income................................ (473,719) 120,575 (1,550) Accrued expenses............................... 1,043,349 474,150 (662,790) ----------- ----------- ----------- Net cash used in operating activities................ (1,751,560) (3,753,235) (1,611,554) ----------- ----------- ----------- Cash flows from investing activities: Acquisition of SecureWare............................ -- -- (587,532) Additions to property and equipment, net of acquisition........................................ (74,247) (284,155) (895,144) ----------- ----------- ----------- Net cash used in investing activities.................. (74,247) (284,155) (1,482,676) ----------- ----------- ----------- Cash flows from financing activities: Proceeds from issuance of debt....................... 2,516,000 6,161,424 -- Repayment of debt.................................... (67,564) (2,900,000) (6,091,586) Series B preferred stock dividends................... (81,900) -- -- Proceeds from exercise of stock options and warrants........................................... 42,470 116,347 94,225 Net proceeds from sales of common stock.............. (56,895) -- 10,736,926 Repurchase of common stock........................... (247,226) -- (751,575) ----------- ----------- ----------- Net cash provided by financing activities.............. 2,104,885 3,377,771 3,987,990 Effect of exchange rate changes on cash................ (65,106) 257,143 20,650 ----------- ----------- ----------- Net increase (decrease) in cash........................ 213,972 (402,476) 914,410 Cash, beginning of year................................ 1,850,588 2,064,560 1,662,084 ----------- ----------- ----------- Cash, end of year...................................... $ 2,064,560 $ 1,662,084 $ 2,576,494 =========== =========== =========== Supplemental disclosure of cash flow information: Interest paid.......................................... $ 53,865 $ 878,892 $ 893,799 Income taxes paid...................................... $ 415,480 $ 709,661 $ 900,373 See accompanying notes to consolidated financial statements. F-6

NOTE 1--SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES NATURE OF OPERATIONS VASCO Data Security International, Inc. and its wholly owned subsidiaries (the Company) designs, develops, markets and supports security products and services which manage and protect against unauthorized access to computer systems of corporate and government customers. PRINCIPLES OF CONSOLIDATION The consolidated financial statements include the accounts of VASCO Data Security International, Inc. and its wholly owned subsidiaries. All significant intercompany accounts and transactions have been eliminated in consolidation. FOREIGN CURRENCY TRANSLATION AND TRANSACTIONS The financial position and results of operations of the Company's foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. dollars using current exchange rates as of the balance sheet date. Revenues and expenses are translated at average exchange rates prevailing during the year. Translation adjustments arising from differences in exchange rates are included as a separate component of stockholders' deficit. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations. Foreign exchange transaction losses aggregating $12,000, $174,000 and $272,000 are included in other non-operating expense for 1997, 1998, and 1999, respectively REVENUE RECOGNITION The American Institute of Certified Public Accountants Statement of Position 97-2, "Software Revenue Recognition" (SOP 97-2) was issued in October 1997 and is effective for transactions entered into in fiscal years beginning after December 15, 1997. SOP 97-2 addresses various aspects of the recognition of revenues on software transactions and supersedes SOP 91-1, the policy previous followed by the Company. The Company adopted SOP 97-2 in fiscal year 1998, beginning January 1, 1998. The adoption of this statement has not resulted in a material impact on the Company's financial statements. LICENSE FEES. Revenues from the sale of computer security hardware and software are recorded upon shipment or, if an acceptance period is allowed, at the later of shipment or customer acceptance. No significant obligations exist with regard to delivery or customer acceptance at the time of recognizing revenue. SUPPORT AGREEMENTS. Support agreements generally call for the Company to provide technical support and software updates to customers. Revenue on technical support and software update rights is recognized ratably over the term of the support agreement. CONSULTING AND EDUCATION SERVICES. The Company provides consulting and education services to its customers. Revenue from such services is generally recognized during the period in which the services are performed. PREPAID ROYALTIES On March 25, 1998, the Company entered into a license agreement with Lernout & Hauspie Speech Products N.V. pursuant to which the Company received a five-year worldwide, non-exclusive, non-transferable license to use certain speaker verification software in access control applications. For this license, the Company agreed to pay a royalty of 10% of revenue associated with the software which will be credited against royalty prepayments aggregating $800,000. On December 31, 1998, the license was F-7

NOTE 1--SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED) extended for an additional five years and the Company made royalty prepayments to reach an aggregate of $1,700,000. Prepaid royalties amounted to $600,000 and $1,700,000 at December 31, 1998 and 1999, respectively. Amortization of the royalty prepayments will commence during the second quarter of 2000 when the applications incorporating the Lernout & Hauspie software are released to the general public. PROPERTY AND EQUIPMENT Property and equipment are stated at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the related assets ranging from three to seven years. Additions and improvements are capitalized, while expenditures for maintenance and repairs are charged to operations as incurred. Gains or losses resulting from sales or retirements are recorded as incurred, at which time related costs and accumulated depreciation are removed from the accounts. " SOFTWARE COSTS The Company capitalizes software development costs in accordance with Statement of Financial Accounting Standards (SFAS) No. 86, "Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed". Research and development costs, prior to the establishment of technological feasibility, determined based upon the creation of a working model, are expensed as incurred. The Company's policy is to amortize capitalized costs by the greater of (a) the ratio that current gross revenues for a product bear to the total of current and anticipated future gross revenues for that product or (b) the straight-line method over the remaining estimated economic life of the product, generally two to five years, including the period being reported on. INCOME TAXES Income taxes are accounted for under the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases and operating loss and tax credit carryforwards. Deferred tax assets and liabilities are measured using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date. FAIR VALUE OF FINANCIAL INSTRUMENTS The following disclosures of the estimated fair value of financial instruments are made in accordance with the requirements of SFAS No. 107, "Disclosures and Fair Value of Financial Instruments." The estimated fair value amounts have been determined by the Company using available market information and appropriate valuation methodologies. The fair values of the Company's financial instruments were not materially different from their carrying amounts at December 31, 1998 and 1999, except for notes payable and long-term debt, for which the fair values were not determinable. USE OF ESTIMATES The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates. F-8

NOTE 1--SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED) RECLASSIFICATIONS Certain amounts in the consolidated financial statements have been reclassified to confirm to the 1999 presentation. GOODWILL AND OTHER INTANGIBLES Goodwill is amortized on a straight-line basis over the expected period to be benefited, which is seven years. Other intangibles are amortized on a straight-line basis and consist of software and hardware technology which is being amortized over a period of four years and workforce and customer lists which are being amortized over a period of seven years. The Company periodically evaluates whether events and circumstances that have occurred indicate that the remaining balance of goodwill and other intangibles may not be recoverable or that the remaining estimated useful lives may warrant revision. When such factors indicate that goodwill and other intangibles should be evaluated for possible impairment, the Company uses an estimate of undiscounted future cash flows to measure whether the goodwill and other intangibles are recoverable. STOCK-BASED COMPENSATION On January 1, 1996, the Company adopted SFAS No. 123, "Accounting for Stock-Based Compensation," which permits entities to recognize the compensation expense associated with the fair value of all stock-based awards on the date of grant. Alternatively, SFAS No. 123 allows entities to continue to apply the provisions of Accounting Principles Board (APB) Opinion No. 25, "Accounting for Stock Issued to Employees," and provide pro forma disclosures as if the fair value method defined in SFAS No. 123 had been applied. The Company has elected to apply the provisions of APB Opinion No. 25 and provide the pro forma disclosures required by SFAS No. 123. LOSS PER COMMON SHARE Basic earnings per share is based on the weighted average number of shares outstanding and excludes the dilutive effect of unexercised common stock equivalents. Diluted earnings per share is based on the weighted average number of shares outstanding and includes the dilutive effect of unexercised common stock equivalents to the extent they are not anti-dilutive. Shares issuable from securities that could potentially dilute basic earnings per share in the future that were not included in the computation of earnings per share because their effect was anti-dilutive were as follows at December 31: 1997 1998 1999 --------- --------- --------- Stock options............................... 1,945,257 1,475,500 2,377,200 Warrants.................................... 1,056,922 1,004,034 804,034 Convertible notes (June 1996)............... 518,595 416,667 416,667 Convertible notes (July 1997)*.............. 657,895 -- -- Convertible notes (August 1997)*............ 893,632 1,123,387 732,658 Convertible notes (March 1998).............. -- 528,048 -- --------- --------- --------- Total................................... 5,072,301 4,547,636 4,330,559 ========= ========= ========= * Due to the contingent nature of the conversion feature of these notes, a 20-day average market price was used to calculate the number of potentially dilutive shares. F-9

NOTE 1--SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES (CONTINUED) Additionally, the net loss applicable to common stockholders for the years ended December 31, 1997, 1998 and 1999 would have been decreased by adding back interest expense related to the convertible notes of approximately $980,000, $1,394,000 and $704,000, respectively. NOTE 2--ACQUISITIONS Effective May 1, 1999, the Company acquired substantially all of the assets of SecureWare SA and DMIC SA (SecureWare), as well as certain developed software licenses from the founder of SecureWare in exchange for $738,735 in cash (of which $151,203 is recorded in accrued liabilities at December 31, 1999) plus 174,575 shares of the Company's common stock, which had a market value based upon the trading price of the common stock on the Nasdaq Bulletin Board ("Market Value") of approximately $650,000 at the time of the acquisition. SecureWare, located in Bordeaux, France, is a software developer focusing on developing security solutions for a number of operating systems. The acquisition of SecureWare was accounted for under the purchase method of accounting, and accordingly, the acquired assets have been recorded at their estimated fair values at the date of acquisition. Purchased software related to this transaction was $889,000 and is being amortized over a period of five years. Goodwill related to this transaction was $406,000 and is being amortized over a period of seven years. The remaining purchase price is related to acquired fixed assets. The effect on the pro forma results of operations had the acquisition occurred at the beginning of 1999 was immaterial. On October 6, 1999, the Company acquired all of the outstanding capital stock of IntelliSoft Corp. (IntelliSoft) in exchange for 1,812,078 shares of common stock, which had a Market Value of approximately $7,250,000 at the time of the acquisition. In addition, the Company paid $751,575 to IntelliSoft dissenters to acquire their capital stock interests, which represented 9.4% of the outstanding capital stock of IntelliSoft at the date of the acquisition. The acquisition of these shares has been treated as the purchase and retirement of common stock. IntelliSoft, located in Acton, MA, specializes in developing true secure single sign-on, Web authorization, PKI, VPN, and enterprise management solutions. This transaction was accounted for under the pooling-of-interests method. Accordingly, the consolidated financial statements have been restated as if IntelliSoft had been combined for all periods presented. The following information reconciles total revenues and net loss of the Company as previously reported in the Company's Annual Report on Form 10-K for the years ended December 31, 1997 and 1998 with the amounts presented in the accompanying consolidated statements of operations for the years F-10

NOTE 2--ACQUISITIONS (CONTINUED) ended December 31, 1997 and 1998, as well as presents the separate results of operations of IntelliSoft for the year ended December 31, 1999 during the period preceding the acquisition. VASCO(1) INTELLISOFT COMBINED ------------ ----------- ------------ Revenues for the year ended: December 31, 1997.................................. $ 12,302,000 $ 906,000 $ 13,208,000 December 31, 1998.................................. 15,016,000 1,484,000 16,500,000 Nine months ended: September 30, 1999................................. N/A 1,635,000 N/A ------------ ----------- ------------ Net income (loss) for the year ended: December 31, 1997.................................. $ (5,916,000) $ (244,000) $ (6,160,000) December 31, 1998.................................. (3,649,000) (133,000) (3,782,000) Nine months ended: September 30, 1999................................. N/A $ 161,000 N/A ------------ ----------- ------------ - ------------------------ (1) Represents the historical results of the Company without considering the effect of the pooling of interests consummated during 1999. NOTE 3--INVENTORIES Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the first-in-first-out (FIFO) method. Inventories are comprised of the following: DECEMBER 31, ---------------------- 1998 1999 ----------- -------- Component parts....................................... $ 407,597 $213,909 Work-in-process and finished goods.................... 993,372 591,473 Obsolescence reserves................................. (129,000) -- ----------- -------- Total............................................. $ 1,272,327 $805,382 =========== ======== NOTE 4--ACCRUED EXPENSES Accrued expenses are comprised of the following: DECEMBER 31, ----------------------- 1998 1999 ---------- ---------- Accrued interest..................................... $ 860,957 $ 698,946 Accrued payroll...................................... 223,369 268,455 Other accrued expenses............................... 1,091,257 651,338 ---------- ---------- Total............................................ $2,175,583 $1,618,739 ========== ========== NOTE 5--INCOME TAXES At December 31, 1999, the Company has United States net operating loss carryforwards approximating $9,100,000 and foreign net operating loss carryforwards approximating $1,400,000. Such losses are available to offset future taxable income in the respective jurisdictions and expire in varying amounts F-11

NOTE 5--INCOME TAXES (CONTINUED) beginning in 2002 and continuing through 2019. In addition, if certain substantial changes in the Company's ownership are deemed to have occurred, there would be an annual limitation on the amount of the U.S. carryforwards which could be utilized. Pretax loss from continuing operations was taxed in the following jurisdictions: FOR THE YEARS ENDED DECEMBER 31, --------------------------------------- 1997 1998 1999 ----------- ----------- ----------- Domestic............................... $(4,898,541) $(3,165,857) $(1,809,920) Foreign................................ (654,619) 70,847 (80,254) ----------- ----------- ----------- Total.............................. $(5,553,160) $(3,095,010) $(1,890,174) =========== =========== =========== The provision for income taxes consists of the following: FOR THE YEARS ENDED DECEMBER 31, ------------------------------ 1997 1998 1999 -------- -------- -------- Current: Federal....................................... $ -- $ -- $ -- State......................................... -- (2,514) -- Foreign....................................... 406,579 689,516 322,310 Deferred: Federal....................................... $175,176 $ -- $ -- State......................................... 24,824 -- -- Foreign....................................... -- -- -- -------- -------- -------- Total..................................... $606,579 $687,002 $322,310 ======== ======== ======== The differences between income taxes computed using the statutory federal income tax rate of 34% and the provisions for income taxes reported in the consolidated statements of operations are as follows: FOR THE YEARS ENDED DECEMBER 31, ------------------------------------- 1997 1998 1999 ----------- ----------- --------- $(1,052,303) Expected tax benefit at the statutory rate............... $(1,888,074) $(642 Increase (decrease) in income taxes resulting from: Foreign taxes at rates other than 34%.................. 149,549 665,000 205,916 Net operating losses not benefited..................... 1,779,000 1,035,000 676,000 Nondeductible expenses................................. 622,257 100,000 155,938 Other, net............................................. (56,153) (60,695) (72,885) ----------- ----------- --------- Total................................................ $ 606,579 $ 687,002 $ 322,310 =========== =========== ========= F-12

NOTE 5--INCOME TAXES (CONTINUED) The deferred income tax balances are comprised of the following: DECEMBER 31, ------------------------- 1998 1999 ----------- ----------- Deferred tax assets: U.S. net operating loss carryforwards............ $ 2,886,000 $ 3,519,000 Foreign net operating loss carryforwards......... 439,000 582,000 Inventory........................................ 25,000 -- Accounts receivable.............................. 11,000 35,000 Accrued expenses................................. 128,000 16,000 Deferred revenue................................. 13,000 43,000 Other............................................ 28,000 22,000 ----------- ----------- Total gross deferred income tax assets............. 3,530,000 4,217,000 Less valuation allowance........................... (3,445,000) (4,121,000) ----------- ----------- 85,000 96,000 Deferred tax liabilities: Fixed assets..................................... (2,000) (13,000) ----------- ----------- Net deferred income taxes.......................... $ 83,000 $ 83,000 =========== =========== The net change in the total valuation allowance for the years ended December 31, 1997, 1998 and 1999 was an increase of $1,779,000, $1,035,000 and $676,000, respectively. In assessing the realizability of deferred tax assets, the Company considers whether it is more likely than not that some portion or all of the deferred tax assets will be realized. The ultimate realization of deferred tax assets is dependent upon the generation of future taxable income during the period in which these temporary differences become deductible. This assessment was performed considering the scheduled reversal of deferred tax liabilities, projected future taxable income, and tax planning strategies. The Company has determined that it is more likely than not that $83,000 of deferred tax assets will be realized. The remaining valuation allowance of $4,121,000 is maintained on deferred tax assets which the Company has not determined to be more likely than not realizable as of December 31, 1999. This valuation allowance will be reviewed on a regular basis and adjustments made as appropriate. F-13

NOTE 6--DEBT Debt consists of the following: DECEMBER 31, ----------------------- 1998 1999 ---------- ---------- Convertible stockholder note, interest payable at 9%................................................. $5,000,000 $5,000,000 Convertible note, interest payable at 3.25%.......... 3,400,000 3,400,000 Convertible note, interest payable at 9.5%........... 3,000,000 -- Revolving line of credit, interest payable at 6.48%.............................................. 3,000,000 -- Short-term credit facility, interest payable at 8.1%............................................... 450,000 -- Installment notes payable............................ 289,770 648,184 ---------- ---------- 15,139,770 9,048,184 Less current maturities.............................. (6,703,867) (639,322) ---------- ---------- Long-term debt....................................... $8,435,903 $8,408,862 ========== ========== In August 1997, the Company renegotiated the guarantee related to the final payment for the 1996 acquisition of Digipass into a term loan in the amount of $3.4 million. The note matures on September 30, 2002 and bears interest at a rate of 3.25% annually. In the event a public offering is completed, the lender may at its option require the principal amount of the loan to be repaid in cash, in which case the Company must pay additional special interest in the amount of $680,000. In addition, the note is convertible into common stock of the Company at the option of the bank, at a conversion price as specified in the agreement. As part of this transaction, T. Kendall Hunt, then the Company's Chief Executive Officer, entered into a pledge agreement with this financial institution pursuant to which he pledged, as collateral for the convertible note, 1,416,666 of his shares of common stock of the Company, which number of shares is subject to adjustment based on the market value of the shares. During 1996, the Company continued to raise capital privately, including a private placement consisting of the issuance of 666,666 shares of common stock and a $5,000,000 convertible note due May 29, 2001. The note is convertible at the option of the holder throughout the term of the note and is convertible at the option of the Company in the event that the Company completes a qualified public offering. The note bears interest at 9%, with interest payable to the holder on a quarterly basis. The holder may, at its option, elect to receive interest payments in cash or common stock. In calculating the shares of common stock to be issued in lieu of cash interest, the average closing price for the Company's common stock for the previous 20 days is used. Aggregate maturities of debt at December 31, 1999 are as follows: 2000........................................................ $ 639,322 2001........................................................ 5,008,862 2002........................................................ 3,400,000 ---------- Total................................................. $9,048,184 ========== Interest expense to stockholders was $507,100, $497,795 and $450,000 for the years ended December 31, 1997, 1998 and 1999, respectively. NOTE 7--STOCKHOLDERS' EQUITY COMMON STOCK During 1999, the Company issued 174,575 shares of common stock as part of the acquisition of SecureWare and 1,812,078 shares of common stock as part of the acquisition of IntelliSoft (see Note 2). F-14

The Company also raised additional capital during 1999 in a private placement of 3,285,714 shares of common stock at a price of $3.50 per share. Total issuance costs of $763,074 have been netted against the $11,500,000 in proceeds from the placement in the Company's financial statements. Also in 1999, the Company issued 158,000 shares of common stock as a result of the exercise of options under the Company's stock compensation plan (see Note 8) generating total proceeds of $44,225; 200,000 shares of common stock were issued as a result of the exercise of the Company's stock warrants, generating total proceeds of $50,000; and 26,019 shares of common stock were issued in lieu of interest that was accrued at December 31, 1998, related to the $5,000,000 convertible note placed during 1996 (see Note 6). During 1998, the "put" option associated with a 1995 private placement of equity units expired, resulting in the reclassification of the put obligation to additional paid-in capital. During 1998, the Company issued 658,257 shares of common stock as a result of the exercise of options under the Company's stock option plan (see Note 8) generating total proceeds of $116,347; 14,472 shares of common stock were issued as a result of the exercise of the Company's stock warrants, under the cashless exercise provision contained within the warrant. WARRANTS Warrant activity for the years ended December 31, 1997, 1998 and 1999 are summarized below: NUMBER OF WEIGHTED AVERAGE SHARES EXERCISE PRICE EXERCISE PRICE --------- ---------------- ----------------------- Outstanding at January 1, 1997...................... 899,412 $4.78 $ .25 -- 7.00 Granted............................................. 210,510 5.44 4.00 -- 10.00 Exercised........................................... -- Canceled............................................ (53,000) 6.00 6.00 --------- Outstanding at December 31, 1997.................... 1,056,922 4.85 .25 -- 10.00 Granted............................................. 5,000 5.19 5.19 Exercised........................................... (57,888) 5.19 5.19 Canceled............................................ -- -- -- --------- Outstanding at December 31, 1998.................... 1,004,034 4.83 .25 -- 10.00 Granted............................................. -- -- -- Exercised........................................... (200,000) .25 .25 Canceled............................................ -- -- -- --------- Outstanding at December 31, 1999.................... 804,034 5.97 4.00 -- 10.00 ========= NOTE 8--STOCK COMPENSATION PLAN The Company's 1997 Stock Compensation Plan, as amended, ("Compensation Plan") is designed and intended as a performance incentive. The Compensation Plan is administered by the Compensation Committee as appointed by the Board of Directors of the Company (Compensation Committee). The Compensation Plan permits the grant of options to employees of the Company to purchase shares of common stock and is intended to be a nonqualified plan. All options granted to employees are for a period of ten years, are granted at a price equal to the fair market value of the common stock on the date of the grant and are typically vested 20% on the first anniversary of the grant, with an additional 20% vesting on each subsequent anniversary of the grant. Alternative vesting schedules include either date or event-based vesting. The Compensation Plan further permits the grant of options to directors, consultants and other key persons (non-employees) to purchase shares of common stock. All options granted to non-employees are F-15

granted at a price equal to the fair market value of the common stock on the date of the grant, and may contain vesting requirements and/or restrictions as determined by the Compensation Committee at the time of grant. As of December 31, 1999, the Compensation Plan was authorized to issue options representing up to 5,292,417 shares of the Company's common stock. The authorized shares under the Compensation Plan represent 20% of the issued and outstanding shares of the Company. The Company applies APB Opinion No. 25 and related interpretations in accounting for the Compensation Plan. Had compensation cost for the Compensation Plan been determined consistent with SFAS No. 123, the Company's net loss available to common stockholders and net loss per common share would have been the pro forma amounts indicated below: FOR THE YEAR ENDED DECEMBER 31, --------------------------------------- 1997 1998 1999 ----------- ----------- ----------- Net loss available to common stockholders: As reported.......................................... $(6,241,639) $(3,782,012) $(2,212,484) Pro forma............................................ (6,514,741) (4,126,931) (2,789,233) Net loss per common share-basic and diluted: As reported.......................................... $ (0.30) $ (0.17) $ (0.09) Pro forma............................................ (0.31) (0.18) (0.11) For purposes of calculating the compensation cost consistent with SFAS No. 123, the fair value of each option grant is estimated on the date of grant using the Black-Scholes option-pricing model with the following weighted-average assumptions used for grants in 1997, 1998 and 1999: dividend yield of 0%; expected volatility of 50%; risk free interest rates ranging from 4.00% to 6.80%; and expected lives of five years. The following is a summary of activity under the Compensation Plan: OPTIONS OUTSTANDING OPTIONS EXERCISABLE -------------------- -------------------- WEIGHTED WEIGHTED WEIGHTED AVERAGE NUMBER AVERAGE NUMBER AVERAGE FAIR VALUE OF OF SHARES PRICE OF SHARES PRICE OPTIONS GRANTED --------- -------- --------- -------- ---------------- Outstanding at December 31, 1996....... 1,661,632 $1.01 1,299,757 $0.57 Granted................................ 512,500 4.18 $1.95 Exercised.............................. (189,375) 0.22 Forfeited.............................. (39,500) 3.91 --------- ----- Outstanding at December 31, 1997....... 1,945,257 1.85 1,460,629 1.29 Granted................................ 245,250 5.09 $2.55 Exercised.............................. (658,257) 0.18 Forfeited.............................. (56,750) 4.25 --------- ----- Outstanding at December 31, 1998....... 1,475,500 3.05 1,088,375 2.48 Granted................................ 1,174,000 3.13 $1.58 Exercised.............................. (158,000) 0.28 Forfeited.............................. (114,300) 4.01 --------- ----- Outstanding at December 31, 1999....... 2,377,200 $3.23 1,074,138 $3.04 ========= ===== ========= ===== F-16

The following table summarizes information about stock options outstanding at December 31, 1999: OPTIONS OUTSTANDING OPTIONS EXERCISABLE --------------------------------------- -------------------- WEIGHTED WEIGHTED WEIGHTED AVERAGE AVERAGE AVERAGE NUMBER REMAINING EXERCISE NUMBER EXERCISE RANGE OF EXERCISE PRICES OF SHARES CONTRACTUAL LIFE PRICE OF SHARES PRICE - ------------------------ --------- ---------------- -------- --------- -------- $2.50--7.25.............................. 2,022,700 8.29 years $3.76 719,638 $4.45 $0.1875--0.25............................ 354,500 3.52 years $0.20 354,500 $0.20 NOTE 9--EMPLOYEE BENEFIT PLAN The Company maintains a contributory profit sharing plan established pursuant to the provisions of Section 401(k) of the Internal Revenue Code, which provides benefits for eligible employees of the Company. The Company made no contributions to the plan during the years ended December 31, 1997, 1998 and 1999. NOTE 10--GEOGRAPHIC AND CUSTOMER INFORMATION In fiscal 1998, the Company adopted SFAS No. 131, "Disclosures about Segments of an Enterprise and Related Information" which establishes standards for reporting information about operating segments and related disclosures about products and services, geographic information and major customers. The Company has identified IdentiSoft and IntelliSoft as its reportable operating segments based on the nature of its products and services and financial reports which are evaluated regularly by management in deciding how to allocate resources and assess performance. The IdentiSoft segment offers software and handheld hardware security products that provide user authentication. The IntelliSoft segment offers enterprise-wide security products that provide encryption, access control, and administration and management tools. The Company does not identify or allocate operating expenses to its reportable segments. Information on reportable segments for the years ended December 31, 1997, 1998 and 1999 is as follows: IDENTISOFT INTELLISOFT TOTAL ----------- ----------- ----------- Year Ended December 31, 1997: Net revenues......................................... $11,911,000 $1,297,000 13,208,000 Cost of goods sold................................... 6,113,000 376,000 6,489,000 Gross profit......................................... 5,798,000 921,000 6,719,000 Year Ended December 31, 1998: Net revenues......................................... 14,652,000 1,848,000 16,500,000 Cost of goods sold................................... 6,845,000 364,000 7,209,000 Gross profit......................................... 7,807,000 1,484,000 9,291,000 Year Ended December 31, 1999: Net revenues......................................... 16,483,000 2,914,000 19,397,000 Cost of goods sold................................... 6,953,000 353,000 7,306,000 Gross profit......................................... 9,530,000 2,561,000 12,091,000 The Company does not measure total assets by reportable business segment for purposes of assessing performance and making operating decisions. During 1997, 1998 and 1999, sales to one customer from the Company's United States operations (a reseller of the Company's product in the Netherlands) aggregated approximately $1,994,000, $1,950,000 and $3,533,000 respectively, representing 15%, 12% and 18% of the total net revenues, respectively. Accounts receivable from this customer represented 25% and 30% of the Company's gross accounts receivable balance at December 31, 1998 and 1999, respectively. F-17

The Company allocates revenues based on the location of the country which initiates the sale. Information regarding geographic areas for the year ended December 31, 1997 is as follows: UNITED STATES BELGIUM TOTAL ------------- ----------- ----------- Net revenues........................................... $3,690,000 $ 9,518,000 $13,208,000 Long-lived assets...................................... 232,000 111,000 343,000 Information regarding geographic areas for the year ended December 31, 1998 is as follows: UNITED STATES BELGIUM TOTAL ------------- ----------- ----------- Net revenues........................................... $4,269,000 $12,231,000 $16,500,000 Long-lived assets...................................... 207,000 183,000 390,000 Information regarding geographic areas for the year ended December 31, 1999 is as follows: UNITED STATES BELGIUM FRANCE TOTAL ------------- ----------- -------- ----------- Net revenues................................. $7,188,000 $12,015,000 $194,000 $19,397,000 Long-lived assets............................ 331,000 810,000 49,000 1,190,000 NOTE 11--COMMITMENTS AND CONTINGENCIES The Company leases office space and equipment under operating lease agreements expiring at various times during 2004. Future minimum rental payments required under noncancelable leases are as follows: YEAR AMOUNT - ---- -------- 2000........................................................ $610,567 2001........................................................ $607,147 2002........................................................ $610,079 2003........................................................ $577,748 2004........................................................ $555,376 Rent expense under operating leases aggregated approximately $261,000, $357,000 and $434,000 for the years ended December 31, 1997, 1998 and 1999, respectively. From time to time, the Company has been involved in litigation incidental to the conduct of its business. Currently, the Company is not a party to any lawsuit or proceeding which, in management's opinion, is likely to have a material adverse effect on its business, financial condition or results of operations. NOTE 12--SUBSEQUENT EVENTS On January 27, 2000, VASCO filed for the listing of its common stock on the NASDAQ National Markets. Additionally, on February 11, 2000 VASCO filed with the SEC for a public offering of its common stock for approximately $50,000,000. In connection with this offering, filings were made with the EASDAQ and NASDAQ. F-18

SCHEDULE II VASCO DATA SECURITY INTERNATIONAL, INC. VALUATION AND QUALIFYING ACCOUNTS BAD DEBT ALLOWANCE FOR DOUBTFUL ACCOUNTS BEGINNING EXPENSE ACCOUNTS ENDING FOR TRADE ACCOUNTS RECEIVABLE BALANCE (RECOVERY) WRITTEN OFF BALANCE - ------------------------------- --------- ---------- ----------- -------- Year ended December 31, 1997...................... $452,000 $ 97,000 $(120,000) $429,000 Year ended December 31, 1998...................... 429,000 (272,000) (102,000) 55,000 Year ended December 31, 1999...................... 55,000 65,216 -- 120,216 OBSOLESCENCE BEGINNING EXPENSE INVENTORY ENDING RESERVE FOR OBSOLETE INVENTORIES BALANCE (RECOVERY) WRITTEN OFF BALANCE - -------------------------------- --------- ------------ ----------- -------- Year ended December 31, 1997...................... $154,000 $ 101,000 $ (91,000) $164,000 Year ended December 31, 1998...................... 164,000 35,000 (70,000) 129,000 Year ended December 31, 1999...................... 129,000 (36,000) (93,000) -- F-19

SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this Report to be signed on its behalf by the undersigned, thereunto duly authorized, on March 15, 2000. VASCO DATA SECURITY INTERNATIONAL, INC. /S/ MARIO R. HOUTHOOFT ----------------------------------------- Mario R. Houthooft CHIEF EXECUTIVE OFFICER AND PRESIDENT Pursuant to the requirements of the Securities Exchange Act of 1934, this Report has been signed by the following persons on behalf of the Registrant in the capacities indicated on March 15, 2000. POWER OF ATTORNEY Each of the undersigned, in his capacity as an officer or director, or both, as the case may be, of VASCO Data Security International, Inc. does hereby appoint Mario R. Houthooft and T. Kendall Hunt, and each of them severally, his true and lawful attorneys or attorney to execute in his name, place and stead, in his capacity as director or officer, or both, as the case may be, this Annual Report on Form 10-K for the fiscal year ended December 31, 1999 and any and all amendments thereto and to file the same with all exhibits thereto and other documents in connection therewith with the Securities and Exchange Commission. Each of said attorneys shall have power to act hereunder with or without the other attorney and shall have full power and authority to do and perform in the name and on behalf of each of said directors or officers, or both, as the case may be, every act whatsoever requisite or necessary to be done in the premises, as fully and to all intents and purposes as to which each of said officers or directors, or both, as the case may be, might or could do in person, hereby ratifying and confirming all that said attorneys or attorney may lawfully do or cause to be done by virtue hereof. SIGNATURE TITLE --------- ----- /s/ MARIO R. HOUTHOOFT ------------------------------------------- Chief Executive Officer and President and Mario R. Houthooft Director (Principal Executive Officer) /s/ T. KENDALL HUNT Chairman of the Board and Executive Vice ------------------------------------------- President (Principal Financial Officer and T. Kendall Hunt Principal Accounting Officer) /s/ CHRISTIAN DUMOLIN ------------------------------------------- Director Christian Dumolin /s/ MICHAEL P. CULLINANE ------------------------------------------- Director Michael P. Cullinane /s/ POL HAUSPIE ------------------------------------------- Director Pol Hauspie /s/ FORREST D. LAIDLEY ------------------------------------------- Director Forrest D. Laidley /s/ MICHAEL A. MULSHINE ------------------------------------------- Director Michael A. Mulshine

EXHIBIT 21 SUBSIDIARIES OF THE REGISTRANT PERCENTAGE ENTITY JURISDICTION OWNERSHIP - ------ ------------ ---------- VASCO Data Security Europe SA............................... Belgium 100%* VASCO Data Security NV/SA................................... Belgium 100%* VASCO Data Security, Inc.................................... Delaware 100% * All shares are held by the parent corporation, except that shares representing less than 1% are held by T. Kendall Hunt.

5 THIS SCHEDULE CONTAINS SUMMARY FINANCIAL INFORMATION EXTRACTED FROM CONSOLIDATED STATEMENTS OF OPERATIONS FOR THE YEARS END DECEMBER 31, 1997, 1998 AND 1999. CONSOLIDATED BALANCE SHEETS AT DECEMBER 31, 1998 AND 1999, AND IS QUALIFIED IN ITS ENTIRETY BY REFERENCE TO SUCH FINANCIAL STATEMENTS.

YEAR YEAR YEAR DEC-31-1997 DEC-31-1998 DEC-31-1999 DEC-31-1997 DEC-31-1998 DEC-31-1999 0 1,662,084 2,576,494 0 0 0 0 3,641,890 2,991,583 0 (55,000) (120,216) 0 1,272,327 805,382 0 7,047,392 7,419,197 0 1,217,762 2,260,425 0 (827,602) (1,070,046) 0 9,556,584 12,318,029 0 10,780,634 4,946,027 0 0 0 0 0 0 0 0 0 0 22,806 26,462 0 (9,682,759) (1,063,322) 0 9,556,584 12,318,029 13,207,980 16,499,866 19,397,108 13,207,980 16,499,866 19,397,108 6,488,798 7,209,038 7,305,672 17,375,602 17,826,521 20,290,065 237,355 310,728 182,294 0 0 0 1,148,183 1,457,627 814,923 (5,553,160) (3,095,010) (1,890,174) 606,579 687,002 322,310 0 0 0 0 0 0 0 0 0 0 0 0 (6,159,739) (3,782,012) (2,212,484) (0.30) (0.17) (0.09) (0.30) (0.17) (0.09)