SEC Filing | OneSpan

UNITED STATES SECURITIES AND EXCHANGE COMMISSION Washington, D.C. 20549 _________________________ FORM 10-K FOR ANNUAL AND TRANSITION REPORTS PURSUANT TO SECTIONS 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 (Mark One) [ X ] ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE FISCAL YEAR ENDED DECEMBER 31, 1998 or [ ] TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(D) OF THE SECURITIES EXCHANGE ACT OF 1934 FOR THE TRANSITION PERIOD FROM __________TO __________ Commission file number 000-24389 VASCO Data Security International, Inc. (Exact Name of Registrant as Specified in Its Charter) DELAWARE 36-4169320 (State or Other Jurisdiction of (IRS Employer Incorporation or Organization) Identification No.) 1901 South Meyers Road, Suite 210 Oakbrook Terrace, Illinois 60181 (Address of Principal Executive Offices)(Zip Code) Registrant's telephone number, including area code: (630) 932-8844 Securities registered pursuant to Section 12(b) of the Act: None Securities registered pursuant to Section 12(g) of the Act: Common Stock, par value $.001 per share Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes X No Indicate by check mark if disclosure of delinquent filers pursuant to Item 405 of Regulation S-K is not contained herein, and will not be contained, to the best of registrant's knowledge, in definitive proxy or information statements incorporated by reference in Part III of this Form 10-K or any amendment to this Form 10-K.

As of April 14, 1999, 24,472,430 shares of the Company's Common Stock, $.001 par value per share ("Common Stock"), were outstanding. On that date, the aggregate market value of voting and non-voting common equity (based upon the last sale price of the Common Stock as reported on the Over-the-Counter Bulletin Board on April 14, 1999) held by non-affiliates of the registrant was $54,079,641 (13,110,216 shares at $4.125 per share). DOCUMENTS INCORPORATED BY REFERENCE Portions of the registrant's definitive proxy statement for the Annual Meeting of Stockholders to be held June 15, 1999 are to be incorporated by reference into Part III of this Form 10-K. PART I Cautionary Statement for Purposes of the "Safe Harbor" Provisions of the Private Securities Litigation Reform Act of 1995 This Annual Report on Form 10-K, including the "Management's Discussion and Analysis of Financial Condition and Results of Operations," contains "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995 concerning, among other things, the prospects, developments and business strategies for the Company (as defined) and its operations, including the development and marketing of certain new products and the anticipated future growth in certain markets in which the Company currently markets and sells its products or anticipates selling and marketing its products in the future. These forward-looking statements (i) are identified by their use of such terms and phrases as "expected," "expects," "believe," "believes," "will," "anticipated," "emerging," "intends," "plans," "could," "may," "estimates," "should," "objective" and "goals" and (ii) are subject to risks and uncertainties and represent the Company's present expectations or beliefs concerning future events. The Company cautions that the forward-looking statements are qualified by important factors that could cause actual results to differ materially from those in the forward-looking statements, including (a) risks of general market conditions, including demand for the Company's products and services, competition and price levels and the Company's historical dependence on relatively few products, certain suppliers and certain key customers, and (b) risks inherent to the computer and network security industry, including rapidly changing technology, evolving industry standards, increasing numbers of patent infringement claims, changes in customer requirements, price competitive bidding, changing government regulations and potential competition from more established firms and others. Therefore, results actually achieved may differ materially from expected results included in, or implied by, these statements. Item 1 - Description of Business

General Description of Business VASCO Data Security International, Inc., a Delaware corporation (the "Company" or "VASCO"), was incorporated on July 15, 1997 and is the successor to the operations of VASCO Corp. (see "1998 Reorganization _ Exchange Offer"). Its executive office is located at 1901 South Meyers Road, Suite 210, Oakbrook Terrace, Illinois 60181; (630) 932-8844. On March 20, 1998, the Company's Common Stock, $.001 par value per share (the "Common Stock") was approved for trading on the Over-the-Counter Bulletin Board system with the symbol: VDSI. The Company, through its operating subsidiaries, designs, develops, markets and supports open standards-based hardware and software security systems which manage and secure access to information assets. This report contains the following trademarks of the Company, some of which are registered: VASCO, AccessKey, VACMan Server and VACMan/CryptaPak, AuthentiCard and Digipass. 1998 Reorganization - Exchange Offer The Company was organized in 1997 as a subsidiary of VASCO Corp., a Delaware corporation ("VASCO Corp."). Pursuant to an exchange offer (the "Exchange Offer") by the Company for securities of VASCO Corp. that was completed March 11, 1998, the Company acquired 97.7% of the common stock of VASCO Corp. Consequently, VASCO Corp. became a subsidiary of the Company, with the remaining 2.3% of VASCO Corp. shareholders representing a minority interest. On October 28, 1998, this minority interest was merged into the Company and VASCO Corp. ceased to exist. For purposes of the discussion of the general business of the Company below, references to the "Company" shall refer to VASCO Corp. for periods prior to March 11, 1998, the date on which VASCO Corp. became a subsidiary of VASCO. Prior Organizational History The Company is essentially a holding company that conducts its business through operating subsidiaries in the United States and Europe. The Company presently has two operating subsidiaries. VASCO Data Security, Inc. ("VDS"), a Delaware corporation headquartered in Oakbrook Terrace, Illinois, is owned directly by the Company. The Company's other operating subsidiary, VASCO Data Security NV/SA ("VDS NV/SA"), is a Belgian corporation headquartered in a suburb of Brussels, Belgium. VDS NV/SA is owned by the Company's European holding company subsidiary, VASCO Data Security Europe SA ("VDSE"). VDS and VDS NV/SA are engaged in the design, development, marketing and support of open standards-based hardware and software based security systems which manage and secure access to information assets and also provide products that permit their customers to encrypt data.

[company organization chart] * One share held by T. Kendall Hunt. VDS. In November 1989, a Utah corporate predecessor of the Company acquired an option to purchase a controlling interest in ThumbScan, Inc. ("ThumbScan"). The Company acquired a controlling interest in ThumbScan in January 1991, and in December 1991 VASCO Data Security International, Inc. increased its holdings in ThumbScan. VASCO subsequently acquired the remaining shares of ThumbScan. In July 1993, ThumbScan was renamed VASCO Data Security, Inc. VDS NV/SA. VASCO Data Security NV/SA ("VDS NV/SA") is a combination of two European companies (Lintel Security NV and Digipass SA) acquired by the Company, through VDSE, in 1996, and accounts for a substantial portion of VASCO's consolidated revenues. Acquisition of Lintel Security. In 1996, the Company began a significant expansion of its computer security business by acquiring a 15% interest in Lintel Security NV ("Lintel Security"). Lintel Security, a newly formed Belgian corporation, concurrently purchased from Lintel NV, a Brussels, Belgium based company, certain assets associated with the development of security tokens and security technologies for personal computers ("PCs"), computer networks and telecommunications systems using Data Encryption Standard ("DES") and Rivest, Shamir, Adelman ("RSA") cryptographic algorithms. The Company acquired the remaining 85% of Lintel Security in June 1996. At the time of acquisition of Lintel NV's assets by Lintel Security, Lintel NV was a competitor of the Company in Europe. The purchase price paid for Lintel Security was approximately $4.4 million, and was paid in cash, shares of VASCO common stock, and VASCO warrants and convertible notes. Acquisition of Digipass. In July 1996, the Company acquired the stock of Digipass SA ("Digipass") for an aggregate purchase price of $8.2 million. Digipass, based in a suburb of Brussels, was also a developer of security tokens and security technologies for PCs, computer networks and telecommunications systems using the DES cryptographic algorithm. At the time of acquisition, Digipass was a competitor of the Company in Europe. Prior to the Company's acquisition of Digipass, certain assets and liabilities of the interactive voice response ("IVR") business of Digiline SA, an integrator of IVR products based in Belgium, were transferred to Digipass. Digipass' IVR products were used primarily in telebanking applications and incorporate authentication and access control technology. During 1997, VDS NV/SA sold the IVR business for approximately $200,000. In January 1997, Digipass changed its name to "VASCO Data Security NV/SA." Concurrent with this event Lintel Security's operations were consolidated with those of VDS NV/SA at a single location near Brussels.

The Company 's original business was providing consulting, training and software services to companies and government agencies. These services were marketed as VASCO Performance Systems ("VPS"). In 1996, management determined that the Company should focus its energies and resources on the data security industry, where it believed significant growth and profit potential existed. Accordingly, on August 20, 1996, the Company sold the assets of VPS and withdrew from the consulting and technical training business. Financial Information about Industry Segments During each of the last three fiscal years, the Company has operated in only one industry segment. Financial Information Relating to Foreign and Domestic Operations and Export Sales See Note 10 to VASCO Notes to Consolidated Financial Statements for certain information about foreign and domestic operations and export sales. Narrative Description of the Business General The Company designs, develops, markets and supports open standards-based hardware and software security systems which manage and secure access to information assets. The Company's hardware products include time-synchronous response only, challenge/response and time-synchronous challenge/response user authentication devices, some of which incorporate an electronic digital signature feature to guarantee the integrity of data transmissions. These devices are commonly referred to as security tokens. The Company's security tokens are based upon its core encryption technology, which utilizes two widely known and accepted algorithms, DES and RSA. The Company's Cryptech division produces high speed hardware and software encryption products used both internally for its security tokens and for original equipment manufacturers ("OEM") vendors requiring real time encryption services. In addition, the Company has introduced a smartcard security token that uses the challenge/response mode and the X.509 certificate authentication standard. The Company's security tokens are designed to be used with the VASCO Access Control Manager ("VACMan") server software or to be integrated directly into applications. Together, the Company's software and hardware products provide what it believes is an economical state-of-the-art authentication, authorization and accounting security system. As of December 31, 1998, the Company had over 2.6 million security token devices, its primary product line, in use. The Company's security products are sold primarily to value-added resellers and distributors, and to a lesser extent end-users.

The Company has embarked upon an aggressive campaign to expand its distributor and reseller network. Distributors and resellers that have entered into agreements with the Company's operating subsidiaries include, among others, Concord-Eracom Nederland BV, Protect Data Norge AS, Sirnet AB, All Tech Data Systems, Inc., Clark Data Systems, Inc. and HUCOM, Inc. Representative end-users of the Company's products include ABN-AMRO Bank, First Union National Bank N.A., Generale Bank, Artesia Bank N.V. (formerly Banque Paribas Belgigue S.A.), Rabobank, S-E Banken, Volvo Data North America, Inc., France Telecom, Manitoba Telephone and Andrew Corp. Industry Background The Data Security Industry. The increasing use and reliance upon proprietary or confidential data by businesses, government and educational institutions that is accessible remotely by users, together with the growth in electronic commerce, has made data security a paramount concern. The Company believes that data security concerns will spur significant growth in the demand for both enterprise and consumer security solutions. Enterprise Security. With the advent of personal computers and distributed systems in the form of wide area networks ("WANs"), intranets which connect users in disparate facilities, local area networks ("LANs"), which connect users located in a single facility and the public network known as the Internet/ World Wide Web (the "Internet"), and other direct electronic links, many organizations have implemented applications to enable their work force and third parties, including vendors, suppliers and customers, to access and exchange data. As a result of the increased number of users having direct and remote access to enterprise networks and data, including a growing number of mobile computer users and telecommuters that perform some or all of their work from home or other remote locations, data has become increasingly vulnerable to unauthorized access. Unauthorized access can range from users who are authorized to access portions of an enterprise's computing resources accessing unauthorized portions, to hackers who have no legitimate access breaking into a network and stealing or corrupting data. The consequences of such unauthorized access, which can often go undetected, can range from theft of proprietary information or other assets to the alteration or destruction of stored data. As a result of unauthorized access stemming from the increased use of enterprise-wide computing and remote access, network security has become a primary concern to most companies that use and rely on data. This increased attention to data security has stimulated demand for data security products. The Company believes that enterprises are seeking solutions which will continue to allow them to expand access to data while maintaining adequate security.

Consumer Security. In addition to the need for enterprise-wide security, the proliferation of PCs in both home and office, combined with widespread access to the Internet, have created significant opportunities for electronic commerce such as electronic bill payment, home banking and home shopping. All of these activities are primarily based on the use of the Internet. According to published reports, the growth in the number of Internet users worldwide is expected to increase from approximately 28 million in 1996 to approximately 175 million by the end of 2001. The public generally perceives that there is a risk involved in using credit cards to make purchases via the Internet and this perception has hampered the development of consumer-based electronic commerce. Accordingly, the Company believes that successful expansion of electronic commerce requires the implementation of improved security measures which accurately identify users and reliably encrypt data transmissions over the Internet. Products Current Data Security Solutions Data security and secured access to on-line commerce generally consist of five components: Encryption: Maintains data privacy by converting information into an unreadable pattern and allowing only authorized parties to decrypt the data. Encryption can also maintain data integrity by creating digital signatures for transmitted data, enabling the recipient to check whether the data was changed since or during transmission. Identification and Authentication: Serves as the foundation for other security mechanisms by verifying that a user is who he or she claims to be. Identification and authentication mechanisms are often employed with encryption tools to authenticate users, to determine the proper encryption key for encrypting/decrypting data, or to enable users to digitally "sign" or verify the integrity of transmitted data. AccessControl: Includes firewalls, which limit a user's access to data to only that data which he or she is authorized to access, and authorization and accounting systems, which also limit access to data and keep track of a user's activities after access has been granted. Anti-Virus: Programs that scan for and, in many cases, remove destructive computer programs known as computer viruses that can become imbedded into programs residing on a computer. Administration and Management Tools: Set, implement and monitor security policies, the access to which is typically regulated by access control systems. These tools are extremely important to the overall effectiveness of a security system.

The most effective security policies employ most, if not all, of these five components. However, most companies only implement a patchwork combination of these components, which can result in their security systems being compromised. Historically, the Company's primary products have been security tokens. Security tokens are an integral part of identification and authentication systems, which in turn serve as the foundation for each of the five components of data security outlined above. The Company has sought to leverage its identification and authentication expertise by expanding its product offerings to include the other components of data security, in each case incorporating the Company's security tokens. The Company has sought to expand its product offerings to reach its ultimate goal of supplying a full range of security products for integrated, enterprise-wide security solutions, which will meet the needs of the emerging data security market. Identification and Authentication. Identification and authentication systems provide the foundation for security systems by validating the identity of each user attempting to access information or data contained in a system, regardless of location. The most common use of an identification and authentication device is to authenticate local and remote users who have established a network connection to a company's computer network. Authentication is often done in conjunction with a firewall to authenticate internal users of stand-alone PCs on networks or to authenticate customers and suppliers who have been granted access to a restricted portion of the Company's data or other information. There are three basic methods used to authenticate a user. The first method identifies who the user is, utilizing a hard-to-forge physical attribute such as the user's fingerprints, voice patterns or eye retina patterns. In each case, the physical attribute, or biometric, must be capable of being scanned and converted to a digital document. While biometric devices offer a high level of authentication, they are susceptible to replay attacks. Replay attacks collect samples of a user's biometric "print" (i.e., voice, finger, retina) and then replay the "print" to access a target system. Furthermore, current technology requires additional hardware to acquire, or read, the biometric "print." The added hardware presents two challenges for biometric solutions: one is the cost and the second is installation and maintenance. The second authentication method is identifying what the user knows, usually a password known only to the specific user. Passwords, while easy to use, are also the least secure because they tend to be short and static, and are often transmitted without encryption ("clear text"). As a result, passwords are vulnerable to decoding or observation and subsequent use by unauthorized persons. Once a user's password has been compromised, the integrity of the entire computer network can be compromised. The third authentication method identifies what the user has, generally a physical device or token intended for use by that specific user. Tokens are small devices ranging from simple credit card-like devices to more complex devices capable of generating time-synchronized challenge/ response access codes. Early examples of simple tokens include building access passes.

Certain token-based systems require both possession of the token itself and a PIN to indicate that the token is being used by an authorized user. Such an approach, referred to as two-factor authentication, provides much greater security than single factor systems such as passwords or simple possession of a token. Early implementations of two-factor authentication include automatic teller machine ("ATM") cards. ATM cards require the user to possess the card and to know the PIN before engaging in the transaction. The Company believes that the use of the two-factor authentication system is the optimal solution for reliable computer and network security and has targeted its products toward this end. Security Tokens. A security token is a small, portable computing device designed to generate a one-time password. They are normally difficult to counterfeit and are assigned to an individual user. The user transmits a token-generated password, along with an assigned user ID, to a host or authentication server, requesting access, generally to a network. Token-generated passwords are derived from a secret key or seed value. An authentication server on the network receives and decrypts the token password with a corresponding decryption key, validates the user, and (if validated) grants access. Currently available security tokens are event-based, time-synchronous, response only or challenge/response based. Event-based tokens have the same list of predetermined passwords as the authentication server. Passwords are generated by the token in a predetermined manner, which is expected by the server, and the passwords remain valid for indefinite periods of time. As a result of the passwords being generated from a predetermined list and their ease of calculation by unauthorized users, event-based tokens are the easiest to compromise. Time-synchronous tokens require the authentication server and the token to be password time-synchronous. When used, the token will calculate and display a password using a stored secret seed value and the current time of day. The server then determines whether the password received is correct for the time frame that it was used in. The principal drawbacks for time-synchronous tokens are extensive maintenance with respect to clock synchronization and the possibility of multiple uses within the specified time frame. Usually, steps are taken to limit the re-use of a password, however, when a time-synchronous token is defined to multiple authentication servers, a common practice, then there is a risk of a password being re-used to access other servers. Nevertheless, these devices provide a higher level of security than event-based tokens. Response only tokens use either an "event" or time to calculate the response only password. Response only tokens require the user to activate the token and read the password.

Challenge/response tokens provide the highest level of security. The authentication server responds to a request for access by issuing a randomly generated challenge in the form of a numeric or alphanumeric sequence. The token, using its embedded seed value, or key, encrypts the challenge. The result is an encrypted response which the user then transmits back to the authentication server via the user's PC keyboard. The server in turn retrieves the key that has been assigned to that user and decrypts the user's response. Assuming a match exists, the server authenticates the user and grants access. As with time-synchronous tokens, challenge/response tokens do not transmit an encryption key. However, unlike time-synchronous tokens, passwords of challenge/response tokens are one-time passwords that can never be re-used. In addition, there is no opportunity to initiate a second, illegal session with a challenge/response token. Each attempt at access is accompanied by a new challenge and a correspondingly unique password response. Although challenge/response tokens generate true one-time passwords, it is possible to compromise the internal seed value of pure challenge/response tokens that only use the seed value and the challenge to calculate the response. Time synchronous challenge/response tokens can be used to add another variable in the calculation of the one-time password. In addition to the secret seed value and the challenge from the host server, the time of day can be used. Because there is a challenge, the time synchronization does not have to be nearly as exact as with time-synchronous tokens. When time is used as an input variable for challenge response tokens, it is impossible, with today's most advanced computers, to use dictionary attacks to compromise the token. Smartcards. Smartcards are credit card sized devices that contain an embedded microprocessor, memory and secure operating system. Smartcards have been used in many applications, for example, as stored value cards, either for making general purchases or for specific applications such as prepaid calling cards, and as health care cards, which are used to store patient and provider information and records. Major smartcard chip and card manufacturers include Gemplus SA, Schlumberger Ltd., Philips Electronics N.V., Siemens A.G. and Groupe Francois Charles Oberthur (FCO). These vendors, together with cryptographic vendors, have worked to make smartcard standards compatible with cryptographic standards to offer a security solution with authentication and digital signature capabilities.

The Company's Solution To date, most approaches to network security have been limited in scope and have failed to address critical aspects of data security. The Company believes that an effective enterprise-wide solution must address and assimilate issues relating to the following: ease of use and administration, reliability, interoperability with heterogeneous enterprise environments and existing customer applications, and scaleability. The Company also believes that, in order to capitalize on this growing market need for enterprise-wide security solutions, network security products must embody both hardware and software components and provide an industry-accepted, open standards-based solution. Accordingly, the Company has adopted the following approach to data security: (i) In designing its products, it has sought to incorporate all industry-accepted, open, non-proprietary, remote access protocols, such as RADIUS and TACACS+. This permits interoperability between the Company's security token products and leading remote access servers. (ii) It has incorporated the two most widely known and accepted algorithms - the DES and RSA algorithms - into its products and has sought to refine its offering of single-function, multi-function, challenge/response, response only and digital signature security token products. The Company believes that its combination of software and hardware products provide security with added speed, cryptographic functionality, reliability and flexibility not attainable with software-only programs. Its products provide two-factor authentication requiring the authorized user to possess both the token and the appropriate PIN. (iii) In addition to providing identification and authentication features in its security products, the Company has included accounting and auditing features that allow customers to track and analyze all user access and attempted access to network systems. This permits easier customer implementation and monitoring of corporate security policies. (iv) The Company has designed its security systems to support various platforms - such as Windows NT and Unix - thereby allowing customers to ensure the same security for remote users as is provided to office-based users. (v) The Company has sought to design products that are easy to use and competitively priced. It also is increasing its customer support capabilities to ensure the smooth installation and maintenance of its systems.

As a result of this approach, the Company believes that it has positioned itself to market a new generation of open standards-based hardware and software security systems, including those designed to provide security to Internet users, and it intends to continue to grow to provide a full range of identification and authentication and other security products. Security Token Products. Generally, the Company's challenge/response tokens work as follows: when a user logs onto a computer or enters a program or network with a user ID, the computer generates a numeric or alphanumeric challenge and displays both the challenge and a flashing bar pattern on the terminal screen. The user holds a token up to the flashing pattern on the screen, and the token reads and interprets the pattern and then displays a unique, or one-time, password on its liquid crystal display. The user then enters this password on the computer keyboard and, if a match exists, access to the computer, program or network is granted. If the terminal screen is not able to display a flashing bar pattern, the user can enter the numeric or alphanumeric challenge into the keypad on the token. PIN protected break-in attempts to unlock the key are tracked by the token internally. After a pre-programmed number of invalid attempts, the token will be locked out of the system until an authorized administrator provides an unlock code to reset the token. Some of the Company's products also are able to perform "digital signatures" for applications which require proof that a transaction was authorized. A combination of numbers from the transaction are entered into a token which produces an encrypted number that only that specific token, and the information from the transaction, could have created. This number is then entered as part of the transaction, acting as a digital signature authorizing the transaction. The Company's security tokens include a family of devices known as Digipass. During the first quarter of 1998, the Company began full production and shipping of its Digipass 300, which is an optical, hand-held multiple-mode security token capable of operating in time-synchronous response only, challenge/response and time synchronous challenge/response modes and of performing digital signature functions. In addition to the Digipass 300, the Company also offers the Digipass 500, a time-synchronous response only token that generates a one-time password, to authenticate users of PCs and networks and to verify data transmissions by electronic signature. Smartcards are also emerging as viable security devices. The Company currently offers a smartcard product, VACMan/CryptaPak, that combines two authentication standards on one smartcard. VACMan/CryptaPak is a standards based smartcard solution that secures Internet applications based on the X.509 authentication standard and also secures remote dial-in access based on the RADIUS authentication standard. It includes a smartcard, smartcard reader and software that enables Netscape Communications Corporation's Communicator to authenticate users via the X.509 certificate standard and software that enables remote dial-in users to be authenticated via the RADIUS authentication standard.

Encryption Products. Hardware encryption product offerings from the Company include DES and RSA microprocessor chips that perform algorithmic functions for use in, among other things, ATMs, fax machines, modems and security servers. The Company's DES and RSA chips are also the central component of its PC DES/RSA Cards, which are printed circuit boards that enable software applications to provide encryption security. Access Control Products. The Company has, through a strategic relationship, developed the VACMan access control system, which centralizes security services in a single location, supports all of the Company's token devices, and is based on industry standard protocols to maximize interoperability. VACMan also incorporates authorization and accounting features. The Company's Strategy The Company's objective is to establish itself as a "best of breed" solutions vendor and to become a leader in the data security market. The Company's growth is largely dependent on the successful implementation of its business strategy. There can be no assurance that the Company will be able to successfully implement its business strategy or that, if implemented, such strategy will be successful. Key elements of the Company's strategy for achieving this objective are listed below: Increase Name Recognition. The Company intends to increase the name recognition of its products. It believes that by establishing itself as a brand name, it will obtain a key competitive advantage. The Company believes that the market for data security products is confused by multiple technologies and conflicting claims and that end-users will ultimately be more comfortable buying a well-known product. The Company intends to increase its name recognition by emphasizing sales to well-known visible end-users, expanding its distribution network, increasing its presence at technology trade shows and other increased marketing activities such as print media campaigns. Expand Product Line. The Company plans to continue to broaden its line of security products to meet its customers' needs. The Company intends to accomplish this by continuing to develop identification and authentication expertise, as well as by seeking strategic relationships and acquiring complementary assets or businesses. Expand Global Presence. The implementation of data security products for electronic banking in the European market has become widespread and as a result, the market for the Company's products has grown more quickly in Europe than in North America. Sales by the Company's European subsidiary, VDS NV/SA, and its U.S. subsidiary, VDSI, represented 81% and 19%, respectively, of the Company's total revenue for the year ended December 31, 1998. Nevertheless, sales to U.S. customers represented just 6% of the Company's sales for the year ended December 31, 1998. The Company believes that there are

significant opportunities for its products in the developing North American market and further believes it is well positioned to take advantage of this growing market. The Company intends to maintain and expand its leadership role in the identification, authentication, authorization and accounting markets in Europe and to leverage its European expertise to introduce and promote the Company's identification, authentication, authorization and accounting products to the North American and other global markets. Enterprises that allow remote access to proprietary databases or information, or need to ensure secure data transmission for purposes of electronic commerce (including via the Internet), are potential customers for the Company's security products. The Company intends to pursue these potential customers through its growing network of distributors and resellers. Expand Marketing Channels. The Company intends to recruit and support a network of value added resellers worldwide that specialize in both vertical (banking, financial, health, telecommunications and government) markets and horizontal (remote access and Internet application) markets. By undertaking these activities, the Company intends to address and fulfill the requirements of the growing remote access market that is in need of advanced identification, authentication, authorization and accounting products. Some of the distributors and resellers that have entered into agreements to distribute the Company's products in various strategic markets include: EUROPE NORTH AND SOUTH AMERICA ASIA Concord-Eracom Nederland BV All Tech Data Systems, Inc. HorizonSystems (Netherlands) (Midwestern United States) (Hong Kong) Telindus Unis Lumin HUCOM (Belgium) (Canada) (Japan) Secureware Excelsys, SA (France) (Chile) Sirnet AB Latin Ware Ltda. (Scandinavia) (Colombia) Q&I Electronics Sistemas Efficientes SA (Netherlands) (Guatemala) Develop Strategic Relationships. To accomplish its strategic goals, the Company has established and is developing strategic relationships with other vendors of complementary security products and may seek to acquire complementary assets or businesses. Also, the Company has identified vendors of security or remote access products that relied solely on static passwords that the Company believes its products can enhance. During 1998, the Company entered into a strategic partnership with Lernout & Hauspie Speech Products NV ("L&H"), a worldwide market leader in speech and linguistic technologies, products, and services.

The Company also has entered into co-development agreements with certain companies to gain access to technology critical to the acceptance and adoption of the Company's technology and products. As an example, the Company entered into a co-development agreement with SHIVA Corp., a leader in remote access communications equipment, pursuant to which the Company licensed from SHIVA Corp. a generic security server. The resulting product, VACMan, enables the Company's technology and products to be inserted into virtually any organization that allows remote dial-in access to its computer networks. The Company's Security Products The Company's family of hardware products include time-synchronous response only, challenge/response and time-synchronous challenge/response user authentication token devices or security tokens. As of December 31, 1998, the Company had over 2.6 million security tokens (AccessKey II, AuthentiCard, Digipass 300 and Digipass 500) in use. In addition, the Company offers a smartcard security token that uses the challenge/ response mode and the X.509 certificate authentication standard. The Company also designs, develops and markets encryption chips and encryption boards through a division called Cryptech. The primary customers of the Cryptech products are OEMs of telecommunications equipment that require real time encryption. All the Company's security tokens can be used with its software authentication server, VACMan, to provide a complete identification, authentication, authorization and accounting security system. VACMan supports each of the Company's security devices and permits users to centralize their security systems in a single server or network of servers. It is designed for small, medium and large enterprises and Internet service providers, and it provides a centralized and flexible solution for managing network access. VACMan is scalable for large remote access systems and a single server can support numerous distributed network access servers. The Company also offers numerous additional products to extend the security services of VACMan/Server to platforms and/or applications that do not yet support the RADIUS protocol. Examples of such products are VACMan/Client NT, VACMan/Client IIS (Microsoft Web Server), and VACMan/Client Solaris. In addition the Company offers workstation software to enhance network connections when using advanced products like Digipass 300 or VACMan/CryptaPak. These products have unique workstation requirements to generate a terminal flash pattern for the security tokens and to communicate to a smartcard reader attached to the workstation in the case of VACMan/CryptaPak. The Company also provides a software development kit ("SDK") that can be used by other vendors or by clients to build RADIUS support into their products or applications. This SDK enables them to perform one integration project and gain support for all RADIUS compliant security servers. The SDKs are written in the C programming language and can be used in numerous operating system environments such as MVS, VMS, UNIX, Windows, NetWare and DOS. The SDKs enable the Company's strategic partners to integrate the Company's products into their own product offerings.

Intellectual Property and Proprietary Rights The Company relies on a combination of patent, copyright, trademark and trade secret laws, as well as employee and third-party non-disclosure agreements to protect its proprietary rights. In particular, the Company holds several patents in the United States and a corresponding patent in certain European countries, which cover certain aspects of its technology. The majority of its patents cover the Company's AccessKey II, Digipass 300, Digipass 500 and AuthentiCard tokens. The U.S. patents expire between 2003 and 2010; the European patent expires in 2008. The Company believes these patents to be valuable property rights and relies on the strength of its patents and trade secret law to protect its intellectual property rights. To the extent that the Company believes its patents are being infringed upon, it intends to assert vigorously its patent protection rights, including but not limited to, pursuing all available legal remedies. While the Company believes that its patents are material to its future success, there can be no assurance that the Company's present or future patents, if any, will provide a competitive advantage. It also may be possible for others to develop products with similar or improved functionality that will not infringe upon the Company's intellectual property rights. Furthermore, to the extent that the Company believes that its proprietary rights are being violated, and regardless of its desire to do so, it may not have adequate financial resources to engage in litigation against the party or parties who may infringe on its proprietary technology. In November 1998, the Company was served with a lawsuit filed against it by Security Dynamics Technologies, Inc. alleging patent infringement. While the Company believes that it is protected by its patents and that this lawsuit was without merit, it was determined to be in the best interests of the Company to resolve this lawsuit in a timely manner. Therefore, on April 6, 1999, Security Dynamics Technologies, Inc., the Company and VASCO Data Security, Inc. announced settlement on confidential terms of the claims that each of the companies had raised in litigation filed during 1998. In addition, the Company is from time to time involved in litigation incidental to the conduct of its business. Except for the foregoing lawsuit, the Company is not a party to any other lawsuit or proceeding which, in the opinion of management, is likely to have a material adverse effect on the Company's business, financial condition or results of operations. Research and Development The Company's research and development efforts are concentrated on product enhancement, new technology development and related new product introductions. The Company employs 11 full-time engineers and, from time to time, independent engineering firms to conduct non-strategic R&D efforts on its behalf. For the fiscal years ended December 31, 1996, 1997 and 1998, the Company expended $575,000, $1,802,000, and $1,788,000, respectively, on R&D, representing approximately 5.6%, 14.6%, and 11.9% of consolidated revenues for 1996, 1997 and 1998, respectively.

Production The Company's security hardware products are manufactured by third parties pursuant to purchase orders issued by the Company. Its hardware products are comprised primarily of commercially available electronic components which are purchased globally. The Company's software products are controlled in-house by Company personnel and can be produced either in-house or by several outside sources in North America and in Europe. At December 31, 1998, the Company had firm purchase orders from customers for an aggregate of 464,000 AccessKey II, AuthentiCard, Digipass 300 and Digipass 500 security token units, exclusive of the units shipped under those orders as of that date. With the exception of the AccessKey II token, the Company's security tokens utilize commercially available programmable microprocessors, or chips. The Company uses two microprocessors, made by Samsung and Epson, for the various hardware products produced other than the AccessKey II token. The Samsung microprocessors are purchased from Samsung Semiconductor in Belgium, and the Epson microprocessors are purchased from Alcom Electronics NV/SA, also located in Belgium. The microprocessors are the only components of the Company's security tokens that are not commodity items readily available on the open market. While there is an inherent risk associated with each supplier of microprocessors, the Company believes having two sources reduces the overall risk. AccessKey II uses a custom-designed and fabricated microprocessor which is currently available from a single source, Micronix Integrated Systems, in the United States. The Company does not have a long-term contract with Micronix, but rather submits blanket purchase orders for the AccessKey II microprocessor. AccessKey II production was reduced during 1998 and ceased full production during the first quarter of 1999, as production of Digipass 300 increased, which employs a widely available microprocessor. Orders of microprocessors and some other components generally require a lead time of 12-16 weeks. The Company attempts to maintain a sufficient inventory of all parts to handle short term spikes in orders. Large orders that would significantly deplete the Company's inventory are typically required to be placed with more than 12 weeks of lead time, allowing the Company to attempt to make appropriate arrangements with its suppliers.

The Company purchases the majority of its product components and arranges for shipment to third parties for assembly and testing in accordance with design specifications. The Company's three security token products are assembled exclusively by two independent companies, each of which is based in Hong Kong. Purchases from one of the companies are made on a purchase order by purchase order basis. Purchases from the other company are under a contract that extends to January 21, 2000, with automatic one-year renewals and subject to termination on six months notice. Each of these companies assembles the Company's security tokens at facilities in mainland China. One of the companies also maintains manufacturing capacity in Hong Kong. Equipment designed to test product at the point of assembly is supplied by the Company and periodic visits are made by Company personnel for purposes of quality assurance, assembly process review and supplier relations. Competition The market for computer and network security solutions is very competitive and, like most technology-driven markets, is subject to rapid change and constantly evolving products and services. The industry is comprised of many companies offering hardware, software and services that range from simple locking mechanisms to sophisticated encryption technologies. The Company believes that competition in this market is likely to intensify as a result of increasing demand for security products. The Company's competition comes from a number of sources, including (i) software operating systems suppliers and application software vendors that incorporate a single-factor static password security system into their products, and (ii) token-based password generator vendors promoting response only and/or challenge/ response technology, such as ActivCard, Inc., AXENT Technologies, Inc. CRYPTOCard, Inc., Leemah DataCom Security Corporation, Racal-Guardata, Inc., Secure Computing Corp., and Security Dynamics Technologies, Inc. In some cases, these vendors also support the Company's products and those of its competitors. The Company also may face competition in the future from these and other parties that develop computer and network security products based upon approaches similar to or different from those employed by the Company. The Company believes that the principal competitive factors affecting the market for computer and network security products include name recognition, technical features, ease of use, quality/reliability, level of security, customer service and support, distribution channels and price. Although the Company believes that its products currently compete favorably with respect to such factors, other than name recognition in certain markets, there can be no assurance that the Company can maintain its competitive position against current and potential competitors, especially those with significantly greater financial, marketing, service, support, technical and other competitive resources.

Many of the Company's present and potential competitors have significantly greater financial, technical, marketing, purchasing and other resources than the Company, and as a result, may be able to respond more quickly to new or emerging technologies and changes in customer requirements, or to devote greater resources to the development, promotion and sale of products, or to deliver competitive products at a lower end user price. Current and potential competitors have established or may establish cooperative relationships among themselves or with third parties to increase the ability of their products to address the needs of the Company's prospective customers. Accordingly, it is possible that new competitors or alliances may emerge and rapidly acquire significant market share. The Company's products are designed to allow authorized users access to a computing environment, in some cases using patented technology as a replacement for the static password. Although certain Company security token technologies are patented, there are other organizations that offer token-type password generators incorporating challenge-response or response only approaches that employ different technological solutions and compete with the Company for market share. Sales and Marketing The Company's computer and network security products are marketed primarily through an indirect sales channel and distribution network and, to a lesser extent, directly to end-users. The Company markets its products primarily in North America, Europe and Asia-Pacific through a combination of value-added resellers, original equipment manufacturers, independent distributors and direct sales efforts. A sales staff of 20 coordinates sales through the distribution network and makes direct sales calls either alone or with sales personnel of vendors of computer systems. The sales staff also provides product education seminars to sales personnel of vendors and distributors with whom the Company has working relations and to potential end-users of the Company's products. In January of 1997, the Company introduced the VASCO Advantage Reseller ("VAR") program. The goal of this program is to expand the Company's marketing channels by engaging companies already proficient in reselling computer network products and security solutions to distribute the Company's products. The Company works with these value added resellers, resellers, OEM's and distributors (collectively referred to as "Resellers") through its United States and European operating subsidiaries, VDSI and VDS NV/SA. VDSI, which is primarily responsible for North America, South America and Japan, started in 1997 with one Reseller. Since January 1, 1997, arrangements have been made with 54 additional Resellers, for a total of 55. VDS NV/SA, which is generally responsible for developing sales in the remainder of the world, had an existing base of 17 Resellers prior to the announcement of the VAR program. Since January 1, 1997, VDS NV/SA has engaged an additional 44 Resellers, for a total of 61.

The Company's international sales and operations are subject to risks such as the imposition of government controls, new or changed export license requirements, restrictions on the export of critical technology, trade restrictions and changes in tariffs. While the Company believes its products are designed to meet the regulatory standards of foreign markets, any inability to obtain foreign regulatory approvals on a timely basis could have a material adverse effect on the Company's financial condition or results of operations. The Company's products are subject to export restrictions and controls as administered by the National Security Agency, the Department of State and the Department of Commerce. Encryption products are eligible for export depending upon the level of encryption technology incorporated into the product. U.S. export laws also prohibit the export of encryption products to a number of specified hostile countries. Until recently, the Company did not need to obtain U.S. export licenses for its products. However, VACMan/CryptaPak, introduced to the Company product line in August 1997, requires a License Exception (i.e., authorization to export, under stated conditions, subject to Export Administration Regulations). The Company believes it is able to obtain License Exceptions for its VACMan/CryptaPak product for sales to international banking and financial institutions. The Company's core authentication products, AccessKey II, Digipass 300, and Digipass 500 do not, nor are they likely to, fall under U.S. encryption export control regulations. Although all of the Company's authentication products utilize encryption technologies, the products cannot read and encrypt client data. Thus, they are not subject to the U.S. encryption export control regulations. Similarly, VDS NV/SA, the Belgian operating subsidiary of the Company, is subject to export licensing requirements under Belgian law. The inability of VDS NV/SA to obtain required approvals or licenses under Belgian law also could have a material adverse effect on the Company's financial condition or results of operations. The Belgian export of VDS NV/SA's cryptographic products, consisting of DES and RSA microprocessors and PC/DES and RSA cards (including software development kit(s)), is subject to European Community regulations. VDS NV/SA's cryptographic products are considered to be "goods of dual use" under those regulations, i.e., goods that can be used for both civil and military purposes. As such, a national individual export license is required for their export, except to Luxembourg and the Netherlands. Only the VDS NV/SA products that perform encryption of data for confidentiality reasons require an individual export license, and VDS NV/SA has obtained such licenses for the export of these products. VDS NV/SA, as owner and exporter of the cryptographic products, must apply to the Belgian Ministry of Economic Affairs for an export license for each company to which it exports such products. An export license is valid for one customer for one year from the date of issue. It can be reused for several consecutive deliveries to that customer until the total export quantity, as indicated on the license, has been exhausted. If the quantity is not completely exported during the one year license period, the license can be renewed once for another year. VDS NV/SA applies for such licenses for customers that wish to purchase cryptographic products.

Customers and Markets Customers for the Company's security products include, to some extent, businesses that purchase products directly from the Company for use by their employees, clients or vendors, but the majority are value-added resellers or distributors of related security products or services who in turn sell to other businesses. To date, virtually all of the Company's security products have been sold in Europe. Sales to one European distributor, Sirnet, accounted for 20% of the Company's consolidated revenues in 1998. Additionally, Rabo Bank and Concord-Eracom Nederland NV each accounted for approximately 16% and 13% of the Company's total revenues, respectively. The Company is aware of the risks associated with this degree of customer concentration and expects to reduce its reliance on these customers in 1999 and beyond. Backlog At December 31, 1998, the Company had firm purchase orders from customers for an aggregate of $9,567,000 of Authenticard, Digipass 300 and Digipass 500 security token units, exclusive of the units already shipped under such purchase orders as of December 31, 1998. This compares to a balance of $8,643,000 as of December 31, 1997. Employees As of December 31, 1998, the Company employed 54 full-time employees and 6 full-time consultants. Of these, 27 were located in North America and 33 were located in Europe. Of the 60 total, 35 were involved in sales, marketing and customer support, 13 in product production, research and development and 12 in administration. Item 2 - Properties The Company's corporate offices and North American administrative, sales and marketing, research and development and support facilities are located in the United States in an office complex in Oakbrook Terrace, Illinois, a western suburb of Chicago. These facilities are leased through November 15, 1999, and consist of approximately 10,000 square feet. The Company believes that the Oakbrook Terrace facilities will be adequate for its present growth plans. The Company's European administrative, sales and marketing, research and development and support facilities are located in Belgium in an industrial park in a southwestern suburb of Brussels. These facilities consist of approximately 10,000 square feet of office space which are occupied under a lease expiring in July of 1999. Upon the termination of the current lease, the Company has arranged a lease for facilities consisting of approximately 20,000 square feet of office space located in a suburb of Brussels, for a term of six years. This lease had not yet been signed.

Item 3 _ Legal Proceedings During 1998, the Company was served with a lawsuit filed against it by Security Dynamics Technologies, Inc. alleging patent infringement. On April 6, 1999, Security Dynamics Technologies, Inc., the Company and VASCO Data Security, Inc. announced a settlement on confidential terms of the claims that each of the companies had raised in litigation filed last year. In addition, the Company is from time to time involved in litigation incidental to the conduct of its business. Except for the foregoing lawsuit, the Company is not a party to any other lawsuit or proceeding which, in the opinion of management, is likely to have a material adverse effect on the Company's business, financial condition or results of operations. Item 4 _ Submission of Matters to a Vote of Security Holders No matter was submitted to a vote of security holders during the fourth quarter of 1998, through solicitation of proxies or otherwise.

PART II Item 5 - Market for Registrant's Common Equity and Related Stockholder Matters There was no established public market for the Common Stock in 1997. On March 20, 1998, the Common Stock was approved for trading on the NASD Electronic Bulletin Board system under the symbol "VDSI." On April 14, 1999, the closing sale price for the Common Stock on the Over-the-Counter Bulletin Board was $4.125 per share. Such Over-the-Counter market quotations reflect inter-dealer prices, without retail mark-up, mark-down or commission and may not necessarily represent an actual transaction. On March 31, 1999, there were approximately 1,500 holders of record of the Common Stock. Prior to March 23, 1998, shares of VASCO Corp. common stock were quoted on the OTC-BB under the symbol "VASC." Since March 23, 1998, the Common Stock has been quoted on the OTC-BB under the symbol "VDSI." The following table sets forth the high and low closing bid quotations for the securities and periods indicated within the past two fiscal years. VASCO Corp. common stock High Low 1997 First Quarter 5 7/8 3 7/16 Second Quarter 4 5/8 2 1/4 Third Quarter 5 7/16 2 3/8 Fourth Quarter 7 2 15/16 1998 First Quarter 7 1/4 4 3/16 Second Quarter 12 11/32 5 3/8 Third Quarter 7 1/4 2 3/4 Fourth Quarter (through October 27, 1998) 3 7/16 2 3/4 Common Stock 1998 First Quarter 6 4 Second Quarter 9 3 Third Quarter 7 1/8 3 Fourth Quarter 4 2 1/2 On October 28, 1998, the last sale price quoted on the OTC BB was 3 1/4. The above quotations represent prices between dealers and do not include retail markups or markdowns or commissions. They may not necessarily represent actual transactions.

The Company has not paid any dividends on its Common Stock since incorporation. Dividends were paid relating to the Company's Series B Preferred Stock, which was converted to Common Stock in September 1997. Restrictions or limitations on the payment of dividends may be imposed under the terms of credit agreements or other contractual obligations. In the absence of such restrictions or limitations, the declaration and payment of dividends will be at the sole discretion of the Board of Directors of the Company and subject to certain limitations under the General Corporation Law of the State of Delaware. The timing, amount and form of dividends, if any, will depend, among other things, on the Company's results of operations, financial condition, cash requirements, plans for expansion and other factors deemed relevant by the Board of Directors. The Company intends to retain any future earnings for use in its business and therefore does not anticipate paying any cash dividends in the foreseeable future. Item 6 - Selected Financial Data (in thousands, except per share data)(1)(2) Year Ended December 31, --------------------------------------------- 1994 1995 1996 1997(2) 1998 ---- ---- ---- ------- ---- Statement of Operations Data: Total revenues $2,693 $3,695 $10,192 $12,302 $15,016 Operating income(loss) 192 (534) (8,658)(3) (3,935)(4) (1,210) Net income (loss) available to common stockholders 30 (465) (9,349)(3) (5,998)(4) (3,649) Basic and diluted income (loss) per common share - (0.03) (0.53)(3) (0.31)(4) (0.18) Shares used in computing per share amounts 14,260 14,817 17,533 19,106 20,431 December 31, --------------------------------------------- 1994 1995 1996 1997 1998 Balance Sheet Data: ---- ---- ---- ---- ---- Cash $ 38 $ 745 $ 1,814 $ 1,898 $ 1,523 Working capital 764 1,074 4,902 (555) (3,086) Total assets 2,111 2,414 12,368 8,376 9,101 Long term obligations, less current portion 60 7 9,114 8,443 8,436 Common stock subject to redemption - 371 742 495 - Stockholders' equity (deficit) 1,364 966 (1,205) (6,865) (9,646)

For a discussion of factors that affect the comparability of the financial information set forth above, such as significant acquisitions undertaken by the Company, the disposition of the Company's VASCO Performance Systems line of business in 1996, and the significant costs incurred during 1997 related to the Exchange Offer, see Item 7 _ "Management's Discussion and Analysis of Financial Condition and Results of Operations." ___________________________ (1) Represents the financial information of VASCO Corp. prior to March 11, 1998, as the Company had not begun operations until the Exchange Offer. (2) Includes the results of operations of Lintel Security from March 1996 and Digipass from July 1996; see "Financial Statements." (3) Includes a pretax charge for acquired in-process research and development of $7,351. (4) Includes legal, accounting and printing costs of approximately $1,218 related to preparing for the Exchange Offer that was completed in March 1998. Item 7 - Management's Discussion and Analysis of Financial Condition and Results of Operations Certain statements contained in the following Management's Discussion and Analysis of Financial Condition and Results of Operations are forward-looking statements. All forward-looking statements included herein are based on information available to the Company on the date hereof and assumptions which the Company believes are reasonable. The Company does not assume any obligation to update any such forward-looking statements. These forward-looking statements involve risks and uncertainties. The Company's actual results could differ materially from those anticipated in these forward-looking statements as a result of certain factors, including those set forth elsewhere in this Form 10-K and the Company's other filings with the Securities and Exchange Commission. On March 11, 1998, VASCO Data Security International, Inc. (the "Company") successfully completed its offer (the "Exchange Offer") to exchange the VASCO Corp.'s shares, options, and warrants for the Company's shares, options and warrants. Because the Company was a non-operating subsidiary of VASCO Corp. prior to the completion of the Exchange Offer (which occurred on March 11, 1998), the discussion of results contained herein relates to the results of VASCO Corp. and its subsidiaries for periods prior to March 11, 1998 and the Company after March 11, 1998. As previously noted, VASCO Corp. merged into the Company effective October 28, 1998.

OVERVIEW VASCO designs, develops, markets and supports open standards- based hardware and software security systems which manage and secure access to information assets. VASCO's original corporate predecessor was founded in 1984, and VASCO entered the data security market in 1991 when it acquired a controlling interest in what is today one of VASCO's two operating subsidiaries, VASCO Data Security, Inc. ("VDS") (formerly known as "ThumbScan, Inc."), a company that designs, develops and sells security tokens, primarily to European customers. In 1996, VASCO began developing and marketing open standards-based security systems by introducing a hardware and software package, VACMan, that is based on industry-accepted remote access protocols. Revenue and Earnings. The majority of sales made by VDS and VDS NV/SA are in the European markets, although the Company intends to actively pursue additional markets outside of Europe, particularly Asia and North and South America. Revenues from sales of security tokens, specifically the AccessKey II and Digipass tokens, continue to represent the majority of the Company's total revenues. In excess of 80% of VDS's sales for 1996, 1997 and 1998 were comprised of security token devices, with Concord-Eracom Nederland BV accounting for 97%, 92% and 70% of VDS's sales in 1996, 1997 and 1998, respectively. On a consolidated basis, the percentages for 1996, 1997 and 1998 were 44%, 16% and 13%, respectively, including revenues relating to the Lintel Security and Digipass operations from their respective acquisition dates in 1996. It is expected that consolidated sales to other customers and markets will increase and, assuming this occurs, the degree of concentration attributable to this major customer will decrease. However, the Company expects that this major customer will continue to be a meaningful contributor to the Company's revenues and earnings for the foreseeable future. In 1998, for example, Concord-Eracom Nederland BV placed an additional $2.5 million order with VDS. Consequently, the unforeseen loss of this customer's business, or the inability to maintain reasonable profit margins on sales to this customer, may have an adverse effect on the Company's results of operations and financial condition. Although the Company believes it is likely that sales of security tokens, including the Digipass 300, will continue to account for a majority of the Company's total revenues for the foreseeable future, the Company also believes that revenues from sales of its other hardware and software data security products, including the additional product offerings made possible by the Lintel Security and Digipass acquisitions, will continue to increase in the future.

Research and Development. The Company is devoting its capital and other resources to enhancing its existing security products and developing new products to provide enterprise-wide hardware and software security solutions. Costs of research and development, principally the design and development of hardware and software prior to the determination of technological feasibility, are expensed as incurred on a project-by-project basis. The Company's capitalization policy currently defines technological feasibility as a functioning beta test prototype with confirmed manufacturability (a working model), within a reasonably predictable range of costs. Additional criteria include receptive customers, or potential customers, as evidenced by interest expressed in a beta test prototype, at some suggested selling price. Once technological feasibility has been established, ongoing development costs incurred prior to actual sales of the subject product are capitalized in accordance with Statement of Financial Accounting Standards No. 86, "Accounting for the Costs of Computer Software to Be Sold, Leased or Otherwise Marketed." Product development costs are capitalized on a product-by-product basis and are amortized by the greater of (i) the ratio that current gross revenues for a product bear to the total of current and anticipated future gross revenues for that product or (ii) the straight-line method over the remaining estimated economic life of the product. The remaining estimated economic life of these products are reviewed at least quarterly. Management has concluded that, in today's rapidly evolving technology markets and with the expanding state of the computer and network security industry in general, it may be impractical to anticipate product life cycles in excess of two years. Historically, however, the Company's products have experienced significantly longer product lives than two years. Variations in Operating Results. The Company's quarterly operating results have in the past varied and may in the future vary significantly. Factors affecting operating results include: the level of competition; the size, timing, cancellation or rescheduling of significant orders; market acceptance of new products and product enhancements; new product announcements or introductions by the Company's competitors; adoption of new technologies and standards; changes in pricing by the Company or its competitors; the ability of the Company to develop, introduce and market new products and product enhancements on a timely basis, if at all; component costs and availability; the Company's success in expanding its sales and marketing programs; technological changes in the market for data security products; foreign currency exchange rates; and general economic trends and other factors.

In addition, the Company has experienced, and may experience in the future, seasonality in its business. The seasonal trends have included higher revenue in the last quarter of the calendar year and lower revenue in the next succeeding quarter. The Company believes that revenue has tended to be higher in the last quarter due to the tendency of certain customers to implement or complete changes in computer or network security prior to the end of the calendar year. In addition, revenue has tended to be lower in the summer months, particularly in Europe, when many businesses defer purchase decisions. Because the Company's operating expenses are based on anticipated revenue levels and a high percentage of the Company's expenses are fixed, a small variation in the timing of recognition of revenue could cause significant variations in operating results from quarter to quarter. Currency Fluctuations. The majority of the supply and sales transactions of VASCO Data Security, Inc. are denominated in U.S. dollars, whereas many of the supply and sales transactions of VDS NV/SA are denominated in various foreign currencies. In order to reduce the risks associated with fluctuations in currency exchange rates, VDS NV/SA began in September 1997 to buy U.S. dollars based on three to six months estimated future needs for U.S. dollars, has developed price lists denominated in both U.S. dollars and foreign currencies, and endeavors to denominate its new supply and sales transactions in U.S. dollars. During 1997, VDS NV/SA purchased $300,000 in U.S. dollars to cover purchases of supplies. This balance proved sufficient to meet VDS NV/SA's needs during 1998 as well. VDS NV/SA has also continued to match the timing of delivery, amount of product and the currency denomination of purchase orders received from vendors with sales orders to customers.

RESULTS OF OPERATIONS The following table sets forth, for the periods indicated, certain consolidated financial data as a percentage of revenues for the years ended December 31, 1996, 1997 and 1998. Percentage of Revenue Year Ended December 31, -------------------------- 1996 1997 1998 ---- ---- ---- Revenues 100.0% 100.0% 100.0% Cost of goods sold 57.6 51.1 46.3 ---- ---- ---- Gross profit 42.4 48.9 53.7 Operating costs: Sales and marketing 13.8 27.5 29.1 Research and development 5.6 14.6 11.9 General and administrative 35.8 38.8 20.8 Acquired in-process research and development 72.1 - - ---- ---- ---- Total operating costs 127.3 80.9 61.8 ----- ---- ---- Operating loss (84.9) (32.0) (8.1) Interest expense (3.4) (9.3) (9.7) Other expense, net (0.4) (1.8) (2.0) ---- ---- ---- Loss before income taxes (88.8) (43.1) (19.8) Provisions for income taxes 1.4 4.9 4.6 ---- ---- ---- Net loss (90.7) (48.0) (24.4) ==== ==== ==== The following discussion is based upon the Company's consolidated results of operations for the years ended December 31, 1998, 1997 and 1996. References to "VASCO" represent the consolidated entity. References to "VASCO NA" represent VASCO Corp. and VDS, excluding the acquisition of Lintel Security and Digipass. References to "VASCO Europe" mean the operations of Lintel Security and Digipass following their acquisition by VASCO. (Percentages in the discussion are rounded to the closest full percentage point.) 1998 COMPARED TO 1997 The following discussion and analysis should be read in conjunction with VASCO's Consolidated Financial Statements for the years ended December 31, 1998 and 1997.

Revenues VASCO's consolidated revenues for the year ended December 31, 1998 were $15,016,000, an increase of $2,714,000, or 22%, as compared to the year ended December 31, 1997. VASCO Europe contributed $12,230,000 or 81% of total consolidated revenues, with VASCO NA contributing the remaining $2,786,000 or 19%. This increase is due to a strong performance from international operations, as the demand for Digipass 300 and Digipass 500 continues to grow, resulting in increased unit sales, as well as increasing orders with smaller quantities, resulting in less volume discounting on revenues. In addition, favorable currency exchange rates benefited the Company. Cost of Goods Sold VASCO's consolidated cost of goods sold for the year ended December 31, 1998 was $6,949,000, an increase of $662,000, or 11%, as compared to the year ended December 31, 1997. VASCO Europe's cost of goods sold was $5,550,000 or 80% of total consolidated cost of goods sold and VASCO NA was $1,399,000 or 20%. This increase is consistent with the increase in revenues for the year. The Company continues to benefit from efficiencies in the manufacturing process, as well as the increasing demand for products with a more favorable cost structure. Gross Profit VASCO's consolidated gross profit for the year ended December 31, 1998 was $8,067,000, an increase of $2,051,000, or 34%, over the year ended December 31, 1997. This represents a gross margin of 54%, as compared to 1997's consolidated gross margin of 49%. The increase in gross margin is due to efficiencies in manufacturing related to increasing volumes, an increase in the mix of higher margin products, as well as increasing orders with smaller quantities, resulting in less volume discounting on revenues. Sales and Marketing Expenses Consolidated sales and marketing expenses for the year ended December 31, 1998 were $4,368,000, an increase of $987,000, or 29%, over 1997. This increase can be attributed to increased sales efforts including, in part, increased travel costs, headcount, and an increase in marketing activities, including the development the new VASCO logo, Internet web page and other efforts. Research and Development Expenses Consolidated R&D costs for the year ended December 31, 1998 were $1,788,000, a decrease of $14,000, or 1%, as compared to the year ended December 31, 1997. This decrease can be attributed to higher spending in 1997 related to the acquisition/development of the VACMan product line, as well as a reduction in employees as compared to 1997, with increased use of temporary employees in 1998.

General and Administrative Expenses Consolidated general and administrative expenses for the year ended December 31, 1998 were $3,120,000, a decrease of $1,648,000, or 34%, over 1997. This decrease can be attributed to the fact that the Company was preparing for the Exchange Offer during 1997, thus generating significant legal, accounting and printing expenses; the Exchange Offer was completed during March 1998. In addition, economies of scale began to be realized during 1997 as a result of the combination of the operations of Lintel Security and VASCO Data Security. The Company also had a favorable experience with regard to bad debt recovery and a reduction of certain legal fees associated with the Exchange Offer, which was recorded during 1998. Operating Loss VASCO's consolidated operating loss for the year ended December 31, 1998 was $1,210,000, compared to the consolidated operating loss of $3,935,000 for 1997, a decrease of $2,725,000, or 69%. Of the 1998 loss, VASCO NA contributed a loss in the amount of $2,163,000 and VASCO Europe contributed income in the amount of $953,000. Interest Expense Consolidated interest expense in 1998 was $1,458,000 compared to $1,148,000 in 1997. The increase can be attributed to average borrowings in 1998 being higher than those of the previous year. See "Liquidity and Capital Resources" below. Income Taxes VASCO recorded tax expense for the year ended December 31, 1998 of $687,000, which consisted of a tax benefit of $2,500 for VASCO NA and tax expense of $689,500 for VASCO Europe. At December 31, 1998, the Company has United States net operating loss carryforwards approximating $7,434,000 and foreign net operating loss carryforwards approximating $1,092,000. Such losses are available to offset future taxable income at VASCO Data Security International, Inc. and its U.S. subsidiary and expire in varying amounts beginning in 2002 and continuing through 2018. In addition, if certain substantial changes in the Company's ownership should occur, there would be an annual limitation on the amount of the carryforwards which could be utilized. Dividends and Accumulated Deficit VASCO paid dividends of $0 and $82,000 during the years ended December 31, 1998 and 1997, respectively. The 1997 dividend payments were attributable to 9,000 shares of VASCO Series B Preferred Stock issued in 1994. During 1997, all 9,000 shares of VASCO Series B Preferred Stock were converted into VASCO Data Security International, Inc. Common Stock. VASCO began 1998 with an accumulated deficit of $15,902,000. As a result of the 1998 net loss, this deficit has increased to $19,550,000.

1997 COMPARED TO 1996 The following discussion and analysis should be read in conjunction with VASCO's Consolidated Financial Statements for the years ended December 31, 1997 and 1996. Revenues VASCO's consolidated revenues for the year ended December 31, 1997 were $12,302,000, an increase of $2,110,000, or 21%, as compared to the year ended December 31, 1996. VASCO Europe contributed $9,518,000, or 77%, of total consolidated revenues, with VASCO NA contributing the remaining $2,784,000, or 23%. Revenues (and other operating results) attributable to VASCO Europe for 1996 are included only from the time of acquisition of Lintel Security and of Digipass. The increase in revenues can be attributed to the full-year effect of the acquisitions, as compared to a partial year in 1996, partially offset by a temporary reduction in shipments to Concord-Eracom Nederland BV during 1997. Concord-Eracom Nederland BV represented approximately $4,200,000 in revenue for 1996, as compared to $2,000,000 in 1997. VPS, the former technical and training unit which was sold in August of 1996, had revenues of $204,000 in 1996 and accounted for 4% of VASCO's revenues in 1996. Cost of Goods Sold VASCO's consolidated cost of goods sold for the year ended December 31, 1997 was $6,287,000, an increase of $416,000, or 7%, as compared to the year ended December 31, 1996. VASCO Europe's cost of goods sold was $4,929,000, accounting for 78% of the consolidated cost of goods sold. The overall increase in cost of goods sold is primarily attributable to the inclusion of VASCO Europe for the entire year 1997. However, the cost of goods sold for security products as a percent of revenue decreased at a slightly quicker pace than revenues for security products. This is due to certain improvements in the manufacture of the products, as well as economies of scale being realized as the 1996 acquisitions of Lintel Security and Digipass were fully integrated. Gross Profit VASCO's consolidated gross profit for the year ended December 31, 1997 was $6,015,000, an increase of $1,694,000, or 39%, over 1996. This represents a consolidated gross margin of 49%, as compared to 1996's consolidated gross margin of 42%. The increase in gross margin is due to certain improvements in the manufacture of the products, as well as economies of scale being realized as the 1996 acquisitions of Lintel Security and Digipass were fully integrated. Sales and Marketing Expenses Consolidated sales and marketing expenses for the year ended December 31, 1997 were $3,381,000, an increase of $1,976,000, or 141%, over 1996. The increase can be attributed to the addition of VASCO Europe for the full year 1997; increased sales efforts including, in part, increased travel costs; an increase in marketing activities, including print media campaigns and other efforts, and an increased presence at trade shows.

Research and Development Expenses Consolidated R&D costs for the year ended December 31, 1997 were $1,802,000, an increase of $1,228,000, or 214%, as compared to the year ended December 31, 1996. R&D costs represented 15% of consolidated revenues for 1997 as compared to 6% for 1996. The increase is due to the addition of R&D headcount, both in the U.S. and Europe, and to the acquisition of the VACMan product from Shiva Corporation and the related integration efforts surrounding it. R&D efforts are undertaken by both VASCO NA and VASCO Europe on behalf of the consolidated group of companies. Whereas VASCO NA is primarily responsible for the development of software products, VASCO Europe is responsible for hardware development. Consequently, management of the Company believes it is not meaningful to address R&D costs separately at the operating company level. VASCO expensed, as cost of goods sold, $0 and $180,000 in 1997 and 1996, respectively, reflecting the amortization of capitalized development costs. As of December 31, 1997 and 1996, VASCO did not carry any product development costs on its books as an asset. There were no product development costs capitalized in 1997 or 1996. General and Administrative Expenses Consolidated general and administrative expenses for the year ended December 31, 1997 were $4,768,000, an increase of $1,120,000, or 31%, over 1996. The majority of this increase can be attributed to the legal, accounting and printing costs associated with the preparation of the Exchange Offer held by the Company during the first quarter of 1998. In addition, the full-year impact of the Lintel Security and Digipass acquisitions and the amortization of intangibles associated with those acquisitions increased general and administrative expenses in 1997. Acquired In-process Research and Development During 1996, VASCO expensed $7,351,000 pertaining to the in- process research and development acquired in the Lintel Security and Digipass acquisitions. Based upon independent appraisals, approximately 67% of the acquisition premium has been expensed in accordance with U.S. Generally Accepted Accounting Principles. As of December 31, 1997, there remains a net balance of $2,314,000 representing the intangible assets related to the acquisitions, which are carried on VASCO's books and amortized over an additional 18-66 months. Amortization expenses amounted to $1,083,000 and $440,000 for the years ended December 31, 1997 and 1996, respectively. Operating Loss VASCO's consolidated operating loss for the year ended December 31, 1997 was $3,935,000, compared to the consolidated operating loss of $8,658,000 for 1996. Of the 1997 loss, VASCO NA contributed a loss in the amount of $4,130,000 and VASCO Europe contributed income in the amount of $195,000. The 1996 consolidated operating loss included a write-off of acquired in-process research and development in the amount of $7,351,000 and $440,000 of amortization expense relating to intangible assets in 1996. The 1996 operating loss, before the write- off and the amortization, was $867,000.

VASCO's 1997 operating loss, excluding the amortization of intangibles, was attributable to continued investment in R&D (primarily for Digipass 300), sales and marketing investments in North America, the expenses for development of corporate infrastructure, such as sales personnel and administrative staff, and the legal, accounting and printing costs incurred during 1997 associated with the preparation of the Exchange Offer held by the Company during the first quarter of 1998. Interest Expense Consolidated interest expense in 1997 was $1,148,000 compared to $346,000 in 1996. The increase can be attributed to average borrowings in 1997 being substantially above those levels of the previous year. See "Liquidity and Capital Resources" below. Income Taxes VASCO recorded tax expense for the year ended December 31, 1997 of $200,000 for VASCO NA and $407,000 for VASCO Europe. The tax expense recorded for VASCO NA represents the revaluation (write-down) of deferred tax assets. As of December 31, 1997, VASCO reflected a net deferred tax asset of $83,000, which represented the amount that management deemed would more likely than not be realized. The net deferred tax asset was net of a valuation allowance of $831,000, which was established during 1996 and adjusted during 1997, considering the effects of reversing deferred tax liabilities, projected future earnings, which were revised substantially as a result of the acquisitions of Lintel Security and Digipass, and tax planning strategies. Dividends and Accumulated Deficit VASCO paid dividends of $82,000 and $108,000 during the years ended December 31, 1997 and 1996, respectively. These dividend payments were attributable to 9,000 shares of VASCO Series B Preferred Stock issued in 1994. During 1997, all 9,000 shares of VASCO Series B Preferred Stock were converted into VASCO Data Security International, Inc. Common Stock. VASCO began 1997 with an accumulated deficit of $9,903,000. As a result of the 1997 net loss, this deficit has increased to $15,902,000. RECENT DEVELOPMENTS On April 6, 1999, Security Dynamics Technologies, Inc., RSA Data Security, Inc., the Company and VASCO Data Security, Inc. announced the settlement on confidential terms of the claims that each of the companies had raised in litigation filed last year. In April 1999, the Company completed a private placement of Common Stock in the amount of $11.5 million. The transaction represented a sale of the Company's Common Stock to European institutional investors at a price of $3.50 per share. A total of 3,285,714 shares of Common Stock were issued as a part of this transaction.

LIQUIDITY AND CAPITAL RESOURCES Since inception, VASCO has financed its operations through a combination of the issuance of equity securities, private borrowings, short-term commercial borrowings, cash flow from operations, and loans from Mr. T. Kendall Hunt, VASCO's Chief Executive Officer and one of the stockholders of the Company's original corporate predecessor. In 1995, VASCO borrowed $130,000 from Mr. Hunt, resulting in a total loan payable balance of $190,000 at the end of 1995. This loan was repaid in 1996 from the proceeds of private placements during 1996. During the second quarter of 1996, VASCO placed additional units consisting of 666,666 shares of VASCO common stock and 137,777 warrants, each of which entitled the holder to purchase one share of VASCO common stock at $4.50. The private placement of shares and warrants generated gross proceeds of $3,000,000. In addition, in the same transaction, VASCO issued a $5,000,000 convertible note due on May 28, 2001. The note bears interest at 9%, with interest payable to the holder on a quarterly basis. The holder may, at its option, elect to receive interest payments in cash or Common Stock. In calculating the shares of VASCO common stock to be issued in lieu of cash interest, the average closing price for shares of VASCO common stock for the previous 20 trading days is used. In the event VASCO receives funds equal to or greater than $30,000,000 from a public offering of its Common Stock, the holder of this note has the right to require VASCO to pay all amounts due and owing under the note within 30 days of receipt by VASCO of notice from the holder of exercise of this right. Total issue fees and costs of $170,000 related to the equity portion of this transaction have been netted against the $3,000,000 of proceeds from the equity private placement. In addition, 55,555 shares of VASCO common stock and 8,889 VASCO Warrants, each of which entitles the holder to purchase one share of VASCO common stock at $4.50, were issued as commissions related to the placement. These warrants were exchanged pursuant to the Exchange Offer and now represent warrants for the Company's Common Stock. The proceeds from the $8,000,000 private placement ($3,000,000 equity and $5,000,000 debt) were used to make the first installment of $4,800,000 toward the Digipass purchase, to satisfy one-time expenses related to the Lintel Security and Digipass acquisitions, to retire VASCO's debt to its commercial lender and to Mr. Hunt, and to fund working capital requirements in general. In 1996, VASCO raised additional funds in a private placement of units consisting of 237,060 shares of VASCO common stock and 35,329 VASCO Warrants, each of which entitles the holder to purchase one share of VASCO common stock at $4.50. Total issue fees and costs of $47,885 were netted against the $1,066,770 in total proceeds from the placement in VASCO's financial statements. In addition, 16,489 shares of VASCO common stock were issued as commissions related to the placement. These warrants were exchanged pursuant to the Exchange Offer and now represent warrants for the Company's Common Stock.

Effective in June 1997, VASCO established a bridge loan with Generale Bank in the amount of $2,500,000, evidenced by five convertible notes in the amount of $500,000 each. Upon completion of the Exchange Offer, the Company became obligated for all obligations under the loan and the notes. These notes bear interest at a rate of 3.25%, payable quarterly, and matured on September 30, 1998, at which time 116% of the principal amount was repaid from the proceeds of a short-term borrowing facility secured by the Company with KBC Bank. The KBC Bank facility represents a three-month revolver, renewable for additional three-month terms, with a corresponding interest rate of 6.48%. This facility is anticipated to be repaid from the proceeds of a private placement that the Company expects to complete during the second quarter of 1999. The net effect of 1997 activity resulted in an increase in cash of $84,000, resulting in a cash balance of $1,898,000 at December 31, 1997, compared to $1,814,000 at the end of 1996. VASCO's working capital at December 31, 1997 was ($555,000), a decrease of $5,457,000, or 111%, from $4,902,000 at the end of 1996. The majority of the change is attributable to a decrease in all current asset categories with the exception of cash, with current liabilities remaining consistent from year to year. VASCO's current ratio was 0.91 to 1.00 at December 31, 1997, compared to 2.32 to 1.00 at the end of 1996. VDSE entered into a convertible loan agreement with Banque Paribas Belgique S.A. effective August 1997, in order to refinance the $3.4 million payment due December 31, 1997 in connection with VASCO's acquisition of Digipass. The terms of the agreement provide that the $3.4 million principal amount is convertible, at the option of the lender, into shares of the Company's Common Stock. This loan bears interest at the rate of 3.25%, payable annually, and matures on September 30, 2002. The loan is convertible, commencing on the earlier of January 1, 1999 or the date of a public offering of the Company's shares on the EASDAQ and/or NASDAQ and terminating on August 31, 2002, at a conversion price equal to the per share public offering price, provided, however, that if no such offering has occurred prior to January 1, 1999, and the loan is converted after such date but prior to a public offering, the conversion price is the average closing market price for shares of the Company's Common Stock on the NASD Electronic Bulletin Board system for the 20 trading days prior to the date of the notice of conversion, less 10%. In the event a public offering is completed, the lender may at its option (by written notice within seven days after receipt by the Company of proceeds of the public offering) require the principal amount of the loan to be repaid in cash, in which case additional special interest is payable as follows: $680,000 if repayment is on January 1, 1999 or later. As part of this transaction, Mr. Hunt entered into a pledge agreement with Banque Paribas Belgique S.A. pursuant to which he pledged, as collateral for the VDSE convertible note, 1,416,666 of his shares of common stock of the Company, which number of shares is subject to adjustment based on the market value of the shares.

On March 31, 1998, the Company entered into a loan agreement with Lernout & Hauspie Speech Products N.V. ("L&H") in the amount of $3 million, bearing interest at 9.5%, payable quarterly, with an original maturity of January 4, 1999. The maturity of this note has been extended to coincide with a private placement of the Company's equity which is currently underway. This loan is convertible at the option of the holder into shares of the Company's common stock based upon the average closing price of VASCO Data Security International, Inc.'s common stock for the 10 trading days prior to March 11, 1998, the date the Exchange Offer closed. The net effect of 1998 activity resulted in a decrease in cash of $375,000, resulting in a cash balance of $1,523,000 at December 31, 1998, compared to $1,898,000 at the end of 1997. VASCO's working capital at December 31, 1998 was ($3,086,000), a decrease of $2,531,000, or 456%, from ($555,000) at the end of 1997. The majority of the change is attributable to a 26% increase in current assets, with current liabilities increasing 64%, mainly due to the current maturities of long-term debt. VASCO's current ratio was -0.70 to 1.00 at December 31, 1998, compared to -0.91 to 1.00 at the end of 1997. In April 1999, the Company completed a private placement of Common Stock in the amount of $11.5 million. The transaction represented a sale of the Company's Common Stock to European institutional investors at a price of $3.50 per share. A total of 3,285,714 shares of Common Stock were issued as a part of this transaction. The Company believes that its current cash balances and anticipated cash generated from operations will be sufficient to meet its anticipated cash needs through June 2000. Continuance of the Company's operations beyond June 2000, however, will depend on the Company's ability to obtain adequate financing. The Company has entered into engagement letters with Artesia Bank and Bank DeGroof for a possible future public offering. The Company intends to seek acquisitions of businesses, products and technologies that are complementary or additive to those of the Company. There can be no assurance that any such acquisition will be made. Year 2000 Considerations Many existing computer systems and software products are coded to accept only two digits entries in the date code field with respect to year. With the year 2000 less than one year away, the date code field in these systems and products must be adjusted to allow for a four digit year or otherwise modified so that they recognize "00" to indicate the year 2000 rather than the year 1900. Based upon its current assessments, which are based in part on certain representations of third party service and product providers, the Company does not expect that it will experience a significant disruption of its operations as a result of the Year 2000.

The Company plans to continue to identify, assess and to resolve all material Year 2000 issues by the end of 1999. The Company is developing contingency plans to address significant internal and external Year 2000 issues as they are identified. These contingency plans are expected to be complete by the end of 1999. Even with the effort to address the Year 2000 issue made by the Company to date, there can be no assurance that the systems of other entities on which the Company relies, including the Company's internal systems and proprietary software, will be remediated in a timely fashion, or that a failure to remediate by another entity and/or the Company, would not have a material effect on the Company's results of operations. The Company has incurred approximately $150,000 to date in addressing Year 2000 issues, and believes that no additional material expenses will be incurred related to the Year 2000 issue. The Company has completed its assessment of products and mission critical systems for Year 2000 readiness and believes no material expenses will be incurred in the future. Additionally, the Company believes that the purchasing patterns of customers and potential customers may be affected by Year 2000 issues as companies expend significant resources to upgrade their current software systems for Year 2000 compliance. This, in turn, could result in reduced funds available to be spent on other technology applications, such as those offered by the Company, which could have a material adverse effect on the Company's business and results of operations. RECENTLY ISSUED ACCOUNTING PRONOUNCEMENTS During 1998, the Financial Accounting Standards Board issued SFAS No. 133 "Accounting for Derivative Instruments and Hedging Activities," which will be effective for the Company's fiscal year 2000. The Company is currently assessing the impact of this new statement, but does not expect any material effect on its consolidated financial position, liquidity, or results of operations. Item 7A - Quantitative and Qualitative Disclosures About Market Risk. Approximately 80% of the Company's business is conducted outside the United States in Europe and Asia/Pacific. The majority of business operations are transacted in foreign currencies. As a result, the Company has exposure to foreign exchange fluctuations. The Company is affected by both foreign currency translation and transaction adjustments. Translation adjustments result from the conversion of the foreign subsidiaries' balance sheets and income statements to U.S. dollars at year-end exchange rates and weighted average exchange rates, respectively. Translation adjustments resulting from this process are recorded directly into stockholders' equity. Transaction adjustments result from currency exchange movements when a foreign subsidiary transacts business in a currency that differs from its local currency. These transactions are recorded as gains or losses in the Company's statement of operations.

The Company's foreign exchange exposure was minimized in 1998 as the majority of the Company's foreign subsidiaries' business transactions were spread across approximately 40 different countries and currencies. This geographic diversity reduces the risk to the Company's operating results. Also, the Company performs periodic reviews of outstanding balances and settles intercompany accounts to minimize foreign exchange transaction gains and losses. The Company has minimal interest rate risk. The Company's $15 million debt is made up of fixed rate notes, ranging from 3.25% to 9.5%, which are not subject to market fluctuations. The maturities of these notes range from 1999 to 2002 (see Note 1 of Notes to Consolidated Financial Statements related to fair value of financial instruments). Item 8 - Financial Statements and Supplementary Data The information in response to this item is included in the Company's consolidated financial statements, together with the report thereon of KPMG LLP, appearing on pages F-1 through F-18 of this Form 10-K, and in Item 7 under the heading "Management's Discussion and Analysis of Financial Condition and Results of Operations." Item 9 - Changes in and Disagreements with Accountants on Accounting and Financial Disclosure None. PART III Item 10 - Directors and Executive Officers of the Registrant The sections entitled "Election of Directors" and "Section 16(a) Beneficial Ownership Report Compliance" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on June 15, 1999, are incorporated herein by reference. Item 11 - Executive Compensation The section entitled "Executive Compensation" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on June 15, 1999, is incorporated herein by reference. Item 12 - Security Ownership of Certain Beneficial Owners and Management The section entitled "Security Ownership of Certain Beneficial Owners and Management" contained in the Company's Proxy Statement for the Annual Meeting of Stockholders to be held on June 15, 1999, is incorporated herein by reference. Item 13 - Certain Relationships and Related Transactions None.

PART IV Item 14 - Exhibits, Financial Statement Schedules and Reports on Form 8-K a. (1) The following consolidated financial statements and notes thereto, and the related independent auditors' report, are included on pages F-1 through F-18 of this Form 10-K: Consolidated Balance Sheets as of December 31, 1997 and 1998 Consolidated Statements of Operations for the Years Ended December 31, 1996, 1997 and 1998 Consolidated Statements of Comprehensive Income for the Years Ended December 31, 1996, 1997 and 1998 Consolidated Statements of Stockholders' Equity (Deficit) for the Years Ended December 31, 1996, 1997 and 1998 Consolidated Statements of Cash Flows for the Years Ended December 31, 1996, 1997 and 1998 Notes to Consolidated Financial Statements Independent Auditors' Report (2) The following financial statement schedule of the Company is included on page S-1of this Form 10-K: Schedule II _ Valuation and Qualifying Accounts All other financial statement schedules are omitted because such schedules are not required or the information required has been presented in the aforementioned consolidated financial statements. (3) The following exhibits are filed with this Form 10-K or incorporated by reference as set forth below: EXHIBIT INDEX

Exhibit Number Description ------- ----------- +3.1 Certificate of Incorporation of Registrant, as amended. ++3.2 Bylaws of Registrant, as amended and restated. 4.1 Intentionally Omitted. +4.2 Specimen of Registrant's Common Stock Certificate. 4.3 Intentionally Omitted. +4.4 Form of Letter of Transmittal and Release. +4.5 Form of Registrant's Warrant Agreement. +4.6 Form of Registrant's Option Agreement. +4.7 Form of Registrant's Convertible Note Agreement. +10.1 Netscape Communications Corporation OEM Software Order Form dated March 18, 1997 between VASCO Data Security, Inc. and Netscape Communications Corporation.** +10.2 License Agreement between VASCO Data Security, Inc. and SHIVA Corporation effective June 5, 1997.** +10.3 Heads of Agreement between VASCO Data Security International, Inc., VASCO Data Security Europe S.A., Digiline International Luxembourg, Digiline S.A., Digipass S.A., Dominique Colard and Tops S.A. dated May 13, 1996. +10.4 Agreement relating to additional terms and conditions to the Heads of Agreement dated July 9, 1996, among the parties listed in Exhibit 10.3. +10.5 Agreement between VASCO Data Security International, Inc., VASCO Data Security Europe SA/NV, Mario Houthooft and Guy Denudt dated March 1, 1996. +10.6 Asset Purchase Agreement dated as of March 1996 by and between Lintel Security SA/NV and Lintel SA/NV, Mario Houthooft and Guy Denudt. +10.7 Management Agreement dated January 31, 1997 between LINK BVBA and VASCO Data Security NV/SA (concerning services of Mario Houthooft). +10.8 Sublease Agreement by and between VASCO Data Security International, Inc. and APL Land Transport Services, Inc. dated as of August 29, 1997. +10.9 Office Lease by and between VASCO Data Security International, Inc. and LaSalle National Bank, not personally, but as Trustee under Trust Agreement dated September 1, 1997, and known as Trust Number 53107, dated July 22, 1985. +10.10 Lease Agreement by and between TOPS sa and Digipass sa effective July 1, 1996. +10.11 Lease Agreement by and between Perkins Commercial Management Company, Inc. and VASCO Data Security, Inc. dated November 21, 1995.

+10.12 Asset Purchase Agreement by and between VASCO Data Security International, Inc. and Wizdom Systems, Inc. dated August 20, 1996. +10.13 1997 VASCO Data Security International, Inc. Stock Option Plan, as amended. +10.14 Distributor Agreement between VASCO Data Security, Inc. and Hucom, Inc. dated June 3, 1997.** +10.15 Non-Exclusive Distributor Agreement by and between VASCO Data Security, Inc. and Concord-Eracom Nederland BV dated May 1, 1994.** +10.16 Banque Paribas Belgique S. A. Convertible Loan Agreement for $3.4 million. +10.17 Pledge Agreement dated July 15, 1997 by and between T. Kendall Hunt and Banque Paribas Belgique S.A. +10.18 Engagement Letter between Banque Paribas S.A. and VASCO Data Security International, Inc. dated June 20, 1997, as amended. +10.19 Financing Agreement between Generale Bank and VASCO Data Security International, Inc. dated as of June 27, 1997. +10.20 Letter Agreement between Generale Bank and VASCO Data Security International, Inc. dated June 26, 1997. +10.21 Form of Warrant dated June 16, 1997 (with Schedule). +10.22 Form of Warrant dated October 31, 1995 (with Schedule). +10.23 Form of Warrant dated March 7, 1997 (with Schedule). +10.24 Form of Warrant dated August 13, 1996 (with Schedule). +10.25 Form of Warrant dated June 27, 1996 (with Schedule). +10.26 Form of Warrant dated June 27, 1996 (with Schedule). +10.27 Convertible Note in the principal amount of $500,000.00, payable to Generale de Banque dated July 1, 1997 (with Schedule). +10.28 Agreement by and between VASCO Data Security NV/SA and S.I. Electronics Limited effective January 21, 1997.** +10.29 Agreement effective May 1, 1993 by and between Digipass s.a. and Digiline s.a.r.l. +10.30 VASCO Data Security, Inc. purchase order issued to National Electronic & Watch Co. LTD. **

+10.31 VASCO Data Security, Inc. purchase order issued to Micronix Integrated Systems.** +10.32 Agreement between Registrant and VASCO Data Security International, Inc. dated as of August 25, 1997. +10.33 Convertible Note dated June 1, 1996 made payable to Mario Houthooft in the principal amount of $373,750.00. +10.34 Convertible Note dated June 1, 1996 made payable to Guy Denudt in the principal amount of $373,750.00. +10.35 Osprey Partners Warrant (and Statement of Rights to Warrant and Form of Exercise) issued June 1, 1992. +10.36 Registration Rights Agreement dated as of October 19, 1995 between certain purchasing shareholders and VASCO Data Security International, Inc. +10.37 First Amendment to Registration Rights Agreement dated July 1, 1996. +10.38 Second Amendment to Registration Rights Agreement dated March 7, 1997. +10.39 Purchase Agreement by and between VASCO Data Security International, Inc. and Kyoto Securities Ltd. +10.40 Convertible Note dated May 28, 1996 payable to Kyoto Securities, Ltd. in principal amount of $5 million. +10.41 Amendment to Purchase Agreement and Convertible Note by and between VASCO Data Security International, Inc. and Kyoto Securities, Ltd. +10.42 Executive Incentive Compensation Plan. +10.43 Letter for Credit granted by Generale de Banque to Digipass SA dated January 27, 1997. ++10.44 License Agreement dated as of March 25, 1998 by and between VASCO Data Security International, Inc., for itself and its subsidiaries, and Lernout & Hauspie Speech Products N.V. ++10.45 Loan Agreement dated as of March 31, 1998 by and between Lernout & Hauspie Speech Products N.V. and VASCO Data Security International, Inc. ++10.46 Convertible Note dated April 1, 1998 payable to Lernout & Hauspie Speech Products N.V. in the principal amount of $3 million. 10.47 Amendment I dated as of December 31, 1998 to the License Agreement dated as of March 25, 1998 by and between VASCO Data Security International, Inc., for itself and its subsidiaries, and Lernout & Hauspie Speech Products N.V.

21 Subsidiaries of Registrant. 23 Consent of KPMG LLP. 27 Financial Data Schedule. __________________________ + Incorporated by reference to the Registrant's Registration Statement on Form S-4, as amended (Registration No. 333-35563), originally filed with the Securities and Exchange Commission on September 12, 1997. ++ Incorporated by reference to the Registrant's Annual Report on Form 10-K, originally filed with the Securities and Exchange Commission on May 5, 1998. ** Confidential treatment has been granted for the omitted portions of this document. VASCO Data Security International, Inc. will furnish any of the above exhibits to its stockholders upon written request addressed to the Secretary at the address given on the cover page of this Form 10- K. The charge for furnishing copies of the exhibits is $.25 per page, plus postage. (b) Reports on Form 8-K No reports on Form 8-K have been filed by the Registrant during the quarter ended December 31, 1998.

VASCO Data Security International, Inc. CONSOLIDATED BALANCE SHEETS December 31, December 31, 1997 1998 ---- ---- ASSETS Current assets: Cash $ 1,897,666 $ 1,523,075 Accounts receivable, net of allowance for doubtful accounts of $429,000 and $55,000 in 1997 and 1998 2,458,451 3,376,218 Inventories, net 1,001,294 1,272,327 Prepaid expenses 86,426 692,326 Deferred income taxes 83,000 83,000 Other current assets 221,572 277,322 ----------- ----------- Total current assets 5,748,409 7,224,268 Property and equipment Furniture and fixtures 488,338 580,427 Office equipment 322,434 468,975 ----------- ----------- 810,772 1,049,402 Accumulated depreciation (497,381) (691,806) ----------- ----------- 313,391 357,596 Goodwill, net of accumulated amortization of $198,000 and $327,000 in 1997 and 1998 704,124 575,211 Other assets 1,609,901 943,821 ----------- ----------- Total assets $ 8,375,825 $ 9,100,896 =========== ===========

LIABILITIES AND STOCKHOLDERS' EQUITY (DEFICIT) Current liabilities: Current maturities of long-term debt $ 3,185,400 $ 6,528,867 Accounts payable 1,083,965 1,144,506 Customer deposits 426,914 519,585 Other accrued expenses 1,606,810 2,117,599 ----------- ----------- Total current liabilities 6,303,089 10,310,557 Long-term debt, including stockholder note of $5,000,000 in 1997 and 1998 8,442,946 8,435,903 Common stock subject to redemption 494,668 - Stockholders' equity (deficit): Preferred stock, 500,000 shares authorized, none issued - - Common stock, $.001 par value - 75,000,000 shares authorized; 20,132,968 shares issued and outstanding in 1997; 20,805,697 shares issued and outstanding in 1998 20,133 20,806 Additional paid-in capital 9,186,726 9,797,068 Accumulated deficit (15,901,575) (19,550,419) Accumulated other comprehensive income- cumulative translation adjustment (170,162) 86,981 ----------- ----------- Total stockholders' equity (deficit) (6,864,878) (9,645,564) ----------- ----------- Total liabilities and stockholders' equity (deficit) $ 8,375,825 $ 9,100,896 =========== =========== See accompanying notes to consolidated financial statements.

VASCO Data Security International, Inc. CONSOLIDATED STATEMENTS OF OPERATIONS For the Year Ended December 31, ----------------------------------- 1996 1997 1998 ---- ---- ---- Revenue: Data security products and services $ 9,988,885 $ 12,302,185 $ 15,015,927 Training and consulting 203,600 - - ----------- ------------ ------------ Total revenues 10,192,485 12,302,185 15,015,927 Cost of goods sold: Data security products and services 5,678,223 6,286,688 6,949,308 Training and consulting 193,245 - - ----------- ------------ ------------ Total cost of goods sold 5,871,468 6,286,688 6,949,308 ----------- ------------ ------------ Gross profit 4,321,017 6,015,497 8,066,619 ----------- ------------ ------------ Operating costs: Sales and marketing 1,405,453 3,380,777 4,368,398 Research and development 574,766 1,801,575 1,787,893 General and administrative 3,647,760 4,768,378 3,120,307 Acquired in-process research and development 7,350,992 - - ----------- ------------ ------------ Total operating costs 12,978,971 9,950,730 9,276,598 ----------- ------------ ------------ Operating loss (8,657,954) (3,935,233) (1,209,979) Interest expense (346,248) (1,148,183) (1,457,627) Other expense, net (42,407) (226,423) (294,236) ----------- ------------ ------------ Loss before income taxes (9,046,609) (5,309,839) (2,961,842) Provision for income taxes 194,000 606,579 687,002 ----------- ------------ ------------ Net Loss (9,240,609) (5,916,418) (3,648,844) Preferred stock dividends (108,160) (81,900) - ----------- ------------ ------------ Net loss available to common stockholders $(9,348,769) $ (5,998,318) $ (3,648,844) =========== ============ ============ Basic and diluted net loss per common share $ (0.53) $ (0.31) $ (0.18) =========== ============ ============ Weighted average common shares outstanding 17,533,369 19,105,684 20,430,692 =========== ============ ============ See accompanying notes to consolidated financial statements.

VASCO Data Security International, Inc. CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME For the Year Ended December 31, --------------------------------------- 1996 1997 1998 ---- ---- ---- Net loss $ (9,240,609) $ (5,916,418) $ (3,648,844) Other comprehensive income (loss) - cumulative translation adjustment (105,056) (65,106) 257,143 ------------ ------------ ------------ Comprehensive loss $ (9,345,665) $ (5,981,524) $ (3,391,701) ============ ============ ============ See accompanying notes to consolidated financial statements.

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY (DEFICIT) Series A Series B Cum Pref Stock Pref Stock Common Stock Accumulated Transl Treasury Stock Total Description Shares Amt Shares Amt Shares Amount APIC Deficit Adj. Shares Amount Equity - ----------- ------- ----- ----- --- ---------- ------ --------- ----------- -------- ------- -------- ---------- Bal at 12/31/95 317,181 $3,172 9,000 $ 90 15,793,575 $15,794 $1,508,534 $ (554,488) - 287,923 $ (7,109) $ 965,993 Net loss - - - - - - - (9,240,609) - - - (9,240,609) Cash div paid on preferred B - - - - - - - (108,000) - - - (108,000) Dividends payable on pref. A upon conversion - - - - - - - (160) - - - (160) Exercise of stock options - - - - 24,000 24 5,215 - - - - 5,239 Issuance of common stock - - - - 1,161,773 1,162 4,252,240 - - - - 4,253,402 Issuance of common stock in connection with Lintel acquisition - - - - 140,651 141 3,387,769 - - (287,923) 7,109 3,395,019 Conversion of Series A pref. stock (200,000)(2,000) - - 1,333,333 1,333 667 - - - - - Cumulative translation adjustment - - - - - - - - (105,056) - - (105,056) Common stock subject to redemption - - - - - - (371,000) - - - - (371,000) ------- ----- ----- -- ---------- ------ --------- ----------- --------- ------- -------- ---------- Bal at 12/31/96 117,181 1,172 9,000 90 18,453,332 18,454 8,783,425 (9,903,257) (105,056) - - (1,205,172) Net loss - - - - - - - (5,916,418) - - - (5,916,418) Cash div paid on preferred B - - - - - - - (81,900) - - - (81,900) Exercise of stock options - - - - 189,375 189 42,281 - - - - 42,470 Cancellation of common stock - - - - (16,489) (17) - - - - - (17) Issuance of common stock - - - - 83,714 83 418,079 - - (32,504) 227,528 645,690 Conversion of Series A pref. stock (117,181) (1,172) - - 778,383 779 391 - - (2,824) 19,768 19,766 Conversion of Series B preferred stock - - (9,000) (90) 644,653 645 (555) - - - - - Repurchase of common stock - - - - - - - - - 35,328 (247,296) (247,296) Legal fees associated with sale of stock - - - - - - (56,895) - - - - (56,895) Cumulative translation adjustment - - - - - - - - (65,106) - - (65,106) ------- ----- ----- -- ---------- ------ --------- ----------- --------- ------- -------- ---------- Bal at 12/31/97 - - - - 20,132,968 20,133 9,186,726 (15,901,575) (170,162) - - (6,864,878)

Net loss - - - - - - - (3,648,844) - - - (3,648,844) Cumulative translation adjustment - - - - - - - - 257,143 - - 257,143 Exercise of stock options - - - - 658,257 658 115,689 - - - - 116,347 Exercise of stock warrants - - - - 14,472 15 (15) - - - - - Expiration of put option - - - - - - 494,668 - - - - 494,668 ------- ----- ----- -- ---------- ------ --------- ----------- --------- ------- -------- ---------- Bal at 12/31/98 - $ - - $- 20,805,697 $20,806 $9,797,068 $(19,550,419) $86,981 - $ - $(9,645,564) ======= ===== ===== == ========== ====== ========= =========== ========= ======= ======== ========== See accompanying notes to consolidated financial statements.

VASCO DATA SECURITY INTERNATIONAL, INC. CONSOLIDATED STATEMENTS OF CASH FLOWS For the Year Ended December 31, ------------------------------------- 1996 1997 1998 ---- ---- ---- Cash flows from operating activities: Net loss $(9,240,609) $(5,916,418) $(3,648,844) Adjustments to reconcile net loss to net cash provided by (used in) operating activities: Acquired in-process research and development 7,350,992 - - Depreciation and amortization 728,734 1,248,807 994,483 Interest paid in shares of common stock 118,750 418,196 - Deferred income taxes 162,000 200,000 - Loss on disposal of fixed assets - - 5,113 Changes in current assets and current liabilities, net of acquisitions: Accounts receivable, net (1,067,374) 784,167 (917,767) Inventories, net 578,143 1,181,449 (271,033) Other current assets and prepaid expenses (279,940) 563,867 (661,750) Accounts payable 459,068 (861,679) 60,541 Customer deposits 1,022,195 (595,281) 92,671 Other accrued expenses (1,728,397) 948,726 510,789 --------- ----------- --------- Net cash used in operations (1,896,438) (2,028,166) (3,835,797) --------- ----------- --------- Cash flows from investing activities: Acquisition of Lintel/Digipass (4,461,144) - - Additions to property and equipment (283,142) (127,646) (248,708) --------- ----------- --------- Net cash used in investing activities (4,744,286) (127,646) (248,708) --------- ----------- --------- Cash flows from financing activities: Series B preferred stock dividends (108,000) (81,900) - Net proceeds from issuance of common stock 4,133,605 (56,895) - Proceeds from exercise of stock options 5,238 42,470 116,347 Repurchase of common stock - (247,261) - Proceeds from issuance of debt 4,986,096 2,716,141 6,236,424 Repayment of debt (1,202,178) (67,564) (2,900,000) --------- ----------- ---------- Net cash provided by financing activities 7,814,761 2,304,991 3,452,771 --------- ----------- ----------

Effect of exchange rate changes on cash (105,056) (65,106) 257,143 --------- ----------- ---------- Net increase (decrease) in cash 1,068,981 84,073 (374,591) Cash, beginning of year 744,612 1,813,593 1,897,666 --------- ----------- ---------- Cash, end of year $ 1,813,593 $ 1,897,666 $ 1,523,075 ========= =========== ========== Supplemental disclosure of cash flow information: Interest paid $ 51,929 $ 53,865 $ 878,892 Income taxes paid $ 120,319 $ 415,480 $ 709,661 Supplemental disclosure of noncash investing and financing activities: Fair value of assets acquired from Lintel/Digipass 12,003,644 Cash paid (4,461,144) Notes payable, common stock and warrants issued 7,542,500 Common stock issued upon conversion of Series A pref stock $ 2,000 $ 1,172 $ - =========== =========== =========== Common stock issued upon conversion of Series B pref stock $ - $ 90 $ - =========== =========== =========== See accompanying notes to consolidated financial statements.

Note 1 - Summary of Significant Accounting Policies Nature of Operations VASCO Data Security International, Inc. and its wholly owned subsidiaries, VASCO Data Security, Inc., and VASCO Data Security NV/SA (the Company), offer a variety of computer security products and services. The Company's patented and proprietary hardware and software products provide computer security, Advanced Authentication Technology and RSA/DES encryption for financial institutions, industry and government. The primary market for these products is Europe. Use of Estimates The preparation of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates. Principles of Consolidation The consolidated financial statements include the accounts of VASCO Data Security International, Inc. and its wholly owned subsidiaries. All significant intercompany accounts and transactions have been eliminated in consolidation. Revenue Recognition Revenues from the sale of computer security hardware and imbedded software are recorded upon shipment. No significant obligations exist with regard to delivery or customer acceptance following shipment. Property and Equipment Property and equipment are stated at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the related assets ranging from three to seven years. Additions and improvements are capitalized, while expenditures for maintenance and repairs are charged to operations as incurred. The cost and accumulated depreciation of property sold or retired are removed from the respective accounts and the resultant gains or losses, if any, are included in current operations.

Software Costs The Company capitalizes software development costs in accordance with Statement of Financial Accounting Standards (SFAS) No. 86. Research and development costs, prior to the establishment of technological feasibility, determined based upon the creation of a working model, are expensed as incurred. The Company's policy is to amortize capitalized costs by the greater of (a) the ratio that current gross revenues for a product bear to the total of current and anticipated future gross revenues for that product or (b) the straight-line method over the remaining estimated economic life of the product, generally two to five years, including the period being reported on. Unamortized capitalized costs determined to be in excess of the net realizable value of a product are expensed at the date of such determination. The Company expensed $180,275, $0 and $0 in 1996, 1997 and 1998, respectively, for the amortization of capitalized software costs. Income Taxes Income taxes are accounted for under the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial statement carrying amounts of existing assets and liabilities and their respective tax bases and operating loss and tax credit carryforwards. Deferred tax assets and liabilities are measured using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date. Fair Value of Financial Instruments and Long-Lived Assets The following disclosures of the estimated fair value of financial instrument are made in accordance with the requirements of SFAS No. 107, "Disclosures and Fair Value of Financial Instruments." The estimated fair value amounts have been determined by the Company using available market information and appropriate valuation methodologies. The fair values of the Company's financial instruments were not materially different from their carrying amounts at December 31, 1997 and 1998, except for notes payable and long-term debt, for which the fair value is not determinable. On January 1, 1996, the Company adopted SFAS No. 121, "Accounting for the Impairment of Long-Lived Assets and for Long- Lived Assets to be Disposed Of," under which the Company has reviewed long-lived assets and certain intangible assets and determined, based on estimated undiscounted cash flows, that their carrying values as of December 31, 1998 are recoverable in future periods.

Stock-Based Compensation On January 1, 1996, the Company adopted SFAS No. 123, "Accounting for Stock-Based Compensation," which permits entities to recognize the compensation expense associated with the fair value of all stock-based awards on the date of grant. Alternatively, SFAS No. 123 allows entities to continue to apply the provisions of Accounting Principles Board (APB) Opinion No. 25, "Accounting for Stock Issued to Employees," and provide pro forma disclosures as if the fair value method defined in SFAS No. 123 had been applied. The Company has elected to apply the provisions of APB Opinion No. 25 and provide the pro forma disclosures required by SFAS No. 123. Foreign Currency Translation and Transactions The financial position and results of operations of the Company's foreign subsidiaries are measured using the local currency as the functional currency. Accordingly, assets and liabilities are translated into U.S. dollars using current exchange rates as of the balance sheet date. Revenues and expenses are translated at average exchange rates prevailing during the year. Translation adjustments arising from differences in exchange rates are included as a separate component of stockholders' equity. Gains and losses resulting from foreign currency transactions are included in the consolidated statements of operations. Goodwill Goodwill is amortized on a straight-line basis over the expected period to be benefited, which is seven years. Adjustments to the carrying value of goodwill are made if the sum of expected future undiscounted net cash flows from the business acquired is less than the book value of goodwill. Loss Per Common Share Basic earnings per share is based on the weighted average number of shares outstanding and excludes the dilutive effect of unexercised common stock equivalents. Diluted earnings per share is based on the weighted average number of shares outstanding and includes the dilutive effect of unexercised common stock equivalents. Because the Company reported a net loss for the years ended December 31, 1996, 1997 and 1998, per share amounts for basic and diluted are the same, and, therefore, have been presented under the basic method only.

Had the Company reported net earnings for the years ended December 31, 1996, 1997 and 1998, the weighted average number of shares outstanding would have potentially been increased by the following common equivalent securities (not assuming the effects of applying the treasury stock method to outstanding stock options or the if-converted method to convertible securities): 1996 1997 1998 ---- ---- ---- Stock options................ 1,661,632 1,945,257 1,475,500 Warrants .................... 928,578 1,056,922 1,004,034 Convertible notes (June 1996) 518,595 518,595 416,667 Convertible notes (July 1997)* - 657,895 - Convertible notes (August 1997)* - 893,632 1,123,387 Convertible notes (March 1998) - - 528,048 --------- --------- --------- 3,108,805 5,072,301 4,547,636 ========= ========= ========= * Due to the contingent nature of the conversion feature of these notes, a 20-day average market price was used to calculate the number of potentially dilutive shares. Additionally, net earnings applicable to common stockholders for the years ended December 31, 1996, 1997 and 1998 would have been increased by adding back interest expense related to the convertible notes of $265,450, $980,250 and $1,394,475, respectively. Note 2 - Acquisitions Effective March 1, 1996, the Company acquired a 15% interest in Lintel NV (Lintel). On June 1, 1996, the Company acquired the remaining 85% of Lintel. Lintel, located in Brussels, Belgium, was a developer of security technologies for personal computers, computer networks and telecommunications systems, using cryptographic algorithms such as DES and RSA. The results of Lintel's operations are included in the Company's consolidated statement of operations from March 1, 1996 with minority interest being reflected in other expense in the consolidated statement of operation for the period from March 1, 1996 to June 1, 1996. The purchase price was $4,432,000, consisting of $289,482 in cash, $747,500 in 8% convertible notes payable due May 30, 1998 and convertible to common stock at a rate of $7.00 per share, 428,574 shares of the Company's common stock valued at $7.00 per share, and 100,000 purchase warrants for the Company's common stock at an exercise price of $7.00 per share. The warrants were recorded at their fair value on the date of grant. The acquisition of Lintel was accounted for as a purchase and, accordingly, the acquired assets have been recorded at their estimated fair values at the date of the acquisition. Acquired in- process research and development in the amount of $2,900,000 was expensed during 1996 in conjunction with the acquisition, based upon an independent third-party valuation. Goodwill related to this transaction was $387,000, which is being amortized over a period of seven years.

Effective July 1, 1996, the Company acquired Digipass s.a. (Digipass). Digipass, located in Belgium, was a developer of security technologies for personal computers, computer networks and telecommunications systems using the DES cryptographic algorithm. Prior to the Company's acquisition of Digipass, the assets of the interactive voice response (IVR) business of Digiline SA were transferred to Digipass. Digipass' IVR products are used primarily in telebanking applications and in corporate authentication and access control technology. The purchase price was $8,200,000, with $4,800,000 being paid at the effective date of acquisition, and the balance of $3,400,000 in the form of a note, which was paid in August 1997. The acquisition of Digipass was accounted for as a purchase and, accordingly, the acquired assets and liabilities have been recorded at their estimated fair values at the date of the acquisition. Acquired in-process research and development in the amount of $4,451,000 was expensed during 1996, based upon an independent third- party valuation. Goodwill related to this transaction was $491,000, which is being amortized over a period of seven years. The results of operations for Digipass have been included in the consolidated statement of operations subsequent to July 1, 1996. Other assets, resulting from the acquisitions of Lintel and Digipass, are comprised of the following at December 31, 1997 and 1998 (net of accumulated amortization of $1,318,000 and $1,984,000 as of December 31, 1997 and 1998, respectively): December 31, --------------------- 1997 1998 ---- ---- Software and hardware technology... $ 988,417 $ 436,417 Workforce ......................... 200,388 163,737 Customer lists .................... 421,096 343,667 ---------- ---------- $1,609,901 $ 943,821 ========== ========== Software and hardware technology is being amortized over a period of three to four years while workforce and customer lists are being amortized over a period of seven years. Amortization of these assets was $374,892, $943,207 and $666,079 for the years ended December 31, 1996, 1997 and 1998, respectively. Included in the 1997 amortization is a write-down in the amount of $234,493 related to the workforce of Digipass, due to attrition realized during the year.

Note 3 - Inventories Inventories, consisting principally of hardware and component parts, are stated at the lower of cost or market. Cost is determined using the first-in-first-out (FIFO) method. Inventories are comprised of the following: December 31, ------------------- 1997 1998 ---- ---- Component parts ..................... $ 569,922 $ 407,597 Work-in-process and finished goods... 595,372 993,730 Obsolescence reserves ............... (164,000) (129,000) ---------- ---------- $1,001,294 $1,272,327 ========== ========== The Company uses multiple suppliers for the microprocessors used in the production of hardware products, as well as for the assembly of the products. The microprocessors are the only components of the Company's hardware devices that would be considered non-commodity items and may not be readily available on the open market. There is, however, an inherent risk associated with each supplier of microprocessors. In order to increase orders of microprocessors, a lead time of twelve weeks is typically needed. The Company maintains a sufficient inventory of all component parts to handle short-term spikes in order quantities. Note 4 - Other Accrued Expenses Other accrued expenses are comprised of the following: December 31, -------------------- 1997 1998 ---- ---- Accrued expenses ............... $ 609,271 $ 852,428 Accrued interest ............... 657,799 860,957 Accrued payroll ................ 171,231 223,369 Accrued dividends .............. 168,509 180,845 ---------- ---------- $1,606,810 $2,117,599 ========== ==========

Note 5 - Income Taxes At December 31, 1998, the Company has United States net operating loss carryforwards approximating $7,434,000 and foreign net operating loss carryforwards approximating $1,092,000. Such losses are available to offset future taxable income at VASCO Data Security International, Inc. and its U.S. subsidiary and expire in varying amounts beginning in 2002 and continuing through 2018. In addition, if certain substantial changes in the Company's ownership should occur, there would be an annual limitation on the amount of the carryforwards which could be utilized. Pretax loss from continuing operations was taxed in the following jurisdictions: For the Year Ended December 31, --------------------------------------- 1996 1997 1998 ---- ---- ---- Domestic ........... $(1,205,853) $(4,655,220) $(3,032,689) Foreign ............ (7,840,756) (654,619) 70,847 ------------ ------------ ------------ $(9,046,609) $(5,309,839) $(2,961,842) ============ ============ ============ The provision for income taxes consists of the following: For the Year Ended December 31, 1996 1997 1998 ---- ---- ---- Current: Federal ........... $ - $ - $ - State ............. - - (2,514) Foreign ........... 31,670 406,579 689,516 Deferred: Federal ........... $ 142,182 $ 175,176 $ - State ............. 20,148 24,824 - Foreign ........... - - - --------- --------- --------- Total $ 194,000 $ 606,579 $ 687,002 ========= ========= =========

The differences between income taxes computed using the statutory federal income tax rate of 34% and the provisions (benefits) for income taxes reported in the consolidated statements of operations are as follows: For the Year Ended December 31, -------------------------------------- 1996 1997 1998 ---- ---- ---- Expected tax benefit at the statutory rate.......................$(3,075,847) $(1,805,345) $(1,007,000) Increase (decrease) in income taxes resulting from: State tax expense, net of fed benefit. (56,414) (144,937) (142,800) Foreign taxes at rates other than 34%. 163,107 149,549 665,000 Change in valuation allowance......... 631,000 1,779,000 1,035,000 Nondeductible acquired in-process tech 2,499,337 - - Nondeductible expenses................ 2,831 622,257 100,000 Other, net ........................... 29,986 6,055 36,802 ---------- ----------- ----------- Total $ 194,000 $ 606,579 $ 687,002 ========== =========== =========== The deferred income tax balances are comprised of the following: December 31, --------------------------- 1997 1998 ---- ---- Deferred tax assets: U.S. net operating loss carryforwards $1,833,000 $2,886,000 Foreign net oper loss carryforward... 412,000 439,000 Inventory ........................... 44,000 25,000 Accounts receivable ................. 149,000 11,000 Accrued expenses .................... - 128,000 Deferred revenue .................... - 13,000 Fixed assets ........................ 30,000 22,000 Other ............................... 25,000 6,000 --------- --------- Total gross deferred income tax assets. 2,493,000 3,530,000 Less valuation allowance ............ (2,410,000) (3,445,000) --------- --------- 83,000 85,000 Deferred tax liabilities: Fixed assets ........................ - (2,000) --------- ---------- Net deferred income taxes ............. $ 83,000 $ 83,000 ========= ==========

The net change in the total valuation allowance for the years ended December 31, 1996, 1997 and 1998 was an increase of $631,000, $1,779,000 and $1,035,000, respectively. In assessing the realizability of deferred tax assets, the Company considers whether it is more likely than not that some portion or all of the deferred tax assets will be realized. The ultimate realization of deferred tax assets is dependent upon the generation of future taxable income during the period in which these temporary differences become deductible. This assessment was performed considering the scheduled reversal of deferred tax liabilities, projected future taxable income, and tax planning strategies. The Company has determined that it is more likely than not that $83,000 of deferred tax assets will be realized. The remaining valuation allowance of $3,445,000 is maintained on deferred tax assets which the Company has not determined to be more likely than not realizable as of December 31, 1998. This valuation allowance will be reviewed on a regular basis and adjustments made as appropriate. Note 6 - Debt Debt consists of the following: December 31, ------------------------ 1997 1998 ---- ---- Convertible stockholder note, interest payable at 9% $ 5,000,000 $ 5,000,000 Convertible stockholders' notes, interest payable at 8% ................................... 636,921 - Convertible note, interest payable at 3.25%......... 3,400,000 3,400,000 Convertible note, interest payable at 3.25%......... 2,500,000 - Convertible note, interest payable at 9.5%.......... - 3,000,000 Revolving line of credit, interest payable at 6.48%. - 3,000,000 Short-term credit facility, interest payable at 8.1% - 450,000 Installment notes payable .......................... 91,425 114,770 ----------- ----------- 11,628,346 14,964,770 Less current maturities ............................ (3,185,400) (6,528,867) ----------- ----------- Long-term debt ..................................... $ 8,442,946 $ 8,435,903 =========== =========== On March 31, 1998, the Company entered into a loan agreement with Lernout & Hauspie Speech Products N.V. ("L&H") in the amount of $3 million, bearing interest at 9.5%, payable quarterly, with an original maturity of January 4, 1999. The maturity of this note has been extended to coincide with a private placement of the Company's equity during the second quarter of 1999. This loan is convertible at the option of the holder into shares of the Company's common stock based upon the average closing price of VASCO Data Security International, Inc.'s common stock for the 10 trading days prior to March 11, 1998, the date the Exchange Offer closed. This loan was funded in April 1998.

In December 1998, the Company entered into a short-term credit facility with a European bank. This facility, bearing interest at a rate of 8.1%, provided for $450,000 in funds to allow the Company to extend and expand its licensing agreement with Lernout & Hauspie Speech Products N.V. This facility was repaid during January 1999 and was terminated at that time. In June 1997, the Company entered into a new financing agreement with a European bank. The new agreement provides for $2.5 million in financing, with a maturity of September 30, 1998, bears interest at a rate of 3.25% annually and is convertible into common stock of the Company at the option of the bank, at conversion prices as specified in the agreement. As of the maturity date of September 30, 1998, per the terms of the agreement, 116% of the principal amount was repaid from the proceeds of a short-term borrowing facility secured by the Company with KBC Bank. The KBC Bank facility represents a three- month revolver, renewable for additional three-month terms, with a corresponding interest rate of 6.48%. This facility is expected to be repaid from the proceeds of a private placement that the Company expects to complete during the second quarter of 1999. In August 1997, the Company renegotiated the guarantee related to the final payment for the 1996 acquisition of Digipass into a term loan in the amount of $3.4 million. The note matures on September 30, 2002 and bears interest at a rate of 3.25% annually. In the event a public offering is completed, the lender may at its option require the principal amount of the loan to be repaid in cash, in which case additional special interest is payable as follows: $340,000 if repayment is on or before June 30, 1998, $510,000 if repayment is between July 1, 1998 and December 31, 1998 and $680,000 if repayment is on January 1, 1999 or later. In addition, the note is convertible into common stock of the Company at the option of the bank, at a conversion prices as specified in the agreement. The Company has accrued $510,000 in special interest as of December 31, 1998. As part of this transaction, T. Kendall Hunt, the Company's Chairman/CEO, entered into a pledge agreement with this financial institution pursuant to which he pledged, as collateral for the convertible note, 1,416,666 of his shares of common stock of the Company, which number of shares is subject to adjustment based on the market value of the shares. During 1996, the Company acquired two companies located in Europe (see Note 2). To facilitate the first acquisition, Lintel, one component of the purchase price was represented by two convertible notes, each payable in the amount of $373,750 ($747,500 total) due May 30, 1998. The notes are convertible at the holders' option at a rate of $7.00 per share of common stock. During 1996 and 1997, these notes were paid down by $33,750 and $76,829, respectively. Each of these notes bears an interest rate of 8%, with interest payments made on a quarterly basis. At the holders' option, the interest may be paid either in cash or in common stock of the Company. In calculating the shares of common stock to be issued in lieu of cash interest, the average closing price for the Company's common stock for the previous 20 trading days is used. These notes were repaid upon maturity.

During 1996, the Company continued to raise capital privately, including a private placement consisting of the issuance of 666,666 shares of common stock and a $5,000,000 convertible note due May 29, 2001. The note bears interest at 9%, with interest payable to the holder on a quarterly basis. The holder may, at its option, elect to receive interest payments in cash or common stock. In calculating the shares of common stock to be issued in lieu of cash interest, the average closing price for the Company's common stock for the previous 20 trading days is used. Aggregate maturities of debt at December 31, 1998 are as follows: 1999 ............................... $6,528,867 2000 ............................... 35,903 2001 ............................... 5,000,000 2002 and thereafter ................ 3,400,000 ---------- Total .................... $14,964,770 ========== Interest expense to stockholders was $265,565, $507,100 and $497,795 for the years ended December 31, 1996, 1997 and 1998, respectively. Note 7 - Stockholders' Equity Preferred Stock The Company has the authority to issue 500,000 shares of preferred stock. As of December 31, 1997, 317,181 of these shares had been designated Series A, 8% convertible preferred stock and 9,500 had been designated Series B, 12% convertible preferred stock. The remaining 173,319 shares were undesignated. The Series A, 8% convertible preferred stock (Series A Shares) consisted of 317,181 shares that carried a cumulative dividend, payable upon conversion, of 8% per annum. During 1996, 200,000 Series A Shares were converted into 1,333,333 shares of common stock; the remaining 117,181 Series A Shares were converted into 781,207 shares of common stock during 1997. The Series B, 12% convertible preferred stock (Series B Shares) consisted of 9,000 shares that carried a cumulative dividend, payable monthly, of 12% per annum based on a liquidation value of $100 per share. On September 17, 1997, all 9,000 Series B Shares were converted into 644,653 shares of common stock. As a result of the above, the 500,000 authorized shares of preferred stock were undesignated as of December 31, 1998.

Common Stock During 1995, the Company privately placed 108,676 equity units, each consisting of two shares of common stock reissued from treasury with one warrant to purchase one share of common stock at $6.00. Included in the 108,676 equity units are 53,000 equity units subject to redemption, at the option of the holder, at a price of $7.00 per share, or $14.00 per equity unit. In March 1997, 17,664 of these equity units (representing 35,328 shares of common stock and 17,664 warrants) were redeemed at $14.00 per equity unit, with 70,667 warrants to purchase one share of common stock at $5.19 being issued to the holders of the redeemed units. The "put" option related to the remaining 35,336 equity units expired in March 1998. During 1998, the Company issued 658,257 shares of common stock as a result of the exercise of options under the Company's stock option plan (see Note 8) generating total proceeds of $116,347; 14,472 shares of common stock were issued as a result of the exercise of the Company's stock warrants, under the cashless exercise provision contained within the warrant itself. In July 1997, the Company reissued 2,824 shares of common stock from treasury and 778,383 original issue shares in conjunction with the conversion of the 117,181 Series A Shares (see Preferred Stock above). Additionally, in September 1997, the Company issued 644,653 shares of common stock in conjunction with the conversion of the 9,000 Series B Shares (see Preferred Stock above). Additional common stock transactions during 1997 were as follows: 189,375 shares of common stock were issued as a result of the exercise of options under the Company's incentive stock option plan (see Note 8) for total proceeds of $42,470; 16,489 shares of common stock that had been issued in December 1996 were subsequently canceled; and 116,218 shares of common stock were issued in lieu of interest related to the $5,000,000 convertible note placed during 1996 (see Note 6). During 1996, the Company reissued 287,923 shares of treasury stock, issued 140,651 shares of common stock and 100,000 warrants to purchase one share of common stock at $7.00 as a part of the acquisition of Lintel (see Note 2). The warrants were recorded at their fair value on the date of grant. In addition, the Company continued to raise money through private placements of its common stock. In the first quarter of 1996, the Company privately placed 167,482 shares of common stock and 83,741 warrants to purchase one share of common stock at $6.00, generating $284,720 in net proceeds. The warrants are exercisable at the option of the holder, however, the Company maintains the right to require exercise of the warrants 30 days prior to a public offering of the Company's stock. During the second quarter of 1996, the Company placed 666,666 shares of common stock with 137,777 warrants to purchase one share of common stock at $4.50. Total issue fees and costs of $170,000 have been netted against $3,000,000 of proceeds from the placement in the Company's financial statements. In addition, 55,555 shares of common stock and 8,889 warrants to purchase one share of common stock at $4.50 were issued as commissions related to the placement.

The Company raised additional funds in 1996 in a private placement of 237,060 shares of common stock with 35,329 warrants to purchase one share of common stock at $4.50. Total issue fees and costs of $47,885 have been netted against the $1,066,770 in total proceeds from the placement in the Company's financial statements. In addition, 16,489 shares of common stock were issued as commissions related to the placement, but were canceled in 1997. Additional common stock transactions during 1996 were as follows: 1,333,333 shares of common stock were issued pursuant to the conversion of 200,000 shares of Series A preferred stock; 24,000 shares of common stock were issued as a result of the exercise of options under the Company's incentive stock option plan (see Note 8) for total proceeds of $5,238; and 20,021 shares of common stock were issued in lieu of an interest payment in the amount of $118,750 related to the private debt placement that occurred during 1996 (see Note 6). Note 8 - Stock Option Plan The Company's 1997 Stock Option Plan, as amended, ("Option Plan") is designed and intended as a performance incentive. The Option Plan is administered by the Compensation Committee as appointed by the Board of Directors of the Company (Compensation Committee). The Option Plan permits the grant of options to employees of the Company to purchase shares of common stock and is intended to be a nonqualified plan. All options granted to employees are for a period of ten years, are granted at a price equal to the fair market value of the common stock on the date of the grant and are vested 20% on the first anniversary of the grant, with an additional 20% vesting on each subsequent anniversary of the grant. The Option Plan further permits the grant of options to directors, consultants and other key persons (non-employees) to purchase shares of common stock. All options granted to non- employees are for a period of ten years, are granted at a price equal to the fair market value of the common stock on the date of the grant, and may contain vesting requirements and/or restrictions as determined by the Compensation Committee at the time of grant. The Option Plan is authorized to issue options representing up to 5,000,000 shares of the Company's common stock. The Company applies APB Opinion No. 25 and related interpretations in accounting for the Option Plan. Had compensation cost for the Option Plan been determined consistent with SFAS No. 123, the Company's net loss available to common stockholders and net loss per common share would have been the pro forma amounts indicated below:

For the Year Ended December 31, ------------------------------------------ 1996 1997 1998 ---- ---- ---- Net loss available to common stockholders: As reported ............ $ (9,348,769) $ (5,998,318) $ (3,648,844) Pro forma .............. (9,542,493) (6,271,420) (3,993,763) Net loss per common share- basic and diluted: As reported ............ $ (0.53) $ (0.31) $ (0.18) Pro forma .............. (0.54) (0.33) (0.20) For purposes of calculating the compensation cost consistent with SFAS No. 123, the fair value of each option grant is estimated on the date of grant using the Black-Scholes option-pricing model with the following weighted-average assumptions used for grants in fiscal 1996, 1997 and 1998: dividend yield of 0%; expected volatility of 50%; risk free interest rates ranging from 4.00% to 6.80%; and expected lives of five years. The following is a summary of activity under the Option Plan: Options Outstanding Options Exercisable ------------------- ------------------- Weighted Average Fair Value Weighted Weighted of Options Average Options Average Options Outstanding Price Exercisable Price Granted ----------- ----- ----------- ----- ------- Outstanding at December 31, 1995 1,425,382 $ 0.20 1,232,257 $ 0.20 Granted................ 335,000 4.65 $ 2.43 Exercised.............. (24,000) 0.23 Forfeited.............. (74,750) 2.14 --------- ------- Outstanding at December 31, 1996...... 1,661,632 1.01 1,299,757 0.57 Granted................ 512,500 4.18 $ 1.95 Exercised.............. (189,375) 0.22 Forfeited.............. (39,500) 3.91 --------- ------- Outstanding at December 31, 1997...... 1,945,257 1.85 1,460,629 1.29 Granted................ 245,250 5.09 $ 2.55 Exercised.............. (658,257) 0.18 Forfeited.............. (56,750) 4.25 --------- ------- Outstanding at December 31, 1998..... 1,475,500 $ 3.05 1,088,375 $ 2.48 ========= ======= ========= ======

The following table summarizes information about stock options outstanding at December 31, 1998: Options Outstanding Options Exercisable --------------------------- --------------- Weighted Average Weighted Weighted Number Remaining Average Number Average of Contractual Exercise of Exercise Range of Exercise Price Shares Life Price Shares Price - ----------------------- ------ ---------- ----- -------- ------- $2.50 - 6.00 ........ 963,000 8.35 years $ 4.55 575,875 $ 4.49 $0.1875 - 0.25 ...... 512,500 3.59 years $ 0.22 512,500 $ 0.22 Note 9 - Employee Benefit Plan The Company maintains a contributory profit sharing plan established pursuant to the provisions of Section 401(k) of the Internal Revenue Code which provides benefits for eligible employees of the Company. The Company made no contributions to the plan during the years ended December 31, 1996, 1997 and 1998. Note 10 - Geographic and Customer Information During each of the last three fiscal years, the Company has operated in only one industry segment. During 1996, 1997 and 1998, sales to one customer (a reseller of the Company's product) aggregated approximately $4,297,000, $1,994,000 and $1,950,000 respectively, representing 44%, 16% and 13% of the total revenues, respectively. Accounts receivable from this customer represented 40% and 60% of the Company's gross accounts receivable balance at December 31, 1997 and 1998, respectively. Sales to unaffiliated customers are based upon the point of sale versus the location of the customer. However, United States sales to unaffiliated customers includes export sales from the Company's United States operations to unaffiliated customers in the Netherlands of approximately $4,297,000, $1,994,000 and $1,950,000 for the years ended December 31, 1996, 1997 and 1998, respectively.

Information regarding geographic areas for the year ended December 31, 1996 is as follows: United Belgium Total States ------ ------- ----- Sales to unaffiliated customers $ 4,774,000 $ 5,418,000 $ 10,192,000 Long-lived assets 270,000 3,478,000 3,748,000 Information regarding geographic areas for the year ended December 31, 1997 is as follows: United Belgium Total States ------ ------- ----- Sales to unaffiliated customers $ 2,784,000 $ 9,518,000 $ 12,302,000 Long-lived assets 285,000 2,432,000 2,717,000 Information regarding geographic areas for the year ended December 31, 1998 is as follows: United Belgium Total States ------ ------- ----- Sales to unaffiliated customers $ 2,785,000 $12,231,000 $ 15,016,000 Long-lived assets 257,000 1,721,000 1,978,000 Note 11 - Commitments and Contingencies The Company leases office space and equipment under operating lease agreements expiring at various times during 1999. Future minimum rental payments required under noncancelable leases are as follows: Year Amount 1999 ................................ $147,380 Rent expense under operating leases aggregated approximately $158,000, $213,000 and $285,000 for the years ended December 31, 1996, 1997 and 1998, respectively. During a period of time extending from the mid-1980s to the mid- 1990s the Company engaged in certain matters that were not in compliance with requisite corporate law. There have been no lawsuits asserted or filed against the Company related to these matters. Management cannot assess the likelihood that a lawsuit would be filed nor can management estimate a potential range of loss.

The Company is subject to legal proceedings and claims which have arisen in the ordinary course of its business and have not been finally adjudicated. These actions, when ultimately concluded and determined, will not, in the opinion of management, have a material adverse impact on the financial position, results of operations and liquidity of the Company. Note 12 - Subsequent Events On April 6, 1999, Security Dynamics Technologies, Inc., RSA Data Security, Inc., the Company and VASCO Data Security, Inc. announced settlement on confidential terms of the claims that each of the companies had raised in litigation filed last year. On April 14, 1999, the Company completed a private placement of Common Stock in the amount of $11.5 million. The transaction represented a sale of the Company's Common Stock to European institutional investors at a price of $3.50 per share. A total of 3,285,714 shares of Common Stock were issued as a part of this transaction.

INDEPENDENT AUDITORS' REPORT The Stockholders and Board of Directors VASCO Data Security International, Inc.: We have audited the accompanying consolidated balance sheets of VASCO Data Security International, Inc. and subsidiaries (the "Company") as of December 31, 1997 and 1998 and the related statements of operations, comprehensive income, stockholders' equity (deficit), and cash flows for each of the years in the three-year period ended December 31, 1998. In connection with our audits of the consolidated financial statements, we have also audited the consolidated financial statement schedule as listed in the accompanying index. These consolidated financial statements and the consolidated financial statement schedule are the responsibility of the Company's management. Our responsibility is to express an opinion on these consolidated financial statements and the consolidated financial statement schedule based on our audits. We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion. In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of VASCO Data Security International, Inc. and subsidiaries as of December 31, 1997 and 1998, and the results of their operations and their cash flows for each of the years in the three-year period ended December 31, 1998, in conformity with generally accepted accounting principles. Also, in our opinion, the related consolidated financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, presents fairly, in all material respects, the information set forth therein. /s/ KPMG LLP Chicago, Illinois March 12, 1999, except for Note 12 which is as of April 15, 1999

SCHEDULE II VASCO DATA SECURITY INTERNATIONAL, INC. VALUATION AND QUALIFYING ACCOUNTS Bad Debt Allowance for Doubtful Accounts Beginning Expense Accounts Ending For Trade Accounts Receivable Balance (Recovery) Written Balance Off - ---------------------------- ---------- ---------- -------- -------- Year ended December 31, 1996 $ 182,000 $ 346,000 $ (76,000) $ 452,000 Year ended December 31, 1997 452,000 97,000 (120,000) 429,000 Year ended December 31, 1998 429,000 (272,000) (102,000) 55,000 Beginning Obsolescence Inventory Ending Reserve for Obsolete Balance Expense Written Balance Inventories Off - ---------------------------- ---------- ---------- -------- -------- Year ended December 31, 1996 $ 114,000 $ 40,000 $ - $ 154,000 Year ended December 31, 1997 154,000 101,000 (91,000) 164,000 Year ended December 31, 1998 164,000 35,000 70,000) 129,000

SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the Registrant has duly caused this Report to be signed on its behalf by the undersigned, thereunto duly authorized, on April 15, 1999. VASCO Data Security International, Inc. /s/ T. Kendall Hunt T. Kendall Hunt Chairman of the Board, Chief Executive Officer and President Pursuant to the requirements of the Securities Exchange Act of 1934, this Report has been signed by the following persons on behalf of the Registrant in the capacities indicated on April 15, 1999. POWER OF ATTORNEY Each of the undersigned, in his capacity as an officer or director, or both, as the case may be, of VASCO Data Security International, Inc. does hereby appoint T. Kendall Hunt and Gregory T. Apple, and each of them severally, his true and lawful attorneys or attorney to execute in his name, place and stead, in his capacity as director or officer, or both, as the case may be, this Annual Report on Form 10-K for the fiscal year ended December 31, 1998 and any and all amendments thereto and to file the same with all exhibits thereto and other documents in connection therewith with the Securities and Exchange Commission. Each of said attorneys shall have power to act hereunder with or without the other attorney and shall have full power and authority to do and perform in the name and on behalf of each of said directors or officers, or both, as the case may be, every act whatsoever requisite or necessary to be done in the premises, as fully and to all intents and purposes as to which each of said officers or directors, or both, as the case may be, might or could do in person, hereby ratifying and confirming all that said attorneys or attorney may lawfully do or cause to be done by virtue hereof. SIGNATURE TITLE /s/ T. Kendall Hunt Chairman of the Board, Chief Executive Officer T. Kendall Hunt and President and Director (Principal Executive Officer) /s/ Gregory T. Apple Vice President and Treasurer Gregory T. Apple (Principal Financial Officer and Principal Accounting Officer) /s/ Robert E. Anderson Director Robert E. Anderson

/s/ Michael P. Cullinane Director Michael P. Cullinane /s/ Pol Hauspie Director Pol Hauspie /s/ Mario A. Houthooft Director Mario A. Houthooft /s/ Forrest D. Laidley Director Forrest D. Laidley /s/ Michael A. Mulshine Director Michael A. Mulshine

LERNOUT & HAUSPIE SPEECH PRODUCTS N.V. AMENDMENT I LICENSE AGREEMENT This Amendment I, effective the 31st day of December, 1998 ("Effective Date"), is by and between Lernout & Hauspie Speech Products N.V. (the "Licensor"), and VASCO Data Security International, Inc. (the "Licensee"), and hereby amends the Agreement dated March 25, 1998 between Licensor and Licensee (the "Agreement"). The parties hereto agree as follows: 1. Scope of Amendment This Amendment I supplements the Agreement to i) add new Development Software, ii) add additional Designated Application, iii) expand the prepayment and the term, iv) modify the payment terms and v) initiate a co-marketing and co-sales effort. In all other respects, the Agreement as amended is ratified and confirmed, and the terms thereof shall remain in effect. 2. Existing Development Software, as of the Effective Date The Agreement is hereby amended to add new Development Software. Accordingly, new Addenda A-I, attached hereto, shall be added to Addendum A and become part of the Agreement. 3. Additional Designated Application The Agreement is hereby amended to add additional Designated Application. Accordingly, a new Addendum B-I, attached hereto, shall be added to Addendum B and become part of the Agreement. 4. Additional prepayment/Extension of Term The Agreement is hereby amended to extend the term with an additional five (5) years. The Agreement is hereby amended to expand the prepayment. Accordingly, Section 1 b) of Addendum C shall be deleted and replaced as follows: 1.b) LICENSEE hereby commits to a non-refundable pre-payment on royalties in the amount of US $1,700,000 (One Million Seven Hundred Thousand US Dollars). 5. Payment Terms The Agreement is hereby amended to change the payment terms. Accordingly, Section 3 of Addendum C shall be deleted and replaced as follows: 3.a) LICENSEE will pay a first non-refundable pre-payment on royalties to the amount of Six Hundred Thousand US Dollars ($600,000 USD) within Three (3) months after the Effective Date of this Agreement. This non-refundable prepayment will be credited against royalty payments as described in this Agreement.

LICENSEE will pay a second non-refundable pre-payment on royalties to the amount of One Million One Hundred Thousand US Dollars ($1,100,000USD) as follows: . $450.000 USD will be payable upon C.E.D of this Amendment I. . $650.000 USD will be payable on or before March 20, 1999. This non-refundable prepayment will be credited against royalty payments as described in this Agreement, as amended. After the minimum committed royalties, the amounts of royalties shall be paid by LICENSEE to LICENSOR in quarterly basis and shall be calculated according to section 1 of this Addendum. b) Payment of Non-Refundable Engineering Fee will be defined when applicable. 6. Co-marketing and co-sales The Agreements is hereby amended to include a co-marketing and co- sales effort for both parties. Accordingly, a new Section 14.11 and 14.12 shall be added and become part of the Agreement. 14.11. Parties agree to use commercially reasonable efforts, upon mutually agreed terms and conditions, to market the products of the other party; such co-marketing to be achieved through but without limitation, joint press releases, promotion on trade fairs, sharing of existing distribution resources. 14.12. In the course of the first quarter of 1999, both parties will work out a co-sales plan, in which they will determine which jointly developed products of one party may be sold by the other party. Pricing and commercial conditions will also be worked out. As a guideline similar royalties are provided in the License Agreement, will be paid by one party to the other, unless otherwise defined in common agreement between both parties, depending on market conditions and functionality of these products. IN WITNESS WHEREOF, the parties execute this Amendment I by their duly authorized representatives, effective as of the Effective Date of this Amendment I. LERNOUT & HAUSPIE VASCO Data Security International, Inc. SPEECH PRODUCTS N.V. By /s/ T. Kendall Hunt By /s/ Gaston Bastiens Name:___T. Kendall Hunt _________ Name:__Gaston Bastiens___ Title:__Chairman/CEO Title:_President/CEO______

Addendum A-1 Software Functional Specification 1.1 LICENSEE agrees having received the Development Software, having the following reference: All existing L&H products, including the following, but not limited to: ASR1500/T, all languages commercially available at the Effective Date, ASR1600/M, all languages commercially available at the Effective Date, ASR 200 and 300, all languages commercially available at the Effective Date, TTS 3000, all languages commercially available at the Effective Date, Speech Coding, but rate 4.8 Kbps. Voice Xpress and Voice Xpress Pro, all languages commercially available at the Effective Date. 1.2 Reference is made to the Documentation as provided for the Development Software. 1.3 Furthermore, by signing this Agreement, LICENSEE accepts that the Development Software meets the functional specification(s). 1.4 Functional Specifications: as per existing technical documentation provided by LICENSOR to LICENSEE 1.5 Other LICENSOR's products, or other language version of existing products, can be added to this agreement, as they become available. This will be done in common agreement between both parties. Notwithstanding the above, LICENSEE shall be entitled to updates of the Development Software delivered hereunder.

Addendum B-1 Designated Application 1. Following are some of the target applications which, incorporating the run-time software will be developed in common agreement between both parties: 1) Telephony applications for the banking and remote access sector using the L&H ASR 1500/T, for command and control functions, in combination with the VASCO Verification and authentication, using the VASCO proprietary products, including but not limited to Cryptech and Advanced Authentication Technologies. 2) PC desktop applications for the banking and remote sector using the L&H ASR 1600/M, for command and control functions, in combination with the VASCO Verification and authentication, using the VASCO proprietary products, including but not limited to Cryptech and Advanced Authentication Technologies. 3) PC desktop Data security applications based on L&H products for Access to the application (as per existing License Agreement), in combination with the VASCO proprietary products, for authentication. 4) PC desktop Data security applications and banking and remote access applications using the L&H products for `document authentication and signature'. Documents can either be created by keyboard input, or by Voice input-via dictation. The exact functionality and specifications of these applications will be defined jointly by product manager of both parties. Product managers from both sides will meet at least once per quarter to identify and define these applications, estimating development cost and cycle. Additional applications, using one or more of LICENSEE's technologies or products can be added to the above list, in common agreement between both parties. 2. LIMITED EXCLUSIVITY The following will clarify the limited exclusivity provisions as mentioned in the License Agreement: During an initial period of three (3) years, LICENSEE's rights as defined in article 2 of the License Agreements shall be exclusive as to the Speaker Verification software for use in PC and network security applications with authentication and/or signature functions.

During an initial period of three (3) years, LICENSEE shall have the exclusive distribution rights of the sdk-version of the Speaker Verification software to customers using the PC and network security applications with authentication and/or signature functions. Both parties agree to work out the procedure under which such distribution shall take place. A fee amounting to 30% of the revenues/license fees generated hereunder by LICENSOR, will be paid to LICENSEE. This exclusivity shall commence on January 1, 1999, and shall remain for a period of three (3) years, so long as LICENSEE: a) does not enter into agreements with other speech software companies b) makes timely payments to LICENSOR under this Agreements and other agreements; The failure to achieve any of the above cumulative conditions shall immediately revert the exclusivity into a non-exclusivity. This clause shall remain valid during any extension of the exclusivity term and shall not be derogated by anything hereunder mentioned. After two (2) years of the initial three (3) year period, LICENSOR and LICENSEE shall both agree on the performance criteria, based on but not limited to market share, which LICENSEE has to meet at the end of the third year. At the end of the initial three (3) year period (and each extension thereof), both parties shall evaluate the results and the commercial forecasts with a view to extend the exclusivity with one year periods. If both parties agree not to extend the exclusivity after any period hereabove mentioned, both parties agree that the agreement shall continue on an non-exclusive basis for the term of the Agreement. LICENSEE acknowledges that the above exclusivity shall not apply to existing customer base of LICENSOR, as well as to chip and board manufacturers.

5 12-MOS DEC-31-1998 DEC-31-1998 1,523,075 0 3,431,218 55,000 1,272,327 7,224,268 1,049,402 691,806 9,100,896 10,310,557 0 0 0 20,806 (9,666,370) 9,100,896 15,015,927 15,015,927 6,949,308 6,949,308 9,276,598 0 1,457,627 (2,961,842) 687,002 (3,648,844) 0 0 0 (3,648,844) (0.18) (0.15)

Exhibit 23 The Stockholders and Board of Directors VASCO Data Security International, Inc.: We consent to incorporation by reference in the registration statement (No. 333-62829) on Form S-8 of VASCO Data Security International, Inc. of our report dated March 12, 1999, except as to Note 12 which is as of April 15, 1999, relating to the consolidated balance sheets of VASCO Data Security International, Inc. and subsidiaries as of December 31, 1998 and 1997, and the related consolidated statements of operations, comprehensive income, shareholders' equity (deficit), and cash flows for each of the years in the three-year period ended December 31, 1998, and the related consolidated financial statement schedule, which report appears in the December 31, 1998 annual report on Form 10-K of VASCO Data Security International, Inc. /s/ KPMG LLP Chicago, Illinois April 15, 1999

Exhibit 21 Subsidiaries of the Registrant Percentage Entity Jurisdiction Ownership [S] [C] [C] VASCO Data Security Europe SA Belgium 100%* VASCO Data Security NV/SA Belgium 100%* VASCO Data Security, Inc. Delaware 100% * All shares are held by the parent corporation, except that shares representing less than 1% are held by T. Kendall Hunt.