OneSpan (OSPN) Q3 2026 earnings review
OneSpan raises its 2026 outlook, but fourth-quarter profit still falls
OneSpan's shift to software subscriptions is lifting revenue and gross margins while higher overhead holds back operating profit. The banking security and e-signature provider grew third-quarter sales 12% to $64 million, and annual recurring revenue rebounded to $196 million after dipping last quarter. Chief executive Victor Limongelli raised the full-year targets for software sales, recurring contracts and cash profit, though by our math the plan still points to fourth-quarter cash profit falling 13% from a year ago.
| Recurring contracts, excluding Build38 at close | +6.9% reported ARR: +8.5% to $195.5M |
|---|---|
| Revenue | $63.9M +12% from a year ago |
| Adjusted EBITDA | $19.3M +10% from a year ago |
| Full-year revenue outlook | Raised $6M middle of the range: 5.3% growth |
⚖️ Verdict: 🟢 Bullish
The story got better because software subscriptions drove the entire $6 million revenue raise, and existing customers expanded their contracts at a 105% rate after slipping to 103% last quarter. One caution: stripping out the Build38 purchase leaves recurring contract growth at about 7% by our math, and the raised full-year plan still points to 5% underlying contract growth by year-end.
The question now is whether the DigipassONE platform and e-signature renewals can push underlying contract growth above the mid-single digits while covering higher sales and administrative costs. Either passkey trials and high-usage e-signature renewals lift fourth-quarter contract additions above the implied $3.5 million, or growth stays dependent on small acquisitions. Fourth-quarter recurring revenue and the 2027 outlook will settle it.
🐂 Bull Case
Subscription Growth Lifted the Full-Year Plan
OneSpan sells cybersecurity software, physical security tokens and e-signature tools to banks. "We delivered an excellent third quarter, highlighted by 16% subscription revenue growth and a 12% increase in operating income," chief executive Victor Limongelli said. Total sales rose 12% from a year ago to $63.9 million, and the company raised its full-year revenue outlook by $6 million so the entire increase comes from software and services.
- Cybersecurity subscription sales: $32.5 million, up 17.4% from a year ago
- Digital Agreements subscription sales: $19.0 million, up 13.6% from a year ago
- Hardware token sales: $10.5 million, up 7.4% from a year ago
Hardware token sales also beat the roughly $8.0 million to $8.7 million that last quarter's second-half plan implied by our math. Because OneSpan kept its full-year hardware forecast at $46 million to $48 million, banks took delivery of security tokens in the third quarter rather than the fourth. That early shipping leaves software to carry the higher full-year target.
What to watch: fourth-quarter software and services revenue against the $51.2 million implied by the full-year outlook. Clearing that bar against last year's high comparison will show that new subscription demand lasts beyond one strong quarter.
Recurring Contracts Rebounded After Last Quarter's Dip
Annual recurring revenue (ARR), the yearly value of active customer contracts, fell by $2.4 million last quarter after a large contract ended. This quarter OneSpan added $5.8 million of ARR to reach $195.5 million, up 8.5% from a year ago, and raised its full-year ARR target by $3 million. Its net retention rate (NRR), which tracks yearly contract growth from existing customers, improved from 103% to 105%.
The rebound fades the concern that contract growth had stalled, but it does not settle it. In the first quarter OneSpan bought Build38, a mobile app protection business that brought about $2.8 million of ARR at close. Stripping out that purchase, ARR grew 6.9% from a year ago by our math, and the new full-year target points to 5.0% underlying growth by year-end.
What to watch: underlying ARR growth excluding acquisitions when OneSpan files its quarterly report. A reading that stays in the mid-single digits would show the company still relies on acquisitions for top-line expansion.
Profit Beat Pushed the Full-Year Target Up
Last quarter's full-year plan pointed to a sharp drop in second-half cash profit. Instead, third-quarter Adjusted EBITDA — earnings before interest, taxes, depreciation, amortization, stock pay and one-offs — rose 9.8% from a year ago to $19.3 million, or 30.1% of revenue. Gross margin rose 2.7 percentage points to 76.3% because software subscriptions made up a larger share of sales, so OneSpan raised its full-year Adjusted EBITDA outlook by $5 million.
What to watch: fourth-quarter Adjusted EBITDA against the $16.8 million implied by the middle of the new full-year outlook. OneSpan beat its final full-year Adjusted EBITDA target by an average of 8% over the past two years, so another beat would erase the planned full-year profit decline.
🐻 Bear Case
Higher Overhead and Fourth-Quarter Spending Weigh on Margins
Limongelli said the company is "investing to strengthen our competitive position and support longer-term growth" while improving execution. Even with a 2.7-point jump in gross margin, GAAP operating margin barely moved at 14.5% because operating costs rose faster than sales. Sales and marketing spending climbed 2.0 percentage points of revenue to 21.9%, and general and administrative overhead rose 1.9 percentage points to 23.2%, driven by higher employee stock pay and Build38 staff.
The raised outlook still points to a fourth-quarter profit drop. By our math, the middle of the full-year forecast leaves $16.8 million of Adjusted EBITDA for the fourth quarter, down 13.4% from $19.4 million a year earlier. That implies a 25.6% margin, down from 30.1% in the third quarter.
What to watch: fourth-quarter sales and marketing and general and administrative expenses as a share of revenue. If overhead keeps rising faster than revenue while growth slows to the implied 4.4% fourth-quarter rate, operating margins will shrink in 2027.
Digital Agreements Slowed as Extra Usage Faded
Digital Agreements, OneSpan's cloud e-signature and identity-checking division, grew revenue 25.2% in the second quarter because a couple of customers paid overage fees for extra transaction volume. Management warned those extra fees would drop in the second half. In the third quarter, Digital Agreements revenue growth slowed to 13.5% from a year ago, or $19.0 million, and dropped 2.8% from the second quarter.
What to watch: Digital Agreements ARR in the fourth quarter. Management has argued that customers who pay overage fees sign larger recurring contracts when they renew, so fourth-quarter contract value will show whether the second-quarter usage boom turned into lasting business.
Risks this quarter didn't answer
Five standing concerns from prior quarters cannot be checked in the earnings release and depend on the conference call or the quarterly filing.
- ARR by segment: not in the release; the filing will show whether Digital Agreements ARR improved from 5.3% growth and whether Cybersecurity gross retention held near 86%.
- Sales in Europe, the Middle East and Africa (EMEA): missing from the release after falling 10% from a year ago in the second quarter; the filing's geographic note will show the third-quarter rate.
- Capitalized software costs in Digital Agreements: not broken out in the release after lifting segment profit in the first half; the filing footnotes will disclose the third-quarter amount.
- AI banking agents vs mobile app shielding: no commentary in the release on whether automated banking agents bypass protected mobile apps.
- Rule of 40 timetable: no target date in the release for when revenue growth plus Adjusted EBITDA margin will reach 40%.
👓 Other Themes
Passkey Trials Launch Next Month Before 2027 Rollout
OneSpan announced next steps for DigipassONE, the unified security platform it introduced in July that combines Nok Nok passwordless login tools with Build38 mobile app protection. The company will launch a free trial of DigipassONE Authenticate in November 2026, "giving organizations that are evaluating where passkeys fit within their authentication strategy a practical way to experiment with them firsthand". DigipassONE Verify remains in early testing, with general availability planned for early 2027.
💲 Other KPIs
Cash rose by $8.1 million from last quarter after falling for five straight quarters on acquisitions, dividends and share buybacks. By our math from the nine-month cash flow statement, OneSpan paused share buybacks entirely in the third quarter after spending $8.3 million in the first half, and kept $5.0 million drawn on its credit line.
Deferred revenue — cash customers have paid upfront for software and maintenance not yet delivered — rose 11.0% from $53.4 million a year ago by our math, nearly matching the 12.0% rise in reported revenue. It sits below the $74.2 million year-end balance because annual contract billings cluster in the fourth and first quarters.
By our math from the nine-month cash flow tables, free cash flow rebounded to $13.3 million (20.8% of revenue) from negative $3.3 million in the second quarter, up 51.3% from $8.8 million a year ago. Collecting customer bills drove the swing, though accounts receivable of $41.8 million remain 52.3% higher than a year ago.
🔮 Guidance
Raised. The security provider lifted the middle of its full-year revenue plan by $6 million to $256 million, or 5.3% growth. It is the second straight raise after moves of $0, +$3.5 million and +$6.0 million. By our math, the outlook leaves $65.7 million for the fourth quarter, up 4.4% from a year ago, or 9.7% excluding $3 million of software sales pulled forward into last year's fourth quarter.
Raised. Management increased the middle of its software and services outlook by $6 million to $209 million, up 7.7% for the year. By our math, that leaves $51.2 million for the fourth quarter, up 5.3% from a year ago against a comparison inflated by last year's early software renewals.
Unchanged. The plan keeps full-year hardware token sales at $47 million at the middle of the range, down 4.3% from 2025. Because third-quarter shipments beat the earlier schedule, by our math the plan now leaves $14.5 million for the fourth quarter, up 1.6% from $14.3 million a year ago.
Raised. The company lifted its year-end ARR target by $3 million to $199 million at the middle of the range, or 6.5% growth (5.0% excluding Build38's $2.8 million at close by our math). That requires $3.5 million of new ARR in the fourth quarter, compared with $6.7 million added in the fourth quarter of 2025.
Raised. OneSpan lifted the middle of its cash profit plan by $5 million to $74 million, which narrows the expected full-year decline to 4.7%. Moves across four quarters run $0, +$3 million and +$5 million. By our math, the outlook leaves $16.8 million for the fourth quarter (a 25.6% margin), down 13.4% from a year ago, though if its two-year pattern of 8% final beats holds, profit would beat.
❓ Key Questions
What was ARR growth without Nok Nok and Build38?
Reported ARR grew 8.5% to $195.5 million, but that includes Build38's $2.8 million at close and post-close additions from Nok Nok. Investors need the clean organic growth rate to tell whether core demand is accelerating.
How did ARR split between Cybersecurity and Digital Agreements?
Digital Agreements ARR growth slowed to 5.3% last quarter even as overage fees lifted revenue. The third-quarter segment ARR split will show whether those high-usage customers signed larger recurring contracts.
Why did accounts receivable stay 52% above last year?
Accounts receivable ended the quarter at $41.8 million against $27.5 million a year ago, while revenue grew 12%. Management has not explained whether multi-year contract billings or slower customer payments drove the increase.
Has OneSpan ended share buybacks to rebuild cash?
Nine-month share repurchases stayed at $8.3 million, which means OneSpan bought back no shares in the third quarter while keeping $5 million drawn on its credit line. Investors need to know the cash target required before buybacks resume.