OneSpan provides authentication and fraud prevention for banks and other organisations that need to protect their users, devices and applications, along with digital agreement tools for electronic signature, identity verification and smart forms. Its products let a customer log in without a password, approve a payment securely on a phone and sign a contract remotely, all with checks that the right person is on the other end.
Its customers are mostly regulated organisations, banks above all, where a weak login or an unverified signature turns directly into fraud losses or compliance exposure.
At A Glance
| Vendor | OneSpan |
|---|---|
| Category | MFA and passwordless authentication, mobile app protection, electronic signature |
| Identities covered | Customers and workforce users, mobile devices and applications, agreement signers |
| Customers | NASA, IBM, RBC Royal Bank, Standard Chartered, BMO |
| Certifications | SOC 2 Type II, ISO/IEC 27001, 27017 and 27018, FedRAMP (OneSpan Sign) |
| Market classification | Identity Verification; also MFA & Passwordless |
What OneSpan Does
OneSpan’s work comes down to protecting users, devices and apps at the moments that carry risk: login, high-value transactions and signing. Its work is split into a Cybersecurity portfolio, for authentication, fraud prevention and app protection, and a Digital Agreements portfolio, for preparing, signing and managing agreements. The two share identity checks and authentication methods such as FIDO passkeys, so a bank can use the same strong authentication to log a customer in and to confirm who signed a loan document. The company processes millions of digital agreements and a reported billions of multi-factor authentication transactions each year.
Products
DigipassONE
DigipassONE is a single platform for authentication, transaction security, digital credentials, application protection and analytics, so that these functions are managed together rather than as separate products. DigipassONE Authenticate is the authentication product within it, used by organisations that want one place to set how customers and staff prove who they are.
Passkeys, FIDO2 And Authenticators
This line replaces passwords for both customers and staff. Passkeys and FIDO2 authentication use public key cryptography, and OneSpan offers the full range of factors around them:
- FIDO hardware authenticators and classic hardware authenticators.
- Digipass FIDO Touch, which works with any service that supports FIDO2.
- Digipass Mobile Authenticator.
- Authentication servers for organisations running their own back end.
Mobile Application Security
Mobile application security protects banking and other apps on devices the organisation does not control. It covers app shielding and in-app protection, mobile threat insights, response and intelligence, and device and malware risk detection. The acquisition of Build38 extended App Shielding with continuous in-app protection and cloud-based threat intelligence.
OneSpan Sign
OneSpan Sign is an eSignature platform built for customer agreements, with identity checks on every signer.
- Mobile, remote and in-person signing.
- Signer identity checks with biometric face comparison and video liveness detection.
- Signer authentication by FIDO passkeys, SMS OTP or digital certificates.
- Smart Forms, white-labelling and NIGO document validation.
How It Works
With FIDO authentication, private keys and biometric templates never leave the user’s device and are never stored on a server, which helps resist phishing, password theft and replay attacks.
| Component | What it does |
|---|---|
| Authenticators | Possession factors, such as an authenticator app or hardware token, or biometrics take the place of a static password. |
| Mobile protection | Build38 adds SDK-based runtime application self-protection inside the app, backed by cloud services and AI. |
| OneSpan Sign service | Login instances run in the US, Canada, Australia and Europe, and eSignature can be embedded into portals and business applications through APIs and SDKs. |
Identities And Systems Covered
| Customers | Passwordless and multi-factor authentication and transaction signing. |
|---|---|
| Workforce | Passwordless authentication with FIDO and Digipass authenticators. |
| Devices and apps | Mobile applications and devices, with device and malware risk detection. |
| Signers | Identity verification of the people signing agreements. |
Integrations
| Area | Integrations |
|---|---|
| CRM | Salesforce, Microsoft Dynamics 365 |
| HR | Workday, Greenhouse |
| Productivity and storage | Google Workspace, Microsoft 365 |
Company Background
| Headquarters | Boston, United States. |
|---|---|
| Listing | Nasdaq, ticker OSPN. |
| Leadership | Victor Limongelli (CEO), Jorge Martell (CFO) and Ashish Jain (CTO). |
| Customers | Thousands of customers, including a reported more than 60% of the world’s 100 largest banks. |
| Acquisitions | Build38, completed in March 2026. |
| Recognition | Included in the KuppingerCole Leadership Compass and in the SPARK Matrix for In-App Protection (2026). |
Note: This overview is compiled from OneSpan’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.