Amended and Restated PSU Agreement dated February 26, 2023 between the Registrant and Matthew Moynahan

WHEREAS, the Company maintains the OneSpan Inc. 2019 Omnibus Incentive Plan (as amended, the “Plan”) for the benefit of its employees, directors, consultants, and other individuals who provide services to the Company;

WHEREAS, to further align the Grantee’s personal financial interests with those of the Company’s stockholders, the Company awarded the Grantee restricted stock units (the “2022 PSU Award”) with respect to shares of Common Stock (as defined below), subject to the restrictions, terms and conditions contained in the Plan and the Prior Agreement; and

WHEREAS, the Company and the Grantee desire to amend and restate the terms and conditions of the 2022 PSU Award by entering into this Agreement.

NOW, THEREFORE, in consideration of these premises and the agreements set forth herein, the parties, intending to be legally bound hereby, agree as follows:

1.Grant of Restricted Stock Units. Pursuant to Article IV of the Plan, the Company granted to the Grantee, effective as of the Effective Date, an award of performance-based restricted stock units (the “Restricted Stock Units”) with respect to the number of shares of the Company’s common stock, par value of $0.001 per share (the “Common Stock”), as set forth on Exhibit A hereto. The terms of the Plan are hereby incorporated into this Agreement by this reference, as though fully set forth herein. Capitalized terms used but not defined in this Agreement have the meanings set forth in the Plan.

2.Vesting of Restricted Stock Units. The Restricted Stock Units will become vested in accordance with this Section 2.

(a)Performance Period. The number of Restricted Stock Units that are earned (the “Earned RSUs”) shall be determined by the Compensation Committee of the Company’s Board of Directors (the “Committee”) based upon the Company’s achievement relative to Performance Targets established by the Committee for the performance period that commenced on January 1, 2022 and ended on December 31, 2022 (the “Performance Period”). The Grantee shall vest in one-third of any Earned RSUs on each of December 31, 2022, December 31, 2023 and December 31, 2024 (each, a “Vesting Date”), subject in each case to the Grantee’s continued service to the Company through the applicable Vesting Date. The Performance Targets for the Performance Period are set forth on Exhibit A attached hereto. For the avoidance of doubt, the RSUs shall be automatically forfeited in their entirety if the Grantee does not remain in the service of the Company through the applicable Vesting Date, except as otherwise provided for herein.

(b)If, on or within 18 months following a Change in Control and prior to any Vesting Date, either (x) the Grantee’s employment is terminated by the Company other than for Cause or (y) the Grantee resigns from employment with the Company for Good Reason, and subject

to the Grantee executing the Company’s standard release of claims which becomes effective in accordance with its terms within 60 days following such termination of employment, then the number of then-outstanding Earned RSUs shall become vested immediately prior to (and contingent upon) such termination of employment.

(c)If the Grantee’s service with the Company ceases by reason of the Grantee’s death or termination by the Company due to Disability prior to the any Vesting Date, 100% of any then-outstanding Earned RSUs shall become vested immediately prior to (and contingent on) the occurrence of such death or termination by the Company due to Disability. Notwithstanding the foregoing, a Disability shall not qualify if it is the result of (A) a willfully self-inflicted injury or willfully self-induced sickness; or (B) an injury or disease contracted, suffered, or incurred while participating in a criminal offense. The determination of Disability for purposes of this Agreement shall not be construed to be an admission of disability for any other purpose.

(d)Except as provided in this Agreement or in any other agreement between the Grantee and the Company or any of its Subsidiaries that is in effect as of the Effective Date, upon cessation of the Grantee’s service with the Company for any reason or for no reason (and whether such cessation is initiated by the Company, the Grantee or otherwise): (i) any Restricted Stock Units that have not, prior to such cessation, become vested shall immediately and automatically, without any action on the part of the Company or the Grantee, be forfeited, and (ii) the Grantee shall have no further rights with respect to those Restricted Stock Units (or the underlying shares of Common Stock).

(e)For purposes of this Agreement, service with the Company shall be deemed to include service with any Subsidiary of the Company for only so long as such entity remains a Subsidiary.

(f)For purposes of this Agreement, “Good Reason” has the meaning given to it in the employment agreement in effect as of the Effective Date between the Grantee and Company, including, for avoidance of doubt, the written notice, cure period, and resignation timing requirements applicable to a termination due to Good Reason under the employment agreement; provided, however, in the event the Grantee is not subject to an employment agreement as of the Effective Date or if an employment agreement in effect as of the Effective Date does not define “Good Reason” or a similar term, then “Good Reason” means, without the Grantee’s consent:

(g)For purposes of this Agreement, “Cause” and “Wrongful Act” mean:

(i)Grantee materially breaches Grantee’s obligations under any Company Agreement;

(ii)Grantee materially breaches Grantee’s obligations under the Company’s Code of Ethics and Conduct (or any successor thereto) or an established policy of the Company;

(iii)Grantee engages in conduct prohibited by law (other than minor violations), commits an act of dishonesty, fraud, or serious or willful misconduct in connection with Grantee’s job duties, or engages in unethical or immoral conduct that, in the reasonable judgment of the Committee, could injure the integrity, character or reputation of Company;

(iv)Grantee fails or refuses to perform, or habitually neglects, Grantee’s duties and responsibilities under any Company Agreement (other than on account of Disability), and continues such failure, refusal or neglect after having been given written notice by the Company that specifies what duties Grantee failed to perform and an opportunity to cure of 30 days;

(v)Subject to Section 10, use or disclosure by Grantee of confidential information or trade secrets other than in the furtherance of the Company’s (or its Subsidiaries’) business interests, or other violation of a fiduciary duty to the Company (including, without limitation, entering into any transaction or contractual relationship causing diversion of business opportunity from the Company or any of its Subsidiaries (other than with the prior written consent of the Board));

(vi)Grantee fails to reasonably cooperate with any audit or investigation involving the Company or its business practices after having been given written notice by the Company that specifies Grantee’s failure to cooperate and an opportunity to cure of ten days; or

(vii)Any other act or omission on the part of the Grantee that would constitute just cause for termination under applicable law.

(h)For purposes of this Agreement, “Disability” means a mental or physical impairment of Grantee that is expected to result in death or that has lasted or is expected to last for a continuous period of 12 months or more and that causes Grantee to be unable to perform his or her material duties for the Company and to be engaged in any substantial gainful activity, in each case as determined by the Company’s chief human resources officer or other person performing that function or, in the case of directors and executive officers, the Committee,

whose determination shall be conclusive and binding. The determination of Disability for purposes of this Agreement shall not be construed to be an admission of disability for any other purpose.

3.Delivery of Common Stock Underlying Restricted Stock Units. Within 60 days after the vesting of any Restricted Stock Units (or such later date as may be required to comply with Section 409A of the Internal Revenue Code of 1986, as amended (the “Code”)), the Company will issue or deliver, subject to the conditions of this Agreement, the shares of Common Stock in respect of the then-vested Earned RSUs to Grantee. Such issuance or delivery shall be evidenced by the appropriate entry on the books of the Company or of a duly authorized transfer agent of the Company. The Company shall pay all original issue or transfer taxes and all fees and expenses incident to such issuance or delivery, except as otherwise provided herein. Prior to the issuance to Grantee of the shares of Common Stock subject to the Restricted Stock Units, Grantee shall have no direct or secured claim in any specific assets of the Company or in such shares, and will have the status of a general unsecured creditor of the Company.

4.Adjustments. In the event of any equity restructuring (within the meaning of Financial Accounting Standards Board Accounting Standards Codification Topic 718, Compensation— Stock Compensation) that causes the per share value of shares of Common Stock to change, such as a stock dividend, stock split, spinoff, rights offering or recapitalization through an extraordinary dividend, the terms of this Agreement, including the number and class of securities subject hereto, shall be appropriately adjusted by the Committee. In the event of any other change in corporate capitalization, including a merger, consolidation, reorganization, or partial or complete liquidation of the Company, such equitable adjustments described in the foregoing sentence may be made as determined to be appropriate and equitable by the Committee to prevent dilution or enlargement of rights of the Grantee. The decision of the Committee regarding any such adjustment shall be final, binding and conclusive.

5.Rights as a Stockholder. The Grantee shall have no rights as a stockholder of the Company with respect to the shares of Common Stock subject to the Restricted Stock Units (including the right to vote) until the underlying Common Stock becomes vested pursuant to Section 2 and the Grantee becomes a stockholder of record with respect to such shares, except that the Grantee shall be entitled to receive dividend equivalents related to the Restricted Stock Units equal in amount to the dividends declared on the underlying shares of Common Stock that become vested pursuant to this Agreement. Dividend equivalent amounts shall accrue and be paid or distributed in cash at the same time the underlying shares of Common Stock are distributed to Grantee in accordance with Section 3.

6.Tax Consequences.

(a)The Grantee acknowledges that the Company has not advised the Grantee regarding the Grantee’s income tax liability in connection with the grant or vesting of the Restricted Stock Units, the dividend equivalents contemplated hereunder or the delivery of the Common Stock underlying the Restricted Stock Units. The Grantee has reviewed with the Grantee’s own tax advisors the federal, state, local and foreign tax consequences of this investment and the transactions contemplated by this Agreement. The Grantee is relying solely on such advisors and not on any statements or representations of the Company or any of its agents. The Grantee understands that the Grantee (and not the Company) will be responsible for the Grantee’s own tax liability that may arise as a result of the transactions contemplated by this Agreement.

(b)As a condition precedent to the delivery of the shares of Common Stock upon the vesting of the Restricted Stock Units, the Grantee acknowledges and agrees that the

Company may be required, under all applicable federal, state, local or other laws or regulations, to withhold and pay over as income or other withholding taxes (the “Required Tax Payments”) with respect to such shares of Common Stock. If the Grantee has not been given permission by the Company to advance the Required Tax Payments in cash, then the Company may, in its discretion, deduct any Required Tax Payments from any amount then or thereafter payable by the Company to the Grantee.

(c)The obligation to advance the Required Tax Payments by the Grantee shall by default take place by the Company withholding whole shares of Common Stock which would otherwise be delivered to the Grantee having an aggregate Fair Market Value, determined as of the applicable date, equal to the Required Tax Payments. Shares of Common Stock to be withheld may not have a Fair Market Value in excess of the minimum amount of the Required Tax Payments. Any fraction of a share of Common Stock which would be required to satisfy any such obligation shall be disregarded and the remaining amount due shall be paid in cash by the Grantee. No certificate representing a share of Common Stock shall be delivered until the Required Tax Payments have been satisfied in full.

7.Nontransferability of Award. The Grantee may not sell, pledge, assign, encumber, hypothecate, gift, transfer, bequeath, devise, donate or otherwise dispose of, in any way or manner whatsoever, whether voluntary or involuntary, any legal or beneficial interest in any of the Restricted Stock Units until the Restricted Stock Units become vested and settled in accordance with Section 2; provided, however, that the restrictions of this Section 7 shall not apply to any transfer (i) pursuant to applicable laws of descent and distribution or (ii) among Grantee’s family group; provided that such restrictions will continue to be applicable to the Restricted Stock Units after any such transfer and the transferees of such Restricted Stock Units have agreed in writing to be bound by the provisions of this Agreement. Grantee’s "family group" means Grantee’s spouse and descendants (whether natural or adopted) and any trust solely for the benefit of Grantee and/or Grantee’s spouse and/or descendants during Grantee’s lifetime.

8.Securities Laws. The Company may from time to time impose any conditions on the Restricted Stock Units or any underlying shares of Common Stock as it deems necessary or advisable to ensure that this Agreement and the Plan satisfies the conditions of Rule 16b-3 adopted under the Securities and Exchange Act of 1934, as amended, and otherwise complies with applicable rules and laws.

9.Recoupment of Award. Notwithstanding anything in this Agreement to the contrary, if the Company determines that the Grantee’s Wrongful Act was a significant contributing factor to the Company or a Subsidiary having to restate all or a portion of its financial statements, all outstanding Restricted Stock Units will immediately and automatically be forfeited and the Grantee shall promptly repay to the Company any shares of Common Stock, cash or other property paid in respect of any Restricted Stock Units during the period beginning on the date the financial statements requiring restatement were originally released to the public or submitted to the Securities and Exchange Commission (whichever is earlier) and ending on the date the restated financial statements are filed with the Securities and Exchange Commission.

10.Protected Rights. Grantee understands that nothing contained in this Agreement limits Grantee’s ability to report possible violations of law or regulation to, or file a charge or complaint with, the Securities and Exchange Commission, the Equal Employment Opportunity Commission, the National Labor Relations Board, the Occupational Safety and Health Administration, the Department of Justice, the Congress, any Inspector General, or any other federal, state or local governmental agency or commission (“Government Agencies”). Grantee further understands that this Agreement does not limit Grantee’s ability to communicate with any Government Agencies or otherwise participate in any investigation or proceeding that may be conducted by any Government

Agency, including providing documents or other information, without notice to the Company. Nothing in this Agreement shall limit Grantee’s ability under applicable United States federal law to (i) disclose in confidence trade secrets to federal, state, and local government officials, or to an attorney, for the sole purpose of reporting or investigating a suspected violation of law or (ii) disclose trade secrets in a document filed in a lawsuit or other proceeding, but only if the filing is made under seal and protected from public disclosure.

11.Compliance with Section 409A. The Restricted Stock Units are intended to be exempt from or comply with Section 409A, and shall be interpreted and construed accordingly, and each payment hereunder shall be considered a separate payment. To the extent this Agreement provides for the Restricted Stock Units to become vested and be settled upon the Grantee’s termination of employment, the applicable shares of Common Stock shall be transferred to the Grantee or his or her beneficiary upon the Grantee’s “separation from service,” within the meaning of Section 409A. Notwithstanding any other provision in this Agreement, to the extent any payments hereunder constitute nonqualified deferred compensation, within the meaning of Section 409A, then (a) each such payment which is conditioned upon Grantee’s execution of a release of claims and which is to be paid or provided during a designated period that begins in one taxable year and ends in a second taxable year, shall be paid or provided in the later of the two taxable years, and (b) if Grantee is a specified employee (within the meaning of Section 409A) as of the date of Grantee’s separation from service, each such payment that is payable upon Grantee’s separation from service and would have been paid prior to the six-month anniversary of Grantee’s separation from service, shall be delayed until the earlier to occur of (i) the first day of the seventh month following the Grantee’s separation from service or (ii) the date of Grantee’s death.

(a)This Agreement and the Plan together represent the entire agreement between the parties with respect to the granting of the Restricted Stock Units and may only be modified or amended in a manner materially adverse to the Grantee in writing signed by both parties.

(b)Any notice, demand or request required or permitted to be given by either the Company or the Grantee pursuant to the terms of this Agreement must be in writing and will be deemed given (i) on the date and at the time delivered via personal, courier or recognized overnight delivery service, (ii) if sent via telecopier on the date and at the time telecopied with confirmation of delivery, (iii) if sent via email or other electronic delivery and receipt is confirmed, on the date and at the time received, or (iv) if mailed, on the date five days after the date of the mailing (which must be by registered or certified mail). Delivery of a notice by telecopy (with confirmation) or by email or other electronic delivery (with confirmation or receipt) will be permitted and will be considered delivery of a notice notwithstanding that it is not an original that is received. Any notice to Grantee under this Agreement will be made to Grantee at the address (or telecopy number, email or other electronic address, as the case may be) listed in the Company’s personnel files. If directed to the Company, any such notice, demand or request will be sent to the Corporate Secretary at the Company’s principal executive office, or such other address or person as the Company may hereafter specify in writing.

(c)The Company may condition delivery of certificates for shares of Common Stock subject to the Restricted Stock Units (or, if the shares are not certificated, the entry in the stock record books of the Company of the transfer to the Grantee of the shares of Common Stock) upon the prior receipt from Grantee of any undertakings which it may determine are required to assure that the certificates are being issued in compliance with federal and state securities laws.

(d)The Grantee has received a copy of the Plan, has read the Plan and is familiar with its terms, and hereby accepts the Restricted Stock Units subject to all of the terms and provisions of the Plan, as amended from time to time. Pursuant to the Plan, the Board and the Committee are authorized to interpret the Plan and to adopt rules and regulations not inconsistent with the Plan as they deem appropriate. The Grantee hereby agrees to accept as binding, conclusive and final all decisions or interpretations of the Board or the Committee upon any questions arising under the Plan.

(e)Subject to Section 7, neither this Agreement nor any rights or interest hereunder will be assignable by the Grantee, the Grantee’s beneficiaries or legal representatives, and any purported assignment in violation hereof will be null and void.

(f)Either party’s failure to enforce any provision or provisions of this Agreement will not in any way be construed as a waiver of any such provision or provisions, nor prevent that party thereafter from enforcing each and every other provision of this Agreement. The rights granted both parties herein are cumulative and will not constitute a waiver of either party’s right to assert all other legal remedies available to it under the circumstances.

(g)The grant of Restricted Stock Units hereunder does not confer upon the Grantee any right to continue in service with the Company.

(h)This Agreement shall be governed by, and enforced in accordance with, the laws of the State of Delaware, without regard to the application of the principles of conflicts or choice of laws.

(i)This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, and all of which together shall be deemed to be one and the same instrument. In the event that any signature to this Agreement is delivered by facsimile transmission or by e-mail delivery of a “.pdf” format data file or picture format data file, such signature shall create a valid and binding obligation of the party executing (or on whose behalf such signature is executed) with the same force and effect as if such electronic facsimile signature page were an original thereof. The parties confirm that it is their wish that this Agreement may be executed by means of electronic signature.

(j)The parties hereto have expressly required that this Agreement and any other contract or document relating thereto be drafted in the English language. All other documents, notices and legal proceedings entered into, given or instituted pursuant to the Award, shall be drawn up in English. If the Grantee has received the Agreement or any other documents related to the Award translated into a language other than English, and if the meaning of the translated version is different than the English version, the English version shall control.

The number of Earned RSUs for the Performance Period, if any, will be dependent on the Company’s achievement of the Performance Targets as defined below:

The “Performance Target” for the RSUs is comprised of the following metrics and weightings:

Metrics follow the Company’s published financial statements and earnings disclosures. Inclusion of revenue from acquisitions shall be determined by the Company in accordance with U.S. Generally Accepted Accounting Principles and approved by the Committee.

The Performance Target metrics shall be subject to a minimum threshold, a maximum achievement and linear interpolation between various performance levels as follows: