OSPN

Are there any regulatory approvals required for the acquisition, and could they introduce delays or costs?

Created August 06, 2025 at 07:37 PM

Short answer:

The news release does not spell out any specific regulatory approvals that OneSpan (OSPN) must obtain for its acquisition of Nok Nok Labs. However, in a cross‑border technology and security‑software deal—especially one that expands authentication capabilities—there are several typical regulatory touch‑points that could require formal clearance, and those clearances can indeed add time and expense to the transaction.

1. Why regulatory approvals are usually needed in a deal like this

Regulatory Area	What it covers	Typical relevance to a OneSpan‑Nok Nok Labs deal
Antitrust / Competition	Review of whether the combined entity would have excessive market power or reduce competition.	Both companies operate in the digital‑identity and authentication space. If the acquisition would give OneSpan a dominant share of FIDO2‑password‑less solutions, competition authorities (e.g., the U.S. FTC, the European Commission’s Competition Directorate, or other national competition agencies) may need to sign off.
Export‑Control / Dual‑Use Technology	Controls on the transfer of software, encryption, or security‑critical technology to foreign parties.	FIDO2 authentication software often incorporates cryptographic components that can be subject to U.S. Export Administration Regulations (EAR) or similar regimes in the EU, UK, Canada, etc. Moving the codebase or IP across borders may trigger licensing requirements.
Data‑Privacy & Cyber‑Security	Rules governing the handling of personal data, especially biometric or authentication data.	If Nok Nok Labs processes biometric identifiers or other sensitive authentication data, the acquisition may need to satisfy GDPR (EU), CCPA/CPRA (California), or other sector‑specific privacy statutes.
Foreign Investment Review	Oversight of inbound/outbound investments that could affect national security.	Some jurisdictions (e.g., the U.S. Committee on Foreign Investment in the United States – CFIUS, or similar bodies in Canada, Australia, Singapore) review deals involving “critical technology” or “critical infrastructure.” Authentication software can be deemed critical, prompting a review.
Sector‑Specific Licences	Certain industries (e.g., financial‑services, health‑tech) have extra layers of oversight.	If either party provides authentication solutions to regulated sectors (banks, insurers, government), regulators of those sectors may need to be notified.

2. Potential regulatory pathways and timelines

Regulator	Typical review window	Possible outcomes
U.S. FTC / Department of Justice (Antitrust)	30–90 days for “Hart‑Scott‑Rodino” (HSR) filing; additional 30–60 days if a “second‑request” is issued.	Clearance, conditional clearance (e.g., divestitures), or a “no‑action” letter.
European Commission (Competition)	30 days for a “simple” merger; up to 150 days if a “screening” is triggered.	Approval, or requirement to modify the deal (e.g., surrender of certain product lines).
CFIUS (U.S. foreign‑investment)	45 days for a “standard” review; up to 120 days if a “mitigated‑risk” filing is needed.	Clearance, mitigation agreement, or a “blocked” transaction.
Export‑Control Agencies (EAR, BIS)	15–30 days for a license request; can be longer if a “red‑flag” is raised.	Export license granted, denied, or conditional.
Data‑Privacy Regulators (e.g., EU DPAs, California Attorney General)	Varies; often tied to the completion of the transaction and post‑merger integration.	Requirement to conduct DPIAs, adopt privacy‑by‑design measures, or in rare cases, block the transfer of data.

Bottom line: Even if OneSpan’s acquisition is “small” in dollar terms, the technology‑intensity and security‑critical nature of the assets can trigger a broader set of reviews than a typical software purchase.

3. How these approvals could translate into delays or extra costs

Potential delay source	Typical cost impact
Legal counsel & filing fees – preparing HSR filings, antitrust questionnaires, export‑control license applications, and CFIUS reports can run $250 k–$1 M for a mid‑size deal.
Regulatory consulting – privacy‑impact assessments, data‑mapping, and security‑risk analyses often cost $100 k–$500 k.
Mitigation measures – if a regulator demands divestitures, firewalls, or post‑merger compliance programs, implementation can add $5 M–$15 M (e.g., building separate data‑processing environments).
Extended timeline – a 30‑day antitrust review is “business as usual,” but a 150‑day EU screening or a 120‑day CFIUS review can push the close date out by 3–5 months. This can affect: • Integration planning (e.g., product‑roadmap alignment) • Revenue forecasts (delayed cross‑sell) • Working‑capital needs (longer financing).
Potential fines or penalties – if the acquisition proceeds without the required licences (e.g., export‑control violations), penalties can be $10 M–$30 M per breach, plus reputational damage.

4. What the news tells us (and what it doesn’t)

What we know: The press release highlights the strategic rationale—adding FIDO2 password‑less authentication via Nok Nok Labs. It does not mention any pending regulatory filings, approvals, or expected hurdles.
What we can infer: Because the acquisition is framed as a “targeted, technology‑driven” move, OneSpan likely has already performed a pre‑closing due‑diligence assessment of the regulatory landscape. Companies in this space typically secure the necessary clearances before publicly announcing the deal, precisely to avoid surprise market reactions.
What remains uncertain: The release does not disclose the size of the transaction, the jurisdictions of the parties, or whether any foreign‑investment or export‑control filings have already been submitted. Those details determine the depth of the regulatory review.

5. Practical take‑aways for stakeholders

Stakeholder	Key considerations
Investors / Analysts	Expect a modest “regulatory risk premium” baked into the deal’s valuation. If the acquisition is under $500 M, antitrust scrutiny is usually light, but watch for export‑control or CFIUS flags that could surface later.
Management	Ensure that all required licences (EAR, GDPR‑compliant data‑transfer agreements, etc.) are in place before integrating the two product lines. Build a “regulatory firewall” to keep authentication data separate if required by law.
Customers (especially in regulated sectors)	Look for any post‑merger communications about data‑privacy or security‑policy changes. A well‑managed acquisition should preserve existing certifications (e.g., ISO 27001, SOC 2) and may even broaden compliance coverage.
Employees	Be aware that a “regulatory integration” team (legal, compliance, security) may be created, potentially requiring cross‑functional collaboration and new reporting structures.

6. Bottom‑line answer to the question

Yes, regulatory approvals are typically required for a transaction that expands authentication capabilities through a technology acquisition. While the news release does not list any specific approvals, OneSpan will almost certainly need to:

File antitrust/competition notices (e.g., HSR in the U.S., possible EU screening).
Secure export‑control licences for any cryptographic software that will be transferred across borders.
Address data‑privacy and security compliance (GDPR, CCPA, sector‑specific rules) if personal or biometric data is involved.
Potentially obtain foreign‑investment clearance (e.g., CFIUS) if the deal is viewed as involving “critical technology.”

These approvals can introduce both time‑related delays (from a few weeks to several months) and tangible costs (legal, consulting, possible mitigation measures, and compliance program upgrades). The exact magnitude of the impact will depend on the transaction size, the jurisdictions of the parties, and the specific data‑handling practices of Nok Nok Labs’ authentication platform.

In practice, most mid‑size tech acquisitions in this space are cleared within a 2–4‑month window, but any unexpected regulator “red‑flag”—especially around export‑control or foreign‑investment—could stretch the timeline and add $0.5 M–$2 M (or more) in direct expenses. Proactive planning and early engagement with the relevant agencies are the best ways to mitigate those risks.