Legal Proceedings and Contingencies	9 Months Ended
Sep. 30, 2018
Legal Proceedings and Contingencies
Legal Proceedings and Contingencies	We are a party to or have intellectual property subject to litigation and other proceedings that arise in the ordinary course of our business. These types of matters could result in fines, penalties, compensatory or treble damages or non-monetary sanctions or relief. We believe the probability is remote that the outcome of each of these matters, including the legal proceedings described below, will have a material adverse effect on the corporation as a whole, notwithstanding that the unfavorable resolution of any matter may have a material effect on our financial results in any particular interim reporting period. Among the factors that we consider in this assessment are the nature of existing legal proceedings and claims, the asserted or possible damages or loss contingency (if estimable), the progress of the case, existing law and precedent, the opinions or views of legal counsel and other advisers, our experience in similar cases and the experience of other companies, the facts available to us at the time of assessment and how we intend to respond to the proceeding or claim. Our assessment of these factors may change over time as individual proceedings or claims progress. Although we cannot predict the outcome of legal or other proceedings with certainty, where there is at least a reasonable possibility that a loss may have been incurred, U.S. GAAP requires us to disclose an estimate of the reasonably possible loss or range of loss or make a statement that such an estimate cannot be made. We follow a process in which we seek to estimate the reasonably possible loss or range of loss, and only if we are unable to make such an estimate do we conclude and disclose that an estimate cannot be made. Accordingly, unless otherwise indicated below in our discussion of legal proceedings, a reasonably possible loss or range of loss associated with any individual legal proceeding cannot be estimated. We include various types of indemnification clauses in our agreements. These indemnifications may include, but are not limited to, infringement claims related to our intellectual property, direct damages and consequential damages. The type and amount of such indemnifications vary substantially based on our assessment of risk and reward associated with each agreement. We believe the estimated fair value of these indemnification clauses is minimal, and we cannot determine the maximum amount of potential future payments, if any, related to such indemnification provisions. We have no liabilities recorded for these clauses as of September 30, 2018. During the second quarter of 2015, our management became aware that certain of our products which were sold by our European subsidiary to a third-party distributor may have been resold by the distributor to parties in Iran, potentially including parties whose property and interests in property may be blocked pursuant to Executive Order 13224, Executive Order 13382 or that may be identified under Section 560.304 of 31 C.F.R. Part 560 as the “Government of Iran”. We ceased shipping to such distributor. In addition, the Audit Committee of the Company’s Board of Directors initiated an internal review of this matter with the assistance of outside counsel. As a precautionary matter, concurrent initial notices of voluntary disclosure were submitted on June 25, 2015 to each of the U.S. Department of the Treasury, Office of Foreign Assets Control (“OFAC”), and the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”). The Audit Committee with the assistance of outside counsel completed their review in 2015. On December 15, 2015, we filed a letter with BIS (Office of Export Enforcement) with the conclusion that the products supplied to the distributor were not subject to United States Export Control jurisdiction. The Office of Export Enforcement issued a “no action” letter, concluding the voluntary self-disclosure process under the Export Administration Regulations. In addition, on January 13, 2016, we filed a letter with OFAC, with the conclusions that the Company and its subsidiaries made no direct sales to Iran or any party listed by OFAC as a Specially Designated National over the five-year period under review (i.e., June 1, 2010 to June 30, 2015). The letter further noted that the investigation did not identify any involvement on the part of senior management officials of the Company, and to the contrary, noted that senior management officials of the Company had sought to implement procedures and provided notices to the Company’s sales personnel to prevent the diversion of the Company’s products to unauthorized destinations and end users. Based upon the OFAC guidelines for monetary penalties, in the fourth quarter of 2015, we recorded a $0.9 million accrual in Other Accrued Expenses for potential penalties if they were to be assessed by OFAC. During the third quarter of 2018, we received a closing letter from OFAC in which they concluded that the investigation into our voluntary filing was closed and that no penalties or other amounts would be assessed. We therefore consider the OFAC and BIS governmental aspects of this case to be concluded, and during the third quarter of 2018 reversed the $0.9 million accrual recorded in Other Accrued Expenses. Following the June 2015 disclosure of the export controls related matter above, on July 28, 2015, a putative class action complaint was filed in the United States District Court for the Northern District of Illinois, captioned Linda J. Rossbach v. Vasco Data Security International, Inc., et al., case number 1:15‑cv‑06605, naming the Company and certain of its current and former executive officers as defendants and alleging violations under the Securities Exchange Act of 1934, as amended. The suit was purportedly filed on behalf of a putative class of investors who purchased securities of the Company between April 28, 2015 and July 28, 2015, and seeks to recover damages allegedly caused by the defendants’ alleged violations of the federal securities laws and to pursue remedies under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b‑5 promulgated thereunder. The complaint seeks certification as a class action and unspecified compensatory damages plus interest and attorneys’ fees. Pursuant to a September 1, 2015 scheduling order entered by the court, the lead plaintiff, once appointed, will have sixty days to file an amended complaint or notify the defendants that the lead plaintiff intends to rely on the current complaint. On January 30, 2017, the appointed lead plaintiff filed an amended complaint in which the allegations regarding OFAC related matters were dropped and replaced with allegations regarding public disclosures made by the defendants in April 2015 as compared to public statements made in July 2015, generally regarding the strength of the Company’s business and its future prospects. This case is now referred to by the name of the new lead plaintiff, Bunk. The defendants filed a motion to dismiss the Bunk complaint on March 31, 2017 and several other related motions and filings took place threafter. On September 30, 2018, the United States District Court for the Northern District of Illinois issued an opinion and order in which the court granted the Company’s motion to dismiss. Plaintiffs' amended complaint was dismissed without prejudice and the plaintiffs were granted leave by the court to file another amended complaint if they could find a way to remedy the deficiencies discussed in the Court's opinion by October 22, 2018. Plaintiffs did not file an amended complaint and have subsequently agreed to file a joint motion for dismissal of the case with prejudice. Once the motion is approved by the Court, the Company considers this case to be concluded. OneSpan is indemnifying its officers and directors for this matter. On October 9, 2015, a derivative complaint was filed in the United States District Court for the Northern District of Illinois, captioned Elizabeth Herrera v. Hunt, et al., case number 1:15‑cv‑08937, naming the Company’s Board of Directors and certain of its current and former executive officers as individual defendants and the Company as a nominal defendant. Two additional complaints, captioned Beth Seltzer v. Hunt, et al., case number 2015‑ch‑15541, and William Hooper v. Hunt, et al., case number 2016‑ch‑04054, were filed on October 22, 2015 and March 22, 2016, respectively, in the Circuit Court of Cook County, Illinois naming the same defendants. The complaints assert, among other things, that the individual defendants breached their fiduciary duties by making material misstatements in, and omitting material information from, the Company’s public disclosures and by failing to maintain adequate internal controls and properly manage the Company. Among other things, the complaints seek unspecified compensatory damages and injunctive relief. On October 29, 2015, a defendant removed the Seltzer action to the United States District Court for the Northern District of Illinois. Thereafter, the plaintiff filed a motion to remand the action back to the Circuit Court of Cook County, Illinois, which was denied on February 3, 2016. On February 9, 2016, the court granted an agreed motion for voluntary dismissal of the Seltzer action, which dismissed the action with prejudice as to the named plaintiff’s individual claims. As for the Hooper action, the court granted a stay on June 8, 2016 and on July 18, 2017, the plaintiff in Hooper amended the complaint to largely mirror the amended complaint in Bunk. On July 19, 2017, a derivative complaint was filed in the Circuit Court of Cook County, Illinois, captioned Fancesco D’Angelo v. Hunt, et. al., naming the Company’s Board of Directors and certain former officers as individual defendants and the Company as a nominal defendant. This complaint largely follows the allegations in the Bunk case. The D’Angelo case has been consolidated with the Hooper case and remains subject to stay. On January 10, 2011, we purchased our wholly-owned subsidiary, DigiNotar B.V., a private company organized and existing in The Netherlands from the shareholders (“Sellers”). On September 19, 2011, DigiNotar B.V. filed a bankruptcy petition under Article 4 of the Dutch Bankruptcy Act in the Haarlem District Court, The Netherlands. The bankruptcy trustee took over management of DigiNotar B.V.’s business activities and is responsible for the administration and liquidation of DigiNotar B.V. In connection with the bankruptcy of DigiNotar B.V., in January 2015, we received a notice of potential claim by the trustee against all of the individuals who served as directors of DigiNotar, both before and after our acquisition of DigiNotar. On March 29, 2018, we entered into a settlement agreement among the bankruptcy estate, the pre-acquisition directors, the Company and its directors. After contributions from the pre-acquisition directors, and reimbursements from our insurance carrier, the amount of the settlement was not material to our financial position. We consider this case to be concluded. In February 2017, we learned an integrated reseller and certain end customers, were named as defendants in a patent infringement lawsuit in Japan related to our Cronto technology. We have indemnification obligations in favor of our reseller and end customers and are working with them to defend such suit. In December 2017, the Japan Patent Office ruled the plaintiff’s patent is invalid. In February 2018, a trial court decision declared the plaintiff’s patent to be invalid. Those decisions were appealed by the plaintiff to a single appellate court. The appellate court has yet to render a decision with respect to the Japan Patent Office appeal. With respect to the appeal of the trial court decision, the appellate court issued its decision in October 2018 upholding the trial court decision that the plaintiff’s patent is invalid. We plan to continue to support our customers in these proceedings and continue to believe that the lawsuit is without merit. On March 14, 2017, a complaint was filed in the United States District Court for the District of Massachusetts, captioned StrikeForce Technologies, Inc. v. Vasco Data Security International, Inc., et al., claiming the Company infringed on certain patent rights of the plaintiff. On May 8, 2017, we answered the complaint denying the allegations of patent infringement. The parties then engaged in motion practice and discovery in the case. The plaintiff has also brought suit against various other companies in the technology industry. In one such suit in the federal district court for the Central District of California, on December 1, 2017, the court granted defendant’s motion to dismiss, finding that the StrikeForce asserted claims are invalid. StrikeForce is in the process of appealing such decision. In light of such ruling, on December 20, 2017, the court in the Company’s case granted a stay of the proceedings pending the appeal in the related case. Although the ultimate outcome of litigation cannot be predicted with certainty, the Company believes that this lawsuit is without merit and intends to defend itself vigorously.

We are a party to or have intellectual property subject to litigation and other proceedings that arise in the ordinary course of our business. These types of matters could result in fines, penalties, compensatory or treble damages or non-monetary sanctions or relief. We believe the probability is remote that the outcome of each of these matters, including the legal proceedings described below, will have a material adverse effect on the corporation as a whole, notwithstanding that the unfavorable resolution of any matter may have a material effect on our financial results in any particular interim reporting period. Among the factors that we consider in this assessment are the nature of existing legal proceedings and claims, the asserted or possible damages or loss contingency (if estimable), the progress of the case, existing law and precedent, the opinions or views of legal counsel and other advisers, our experience in similar cases and the experience of other companies, the facts available to us at the time of assessment and how we intend to respond to the proceeding or claim. Our assessment of these factors may change over time as individual proceedings or claims progress.

Although we cannot predict the outcome of legal or other proceedings with certainty, where there is at least a reasonable possibility that a loss may have been incurred, U.S. GAAP requires us to disclose an estimate of the reasonably possible loss or range of loss or make a statement that such an estimate cannot be made. We follow a process in which we seek to estimate the reasonably possible loss or range of loss, and only if we are unable to make such an estimate do we conclude and disclose that an estimate cannot be made. Accordingly, unless otherwise indicated below in our discussion of legal proceedings, a reasonably possible loss or range of loss associated with any individual legal proceeding cannot be estimated.

We include various types of indemnification clauses in our agreements. These indemnifications may include, but are not limited to, infringement claims related to our intellectual property, direct damages and consequential damages. The type and amount of such indemnifications vary substantially based on our assessment of risk and reward associated with each agreement. We believe the estimated fair value of these indemnification clauses is minimal, and we cannot determine the maximum amount of potential future payments, if any, related to such indemnification provisions. We have no liabilities recorded for these clauses as of September 30, 2018.

During the second quarter of 2015, our management became aware that certain of our products which were sold by our European subsidiary to a third-party distributor may have been resold by the distributor to parties in Iran, potentially including parties whose property and interests in property may be blocked pursuant to Executive Order 13224, Executive Order 13382 or that may be identified under Section 560.304 of 31 C.F.R. Part 560 as the “Government of Iran”. We ceased shipping to such distributor. In addition, the Audit Committee of the Company’s Board of Directors initiated an internal review of this matter with the assistance of outside counsel. As a precautionary matter, concurrent initial notices of voluntary disclosure were submitted on June 25, 2015 to each of the U.S. Department of the Treasury, Office of Foreign Assets Control (“OFAC”), and the U.S. Department of Commerce, Bureau of Industry and Security (“BIS”).

The Audit Committee with the assistance of outside counsel completed their review in 2015. On December 15, 2015, we filed a letter with BIS (Office of Export Enforcement) with the conclusion that the products supplied to the distributor were not subject to United States Export Control jurisdiction. The Office of Export Enforcement issued a “no action” letter, concluding the voluntary self-disclosure process under the Export Administration Regulations.

In addition, on January 13, 2016, we filed a letter with OFAC, with the conclusions that the Company and its subsidiaries made no direct sales to Iran or any party listed by OFAC as a Specially Designated National over the five-year period under review (i.e., June 1, 2010 to June 30, 2015). The letter further noted that the investigation did not identify any involvement on the part of senior management officials of the Company, and to the contrary, noted that senior management officials of the Company had sought to implement procedures and provided notices to the Company’s sales personnel to prevent the diversion of the Company’s products to unauthorized destinations and end users.

Based upon the OFAC guidelines for monetary penalties, in the fourth quarter of 2015, we recorded a $0.9 million accrual in Other Accrued Expenses for potential penalties if they were to be assessed by OFAC. During the third quarter of 2018, we received a closing letter from OFAC in which they concluded that the investigation into our voluntary filing was closed and that no penalties or other amounts would be assessed. We therefore consider the OFAC and BIS governmental aspects of this case to be concluded, and during the third quarter of 2018 reversed the $0.9 million accrual recorded in Other Accrued Expenses.

Following the June 2015 disclosure of the export controls related matter above, on July 28, 2015, a putative class action complaint was filed in the United States District Court for the Northern District of Illinois, captioned Linda J. Rossbach v. Vasco Data Security International, Inc., et al., case number 1:15‑cv‑06605, naming the Company and certain of its current and former executive officers as defendants and alleging violations under the Securities Exchange Act of 1934, as amended. The suit was purportedly filed on behalf of a putative class of investors who purchased securities of the Company between April 28, 2015 and July 28, 2015, and seeks to recover damages allegedly caused by the defendants’ alleged violations of the federal securities laws and to pursue remedies under Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 and Rule 10b‑5 promulgated thereunder. The complaint seeks certification as a class action and unspecified compensatory damages plus interest and attorneys’ fees. Pursuant to a September 1, 2015 scheduling order entered by the court, the lead plaintiff, once appointed, will have sixty days to file an amended complaint or notify the defendants that the lead plaintiff intends to rely on the current complaint. On January 30, 2017, the appointed lead plaintiff filed an amended complaint in which the allegations regarding OFAC related matters were dropped and replaced with allegations regarding public disclosures made by the defendants in April 2015 as compared to public statements made in July 2015, generally regarding the strength of the Company’s business and its future prospects. This case is now referred to by the name of the new lead plaintiff, Bunk. The defendants filed a motion to dismiss the Bunk complaint on March 31, 2017 and several other related motions and filings took place threafter.

On September 30, 2018, the United States District Court for the Northern District of Illinois issued an opinion and order in which the court granted the Company’s motion to dismiss. Plaintiffs' amended complaint was dismissed without prejudice and the plaintiffs were granted leave by the court to file another amended complaint if they could find a way to remedy the deficiencies discussed in the Court's opinion by October 22, 2018. Plaintiffs did not file an amended complaint and have subsequently agreed to file a joint motion for dismissal of the case with prejudice. Once the motion is approved by the Court, the Company considers this case to be concluded. OneSpan is indemnifying its officers and directors for this matter.

On October 9, 2015, a derivative complaint was filed in the United States District Court for the Northern District of Illinois, captioned Elizabeth Herrera v. Hunt, et al., case number 1:15‑cv‑08937, naming the Company’s Board of Directors and certain of its current and former executive officers as individual defendants and the Company as a nominal defendant. Two additional complaints, captioned Beth Seltzer v. Hunt, et al., case number 2015‑ch‑15541, and William Hooper v. Hunt, et al., case number 2016‑ch‑04054, were filed on October 22, 2015 and March 22, 2016, respectively, in the Circuit Court of Cook County, Illinois naming the same defendants.

The complaints assert, among other things, that the individual defendants breached their fiduciary duties by making material misstatements in, and omitting material information from, the Company’s public disclosures and by failing to maintain adequate internal controls and properly manage the Company. Among other things, the complaints seek unspecified compensatory damages and injunctive relief.

On October 29, 2015, a defendant removed the Seltzer action to the United States District Court for the Northern District of Illinois. Thereafter, the plaintiff filed a motion to remand the action back to the Circuit Court of Cook County, Illinois, which was denied on February 3, 2016. On February 9, 2016, the court granted an agreed motion for voluntary dismissal of the Seltzer action, which dismissed the action with prejudice as to the named plaintiff’s individual claims. As for the Hooper action, the court granted a stay on June 8, 2016 and on July 18, 2017, the plaintiff in Hooper amended the complaint to largely mirror the amended complaint in Bunk.

On July 19, 2017, a derivative complaint was filed in the Circuit Court of Cook County, Illinois, captioned Fancesco D’Angelo v. Hunt, et. al., naming the Company’s Board of Directors and certain former officers as individual defendants and the Company as a nominal defendant. This complaint largely follows the allegations in the Bunk case. The D’Angelo case has been consolidated with the Hooper case and remains subject to stay.

On January 10, 2011, we purchased our wholly-owned subsidiary, DigiNotar B.V., a private company organized and existing in The Netherlands from the shareholders (“Sellers”). On September 19, 2011, DigiNotar B.V. filed a bankruptcy petition under Article 4 of the Dutch Bankruptcy Act in the Haarlem District Court, The Netherlands. The bankruptcy trustee took over management of DigiNotar B.V.’s business activities and is responsible for the administration and liquidation of DigiNotar B.V. In connection with the bankruptcy of DigiNotar B.V., in January 2015, we received a notice of potential claim by the trustee against all of the individuals who served as directors of DigiNotar, both before and after our acquisition of DigiNotar. On March 29, 2018, we entered into a settlement agreement among the bankruptcy estate, the pre-acquisition directors, the Company and its directors. After contributions from the pre-acquisition directors, and reimbursements from our insurance carrier, the amount of the settlement was not material to our financial position. We consider this case to be concluded.

In February 2017, we learned an integrated reseller and certain end customers, were named as defendants in a patent infringement lawsuit in Japan related to our Cronto technology. We have indemnification obligations in favor of our reseller and end customers and are working with them to defend such suit. In December 2017, the Japan Patent Office ruled the plaintiff’s patent is invalid. In February 2018, a trial court decision declared the plaintiff’s patent to be invalid. Those decisions were appealed by the plaintiff to a single appellate court. The appellate court has yet to render a decision with respect to the Japan Patent Office appeal. With respect to the appeal of the trial court decision, the appellate court issued its decision in October 2018 upholding the trial court decision that the plaintiff’s patent is invalid. We plan to continue to support our customers in these proceedings and continue to believe that the lawsuit is without merit.

On March 14, 2017, a complaint was filed in the United States District Court for the District of Massachusetts, captioned StrikeForce Technologies, Inc. v. Vasco Data Security International, Inc., et al., claiming the Company infringed on certain patent rights of the plaintiff. On May 8, 2017, we answered the complaint denying the allegations of patent infringement. The parties then engaged in motion practice and discovery in the case. The plaintiff has also brought suit against various other companies in the technology industry. In one such suit in the federal district court for the Central District of California, on December 1, 2017, the court granted defendant’s motion to dismiss, finding that the StrikeForce asserted claims are invalid. StrikeForce is in the process of appealing such decision. In light of such ruling, on December 20, 2017, the court in the Company’s case granted a stay of the proceedings pending the appeal in the related case. Although the ultimate outcome of litigation cannot be predicted with certainty, the Company believes that this lawsuit is without merit and intends to defend itself vigorously.