- -------------------------------------------------------------------------------- - -------------------------------------------------------------------------------- UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON, D.C. 20549 --------------------- FORM 10-K FOR ANNUAL AND TRANSITION REPORTS PURSUANT TO SECTIONS 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
PART I CAUTIONARY STATEMENT FOR PURPOSES OF THE "SAFE HARBOR" PROVISIONS OF THE PRIVATE SECURITIES LITIGATION REFORM ACT OF 1995 This Annual Report on Form 10-K, including "Management's Discussion and Analysis of Financial Condition and Results of Operations," contains "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995 concerning, among other things, the prospects, developments and business strategies for the Company (as defined) and its operations, including the development and marketing of certain new products and the anticipated future growth in certain markets in which the Company currently markets and sells its products or anticipates selling and marketing its products in the future. These forward-looking statements (i) are identified by their use of such terms and phrases as "expected," "expects," "believe," "believes," "will," "anticipated," "emerging," "intends," "plans," "could," "may," "estimates," "should," "objective" and "goals" and (ii) are subject to risks and uncertainties and represent the Company's present expectations or beliefs concerning future events. The Company cautions that the forward-looking statements are qualified by important factors that could cause actual results to differ materially from those in the forward-looking statements, including (a) risks of general market conditions, including demand for the Company's products and services, competition and price levels and the Company's historical dependence on relatively few products, certain suppliers and certain key customers, and (b) risks inherent to the computer and network security industry, including rapidly changing technology, evolving industry standards, increasing numbers of patent infringement claims, changes in customer requirements, price competitive bidding, changing government regulations and potential competition from more established firms and others. Therefore, results actually achieved may differ materially from expected results included in, or implied by, these statements. ITEM 1. DESCRIPTION OF BUSINESS GENERAL DEVELOPMENT OF BUSINESS VASCO Data Security International, Inc. was incorporated in Delaware in 1997 and is the successor to VASCO Corp., a Delaware corporation. Our principal executive offices are located at 1901 South Meyers Road, Suite 210, Oakbrook Terrace, Illinois 60181 and the telephone number at that address is (630) 932-8844. Our principal offices in Europe are located at Koningin Astridlaan 164, B-1780 Wemmel (Belgium) and the telephone number at that address is 32(0)2/456.98.10. Unless otherwise noted, specifically in the section entitled Management's Discussion and Analysis of Financial Condition and Results of Operations, references in this prospectus to "VASCO," "company," "we," "our," and "us" refer to VASCO Data Security International, Inc., its predecessor, VASCO Corp., and its subsidiaries. On March 29, 2001, the Company acquired Identikey Ltd., ("Identikey"), a privately held international security software company headquartered in Brisbane, Australia, with operations in the United States, Europe and Australia. Under the terms of the purchase agreement, more than 90 percent of the outstanding capital stock of Identikey was exchanged for 366,913 shares of Company common stock, with potential additional earn-out payments made in the form of additional shares which are based on defined performance incentives as specified in the purchase agreement. The Company, through its operating subsidiaries, designs, develops, markets and supports open standards-based hardware and software security systems which manage and secure access to information assets. FINANCIAL INFORMATION RELATING TO FOREIGN AND DOMESTIC OPERATIONS AND EXPORT SALES See Note 10 to VASCO Notes to Consolidated Financial Statements for certain information about foreign and domestic operations and export sales. - --------------- This report contains the following trademarks of the Company, some of which are registered: VASCO, AccessKey, VACMan Server and VACMan/CryptaPak, AuthentiCard and Digipass. 1
NARRATIVE DESCRIPTION OF THE BUSINESS General We design, develop, market and support security products and services which manage and secure access to computer systems of corporate and governmental clients. Additionally, we enable secure financial transactions made over private enterprise networks and public networks, such as the Internet. We believe that our software and hardware products provide organizations with strong, flexible, and effective Internet and enterprise security solutions and they compete favorably against those of our competitors. Our Digipass product line provides greater flexibility and a more affordable means than competing products of authenticating to any network, including the Internet. The Digipass family of user authentication devices, all of which incorporate an electronic digital signature capability to guarantee the integrity of electronic transactions and data transmissions, are commonly referred to as security tokens. The VACMAN product line incorporates a range of strong authentication utilities and solutions designed to allow organizations to add Digipass strong authentication into their existing networks and applications. Our security solutions are sold worldwide through our direct sales force, as well as through distributors, resellers and systems integrators. We currently have approximately 500 customers in more than 50 countries. Representative customers of our products include Rabobank Nederland, ABN AMRO Bank, Eterra Norway, ING Bank, John Hancock, Fortis Bank, Liberty Mutual, Allmerica Financial Services and the U.S. Government. Industry Background The growth in electronic banking and electronic commerce, and the increasing use and reliance upon proprietary or confidential information by businesses, government and educational institutions that is remotely accessible by many users, has made information security a paramount concern. We believe that enterprises are seeking solutions which will continue to allow them to expand access to data and financial assets while maintaining network security. According to International Data Corporation (IDC), the global market for security products is growing from $4.0 billion in 1999 to over $11.3 billion in 2004, a compound annual growth rate of 23%. Internet and Enterprise Security. With the advent of personal computers and distributed information systems in the form of wide area networks, intranets, local area networks and the Internet, as well as other direct electronic links, many organizations have implemented applications to enable their work force and third parties, including vendors, suppliers and customers, to access and exchange data and perform electronic transactions. As a result of the increased number of users having direct and remote access to such enterprise applications, data and financial assets have become increasingly vulnerable to unauthorized access and misuse. Individual User Security. In addition to the need for enterprise-wide security, the proliferation of personal computers, personal digital assistants and mobile telephones in both the home and office settings, combined with widespread access to the Internet, have created significant opportunities for electronic commerce by individual users such as electronic bill payment, home banking and home shopping. Fueled by recent and well-publicized incidents including misappropriation of credit card information and denial of service attacks, there is a growing perception among many consumers that there is a risk involved in transmitting information via the Internet. These incidents and this perception may hamper the development of consumer-based electronic commerce. Accordingly, we believe that electronic commerce will benefit from the implementation of improved security measures that accurately identify users and reliably encrypt data transmissions over the Internet. Components of Security. Data and financial asset security, and secured access to and participation in on-line commerce, generally consist of the following components: - Encryption: Maintains data privacy by converting information into an unreadable pattern and allowing only authorized parties to decrypt the data. Encryption can also maintain data integrity by 2
creating digital signatures for transmitted data, enabling the recipient to check whether the data has been changed since or during transmission. - Identification and Authentication: Serves as the foundation for other security mechanisms by verifying that a user is who he or she claims to be. Identification and authentication mechanisms are often employed with encryption tools to authenticate users, to determine the proper encryption key for encrypting/decrypting data, or to enable users to digitally "sign" or verify the integrity of transmitted data. - Access Control: Software that provides authentication, authorization, and accounting functions, controlling a user's access to only that data or the financial assets which he or she is authorized to access, and which keep track of a user's activities after access has been granted. - Administration and Management Tools: Software which sets, implements, and monitors security policies, the access to which is typically regulated by access control systems. These tools are extremely important to the overall effectiveness of a security system. The most effective security policies employ most, if not all, of the above components. Most companies, however, only implement a patchwork of these components, which can result in their security systems being compromised. The VASCO Solution To date, most approaches to network security, including Internet security, have been limited in scope and have failed to address all of the critical aspects of data security. We believe that an effective enterprise-wide solution must address and assimilate issues relating to the following: - speed and ease of implementation, use, and administration; - reliability; - interoperability with diverse enterprise environments, existing customer applications, and the security infrastructure; - scalability; and - overall cost of ownership. Accordingly, we have adopted the following approach to data security: - In designing our products, we have sought to incorporate all industry-accepted, open, and non-proprietary protocols. This permits interoperability between our products and the multiple platforms, products, and applications widely in use. - We have designed our products and services to minimize their integration effort with, and disruption of, existing legacy applications and the security infrastructure, such as public key infrastructure, known as PKI. We provide customers with easier implementations and a more rapid means of implementing security across the enterprise, including the Internet. With security being a critical enabling technology for on-line business initiatives, speed and ease of security implementation has become crucial to an organization's success. - We design our products and services to have a lower total cost of security ownership than competing products and services. We have found that product improvements and tools that lower a customer's total cost of ownership create differentiating sales and marketing tools, and also help in the development of a highly loyal customer base that is open to new solutions that we offer. As a result of this approach, we believe that we are positioned to be a leading provider of our open standards-based software and hardware security solutions. 3
VASCO'S STRATEGY We believe we have one of the most complete lines of security products and services available in the market today and we intend to become a leading worldwide provider of these products and services. A key element of our growth strategy is to demonstrate to an increasing number of distributors, resellers and systems integrators that, by incorporating our security products into their own products, they can more effectively differentiate themselves in their marketplaces and increase the value of their products. In addition, we demonstrate to our corporate users that our products provide mission critical security to their internal and external security infrastructures. Following this aggressive marketing and promotion effort, we work with these resellers and integrators to support their sales of solutions which include our products. Also, we plan to expand our direct sales marketing program to new and existing blue chip customers. Further, we intend to: Increase Sales and Marketing Efforts Worldwide. We intend to increase sales of our security products and services in our firmly established European markets and to aggressively increase our sales and support presence and marketing efforts in North America, South America, Asia/Pacific, Australia and the Middle East. We plan to: - market new services and products to our existing customers by providing testimonial evidence of user experiences from other customers; - launch a worldwide marketing campaign to raise awareness of our solutions among the decision makers in the security products industry; - form additional strategic relationships with resellers and vendors of complementary, innovative security products and systems; and - develop a marketing and sales infrastructure in new markets. Continue Innovation. We intend to continue to enhance and broaden our line of security products to meet the changing needs of our existing and potential customers by: - building on our core software and hardware security expertise, such as expanding our technology for use on different platforms (like mobile phones and personal digital assistants) and incorporating biometrics into our products; - acquiring complementary technologies or businesses; and - developing additional applications for our products in areas which may include securing the exchange of data in the healthcare field and providing security for Internet gambling and lottery transactions, among others. VASCO'S PRODUCTS Digipass Product Line Our Digipass product line, which exists as a family of authentication devices as well as extensive software libraries, provides a flexible and affordable means of authenticating users to any network, including the Internet. Security can be broken into three factors: - What you have (the Digipass device itself); - What you know (the PIN code to activate the Digipass); and - Who you are (biometrics). 4
The Digipass family is currently based on the first two factors. We are developing new technology to incorporate the third factor into the Digipass. Using the Digipass system, in order to enter a remote system or to digitally sign data one needs: - the hardware device (the token) itself so that if you do not physically have the token, you will not be able to log on to the system; and - the PIN code for the token so if you do not know the appropriate code the user will not be able to use the applications stored inside. Both of these factors help to make sure that a natural person is authenticating (or signing), instead of a computer or another device. These factors also enable extremely high portability for security anytime, anywhere and anyhow. Digipasses calculate dynamic passwords, also known as one-time passwords to authenticate users on a computer network and for a variety of other applications. There are several versions of the Digipass, the DP Desk 3000, DP Pro 200, DP Go 1, 250, 300, 550, 600, 700, 800 and 850, each of which has its own distinct characteristics depending on the platform that they use and the functions they perform. However, the Digipass family is designed to work together and customers can switch their users' devices without requiring any changes to the customers' existing infrastructure. In addition, these devices can be used to calculate digital signatures, also known as electronic signatures or message authentication codes, to protect electronic transactions and guarantee the integrity of the contents of these transactions. In addition, Digipass Desk 3000 is designed to operate on non-VASCO platforms such as a desktop PC or laptop. With the DP Pro 200, Digipass technology is brought to personal digital assistants (PDA) while the DP Go 1 does the same for the mobile phones. Digipass 800 and 850 combine the benefits of both traditional password tokens (authentication and digital signatures) like Digipass 300 with smartcard readers. They both bring portability to smart cards and allow secure time-based algorithms. A VASCO-secured system has the features needed to secure both today and tomorrow's IT resources. 5
DIGIPASS AT WORK [GRAPHIC: DIGIPASS INITIALIZATION PROCESS] The above illustration shows the various steps in the Digipass initialization process. In the first step, the devices are initialized with their unique set of secrets and keys per device. These secrets are stored in an encrypted way on a diskette that is sent to the application owner (for example, the information technology manager in a company or the security department of a bank). These floppy disks are one way of safely transporting the Digipass secrets to the host computer. The files on the floppy disks will be used to read all the necessary secrets and other data from the delivered Digipasses into a database. Then the application owner will assign those Digipass secrets to the end-users. This assignment is based on the serial number of the Digipass and the identity of the end-user. The Digipass is then shipped to the end-user together with a manual and the protected PIN-code on a secure PIN-mailer is sent by a separate shipment. Using a Digipass requires a connection to the host (server) computer that knows the parameters of the end-user's Digipass. Every time the user sends a dynamic password or digital signature to the host computer, the computer will retrieve all the necessary information from the database and will check the validity of the password or signature. After the host has checked the validity of the dynamic password or signature, it will notify the end-user of the correctness or incorrectness of the validity check. Digipass security devices are not terminal dependent and do not require any specific software platform since they only interact with a person. Currently, the Digipass is used in many applications, the largest of which is banking. Different banking applications are: - corporate banking through direct dial-up, as well as over the Internet and - retail banking to secure transactions made through the use of a dial-up connection with a personal computer, the traditional phone system, the Internet, and wireless phones and other communication devices such as personal digital assistants. 6
Another significant application for the Digipass is to secure access to corporate networks for home-based, traveling and other remote users. Finally, Digipasses are increasingly being used in a variety of e-commerce applications where the user is part of a pre-defined user group. We intend to expand the use of the Digipass to other groups of users and applications, including electronic commerce transactions directed at the general public. Cryptech Product Line. The Cryptech product line produces encrypted microprocessor chips. These chips are used to encrypt data for use in ATMs, fax machines, modems and security servers at high speeds using DES and RSA algorithms. VACMAN Product Line The VACMAN Product line incorporates a range of strong authentication utilities and solutions designed to allow organizations to add Digipass strong authentication into their existing networks and applications. Designed to provide the greatest flexibility, while not compromising on functionality or security, VACMAN solutions are able to integrate with most popular hardware and software. Once integrated the VACMAN components become largely transparent to the users minimizing rollout and support issues. VACMAN Controller Designed by specialists in "system entry" security, VACMAN Controller makes it easy to administer a high level of access control. You simply add a field to your existing user database, describing the unique Digipass token assigned to the user. VACMAN Controller takes it from there, automatically authenticating the logon request using the security sequence you specify, whether it's a one-time password using either Response-Only or a Challenge/Response authentication scheme or an electronic signature. VACMAN Controller gives you the freedom to provide secure remote access to virtually any type of application. VACMAN Controller is a library requiring only a couple of days to implement in most systems and supports all Digipass functionality. Once linked to an application, VACMAN Controller automatically handles login requests from any users you've authorized to have a Digipass token. VACMAN RADIUS Middleware VACMAN RADIUS Middleware brings strong user authentication to existing RADIUS based environments, while seamlessly integrating with other current infrastructure technology. Many companies already use RADIUS servers and/or firewalls to provide a way to centrally manage all remote connections to the corporate IT infrastructure. VACMAN RADIUS Middleware allows administrators to positively identify remote users before granting remote access to sensitive corporate data and applications. Logically VACMAN RADIUS Middleware is installed between the RADIUS client (NAS, RAS or firewall) and the existing RADIUS server or servers. Once installed VACMAN RADIUS Middleware functions transparently, adding strong, two factor, authentication without otherwise affecting the operation of the server or other network components. With a range of automated administration features such as Dynamic User Registration, automatic assignment of Digipass devices and the ability to bulk manage users, VACMAN RADIUS Middleware provides transparent strong authentication without adding significantly to the administration load. VACMAN Server VACMAN Server is an integrated, cross platform solution that uses industry and international standards to provide strong two factor authentication, access control and audit for remote, local and web-based users. It includes full support for RADIUS, LAN and Web-based access solutions. VACMAN Server has three access control modules that are available for individual or integrated use. Strong authentication is achieved for server based access control and management on an anywhere, anyhow, 7
anytime basis. System access can be achieved independently via each module (i.e., specific to a functional task) or in concert with each other, making efficient use of common user authentication administration. VACMAN Server provides a number of centralized services that are common to all authentication solutions including secure, web-based administration allowing administrators the option to administer either locally or remotely, customizable reporting, delegation of administrative tasks on an organizational basis or by function, full session monitoring and a full redundancy option for the authentication server and database. [VACMAN SERVER FOR RADIUS GRAPHIC] RADIUS based solutions have generally relied on static user name and passwords for authentication. Static passwords offer a potential weakness as they can be trapped, guessed or forced to gain access to an otherwise secure network. The VACMAN Server for RADIUS (VSR) removes this potential weakness by adding support for One Time Passwords (OTP) for secure, two factor authentication using Vasco's Digipass technology. OTP's ensure that all users are strongly authenticated with information that cannot be re-used or guessed, eliminating the most common means of defeating security systems. VACMAN Server for RADIUS compliments an organization's existing security infrastructure by ensuring that only users who have been strongly authenticated are granted access to the network. The ability to support industry standards and run on existing operating systems and hardware platforms provides the flexibility to support any existing security solution adding value to an organization's existing investment in people and equipment. 8
[VACMAN SERVER FOR NETWORKS GRAPHIC] Combining strong user authentication and audit for LAN and RADIUS into a single strong authentication solution, VACMAN Server for Networks provides the same authentication solution to users regardless of how they access the network and network resources. VACMAN Server for Networks has been designed to integrate seamlessly within existing Windows NT and Windows 2000 based LAN solutions and can generally function with existing client side network components. The ability to reuse existing client side network access components provides an organization with the option of implementing a staged rollout where user numbers are high or users are scattered around different geographic locations. This also reduces support and administrative loads as the user only sees minor changes to the logon process. 9
[VACMAN SERVER FOR WEB GRAPHIC] Combining user authentication, authorization and audit into a single strong authentication solution, VACMAN Server for Web extends established AAA principles to web based access and also supports the use of One Time Passwords (OTP) for true, Digipass two factor strong authentication. VACMAN Server for Web controls user access to individual resources within the protected web site allowing an organization to finely control what information is accessed, not only by who, but also when. With VACMAN Server for Web installed, OTP's can be used to provide secure access to remote users, through the organization's existing web servers and firewalls. Once remote access is allowed and corporate processes can be accessed, additional authentication may be required to validate any transactions undertaken. VACMAN Server for Web fully supports Digipass electronic signatures providing non-repudiation for any electronic transaction. 10
[VACMAN SERVER CORPORATE LOGO] VACMAN Server Corporate combines all VACMAN Server modules (RADIUS, LAN and Web) into a single strong authentication solution for the entire organization. VACMAN Server Corporate has been designed to integrate seamlessly within existing access solutions to the network and can generally function with existing client side network components. The ability to reuse existing client side network access components provides an organization with the option of implementing a staged rollout where user numbers are high or users are scattered around different geographic locations. This also reduces support and administrative loads as the user only sees minor changes to the logon process. With the ability to support multiple domains and web servers, a single VACMAN Server Corporate implementation can secure access to the entire network regardless of the location of the protected entry points. VACMAN Server Corporate supports an optional API that allows the administrator to provide authentication services, manage users and their rights and integrate VACMAN Server Corporate into existing security and user management solutions via a consistent, secure programmatic interface, significantly reducing the management overheads. Public Key Infrastructure Many corporations are increasingly relying upon digital certificates to authenticate and identify users on a network, including the Internet. In addition, digital certificates are used to transmit data in an encrypted format over a network. The issuance, revocation, management and policies surrounding these digital certificates is commonly referred to as public key infrastructure or PKI. Like any other new comprehensive technology infrastructure, large companies need to integrate PKI into their legacy and new applications. This takes time, money, and specialized, hard-to-find personnel. While there may be significant commercial 11
potential for PKI, the process of integrating PKI into other enterprise-wide applications has proven so difficult that few companies have existing PKI deployments beyond the pilot stage. We also have patent pending technology that allows for secure storage of a digital certificate's private key on a server that can be accessed from any network using any of our Digipass family of products. The effect of this technology is that it gives digital certificates the portability of PKI deployed on smartcards, without the cost or infrastructure development required for deploying smartcards and their associated smartcard readers. INTELLECTUAL PROPERTY AND PROPRIETARY RIGHTS AND LICENSES We rely on a combination of patent, copyright, trademark and trade secret laws, as well as employee and third-party non-disclosure agreements to protect our proprietary rights. In particular, we hold several patents in the United States and a corresponding patent in certain European countries, which cover certain aspects of our technology. The majority of our patents cover our Digipass family of security tokens. The U.S. patents expire between 2003 and 2010 and the European patent expires in 2008. We believe these patents to be valuable property rights and we rely on the strength of our patents and on trade secret law to protect our intellectual property rights. To the extent that we believe our patents are being infringed upon, we intend to assert vigorously our patent protection rights, including but not limited to, pursuing all available legal remedies. RESEARCH AND DEVELOPMENT Our research and development efforts historically have been, and will continue to be, concentrated on product enhancement, new technology development and related new product introductions. We employ 20 full-time engineers and, from time to time also engage independent engineering firms to conduct non-strategic research and development efforts on our behalf. For the fiscal years ended December 31, 1999, 2000 and 2001, we expended $3,587,000, $4,369,000 and $4,981,000, respectively, on research and development, representing approximately 18%, 15% and 19% of consolidated revenues for 1999, 2000 and 2001, respectively. While management is committed to enhancing our current product offerings, and introducing new products, we cannot be certain that our research and development activities will be successful. Furthermore, we may not have sufficient financial resources to identify and develop new technologies and bring new products to market in a timely and cost effective manner, and we cannot ensure that any such products will be commercially successful if and when they are introduced. PRODUCTION Our security hardware products are manufactured by third parties pursuant to purchase orders that we issue. Our hardware products are made primarily from commercially available electronic components which are purchased globally. Our software products are produced either in-house or by several outside sources in North America, Australia and Europe. The security tokens utilize commercially available programmable microprocessors, or chips. We use two microprocessors, made by Samsung and Epson, for the various hardware products we produce. The Samsung microprocessors are purchased from Samsung Semiconductor in France, and the Epson microprocessors are purchased from Alcom Electronics NV/SA, also located in Belgium. The microprocessors are the only components of our security tokens that are not commodity items readily available on the open market. While there is an inherent risk associated with each supplier of microprocessors, we believe having two sources reduces the overall risk to a commercially acceptable level. Orders of microprocessors and some other components generally require a lead time of 12-16 weeks. We attempt to maintain a sufficient inventory of all parts to handle short term increases in orders. Large orders that would significantly deplete our inventory are typically required to be placed with more than 12 weeks of lead time, allowing us to attempt to make appropriate arrangements with our suppliers. We purchase the majority of our product components and arrange for shipment to third parties for assembly and testing in accordance with our design specifications. Our security token products are assembled 12
exclusively by two independent companies, each of which is based in Hong Kong. Purchases from one of the companies are made on a purchase order by purchase order basis. Purchases from the other company are under a contract with automatic one-year renewals and subject to termination on six months notice. Each of these companies assembles our security tokens at facilities in mainland China. One of the companies also maintains manufacturing capacity in Hong Kong. Equipment designed to test product at the point of assembly is supplied by us and periodic visits are made by our personnel for purposes of quality assurance, assembly process review and supplier relations. There can be no assurance that we will not experience interruptions in the supply of either the component parts that are used in our products or fully-assembled token devices in general. In the event that the flow of components or finished product was interrupted there could be a considerable delay in finding suitable replacement sources for those components, as well as in replacement assembly subcontractors with the result that our business and results of operations could be adversely affected. COMPETITION The market for computer and network security solutions is very competitive and, like most technology-driven markets, is subject to rapid change and constantly evolving products and services. For both Digipass and VACMAN products, our main competitor is RSA Security, Inc.. There are many other companies such as Computer Associates International, Inc., Symantec, Inc., ActivCard and Entegrity Solutions, Inc. which offer hardware, software and services that range from simple locking mechanisms to sophisticated encryption technologies. We believe that competition in this market is likely to intensify as a result of increasing demand for security products. We believe that the principal competitive factors affecting the market for computer and network security products include the strength and effectiveness of the solution, technical features, ease of use, quality/reliability, customer service and support, name recognition, distribution channels and price. Although we believe that our products currently compete favorably with respect to such factors, other than name recognition in certain markets, there can be no assurance that we can maintain our competitive position against current and potential competitors, especially those with significantly greater financial, marketing, service, support, technical and other competitive resources. Many of our present and potential competitors have significantly greater financial, technical, marketing, purchasing and other resources than we do, and as a result, may be able to respond more quickly to new or emerging technologies and changes in customer requirements, or to devote greater resources to the development, promotion and sale of products, or to deliver competitive products at a lower end user price. Current and potential competitors have established or may establish cooperative relationships among themselves or with third parties to increase the ability of their products to address the needs of our prospective customers. Accordingly, it is possible that new competitors or alliances may emerge and rapidly acquire significant market share. Our products are designed to allow authorized users access to a computing environment, in some cases using patented technology as a replacement for the static password. Although certain of our security token technologies are patented, there are other organizations that offer token-type password generators incorporating challenge-response or response-only approaches that employ different technological solutions and compete with us for market share. For additional information regarding our competition, please refer to the section titled "Risk Factors." SALES AND MARKETING Our security solutions are sold through our direct sales force, as well as through distributors, resellers and systems integrators. A sales staff of 52 coordinates our sales through both our sales channels and these strategic partners' sales channels and makes direct sales calls either alone or with sales personnel of vendors of computer systems. Our sales staff also provides product education seminars to sales and technical personnel of vendors and distributors with whom we have working relationships and to potential end-users of our products. 13
Part of our expanded selling effort includes approaching our existing strategic partners to find additional applications for our security products. In addition, our marketing plan calls for the identification of new business opportunities that may require enhanced security over the transmission of electronic data or transactions where we do not currently market our products. Our efforts also include the preparation and dissemination of white papers prepared by our support engineers which explain how we believe our security products can add value or otherwise be beneficial. CUSTOMERS AND MARKETS Customers for our products include some of the world's most recognized names:
ITEM 2. PROPERTIES Our corporate office is located in the United States in an office complex in Oakbrook Terrace, Illinois, a suburb of Chicago. This facility is leased through November 30, 2004, and consists of approximately 9,000 square feet. Our European administrative, sales and marketing, research and development and support facilities are located in a suburb of Brussels, Belgium. These facilities consist of approximately 23,500 square feet of office space which are occupied under a lease expiring in October 30, 2006. We believe that these facilities are adequate for our present growth plans. Our Australian office is located in a suburb of Brisbane, consisting approximately 4,900 square feet under a lease expiring on December 2006. Our Asia/Pacific sales office is located in an office complex in Singapore, consisting approximately 377 square feet with a one-year lease, renewable annually. ITEM 3. LEGAL PROCEEDINGS The Company is from time to time involved in litigation incidental to the conduct of its business. The Company is currently not a party to any lawsuit or proceeding which, in the opinion of management, is likely to have a material adverse effect on the Company's business, financial condition or results of operations. On March 13, 2002, a suit was filed against the Company claiming patent infringement, false designation of origin and tradedress infringement. The case is currently being evaluated by the Company and its legal counsel. The Company believes the suit is without merit. As the suit is in its early stages, management is unable to estimate the effect of this suit at this time. ITEM 4. SUBMISSION OF MATTERS TO A VOTE OF SECURITY HOLDERS No matter was submitted to a vote of security holders during the fourth quarter of 2001, through solicitation of proxies or otherwise. 15
PART II ITEM 5. MARKET FOR REGISTRANT'S COMMON EQUITY AND RELATED STOCKHOLDER MATTERS On March 20, 1998, the Company's Common Stock was approved for trading on the NASD Electronic Bulletin Board system under the symbol "VDSI." On April 7, 2000, the Company's Common Stock was listed on the Nasdaq National Market in the United States under the trading symbol "VDSI". On March 13, 2002, the closing sale price for the Common Stock on the Nasdaq was $2.99 per share. Such market quotations reflect inter-dealer prices, without retail mark-up, mark-down or commission and may not necessarily represent an actual transaction. On February 28, 2002, there were approximately 123 holders of record of the Common Stock. The following table sets forth the high and low closing bid quotations for the Common Stock for the periods indicated.
ITEM 6. SELECTED FINANCIAL DATA
actions which occurred mostly during the 1980's. In the Exchange Offer, almost 98% of our predecessor's securities were tendered and accepted for exchange. In October 1998, we completed the merger of our predecessor with and into the current company and thereby eliminated all remaining outstanding securities of our predecessor and our predecessor thereby ceased to exist. Since the Exchange Offer, we have engaged in four acquisitions. In May 1999, we acquired the assets of SecureWare SA, a French company for a combination of approximately $1.4 million in our stock and cash. In October 1999, we acquired Intellisoft Corp. for a combination of approximately $8 million in our stock and cash distributed to dissenting shareholders. This acquisition was accounted for under the pooling-of-interests method of accounting and, therefore, all of our financial information has been restated to include the results of IntelliSoft. In August 2000, we acquired Invincible Data Systems (IDS) in a transaction which was accounted for under the pooling-of-interests method of accounting. A total of 322,565 shares were issued in the transaction. Our historical financial information was not restated for this transaction, which was deemed immaterial. Our latest acquisition was on March 29, 2001 when we acquired Identikey Ltd. ("Identikey"), a privately held international security software company headquartered in Brisbane, Australia. Under the terms of the purchase agreement, more than 90 percent of the outstanding capital stock of Identikey was exchanged for 366,913 shares of Company common stock, with potential additional earn-out payments made in the form of additional shares which are based on defined performance incentives as specified in the purchase agreement. This purchase was accounted for under the purchase method of accounting, and accordingly, the acquired assets have been recorded at their estimated fair values at the date of acquisition. Intangible assets related to this transaction were $1,897,000 and are being amortized over a period of 7 years. OVERVIEW We design, develop, market and support security products and services which manage and protect against unauthorized access to computer systems of corporate and governmental clients. Revenue and Earnings. We sell the majority of our products in European countries with significant sales in the United States, although we intend to actively pursue additional markets outside of Europe, particularly South America, Asia/Pacific, Australia and the Middle East. Revenues from sales from our Digipass family, specifically the Digipass 300 and 500 tokens, continue to represent the majority of our total revenues. During 1999 and 2000, Digipass products accounted for 80% and 70% of revenues, respectively. For 2001, in excess of 80% of the Company's sales were comprised of security token devices. Although we believe it is likely that sales of the Digipass family of tokens, which can be used on various platforms, will continue to account for a majority of our total revenues for the next few years, we also believe that revenues from sales of our other hardware and software data security products, including the VACMAN product line, will increase in the future. Research and Development. We are devoting substantial capital and other resources to enhancing our existing security products and developing new products to provide enterprise-wide hardware and software security solutions. Costs of research and development, principally the design and development of hardware and software prior to the determination of technological feasibility, are expensed as incurred on a project-by-project basis. Our software capitalization policy currently defines technological feasibility as a functioning beta test prototype with confirmed manufacturability (a working model), within a reasonably predictable range of costs. Additional criteria include receptive customers, or potential customers, as evidenced by interest expressed in a beta test prototype, at some suggested selling price. 18
Variations in Operating Results. Our quarterly operating results have in the past varied and may in the future vary significantly. Factors affecting operating results include: - the level of competition; - the size, timing, cancellation or rescheduling of significant orders; market acceptance of new products and product enhancements; - new product announcements or introductions by our competitors; - adoption of new technologies and standards; changes in pricing by us or our competitors; - our ability to develop, introduce and market new products and product enhancements on a timely basis, if at all; - component costs and availability; - our success in expanding our sales and marketing programs; - technological changes in the market for data security products; - foreign currency exchange rates; - and general economic trends and other factors. In addition, we have experienced, and may experience in the future, long sales cycles due to the size of our contracts and the timing of when our customers take delivery of our products. We also experience seasonality in our business. These seasonal trends have included higher revenue in the last quarter of the calendar year and lower revenue in the next succeeding quarter. We believe that revenue has tended to be higher in the last quarter due to the tendency of certain customers to implement or complete changes in computer or network security prior to the end of the calendar year. In addition, revenue has tended to be lower in the summer months, particularly in Europe, when many businesses defer purchase decisions. Because our operating expenses are based on anticipated revenue levels and a high percentage of our expenses are fixed, a small variation in the timing of recognition of revenue could cause significant variations in operating results from quarter to quarter. Currency Fluctuations. The majority of our supply and sales transactions are denominated in U.S. dollars, however, a significant portion of those transactions are denominated in various foreign currencies. In order to reduce the risks associated with fluctuations in currency exchange rates, we attempt to match the timing of delivery, amount of product and the currency denomination of purchase orders received from vendors with sales orders to customers. The financial position and results of operations of the Company's foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. dollars using current exchange rates as of the balance sheet date. Revenues and expenses are translated at average exchange rates prevailing during the year. Translation adjustments arising from differences in exchange rates are included as a separate component of stockholders' equity (deficit). Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations. Foreign exchange transaction gains (losses) aggregating ($272,000), $289,000 and $183,000 are included in other non-operating income (expense) for 1999, 2000, and 2001, respectively. 19
RESULTS OF OPERATIONS The following table sets forth, for the periods indicated, certain consolidated financial data as a percentage of revenues for the years ended December 31, 1999, 2000 and 2001.
Gross Profit Our consolidated gross profit for the year ended December 31, 2001 was $16,136,000, a decrease of $1,860,000, or 10%, over the year ended December 31, 2000. This represents a gross margin of 60%, as compared to 2000's consolidated gross margin of 64%. This decrease was due to stronger sales of products with lower margins. Token products average gross margins of about 50% while non-token products average over 90%. Sales and Marketing Expenses Consolidated sales and marketing expenses for the year ended December 31, 2001 were $13,579,000, an increase of $3,626,000, or 36%, over 2000. This increase is mainly due to the increase in average full time employee headcount of 68 in 2001 versus 43 in 2000. Also, increased sales efforts including, in part, increased travel costs, and an increase in marketing activities, including tradeshows, contributed to this expense. Additionally, the acquisition of Identikey in March 2001 and the opening of the sales office in Singapore resulted in additional expenses. Research and Development Expenses Consolidated research and development costs for the year ended December 31, 2001 were $4,981,000, an increase of $612,000, or 14%, as compared to the year ended December 31, 2000. This increase was, in part, related to the acquisition of Identikey in March 2001. As Identikey is primarily a development center, the acquisition resulted in increased research and development headcount and expenditures at an additional facility. Average full time employee headcount in 2001 was 38 compared to 32 in 2000. General and Administrative Expenses Consolidated general and administrative expenses for the year ended December 31, 2001 were $6,349,000, an increase of $575,000, or 10%, over 2000. This increase can be principally attributed to the acquisition of Identikey. As a result of our fourth quarter restructuring, administrative headcount at the end of 2001 was 13 compared to 19 at the end of 2000. Interest Income (expense), Net Consolidated interest income (expense), net in 2001 was $775,000 compared to $29,000 in 2000. This increase was due to a reversal of interest expense accrued in 2000 associated with the restructuring of the Company's long-term debt. Income Taxes An income tax recovery of $13,000 was recorded for the year ended December 31, 2001, which relates to one of our European subsidiaries. At December 31, 2001, the Company has United States net operating loss carryforwards approximating $22,400,000 and foreign net operating loss carryforwards approximating $3,400,000. Such losses are available to offset future taxable income in the respective jurisdictions and expire in varying amounts beginning in 2002 and continuing through 2020. In addition, if certain substantial changes in the Company's ownership are deemed to have occurred, there would be an annual limitation on the amount of the U.S. carryforwards which could be utilized. 1999 COMPARED TO 2000 Revenues Our consolidated revenues for the year ended December 31, 2000 were $28,066,000, an increase of $8,669,000, or 45%, as compared to the year ended December 31, 1999. This increase is due to a strong performance from international operations, as the demand for Digipass products continues to grow, resulting in 21
increased unit sales, as well as increasing orders with smaller quantities and less volume discounting. Also, sales of VACMAN products in the U.S. more than doubled 1999 revenues. The European operations contributed $17,000,000 or 61% of total consolidated revenues, with the United States operations contributing the remaining $11,065,000 or 39%. Cost of Goods Sold Our consolidated cost of goods sold for the year ended December 31, 2000 was $10,069,000, an increase of $2,763,000, or 38%, as compared to the year ended December 31, 1999. Cost of goods sold has not increased at the same rate as our revenues primarily due to product sales mix and also from efficiencies in the manufacturing process, as well as the increasing demand for products with a more favorable cost structure. Gross Profit Our consolidated gross profit for the year ended December 31, 2000 was $17,997,000, an increase of $5,905,000, or 49%, over the year ended December 31, 1999. This represents a gross margin of 64% compared to 1999's consolidated gross margin of 62%. The increase in gross margin is due to product sales mix as VACMAN products provide higher gross margins. Sales and Marketing Expenses Consolidated sales and marketing expenses for the year ended December 31, 2000 were $9,954,000, an increase of $3,992,000, or 67%, over 1999. This increase can be attributed to increased sales efforts including increased travel costs, headcount, and an increase in marketing activities, including tradeshows and advertising. Sales and marketing headcount increased from 44 at the end of 1999 to 61 at the end of 2000. Research and Development Expenses Consolidated research and development costs for the year ended December 31, 2000 were $4,368,000, an increase of $781,000, or 22%, as compared to the year ended December 31, 1999. Most of this increase is due to activities relating to the development of the VACMAN product line. General and Administrative Expenses Consolidated general and administrative expenses for the year ended December 31, 2000 were $5,773,000, an increase of $2,339,000, or 68%, over 1999. This increase can be attributed to growth in infrastructure needed to support our growth, increased recruiting expenses and amortization charges related to royalties. Administrative headcount increased from 12 at the end of 1999 to 18 at the end of 2000. In addition, the Company recorded approximately $150,000 of merger costs in 2000 related to the Invincible Data Systems transaction. Interest Income (Expense) Consolidated interest income, net in 2000 was $29,000 compared to interest expense, net of $815,000 in 1999. Interest income from the proceeds generated upon the issuance of convertible preferred stock offset interest expense related to borrowings. Additionally, interest expense from debt outstanding decreased as long-term debt was reduced from $8,409,000 at the end of 1999 to $3,764,000 at the end of 2000. Income Taxes We recorded tax expense for the year ended December 31, 2000 of $395,000, which relates to one of our European subsidiaries. RECENT DEVELOPMENTS During the fourth quarter of 2001, the Company announced a restructuring of its operations to redirect resources to its core business, strong authentication and server software to enable enhanced security for the 22
web, remote access, corporate networks and financial transactions. A reduction in workforce of approximately 60 employees occurred in the fourth quarter, along with the write-off of intangible assets and property and equipment related to non-core activities. A restructuring charge of $4,284,000 was recorded in the fourth quarter. Severance and compensation related expenses represent approximately 21% of the charge, approximately 72% is the write-off of goodwill and 7% is the write-off of other assets and expenses. LIQUIDITY AND CAPITAL RESOURCES At December 31, 2001, our aggregate consolidated indebtedness was $3,827,000. Cash used in operating activities was $6,183,000 for the year ended December 31, 2001. During that period we used $892,000 in investing activities and $266,000 in financing activities. Capital expenditures were $948,000 for the year ended December 31, 2001. In 1996, we issued a 9% convertible note to Kyoto Securities, Ltd., a Bahamian corporation, in the amount of $5,000,000. The note provided for quarterly interest payments and was payable in full on May 29, 2001. The note was convertible into shares of our Common Stock at a conversion price of $12.00 per share, or 416,667 shares. In April 2000, the note and accrued interest were converted into 435,910 shares of common stock. In 1997, we entered into a convertible loan agreement with Artesia Bank N.V., formerly Banque Paribas Belgique S.A., in order to refinance the $3,400,000 payment due December 31, 1997 in connection with our acquisition of Digipass. The terms of the agreement provide that the $3,400,000 principal amount is convertible, upon an offering, into shares of our Common Stock. The original interest was at the rate of 3.25%, payable annually, and the original maturity date was on September 30, 2002. On August 9, 2001, the terms of this loan were restructured. Under the revised terms, the loan will now be convertible into shares of VASCO common stock at the fixed conversion rate of $7.50 per share rather than a floating rate based on the market price of VASCO common stock. The maturity date of the convertible loan is September 30, 2003 and the interest rate is 6%. In April 1999, we completed a private placement of Common Stock in the amount of $11.5 million. The transaction represented a sale of our Common Stock to European institutional investors at a price of $3.50 per share. A total of 3,285,714 shares of Common Stock were issued as a part of this transaction. During the first quarter of 2000, the Company filed a registration statement in connection with an offering of its Common Stock to the public. On April 13, 2000, the Company terminated this offering due to the volatility of market conditions. Costs related to this offering of $1,331,000 were written off and included in other expense in the consolidated statement of operations. In July 2000, the Company issued 150,000 shares of preferred stock for cash of $15,000,000. The preferred stock is convertible into 1,052,632 shares of Common Stock at any time over the next 48 months. The net effect of 2001 activity resulted in a decrease in cash of $7,490,000, resulting in a cash balance of $6,342,000 at December 31, 2001, compared to $13,833,000 at the end of 2000. Our working capital at December 31, 2001 was $6,672,000, a decrease of $7,635,000, or 53% from $14,307,000 at December 31, 2000. The majority of the change is attributable to operating activities. Our current ratio was 2.0 to 1.0 at December 31, 2001. We believe that our current cash balances and anticipated cash generated from operations will be sufficient to meet our anticipated cash needs for the foreseeable future. We intend to seek acquisitions of businesses, products and technologies that are complementary or additive to ours. There can be no assurance that any such acquisitions will be made. CRITICAL ACCOUNTING POLICIES AND ESTIMATES Management's Discussion and Analysis of Financial Condition and Results of Operations discusses the Company's consolidated financial statements, which have been prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these financial statements requires management to make estimates and assumptions that affect the reported amounts of assets and 23
liabilities and the disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. On an on-going basis, management evaluates its estimates and judgments, including those related to bad debts and intangible assets. Management bases its estimates and judgments on historical experience and on various other factors that are believed to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Actual results may differ from these estimates under different assumptions or conditions. Management believes the following critical accounting policies, among others, affect its more significant judgments and estimates used in the preparation of its consolidated financial statements. ALLOWANCE FOR DOUBTFUL ACCOUNTS: We maintain allowances for doubtful accounts for estimated losses resulting from the inability of our customers to make payments for services. We analyze accounts receivable, customer credit-worthiness, current economic trends and changes in our customer payment terms when evaluating the adequacy of the allowance for doubtful accounts. If the financial condition of our customers deteriorates, resulting in an impairment of their ability to make payments, additional allowances may be required. VALUATION OF PREPAID LICENSE FEES, GOODWILL AND OTHER INTANGIBLE ASSETS, AND SOFTWARE DEVELOPMENT COSTS: We assess the impairment of intangible assets whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors we consider important which could trigger an impairment review include significant underperformance relative to expected historical or projected future operating results, significant changes in the manner of our use of the acquired assets or the strategy for our overall business, and significant negative industry or economic trends. The Company assesses the recoverability of its software development costs against estimated future revenue for the individual products over the estimated remaining economic life of the software. When we determine that the carrying value of intangibles and goodwill may not be recoverable based upon the existence of one or more of the above indicators of impairment, we measure any impairment based on a projected discounted cash flow method using a discount rate determined by our management to be commensurate with the risk inherent in our current business model. Given the highly competitive environment and technological changes, it is reasonably possible that estimates of anticipated future revenue, the remaining economic life of the Company's software products, or both may be reduced significantly. RECENTLY ISSUED ACCOUNTING PRONOUNCEMENTS In June 2001, the FASB issued SFAS No. 142, "Goodwill and Other Intangible Assets" ("SFAS 142") which supersedes APB Opinion No. 17, "Intangible Assets". SFAS 142 addresses how intangible assets that are acquired individually or with a group of other assets (but not those acquired in a business combination) should be accounted for in financial statements upon their acquisition. SFAS 142 also addresses how goodwill and other intangible assets should be accounted for after they have been initially recognized in the financial statements. The provisions of SFAS 142 are required to be applied starting with fiscal years beginning after December 15, 2001. SFAS 142 is required to be applied at the beginning of an entity's fiscal year and to be applied to all goodwill and other intangible assets recognized in its financial statements at that date. As of December 31, 2001, the Company has identified $242,000 of goodwill, which was previously amortized over 7 years, which will no longer be amortized. In August 2001, the FASB issued SFAS No. 143, "Accounting for Asset Retirement Obligations" ("SFAS 143"). SFAS 143 addresses financial accounting and reporting for obligations associated with the retirement of tangible long-lived assets and for the associated asset retirement costs. SFAS must be applied starting with fiscal years beginning after June 15, 2002. Management is currently evaluating the impact that the adoption of SFAS 143 will have on the consolidated financial statements. In August 2001, the FASB issued SFAS No. 144 "Accounting for the Impairment or Disposal of Long-Lived Assets" ("SFAS 144"). SFAS No. 144 addresses financial accounting and reporting for the impairment or disposal of long-lived assets. While SFAS No. 144 supersedes SFAS No. 121, "Accounting for the 24
Impairment of Long-Lived Assets and for Long-Lived Assets to Be Disposed Of" it retains many of the fundamental provisions of that Statement. SFAS No. 144 also supersedes the accounting and reporting provisions of APB Opinion No. 30, "Reporting the Results of Operations-Reporting the Effects of Disposal of a Segment of a Business, and Extraordinary, Unusual and Infrequently Occurring Events and Transactions" for the disposal of a segment of a business. However, it retains the requirement in Opinion 30 to report separately discontinued operations and extends that reporting to a component of an entity that either has been disposed of (by sale, abandonment, or in a distribution to owners) or is classified as held for sale. SFAS No. 144 is effective for fiscal years beginning after December 15, 2001 and interim periods within those fiscal years. The Company is in the process of evaluating the impact that adoption of SFAS No. 144 may have on the financial statements; however, such impact, if any, is not known or reasonably estimable at this time. ITEM 7A. QUANTITATIVE AND QUALITATIVE DISCLOSURES ABOUT MARKET RISK. Approximately 79% of our business is conducted outside the United States, in Europe and Asia/Pacific. A significant portion of our business operations are transacted in foreign currencies. As a result, we have exposure to foreign exchange fluctuations. We are affected by both foreign currency translation and transaction adjustments. Translation adjustments result from the conversion of the foreign subsidiaries' balance sheets and income statements to U.S. dollars at year-end exchange rates and weighted average exchange rates, respectively. Translation adjustments resulting from this process are recorded directly into stockholders' equity. Transaction adjustments result from currency exchange movements when a foreign subsidiary transacts business in a currency that differs from its local currency. These transactions are recorded as gains or losses in our statement of operations. Our foreign subsidiaries' business transactions are spread across approximately 50 different countries and currencies. This geographic diversity reduces the risk to our operating results. We have minimal interest rate risk. Our $3.4 million long-term debt has a fixed rate of 6%, which is not subject to market fluctuations. This note matures in September 2003. ITEM 8. FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA The information in response to this item is included in our consolidated financial statements, together with the report thereon of KPMG LLP, appearing on pages F-1 through F-20 of this Form 10-K, and in Item 7 under the heading "Management's Discussion and Analysis of Financial Condition and Results of Operations." ITEM 9. CHANGES IN AND DISAGREEMENTS WITH ACCOUNTANTS ON ACCOUNTING AND FINANCIAL DISCLOSURE None. PART III ITEM 10. DIRECTORS AND EXECUTIVE OFFICERS OF THE REGISTRANT The sections entitled "Election of Directors" and "Section 16(a) Beneficial Ownership Report Compliance" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on July 16, 2002, are incorporated herein by reference. ITEM 11. EXECUTIVE COMPENSATION The section entitled "Executive Compensation" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on July 16, 2002, is incorporated herein by reference. 25
ITEM 12. SECURITY OWNERSHIP OF CERTAIN BENEFICIAL OWNERS AND MANAGEMENT The section entitled "Security Ownership of Certain Beneficial Owners and Management" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on July 16, 2002, is incorporated herein by reference. ITEM 13. CERTAIN RELATIONSHIPS AND RELATED TRANSACTIONS None. PART IV ITEM 14. EXHIBITS, FINANCIAL STATEMENT SCHEDULES, AND REPORTS ON FORM 8-K (a)(1) The following consolidated financial statements and notes thereto, and the related independent auditors' report, are included on pages F-1 through F-20 of this Form 10-K: Independent Auditors' Report Consolidated Balance Sheets as of December 31, 2000 and 2001 Consolidated Statements of Operations for the Years Ended December 31, 1999, 2000 and 2001 Consolidated Statements of Comprehensive Loss for the Years Ended December 31, 1999, 2000 and 2001 Consolidated Statements of Stockholders' Equity (Deficit) for the Years Ended December 31, 1999, 2000 and 2001 Consolidated Statements of Cash Flows for the Years Ended December 31, 1999, 2000 and 2001 Notes to Consolidated Financial Statements (2) The following consolidated financial statement schedule of the Company is included on this Form 10-K: Schedule II -- Valuation and Qualifying Accounts All other financial statement schedules are omitted because such schedules are not required or the information required has been presented in the aforementioned consolidated financial statements. 26
(3) The following exhibits are filed with this Form 10-K or incorporated by reference as set forth in the next page: EXHIBIT INDEX
This page intentionally left blank.
INDEPENDENT AUDITORS' REPORT The Board of Directors and Stockholders VASCO Data Security International, Inc.: We have audited the accompanying consolidated balance sheets of VASCO Data Security International, Inc. and subsidiaries (the "Company") as of December 31, 2000 and 2001 and the related consolidated statements of operations, comprehensive loss, stockholders' equity (deficit), and cash flows for each of the years in the three-year period ended December 31, 2001. In connection with our audits of the consolidated financial statements, we have also audited the accompanying consolidated financial statement Schedule II - Valuation and Qualifying Accounts. These consolidated financial statements and the consolidated financial statement schedule are the responsibility of the Company's management. Our responsibility is to express an opinion on these consolidated financial statements and the consolidated financial statement schedule based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion. In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of VASCO Data Security International, Inc. and subsidiaries as of December 31, 2000 and 2001, and the results of their operations and their cash flows for each of the years in the three-year period ended December 31, 2001, in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, the related consolidated financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly, in all material respects, the information set forth therein. /s/ KPMG LLP Chicago, Illinois February 15, 2002, except as to Note 14, which is as of March 13, 2002 F-1
VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED BALANCE SHEETS
VASCO DATA SECURITY INTERNATIONAL, INC CONSOLIDATED STATEMENTS OF OPERATIONS
VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS
VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY (DEFICIT) FOR THE YEARS ENDED DECEMBER 31, 1999, 2000 AND 2001
VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF CASH FLOWS
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS NOTE 1 -- SUMMARY OF SIGNIFICANT ACCOUNTING POLICIES NATURE OF OPERATIONS VASCO Data Security International, Inc. and its wholly owned subsidiaries (the Company) designs, develops, markets and supports security products and services which manage and protect against unauthorized access to computer systems of corporate and government customers. PRINCIPLES OF CONSOLIDATION The consolidated financial statements include the accounts of VASCO Data Security International, Inc. and its wholly and majority owned subsidiaries. All significant intercompany accounts and transactions have been eliminated in consolidation. FOREIGN CURRENCY TRANSLATION AND TRANSACTIONS The financial position and results of operations of the Company's foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. dollars using current exchange rates as of the balance sheet date. Revenues and expenses are translated at average exchange rates prevailing during the year. Translation adjustments arising from differences in exchange rates are included as a separate component of stockholders' equity. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations. Foreign exchange transaction gains (losses) aggregating ($272,000), $289,000 and $183,000 are included in other income (expense) for 1999, 2000, and 2001, respectively. REVENUE RECOGNITION License Fees. Revenues from the sale of computer security hardware and software are recorded upon shipment or, if an acceptance period is allowed, at the later of shipment or customer acceptance. No significant obligations exist with regard to delivery or customer acceptance at the time of recognizing revenue. Support Agreements. Support agreements generally call for the Company to provide technical support and software updates to customers. Revenue on technical support and software update rights is recognized ratably over the term of the support agreement. Consulting and Education Services. The Company provides consulting and education services to its customers. Revenue from such services is generally recognized during the period in which the services are performed. PROPERTY AND EQUIPMENT Property and equipment are stated at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the related assets ranging from three to seven years. Additions and improvements are capitalized, while expenditures for maintenance and repairs are charged to operations as incurred. Gains or losses resulting from sales or retirements are recorded as incurred, at which time related costs and accumulated depreciation are removed from the accounts. SOFTWARE COSTS The Company capitalizes software development costs in accordance with Statement of Financial Accounting Standards (SFAS) No. 86, "Accounting for the Costs of Computer Software to Be Sold, Leased, or Otherwise Marketed". Research and development costs, prior to the establishment of technological feasibility, determined based upon the creation of a working model, are expensed as incurred. The Company's policy is to amortize capitalized costs by the greater of (a) the ratio that current gross revenues for a product F-7
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) bear to the total of current and anticipated future gross revenues for that product or (b) the straight-line method over the remaining estimated economic life of the product, generally two to five years, including the period being reported on. The Company did not capitalize any software costs during the years ended December 31, 1999, 2000 and 2001. INCOME TAXES Income taxes are accounted for under the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases and operating loss and tax credit carryforwards. Deferred tax assets and liabilities are measured using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date. FAIR VALUE OF FINANCIAL INSTRUMENTS The following disclosures of the estimated fair value of financial instruments are made in accordance with the requirements of SFAS No. 107, "Disclosures and Fair Value of Financial Instruments." The estimated fair value amounts have been determined by the Company using available market information and appropriate valuation methodologies. The fair values of the Company's financial instruments were not materially different from their carrying amounts at December 31, 2000 and 2001, except for notes payable and long-term debt, for which the fair values were not determinable. USE OF ESTIMATES The preparation of financial statements in conformity with accounting principles generally accepted in the United States of America requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates. RECLASSIFICATIONS Certain amounts in the consolidated financial statements have been reclassified to conform to the 2001 presentation. For the year 2000, amortization of intangible assets amounting to $212,500 was reclassified from research and development costs to general and administrative expenses. GOODWILL AND OTHER INTANGIBLES Goodwill is amortized on a straight-line basis over the expected period to be benefited, which is seven years. Other intangibles are amortized on a straight-line basis and consist of software and hardware technology totaling $4,616,000, which is being amortized over a period of four years and workforce and customer lists of approximately $320,000 and $542,000, respectively, which are being amortized over a period of seven years. The Company assesses the impairment of intangible assets whenever events or changes in circumstances indicate that the carrying value may not be recoverable. Factors considered important which could trigger an impairment review include significant underperformance relative to expected historical or projected future operating results, significant changes in the manner of our use of the acquired assets or the strategy for our overall business, and significant negative industry or economic trends. The Company assesses the recoverability of its software development costs against estimated future revenue for the individual products over the estimated remaining economic life of the software. F-8
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) When the Company determines that the carrying value of intangibles and goodwill may not be recoverable based upon the existence of one or more of the above indicators of impairment, we measure any impairment based on a projected discounted cash flow method using a discount rate determined by our management to be commensurate with the risk inherent in our current business model. Given the highly competitive environment and technological changes, it is reasonably possible that estimates of anticipated future revenue, the remaining economic life of the Company's software products, or both may be reduced significantly. At December 31, 2000 and 2001, ending balances of goodwill and other intangibles, net of amortization, are as follows:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) NOTE 2 -- ACQUISITIONS Effective May 1, 1999, the Company acquired substantially all of the assets of SecureWare SA and DMIC SA (SecureWare), as well as certain developed software licenses from the founder of SecureWare in exchange for $738,735 in cash (of which $151,203 was recorded in accrued liabilities at December 31, 1999) plus 174,575 shares of the Company's common stock, which had a market value based upon the trading price of the common stock on the NASD Bulletin Board ("Market Value") of approximately $650,000 at the time of the acquisition. SecureWare, located in Bordeaux, France, is a software developer focusing on developing security solutions for a number of operating systems. The acquisition of SecureWare was accounted for under the purchase method of accounting, and accordingly, the acquired assets have been recorded at their estimated fair values at the date of acquisition. Purchased software related to this transaction was $889,000 and is being amortized over a period of 5 years. Goodwill related to this transaction was $406,000 and is being amortized over a period of 7 years. On October 6, 1999, the Company acquired all of the outstanding capital stock of IntelliSoft Corporation (IntelliSoft) in exchange for 1,812,078 shares of Common Stock which had a Market Value of approximately $7,250,000 at the time of the acquisition. In addition, the Company paid $751,575 to IntelliSoft dissenters to acquire their capital stock interests, which represented 9.4% of the outstanding capital stock of IntelliSoft at the date of the acquisition. The acquisition of these shares has been treated as the purchase and retirement of common stock. IntelliSoft, located in Acton, MA, specializes in developing true secure single sign-on, Web authorization, PKI, VPN, and enterprise management solutions. This transaction was accounted for under the pooling-of-interests method of accounting. Accordingly, the consolidated financial statements have been restated as if IntelliSoft had been combined for all periods presented. At the end of August 2000, the Company acquired Invincible Data Systems (IDS) in a transaction which has been accounted for under the pooling-of-interests method. A total of 322,565 shares were issued in this transaction, which is deemed immaterial. On March 29, 2001, the Company acquired Identikey Ltd., ("Identikey"), a privately held international security software company headquartered in Brisbane, Australia, with operations in the United States, Europe and Australia. Under the terms of the purchase agreement, more than 90 percent of the outstanding capital stock of Identikey was exchanged for 366,913 shares of Company common stock, with potential additional earn-out payments made in the form of additional shares which are based on defined performance incentives as specified in the purchase agreement. The acquisition of Identikey was accounted for under the purchase method of accounting, and accordingly, the acquired assets have been recorded at their estimated fair values at the date of acquisition. Intangible assets consisting of technology licenses related to this transaction were $1,897,000 and are being amortized over a period of 7 years. The following summarized unaudited pro forma financial information for the year 2001 assumes the Identikey acquisition occurred as of January 1, 2000.
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) NOTE 3 -- INVENTORIES Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the first-in-first-out (FIFO) method. Inventories are comprised of the following:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) The provision of income taxes consists of the following:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) The net change in the total valuation allowance for the years ended December 31, 1999, 2000 and 2001 was an increase of $676,000, $1,739,000 and $4,380,000, respectively. In assessing the realizability of deferred tax assets, the Company considers whether it is more likely than not that some portion or all of the deferred tax assets will be realized. The ultimate realization of deferred tax assets is dependent upon the generation of future taxable income during the period in which these temporary differences become deductible. The Company has determined that it is more likely than not that $83,000 of deferred tax assets will be realized. This valuation allowance will be reviewed on a regular basis and adjustments made as appropriate. NOTE 6 -- DEBT Debt consists of the following:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) The value of the warrants which reduces the carrying value of the preferred stock is being accreted and reduces earnings available to common shareholders. COMMON STOCK In 2001, the Company issued 25,633 shares of common stock as a result of the exercise of options under the Company's stock compensation plan (see Note 8) generating total proceeds of $15,664; 3,929 shares of common stock were issued as a result of the exercise of warrants, generating total proceeds of $17,693. In March 2001, the Company issued 366,913 shares of common stock to acquire 90% of the outstanding capital stock of Identikey Ltd. In 2000, the Company issued 435,910 shares of common stock to convert a $5,000,000 note and related accrued interest. In September 2000, the Company issued 322,565 shares of common stock as part of the acquisition of Invincible Data Systems. Also in 2000, the Company issued 342,400 shares of common stock as a result of the exercise of options under the Company's stock compensation plan (see Note 8) generating total proceeds of $557,213 and 303,625 shares of common stock were issued as a result of the exercise of the warrants, generating total proceeds of $1,724,717. WARRANTS Warrant activity for the years ended December 31, 1999, 2000 and 2001 are summarized below:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) ten years, are granted at a price equal to the fair market value of the common stock on the date of the grant and are typically vested 25% on the first anniversary of the grant, with an additional 25% vesting on each subsequent anniversary of the grant. Alternative vesting schedules include either date or event-based vesting. During 2001, the Compensation Committee of the Board of Directors approved a revised vesting schedule. The new vesting schedule for officers is based on a time period of 36 months, with 6/36th of the options vesting at the end of the first 6 months and 1/36th of the options vesting each month thereafter on the last day of each month. The Compensation Plan further permits the grant of options to directors, consultants and other key persons (non-employees) to purchase shares of common stock. All options granted to non-employees are granted at a price equal to the fair market value of the common stock on the date of the grant, and may contain vesting requirements and/or restrictions as determined by the Compensation Committee at the time of grant. Non-cash compensation expense of $49,555 was recognized in 2001 in accordance with FIN 44, "Accounting for Certain Transactions Involving Stock Compensation", an interpretation of Accounting Principles Board Opinion No. 25. This charge was attributed to stock options issued to officers of the Company who are located outside the U.S. and whose services are rendered under consulting agreements. As of December 31, 2001, the Compensation Plan was authorized to issue options representing up to 5,652,612 shares of the Company's common stock. The authorized shares under the Compensation Plan represent 20% of the issued and outstanding shares of the Company. The Company applies APB Opinion No. 25 and related interpretations in accounting for the Compensation Plan. Had compensation cost for the Compensation Plan been determined consistent with SFAS No. 123, the Company's net loss available to common stockholders and net loss per common share would have been the pro forma amounts indicated below:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) The following is a summary of activity under the Compensation Plan:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) NOTE 10 -- GEOGRAPHIC AND CUSTOMER INFORMATION The Company allocates revenue based on the location of the country which initiates the sale. Information regarding geographic areas for the years ended December 31, 1999, 2000 and 2001 are as follows:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) From time to time, the Company has been involved in litigation incidental to the conduct of its business. Currently, the Company is not a party to any lawsuit or proceeding which, in management's opinion, is likely to have a material adverse effect on its business, financial condition or results of operations. (See Note 14.) NOTE 12 -- RESTRUCTURING During the fourth quarter of 2001, the Company announced a restructuring of its operations to redirect resources to its core business, strong authentication and server software to enable enhanced security for the web, remote access, corporate networks and financial transactions. A reduction in workforce of approximately 60 employees occurred in the fourth quarter, along with the write-off of related intangible assets and property and equipment related to non-core activities. A restructuring charge of $4,284,000 was recorded in the fourth quarter. A breakdown of this charge is as follows:
VASCO DATA SECURITY INTERNATIONAL NOTES TO CONSOLIDATED FINANCIAL STATEMENTS -- (CONTINUED) NOTE 13 -- QUARTERLY RESULTS OF OPERATIONS (UNAUDITED)
VASCO DATA SECURITY INTERNATIONAL, INC. SCHEDULE II. VALUATION AND QUALIFYING ACCOUNTS
SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this Report to be signed on its behalf by the undersigned, thereunto duly authorized, on March 28, 2002. VASCO DATA SECURITY INTERNATIONAL, INC. /s/ MARIO R. HOUTHOOFT -------------------------------------- Mario R. Houthooft Chief Executive Officer and President PURSUANT TO THE REQUIREMENTS OF THE SECURITIES EXCHANGE ACT OF 1934, THIS REPORT HAS BEEN SIGNED BY THE FOLLOWING PERSONS ON BEHALF OF THE REGISTRANT IN THE CAPACITIES INDICATED ON APRIL 15, 1999. POWER OF ATTORNEY Each of the undersigned, in his capacity as an officer or director, or both, as the case may be, of VASCO Data Security International, Inc. does hereby appoint Mario Houthooft, and each of them severally, his true and lawful attorneys or attorney to execute in his name, place and stead, in his capacity as director or officer, or both, as the case may be, this Annual Report on Form 10-K for the fiscal year ended December 31, 2001 and any and all amendments thereto and to file the same with all exhibits thereto and other documents in connection therewith with the Securities and Exchange Commission. Each of said attorneys shall have power to act hereunder with or without the other attorney and shall have full power and authority to do and perform in the name and on behalf of each of said directors or officers, or both, as the case may be, every act whatsoever requisite or necessary to be done in the premises, as fully and to all intents and purposes as to which each of said officers or directors, or both, as the case may be, might or could do in person, hereby ratifying and confirming all that said attorneys or attorney may lawfully do or cause to be done by virtue hereof.
EXHIBIT 23 CONSENT OF KPMG LLP The Board of Directors VASCO Data Security International, Inc.: We consent to the incorporation by reference in the registration statement (No. 333-62829 on Form S-8 and No. 333-46256 on Form S-3) of our report dated February 15, 2002, except as to Note 14, which is as of March 13, 2002, relating to the consolidated balance sheets of VASCO Data Security International, Inc. and subsidiaries as of December 31, 2001 and 2000, and the related consolidated statements of operations, comprehensive income, stockholders' equity (deficit), and cash flows for each of the years in the three-year period ended December 31, 2001, and related consolidated financial statement schedule, which report appears in the December 31, 2001 annual report on Form 10-K of VASCO Data Security International, Inc. Chicago, Illinois March 26, 2002 /s/ KPMG LLP