AI Terminal

MODULE: AI_ANALYST
Interactive Q&A, Risk Assessment, Summarization
MODULE: DATA_EXTRACT
Excel Export, XBRL Parsing, Table Digitization
MODULE: PEER_COMP
Sector Benchmarking, Sentiment Analysis
SYSTEM ACCESS LOCKED
Authenticate / Register Log In

F-Secure Oyj

Annual Report Mar 15, 2017

3268_10-k_2017-03-15_66432de2-c9e6-4571-a768-3ca0cfeeda6e.pdf

Annual Report

Open in Viewer

Opens in native device viewer

For three decades, F-Secure has driven innovation in cyber security. We defend tens of thousands of companies and millions of people around the world through our network of over 200 telecommunications operators and thousands of IT service and retail partners. F-Secure's security experts have participated in more European cyber crime scene investigations than any other company in the industry.

CONTENTS

01 Key figures 2016 .
01
F-Secure in brief
02
CEO letter .
04
02 Board of Directors' Report .
06
03 FINANCIAL STATEMENTS
F-SECURE CONSOLIDATED .
13
Statement of comprehensive income .
13
Statement of financial position .
14
Statement of cash flows .
15
Statement of changes in equity .
16
Notes to the Financial Statements .
17
Calculation of key ratios .
36
F-SECURE CORPORATION .
37
Income statement .
37
Balance sheet .
38
Cash flow statement .
39
Notes to the parent company
Financial Statements .
40
04 Auditor's report .
49
F-Secure's Corporate Governance Statement
53
Board of Directors .
58
Leadership team .
61
05 Information for shareholders .
65

KEY FIGURES 2016

Revenue MEUR 158.3 Operating profit MEUR 19.2 Earnings per share EUR 0.10 Dividend per share EUR 0.06 Extra dividend per share EUR 0.06 Cash flow from operations MEUR 21.9 Equity ratio 67% Personnel, end of period 1,026 Revenue split by region 2016, %

F-Secure acquired nSense in June 2015 and has consolidated it into the F-Secure Group accounts since Q2 2015. F-Secure's personal cloud storage business (younited) was sold to Synchronoss Technologies in February 2015 and is reported as discontinued operations. Income statement figures on this page concern only continuing operations.

Revenue and operating profit by quarter 2016, MEUR

Revenue split by business 2016, MEUR

AT YOUR SIDE WATCHING YOUR BACK

A FRONTRUNNER IN CYBER SECURITY

For three decades, F-Secure has driven innovation in cyber security. We defend tens of thousands of companies and millions of people around the world through our network of over 200 telecommunications operators and thousands of IT service and retail partners. F-Secure's security experts have participated in more European cyber crime scene investigations than any other company in the industry.

Digitalization continues to increase cyber threats

Due to the explosive growth in the number of internet-connected devices both in business and in our private lives, society expects services and data to be accessible everywhere and on any device. Online business services are becoming the de-facto standard, but at the same time online crime has become ever present and globally connected.

As cyber threats grow in number, they also evolve in scope and sophistication. Protecting people and organizations from new types of attacks, as well as securing new areas of technology and business requires a move away from single solutions towards a broader cyber security portfolio.

Comprehensive offering for consumers and businesses

F-Secure's sophisticated technology combines the power of machine learning with the human expertise of its world-renowned security labs for a singular approach called Live Security. It covers all aspects of cyber security: prediction, prevention, detection and response.

Our security advisory services help businesses analyze and predict threats. Our vulnerability assessment and management solution (F-Secure Radar) is an invaluable tool in spotting weaknesses and helping corporate customers fulfil their compliance needs. Our detection solution (Rapid Detection Service) enables companies

In February 2017, F-Secure won the Best Protection award from the AV-TEST Institute for superior protection technology throughout 2016. The win makes F-Secure a five-time winner of the award, and it's the only company in the history of AV-TEST to achieve such a distinction.

Our approach to cyber security

Cyber security moves too fast for silver bullets. It takes a combination of the latest human expertise and continuously improving technology to comprehensively predict, prevent, detect and respond to breaches.

Understand your attack surface

Understanding your risk starts by mapping your attack surface – across systems, infrastructure and even third parties – and regularly scanning it for vulnerabilities.

React to incidents and breaches

It takes IT forensic expertise to understand how the attackers got in and which systems and data were compromised. It also takes experience to know exactly how to react to the attack: how to escalate the issue, isolate corrupted machines, manage communications and remediate the damage.

Minimize your attack surface

This is where tried and tested endpoint protection tools and best practices come in – system hardening, firewall configurations, reputation analysis, access controls, antivirus scanning and automated patch management. With modern endpoint protection tools, you get smarter prevention capabilities including behavioral analytics, which are capable of blocking 0-day malware.

Recognize incidents and breaches

Using technology and human expertise to monitor your attack surface and heuristically detect, block and isolate suspicious behavior, it becomes possible to reduce harmful dwell time – the time it takes before a breach is detected.

to realize they've been breached in minutes instead of months. And for customers who have already been breached, F-Secure offers forensics and incident response services to enable swift recovery.

F-Secure's security solutions for endpoints (Protection Services for Business, Business Suite) feature multiple layers of protection technology to efficiently and effectively block zero day and advanced attacks. Our solutions also enable an additional layer of security for cloud platforms (e.g. F-Secure Cloud Protection for Salesforce, due in the first half of 2017).

For consumers, we offer total security and privacy with our multi-device solutions (F-Secure SAFE, F-Secure Freedome & F-Secure Key). F-Secure helps people secure their devices and connections, protect their online life and enjoy it to the fullest without the fear of unwanted tracking, profiling or information theft. With the launch of F-Secure SENSE, due in the first half of 2017, F-Secure will provide people with a single source of protection for all of the devices in their homes.

Our strategy is driven by our aspiration to grow

The key driver behind F-Secure's strategy is the Company's aspiration for growth. Encouraged by the results from our growth investments in corporate security in 2016, we have decided to make a meaningful additional investment in both product development and go-to-market in 2017.

We will continue ramping up our investments in the fastest growing markets within corporate security. These include new security products for

Our business model

cloud services, managed endpoint security services and managed detection and response services sold through the reseller channel as well as the cyber security services business. Investments in consumer security are continued at a level that targets profitable growth. To enable execution of the growth strategy, F-Secure is actively recruiting highly skilled security professionals, rising cyber security talents and capable sales personnel. The Company also aims at growing through M&A.

The cyber security market continues to offer good structural growth, and we believe the market environment and our proven competitiveness will continue to support our anticipated growth.

CEO LETTER

Samu Konttinen

WE ARE WINNING MARKET SHARE

In 2016, F-Secure continued to take advantage of the opportunities offered by the rapidly evolving cyber security market. We successfully expanded our sales channels, and continued to increase the number of active resellers while leveraging the full breadth and power of our comprehensive portfolio. Encouraged by our strong track-record across the board last year, we will now increase our investments in growth. We see tremendous potential in the industry, and feel confident in our ability to tap into it.

Last year breaches once again impacted everything from personal finances to mega-corporations – even large-scale political elections. One obvious trend was the rapid expansion of ransomware, which continues to pose a menace to consumers and companies alike. Likewise, society continues to witness repeated failures to protect data. As the question is no longer whether your organization will be hit but when, organizations are increasingly shifting their focus from prevention to detection.

While it's impossible to block all attacks, it's getting increasingly costly for companies not to notice them even after the fact. The upcoming new EU regulation – the General Data Protection Regulation – threatens companies with massive fines, and stipulates that in the event of a data breach, data controllers must notify the supervisory authority within 72 hours after having become aware of it. With average response time to breaches currently ranging from months to even years, it is certain that defenders are not yet up to the task.

We continue to be a frontrunner in innovation

F-Secure continues to develop solutions to fight the threats our customers are facing, and we remain one of the key innovators in the industry, as has been the case for nearly three decades. Going forward, we'll continue to utilize the ample opportunities provided by artificial intelligence, machine learning and big data to further improve our prevention and detection capabilities. Another obvious mega trend in IT is cloudification. I'm happy

that we are already partnering with Salesforce, one of the major players in this field.

F-Secure Labs, our security research arm, is one of the most recognized IT security units worldwide. Their expertise combined with the insights of our cyber security consultants, enables us to have superior understanding of the threat landscape. Our experts – many of whom are best in the world in their own niche – help large companies fight the most advanced threats, witnessing attacks no one has ever seen before. What we see and learn from these cases allows us to create new security innovations and feed new features into our technology platform. It is precisely this combination of best-in-class products and cyber security services which gives F-Secure a unique competitive advantage.

Our technology leadership was highlighted again in February this year, when we won the Best Protection Award from AV-TEST, one of the leading independent testing institutes in our field. We won this award for the fifth time, a feat no other security company has ever achieved. We are multiple times smaller than some of our rivals, but in terms of security competence, we are second to none.

Our strong economic engine works

Another strong driver for success is our channel commitment. We sell our corporate products through thousands of IT reseller and service partners. Over the past year, we increased the number of active corporate reseller partners by 13%. We have designed our operations with a clear focus on the channel, with our solutions not only optimized for best protection, but also for ease of doing business for our partners, All this helps explain why, within the corporate endpoint security segment, we managed to grow several times faster than the market. Going forward, the expanding channel will continue to support our growth. And as we start to fully leverage the full power of our corporate portfolio – including our Rapid Detection Service and our vulnerability management solution F-Secure Radar – through our channel, there will be great potential for upselling and cross-selling to our end point protection customer base.

In consumer security, our network of over 200 operator partners continues to be a great asset. In this ecosystem we are unmatched in our industry. Despite our conservative view of the aggregate growth potential of the market, we see several opportunities for F-Secure in this segment as well. Our consumer security portfolio offers a very broad set of solutions, ranging from end point protection to privacy and password management. We will also soon be launching F-Secure Sense, our solution for all connected home devices, and F-Secure's first-ever consumer hardware product. The Internet of Things is sure to reshape the way consumers use their devices, and we are one of the first companies coming out with a viable solution in this emerging

security market. While we are moderate in our forecasts for this business, this clearly presents another opportunity for us.

As a good example of the power of our portfolio, last year in our direct consumer sales, we began bundling our privacy product Freedome together with our flagship security product F-Secure SAFE, offering consumers total security and privacy. Our initial experiences show great traction for this new approach and increasing average annual revenue per customer. We now look forward to rolling out a similar approach with our operator partners.

We are tapping into emerging opportunities

Looking back upon the year, I'm extremely pleased to see the both our technological as well as economic engine working so well. We successfully recruited more than 100 people in a highly competitive labor market, highlighting our strong brand within the industry – and we'll continue to recruit the best talent. Our revenue growth has accelerated, with every business line having delivered according to plan in 2016. The demand for cyber security services particularly exceeded even our own predictions. Behind our success is the very scalable, very repeatable, high-margin product business – the industrial logic you would expect from a software company.

The key driver behind the strategy is F-Secure's aspiration for growth. We are certain that the cyber security market will continue to offer attractive business opportunities, especially in corporate security. Encouraged by the traction we are already seeing for our solutions, we have decided to boost our investments in growth further. We will particularly focus additional investments on the go-to-market of our new managed detection service (RDS) and vulnerability management (F-Secure Radar) solutions. We will also increase our investments to enhance our portfolio competitiveness, and to improve cross selling to existing customers.

We are seeing great potential in leveraging our full portfolio and reaching out to larger customers. In this situation, we feel confident that this is not the time to focus on short term profitability. Instead, we strongly believe it is now in the best interest of the Company to optimize for growth and scale. That said, we are confident that this will yield considerably higher profits towards the end of our current 2017–2020 strategy period.

As we approach the 30th anniversary of our Company next year, it makes me very proud to be a part of this great team. F-Secure has a stronger portfolio than ever before. We are expanding our sales channel and facing very strong demand in the market. Together, we are looking forward to another exciting year.

Samu Konttinen

F-SECURE 2016

LET US IN KEEP THEM OUT

BOARD OF DIRECTORS' REPORT 2016

For F-Secure 2016 was a solid year of good growth in corporate security and stable performance in consumer security. The increasing focus on corporate security was highlighted by successful recruitment of cyber security consultants, substantial increase in the number of sales personnel, and significant investments in product development to broaden the corporate security product offering. In consumer security the direct consumer business continued its growth, while revenue from the operator channel remained at the previous year's level with improved confidence in its stability going forward.

With the cyber security market providing attractive business opportunities, F-Secure continued to prioritize growth over short term profitability. Emphasis was on increasing the reach in the mid-market within and outside of Europe. As a result, the number of active corporate resellers increased by 13% compared to the previous year, and extending the reseller base to larger managed service partners to cover the new solutions F-Secure Radar and Rapid Detection Service was also commenced. The new offerings complement traditional endpoint protection and are gaining traction in the market place. Widely acknowledged as leading experts in the field, F-Secure's cyber security consultants are facing high demand and concurrently support the product sales.

Financially, F-Secure's year was concluded according to plan with 7 per cent annual revenue growth, solid cash flow and operating profit at 12% of revenue.

Financial performance and key figures

In 2016, total revenue grew by 7% year-on-year to EUR 158.3 million (147.6m), driven by corporate security. Organic revenue growth was 5%.

Corporate security

Revenue from corporate security increased by 20% year-onyear to EUR 62.5 million (52.1m), and represented 39% (35%) of F-Secure's total revenue.

The growth during the year stemmed both from increasing product sales through the reseller channel and from very strong performance in cyber security services. The revenue increase reflected significant investments in product development as well as strong recruiting in the sales organization during the past two years. The acquisition of nSense affected the reported figures from Q2/2015 onwards.

Consumer security

Revenue from consumer security remained at the previous year's level and was 95.8 million (95.5m), representing 61% (65%) of F-Secure's total revenue.

The direct consumer sales continued to grow, while sales from the operator channel were largely flat. After the relatively weak first quarter the sales from the operator channel increased quarter-to-quarter throughout 2016, and the outlook for the operator business remains stable.

Deferred revenue

Deferred revenue increased by 13% year-on-year to EUR 54.3 million (48.1m), driven primarily by the increased sale of corporate security products and services with contracts extending to one year or beyond.

Costs

Total fixed costs increased by 9% year-on-year to EUR 137.6 million (126.0m). The increase was driven by costs incurred as a result of significant recruitment in corporate security, as well as long-term incentive plan accruals reflecting the increase in F-Secure's share price during July–December.

Depreciation and amortization (capitalized R&D, software, hardware) decreased to EUR 5.3 million (5.9 m).

Profitability

EBIT was EUR 19.2 million and 12% of revenue (20.0m, 14%), including the nSense acquisition-related costs (earn-out and deferred payment) for the period, which amounted to EUR 3.4 million.

Tax

F-Secure made a EUR 4.0 million repayment, including late payment interest, of foreign tax credits on withholding taxes from 2009–2011 based on debit decisions by the Finnish tax authority. F-Secure has appealed the debit decisions with the tax administration's Board of Adjustment.

The effective tax rate for the group in 2016 was 24% (2015: 42%) and 28% excluding adjustments to previous years' taxes (2015: 31%). Uncreditable withholding taxes increase F-Secure's effective tax rate.

Cash flow

Cash flow from operations amounted to EUR 21.9 million (28.9m). Substantial factors impacting the cash flow negatively included a residual tax payment of EUR 6.1 million resulting from the divestment of F-Secure's personal cloud storage business to Synchronoss in 2015 and the repayment of foreign tax credits on withholding taxes from 2009–2011 based on debit decisions by the Finnish tax authority. Cash flow was positively impacted by the release of the EUR 4.5 million escrow account relating to the above mentioned divestment.

Financing and Capital Structure

On 31 December 2016 the combined market value of cash and cash equivalents and short term investments in interest rate funds classified as available-for-sale assets was EUR 92.7 million (31 December 2015: 94.3m).

Cash and available-for-sale financial assets were impacted by paid dividends, amounting in total to EUR 18.7 million. In addition to a regular dividend of EUR 0.06 per share, an extra dividend of EUR 0.06 per share was paid following the sale of the personal cloud storage business to Synchronoss Technologies Inc for USD 60 million in February 2015.

In January–December the Company's capital expenditure amounted to EUR 6.9 million (14.6m). The capitalized development expenses were EUR 3.2 million (2.3m).

F-Secure's financial position remained solid. The Company's equity ratio on 31 December was 67% (64%) and its gearing ratio was 122% negative (122% negative).

F-Secure business in 2016

Corporate security

F-Secure provides a broad offering of cyber security products and managed services through a large network of resellers and service partners. Products include both online (Protection Service for Business) and on-premise (Business Suite) endpoint protection solutions, as well as solutions targeted at detecting and responding to advanced attacks (Rapid Detection Service, RDS) and vulnerability management (F-Secure Radar). RDS is typically sold as a managed service. The majority of corporate security revenue comes from the sale of endpoint protection solutions through the reseller channel.

In 2016, F-Secure's corporate security revenue continued to grow faster than the market in the Company's chosen focus regions in Europe and Japan, with revenue from endpoint protection showing double-digit growth throughout the year. Renewals and upselling to existing customer base developed favorably, and new customer acquisition continued to show strong growth. The number of active resellers increased by 13% to over 4,000 compared to previous year. To enable the growth, the size of the sales organization was increased by nearly a third during the year.

Regionally most of the absolute sales growth in the reseller channel came from focus markets in Europe, but already nearly a third of the growth came from North America and Asia-Pasific. In Asia, absolute sales grew most in Japan, but India continued to show particularly good progress in new sales, albeit still from modest absolute levels. In Europe, growth was most strongest in Finland, Germany, Sweden, United Kingdom and France.

To complement the endpoint security offering, F-Secure continued to invest in product development to address the rapidly growing detection and response and vulnerability

F-SECURE 2016 08

management markets. Within these segments, respectively, RDS and F-Secure Radar were commercially launched in the spring.

The sales of RDS and F-Secure Radar have subsequently developed as expected, and strong demand for both is already seen although the solutions are still in the early phase of their lifecycle. The cross-selling potential of the expanded corporate security offering has also been confirmed, as most new RDS contracts during the latter half of 2016 also included F-Secure Radar. To accelerate the growth, F-Secure is selling these new solutions through current reseller partners and actively increasing the network of new resellers.

Reflecting the increasing cloudification of IT systems, F-Secure is developing new capabilities to secure cloud platforms. In November, the Company announced that it will launch F-Secure Cloud Protection for Salesforce during the first half of 2017. The solution offers an additional layer of security for Salesforce customers by automatically analyzing any files or links uploaded by users and then blocking malicious content.

Cyber security consultancy sales showed very strong double digit growth. The demand for security services and consulting remained very strong across multiple industry verticals. During the year, F-Secure continued to win significant customers among large enterprises, and successfully attracted cyber security experts in a very competitive employment market. The Company also regionally expanded its operations in Norway and Sweden, as well as diversified into new verticals such as aviation.

Consumer security

The majority of revenue comes from the sales of endpoint protection products (mainly F-Secure SAFE) through the operator channel, with F-Secure Freedome (VPN, privacy and security) and F-Secure Key (password manager) increasingly being part of the offering. The Company also sells consumer products through various online and retail partners, as well as F-Secure's own web shop.

In the operator channel, the best performance regionally came from North and South America. Sales in Europe remained stable and on last year's level. The Company continued to focus on improving operational excellence with partners, achieving promising results in end-user take-up rates.

Direct consumer sales continued to show solid growth, driven by online sales of Freedome. Overall, retail sales of consumer products continued to develop favorably. As with operators, F-Secure increasingly promoted sales of Freedome as a bundled offering with F-Secure SAFE ("total security and privacy"). The combined offering is expected to support cross-selling and generate higher annual average revenue per user. Initial experiences from the new sales model have been positive.

The Company continued to prepare for the commercial launch of F-Secure Sense, an innovative security solution for connected home devices. The first deliveries are expected by the end of the second quarter in 2017. As the smart home security market continues to shape up, several security solutions for connected devices have lately been introduced by various companies in the industry. F-Secure expects these announcements to further build awareness of this emerging market and thus support the forthcoming launch of F-Secure Sense.

Acquisitions and disposals

F-Secure did not make any acquisitions or disposals in 2016.

Research and Development

F-Secure's research and development activities in 2016 continued to focus on the development of new products and product amendments both for businesses and consumers. Key projects included RDS, F-Secure Sense, F-Secure Cloud Protection for Salesforce, and improvements to several existing products. In addition to the development of new protection features and functionalities, also improvements in customer user experience were paid attention to.

On a more general level, F-Secure is working on simplifying and streamlining its product and service architecture as well as continuing its transition towards the use of cloud services. With these activities the Company aims to improve product scalability, security, stability as well as speed of development. F-Secure also strives to become a truly data-driven company and invests in processing more data than before and increasingly using artificial intelligence for analysis.

In 2016 F-Secure's research and development expenditure amounted to EUR 28.4 million, representing 18% of revenue (EUR 26.9m, 18%). The capitalized development expenses amounted to EUR 3.2 million (EUR 2.3 million).

Product and service announcements

New products launched in 2016

  • F-Secure launched the new Rapid Detection Service (RDS) aimed at businesses with critical IT systems. RDS is a managed security service that combines best-in-class cyber security experts, the latest threat intelligence and new security technology to allow for customers to be notified within 30 minutes of a breach detection. The service includes a manned 24/7 monitoring center with a team of cyber security experts to ensure both the elimination of false positives as well as rapid response.
  • F-Secure launched a new URL-checking API that runs on Amazon API Gateway (F-Secure Security Cloud API). The product strengthens the security of any cloud service that features links or sharing by checking URLs in the cloud for malicious content and categorizes them by content type.

Other significant product announcements

– The Company's vulnerability management solution was renamed as F-Secure Radar (formerly known as Karhu) as the product was officially added to the F-Secure corporate portfolio.

– F-Secure announced F-Secure Cloud Protection for Salesforce, a new first-in-the-market concept for cloud security. The product is expected to be commercially available during the first half of 2017, and it offers an additional layer of security for Salesforce customers by automatically analyzing any files or links uploaded by users and then blocking malicious content.

Updates for corporate products

  • Protection Service for Business (PSB, cloud-based endpoint security suite) was updated with significant new capabilities allowing the solution to be fully integrated to third party management, auditing or reporting tools. Support was added for Windows 10 and El Capitan (OS X), along with new features focusing on web security and control. And additionally, the PSB management portal was completely redesigned to provide faster and more intuitive management experience.
  • Business Suite was added with new security features, including Botnet Blocker which stops criminals from getting control of compromised assets. The product was also updated to improve scalability and usability to support our strategic objective of enhancing our services for bigger organizations.

Updates for consumer security products

  • F-Secure SAFE (multi-device security solution) was updated to make activating and installing the solution simpler for customers. New capabilities were added to enable cross-selling the entire F-Secure product portfolio to SAFE customers. A joint initiative brought operator partners together with F-Secure to optimize the product's end-to-end customer journey covering service discovery, purchasing, activation and usage.
  • F-Secure Key (password manager) was updated with a new browser extension allowing better auto-fill capabilities for popular browsers. The new version also allowed for easy storage of different types of data beyond passwords,

including credit card information. The products user interface was redesigned for tablets and fingerprint sensor support was added for Android and iOS devices.

  • F-Secure Freedome's (a privacy and security product) Tracker Mapper tool was introduced also for mobile devices. New language localizations were added to reach new markets and new capabilities were added to support operator channel partner sales. User interfaces, trial length and onboarding flows were optimized for smoother customer experience.
  • The Company continued to prepare for the commercial launch of F-Secure Sense, an innovative security solution for connected home devices. The first deliveries are expected by the end of the first half of 2017.

Additionally, F-Secure started to globally sell F-Secure SAFE and Freedome also as a commercial bundle offering customers total security and privacy. The aim is to increase customer value as well as customer revenue by offering a way to purchase both of F-Secure's key security products with one simple subscription. Initial customer feedback had been very positive.

Significant awards

  • UK Internet Industry Awards awarded F-Secure SAFE for offering customers the most secure internet experience. This was the second year in a row F-Secure SAFE received the award.
  • After period-end, in February 2017, F-Secure's position as a front runner in security technology was once again confirmed with the Company receiving the 2016 Best Protection Award by AV-TEST for the fifth time, as the first company in the test history.

Shares, Shareholders' Equity, Own Shares

The total number of Company shares was 158,798,739 on 31 December 2016. The Company's registered shareholders'

equity is EUR 1,551,311.18. The Company held 2,540,539 of its own shares on 31 December 2016.

The Company holds its own shares to be used in the incentive compensation plans, for making acquisitions or implementing other arrangements related to the Company's business, to improve the Company's financial structure, or to be otherwise assigned or cancelled.

The Company currently has a share-based incentive program for key employees for the earning periods of 2015–2017 and 2016–2018, as well as synthetic option-based incentive programs for the same periods. In 2016 the Company did not pay any rewards based on the share-based incentive program.

In accordance with the decision by the Annual General Meeting, 40% of the fees paid to the Members of the Board of Directors in 2016 were paid in F-Secure shares. In total, 36,068 of F-Secure shares were assigned to the Members of the Board. The shares were purchased from the market.

Risks and uncertainties

Risks are defined as uncertainties which can impact the achievement of the Company's short and long term objectives. Risks are assessed as a combination of probability and impact. The objective of risk management is to ensure a current, correct and comprehensive understanding and prioritized management of key uncertainties related to strategy implementation and business operations.

In 2016, F-Secure adopted a new risk modeling method with the aim of more accurately capturing all elements of operational security risks. The latest risk assessment cycle was started using the new method and focusing on key assets.

F-Secure uses the following categories to group the risks: strategic, operational, financial and compliance risks. The most significant risks for F-Secure are related to the following factors:

– Volatility of the economic environment and its potential impact on business volumes

F-SECURE 2016 10

  • Security market transformation and changes in customer demand
  • Changes in the competitive environment
  • Potential loss of key customers and partnerships
  • Failure to attract and retain required human capital
  • Competitiveness of F-Secure's product portfolio in the rapidly changing market
  • Intellectual property (IPR) claims against F-Secure
  • Risk exposure from contractual liability requirements
  • Failure to successfully complete acquisitions or divestments
  • Failure of new product launches
  • Potential security threats related to F-Secure's products and services
  • Credit risk due to regional political or financial climate and regulation
  • Tax risk relating to changing laws and regulations and interpretations of said regulations by the relevant authorities

Organization and leadership

At the beginning of 2016, F-Secure stated a target of recruiting over a hundred new employees during the year to support the Company growth. At the end of December, F-Secure had 1,026 employees (926 on 31 December 2015), which shows a net increase of 100 employees (11%) since the beginning of the year. F-Secure continues to actively recruit security professionals, cyber security consultants and sales personnel especially in corporate security.

In August, Samu Konttinen was appointed as the Company's President and CEO. In October, Jyrki Rosenberg was appointed Executive Vice President (Corporate Security). After periodend in February 2017, Eriikka Söderström was appointed as the new CFO.

At the time of the signing of the Financial Statement on 15 February 2017, the composition of the Leadership Team was the following:

Samu Konttinen (CEO), Mari Heusala (HR & Office Services), Kristian Järnefelt (Consumer Security), Saila Miettinen-Lähde (CFO, until 17 February 2017), Jyrki Rosenberg (Corporate Security), Jari Still (Information & Business Services), Mika Ståhlberg (Security Research & Technologies), Jens Thonke (Cyber Security Services) and Jyrki Tulokas (Strategy & Corporate Development). Eriikka Söderström will start as CFO on 18 February 2017.

Corporate Governance

F-Secure's corporate governance practices comply with Finnish laws and regulations, F-Secure's Articles of Association, the rules of NASDAQ Helsinki Oy and the Finnish Corporate Governance Code 2015 issued by the Securities Market Association of Finland. The code is publicly available at http:// cgfinland.fi/en/. F-Secure's Corporate Governance Statement for 2015 as well as up-to-date information about the Company's governance are available on the Company website. The Corporate Governance Statement for 2016 will be published at latest on 15 March 2017.

The Annual General Meeting

The Annual General Meeting of F-Secure Corporation was held on 7 April 2016. The Meeting confirmed the financial statements for the financial year 2015. The members of the Board and the President and CEO were granted discharge from liability. In addition, the Annual General Meeting made the following decisions:

The Annual General Meeting decided to distribute a dividend of EUR 0.06 per share and an extra dividend of EUR 0.06 per share, which was paid on 19 April 2016 to those shareholders that on the record date of 11 April 2016 were registered in the Register of Shareholders held by Euroclear Finland Ltd.

It was decided that the annual compensation of Board members remains on the previous year's level: for the Chairman EUR 55,000, Chairmen of the Executive and Audit Committees EUR 40,000, members EUR 30,000 and a member employed by F-Secure Corporation EUR 10,000. Approximately 40% of the annual remuneration will be paid as company shares.

It was decided that the number of Board members is seven (7). The following current members were re-elected: Mr. Jussi Arovaara, Mr. Pertti Ervi, Mr. Matti Heikkonen, Ms. Anu Nissinen and Mr. Risto Siilasmaa. Mr. Bruce Oreck and Mr. Janne Pirttilahti were elected as new members of the Board. The Board elected in its organizational meeting Mr. Siilasmaa as the Chairman of the Board. The Board nominated Mr. Siilasmaa as the Chairman of the Executive Committee and Mr. Heikkonen and Ms. Nissinen as members of the Executive Committee. Mr. Ervi was nominated as the Chairman of the Audit Committee and Mr. Arovaara, Mr. Oreck and Mr. Pirttilahti were nominated as members of the Audit Committee.

It was decided that the Auditor's fee will be paid against approved invoice. Pricewaterhouse Coopers Oy was elected the Group's auditors. APA, Mr. Janne Rajalahti acts as the responsible partner.

It was decided that the Board of Directors may pass a resolution to repurchase a maximum of 10,000,000 own shares of the company in one or multiple tranches with the Company's unrestricted equity. The authorization entitles the Board of Directors to decide on the repurchase also in deviation from the proportional holdings of the shareholders (directed repurchase). The authorization covers the repurchase of shares either in trading at the regulated market organized by NASDAQ Helsinki Ltd in accordance with its rules and guidelines, in which case the shares must be purchased at the prevailing market price at the time of repurchase, or through a public tender offer to the shareholders, in which case the price offered must be the same for all shareholders. The repurchased shares can be used for making acquisitions or implementing other arrangements related to the Company's business, for improving the Company's financial structure, for use as

part of the Company's incentive schemes or otherwise for further assigning or cancelling the shares. The authorization includes the right for the Board of Directors to decide upon all other terms and conditions related to the repurchase of the Company's own shares. The authorization is valid for 12 months, and the previous authorization granted to the Board of Directors by the 2015 Annual General Meeting regarding the repurchase of the Company's own shares expired upon the new authorization.

The Annual General Meeting authorized the Board of Directors to decide on the issuance of a maximum of 31,000,000 shares or the issuance of special rights entitling to shares referred to in Chapter 10, Section 1 of the Finnish Limited Liability Companies Act in one or multiple tranches. The authorization concerns both the issuance of new shares as well as the transfer of treasury shares. The authorization includes the right for the Board of Directors to decide upon all terms and conditions related to the issuance of shares and special rights. The issuance of shares may be carried out in deviation from the shareholders' pre-emptive rights (directed issue). The authorization can be used for implementing potential acquisitions, other arrangements or equity-based incentive plans or for other purposes decided by the Board of Directors. The Board of Directors also has the right to decide on the sale of Company shares at the regulated market in accordance with NASDAQ Helsinki Ltd's rules and regulations. The authorization is valid for 18 months, and the previous authorization granted to the Board of Directors by the 2015 Annual General Meeting regarding the issuance of shares and transfer of own shares expired.

Market overview

The growing number and variety of connected devices as well as digital services continues to create security challenges for both businesses and individuals. Combined with the increasing complexity of IT systems, these trends are driving demand for security services. While advanced cyber-attacks are becoming more common and persistent, criminals

are targeting companies of all sizes along with consumers by taking advantage of vulnerabilities in popular software, traditional and new connected devices as well as online services. Apart from pure criminal activity, governments and hacktivists use vulnerabilities and malware e.g. for espionage and surveillance.

Attacks against corporations often go undetected for months, which fuels demand for products and services for incident detection and response, supplementing the endpoint security market. Furthermore, as organizations are increasingly adopting cloud services, they seek managed security services and cloud-based delivery to help them maintain control of their security. In the long run, this trend is expected to shift investment away from on-premise security products, while new opportunities are emerging in securing the cloud platforms. Larger organizations also remain interested in securing their mobile device fleets.

The consumer security software market continues to be impacted by the changing device landscape, as well as the increasing significance of app stores and online sales overall. While the sales of traditional PC's have declined slightly, the number of connected smart home devices is growing very rapidly. This creates opportunities for innovative new security products. There are also opportunities to capture market share from the competition with traditional security products.

The information security market overall was estimated to be worth USD 83.7 billion in 2016, and the market is expected to grow by 7.8% annually in 2015–20201). The endpoint security platforms (enterprise) market was worth USD 3.3 billion in 2016, and is expected to grow by 2.6% annually in 2015–20201). The consumer security software market was worth USD 4.7 billion in 2016, and is expected to grow by 1.3% annually in 2015–20201). The IT outsourcing market, including managed security services, was worth USD 15.9 billion in 2016, and is estimated to grow by 11.9% annually in 2015–20201).

Sources: 1) Gartner, Forecast Information Security, Worldwide, 2014–2020, 4Q16, Ruggero Contu, Christian Canales, Sid Deshpande and Lawrence Pingree, 25 January 2017. Market size quoted in current dollars, growth rates in constant dollars.

The Gartner Report(s) described herein, (the "Gartner Report(s)") represent(s) research opinion or viewpoints published, as part of a syndicated subscription service, by Gartner, Inc. ("Gartner"), and are not representations of fact. Each Gartner Report speaks as of its original publication date (and not as of the date of this Interim Report) and the opinions expressed in the Gartner Report(s) are subject to change without notice.

Strategy 2017–2020

F-Secure's strategy is to capitalize on the next phase of the internet and connected world. The strategy reflects the fast growing number of internet-connected devices, the changes in the ways business is done amid the increasing digitalization, and the concurrent increase in cybercrime. Execution of the strategy will further speed up F-Secure's transformation from an antivirus company to a cyber security leader with a broader set of products and services.

The key driver behind the strategy is F-Secure's aspiration for growth. F-Secure continues its investments in the fastest growing markets within corporate security. These include new security products for cloud services, managed endpoint security services and managed detection and response services sold through the reseller channel as well as the cyber security services business. Investments in consumer security are continued at a level that targets profitable growth. To enable execution of the growth strategy, F-Secure is actively recruiting highly skilled security professionals, rising cyber security talents and capable sales personnel. The Company also aims at growing through M&A.

Due to the explosive growth in the number of internetconnected devices both in business and in our private lives, society now expects services and data to be accessible everywhere and on any device. Online business services are becoming the de-facto standard, but at the same time online crime has become ever present and globally connected. Cyber

threats are growing rapidly and evolving in both scope and sophistication. Protecting people and organizations from new types of attacks, as well as securing new areas of technology and business requires a move away from single solutions towards a broader cyber security portfolio.

In cyber security, F-Secure sees the enterprises with business critical IT systems or customer data as being at the forefront of the market. Such enterprises have needs for cutting-edge threat prevention and detection solutions, as well as solutions that enable them to respond to and predict threats. F-Secure is already serving even the most demanding customers utilizing its know-how and expertise, and aims to increase its presence in this market segment especially in selected target verticals. These include the financial industry, gaming and gambling companies, aviation, defense, law enforcement, and certain global brands.

Over time, the most advanced cyber security solutions will be adapted to more easily scalable corporate security offerings sold through the Company's strong and expanding reseller channel. Eventually, the same technologies can be commercialized in consumer security products as well, for which F-Secure's extensive operator channel offers an attractive route to market.

F-Secure aims to maximize the commercial impact of its technical expertise and multiple sales channels for further growth in its chosen key market segments. These include cyber security services offerings to large enterprises in Europe and globally selected industry verticals, and corporate security business through the reseller channel globally. In consumer security, F-Secure continues with its existing sales channels aiming at profitable growth.

Outlook for 2017

Encouraged by the results from our growth investments in corporate security in 2016, we have decided to make a meaningful additional investment in both product development and go-to-market in 2017. Consequently, the Company's outlook for 2017 is the following:

  • Revenue is anticipated to grow from the previous year's level (2016: EUR 158.3 million )
  • Operating profit is anticipated to be EUR 8–12 million (2016: EUR 19.2 million, 12% of revenue); profitability in the first quarter of 2017 is foreseen to be lowest during the year following typical seasonality, and clearly better towards the year-end

Revenue growth is expected to be driven by F-Secure's cyber security services and corporate security products (in particular endpoint protection products, RDS and F-Secure Radar) sold through the reseller channel.

The decision to continue increasing investment in corporate security is based on the already proven revenue growth seen during the last two years. F-Secure believes that additional investment to expedite market penetration of Rapid Detection Service and F-Secure Radar, in addition to endpoint protection products, and to improve portfolio competitiveness for better cross sell opportunities to existing customers will further enhance growth opportunities. The profitability impact of these growth investments will be clearly negative in 2017.

In cyber security services, F-Secure's consultants are widely recognized as leading experts in the field, and demand for their services is high across several industry verticals internationally. Expansion of the consultancy business therefore continues.

Revenue from consumer security is anticipated to remain at approximately previous year's level.

Outlook for strategy period 2017–2020

Driven by the anticipated revenue growth and scalability of the high gross margin product based business model, profitability is expected to improve clearly above the level achieved last year (2016: 12% of revenue) towards the end of the 2017–2020 strategy period.

Proposal for dividend distribution

The Board of Directors is proposing to the Annual General Meeting, to be held on 5 April 2017, that a regular dividend of EUR 0.06 per share and an extra dividend of EUR 0.06 per share be paid based on the adopted balance sheet for the financial year 2016. The suggested dividend record date is 7 April 2017 and the suggested payment date 20 April 2017.

The dividend payout ratio is approximately 123% of the parent company's result. On 31 December 2016, the parent company's distributable equity amounted to a total of EUR 58.0 million. Events after period-end do not weaken the Company's financial position nor does the proposed dividend pose any risk to the company's financial standing.

Events after period-end

No material changes regarding the Company's business or financial position have occurred after the end of the year.

Helsinki, 15 February 2017

F-Secure Corporation

Board of Directors

Risto Siilasmaa Jussi Arovaara Pertti Ervi Matti Heikkonen Anu Nissinen Bruce Oreck Janne Pirttilahti

President and CEO Samu Konttinen

STATEMENT OF COMPREHENSIVE INCOME JAN 1–DEC 31, 2016

EUR 1,000 Note Consolidated,
IFRS 2016
Consolidated,
IFRS 2015
Continuing operations
NET SALES (1) 158,289 147,608
Material and services –5,762 –5,583
GROSS MARGIN 152,526 142,026
Other operating income (4) 4,309 3,959
Sales and marketing (5, 6) –95,487 –86,321
Research and development (5, 6) –28,396 –26,888
Administration (5, 6) –13,720 –12,747
OPERATING RESULT 19,231 20,028
Financial income (8) 3,269 3,494
Financial expenses (8) –1,722 –2,839
PROFIT (LOSS) BEFORE TAXES 20,778 20,683
Income tax (10) –5,053 –8,611
Result for the financial period from the continuing operations 15,725 12,072
Result for the financial period from the discontinued operations –484 9,980
RESULT FOR THE FINANCIAL YEAR 15,241 22,052
Other comprehensive income
Other comprehensive income to be reclassified to profit or loss in subsequent periods
Exchange difference on translation of foreign operations –339 312
Available-for-sale financial assets (9) 901 –183
Taxes related to components of other comprehensive income (10) –180 37
COMPREHENSIVE INCOME FOR THE YEAR 15,624 22,217
Result of the financial year is attributable to:
Equity holders of the parent
15,241 22,052
Comprehensive income for the year is attributable to:
Equity holders of the parent
15,624 22,217
Earnings per share continuing operations
– basic and diluted
(11) 0.10 0.08
Earnings per share discontinued operations
– basic and diluted
(11) 0.00 0.06

14

STATEMENT OF FINANCIAL POSITION DEC 31, 2016

EUR 1,000 Note Consolidated,
IFRS 2016
Consolidated,
IFRS 2015
ASSETS
NON-CURRENT ASSETS
Tangible assets (12) 3,332 3,407
Intangible assets (12) 13,400 12,170
Goodwill (3,13) 7,632 7,599
Deferred tax assets (14) 2,734 1,330
Other receivables (16) 77 11
Total non-current assets 27,175 24,518
CURRENT ASSETS
Inventories (15) 109 134
Trade and other receivables (16) 46,182 42,443
Income tax receivables (16) 342 285
Available-for-sale financial assets (17) 63,671 64,437
Cash and bank accounts (18) 29,050 29,919
Total current assets 139,354 137,219
Discontinued operations 1,534 6,360
TOTAL ASSETS 168,064 168,097
EUR 1,000 Note Consolidated,
IFRS 2016
Consolidated,
IFRS 2015
SHAREHOLDERS' EQUITY AND LIABILITIES
SHAREHOLDERS' EQUITY (19)
Share capital 1,551 1,551
Share premium 165 165
Treasury shares –5,741 –6,966
Fair value reserve 1,077 355
Translation differences 284 623
Reserve for invested unrestricted equity 5,211 5,102
Retained earnings 73,365 76,224
Total equity 75,912 77,055
NON-CURRENT LIABILITIES
Deferred tax liabilities (14) 361 923
Other non-current liabilities (21) 13,916 12,240
Provisions (21) 158
Total non-current liabilities 14,436 13,163
CURRENT LIABILITIES (21)
Trade and other payables 32,088 28,295
Income tax liabilities 2,516 3,981
Other current liabilities 40,514 35,996
Total current liabilities 75,117 68,272
Discontinued operations 2,599 9,607
TOTAL SHAREHOLDERS' EQUITY AND
LIABILITIES
168,064 168,097

STATEMENT OF CASH FLOWS JAN 1–DEC 31, 2016

EUR 1,000
Note
Consolidated,
IFRS 2016
Consolidated,
IFRS 2015
EUR 1,000
Note
Consolidated,
IFRS 2016
Consolidated,
IFRS 2015
CASH FLOW FROM OPERATIONS CASH FLOW FROM INVESTMENTS
Result for the financial year 15,241 22,052 Investments in intangible and tangible assets –6,890 –4,608
Adjustments (24)
19,696
7,082 Investments in subsidiary shares,
Cash flow from operations before change
in working capital
34,938 29,134 net of cash acquired
(3)
Investments in available-for-sale
financial assets
(17)
–9,527 –10,232
–35,718
Change in net working capital Proceeds from sale of intangible and
tangible assets
(2)
44 43,916
Current receivables, increase (–),
decrease (+)
1,280 –1,514 Proceeds from available-for-sale
financial assets
(17)
11,742 11,419
Inventories, increase (–), decrease (+) 26 –27
Non-interest bearing debt, increase (+),
decrease (–)
929 2,508 Cash flow from investments –4,630 4,776
Provisions, increase (+), decrease (–) 158 1,173 Cash flow from financing activities
Dividends paid –18,696 –24,928
Cash flow from operations before financial
items and taxes
37,330 31,274 Cash flow from financing activities –18,696 –24,928
Interest expenses paid –1,010 –8 Change in cash –1,434 8,740
Interest income received 93 47
Other financial income and expenses –731 2,067 Cash and bank at the beginning of the period 29,919 21,067
Income taxes paid –13,790 –4,487
Effects of exchange rate changes 565 112
Cash flow from operations 21,892 28,893
Cash and bank at period end 29,050 29,919

For the purposes of the consolidated statement of cash flows F-Secure has previously recognized available-for-sale financial assets as part of cash equivalents. However, as the AFS assets are short term investments as defined under IAS 7, this has been a misstatement. The misstatement is not considered material and it has no effect on the statement of income or the statement of financial position. The AFS assets have been reclassified as of the beginning of 2016 and they are now recognized in cash flow from investments. The comparison period has been restated accordingly, resulting in the transfer of EUR –24.3 million cash flow from cash and bank to the cash flow from investments in 2015.

16

STATEMENT OF CHANGES IN EQUITY

Attributable to the equity holders of the parent

EUR 1,000 Share capital Share
premium fund
Treasury
shares
Available
for-sale
Translation diff. Unrestricted
equity reserve
Retained
earnings
Total equity
Equity December 31, 2014 1,551 165 –6,989 502 312 5,102 79,290 79,933
Available-for-sale financial assets, net –146 –146
Translation difference 311 311
Result of the financial year 22,052 22,052
Total comprehensive income for the year –146 311 22,052 22,216
Dividends –24,928 –24,928
Cost of share based payments –189 –189
Other changes 23 23
Equity December 31, 2015 1,551 165 –6,966 355 623 5,102 76,224 77,055
Available-for-sale financial assets, net 721 721
Translation difference –339 –339
Result of the financial year 15,241 15,241
Total comprehensive income for the year 721 –339 15,241 15,624
Dividends –18,696 –18,696
Cost of share based payments 1,224 109 596 1,929
Equity December 31, 2016 1,551 165 –5,741 1,077 284 5,211 73,365 75,912

More information in note 19. Shareholders' equity.

NOTES TO THE FINANCIAL STATEMENTS

ACCOUNTING PRINCIPLES FOR THE CONSOLIDATED FINANCIAL STATEMENTS

Basic information

F-Secure produces online security and privacy services for consumers and businesses against malware and other threats.

The parent company of the Group is F-Secure Corporation incorporated in Finland and domiciled in Helsinki. Company's registered address is Tammasaarenkatu 7, 00180 Helsinki. A copy of consolidated financial statements can be downloaded on www.f-secure.com or can be received from the parent company's registered address.

These financial statements were authorized for issue by the Board of Directors on 15 February 2017. According to the Finnish Companies Act, the Annual General Meeting can confirm or reject the consolidated financial statements after publication. The Annual General Meeting can also decide to change the financial statements.

ACCOUNTING PRINCIPLES

The consolidated financial statements of F-Secure Corporation of 2016 have been prepared in accordance with International Financial Reporting Standards (IFRS), applying the IAS and IFRS standards as well as SIC and IFRIC interpretations that were in force and had been approved by the EU by 31 December 2016. The disclosures comply also with the Finnish accounting and corporate legislation.

Management judgment on significant accounting principles and use of estimates and assumptions

The preparation of consolidated financial statements requires the use of estimates and assumptions as well as the use of judgment when applying accounting principles. These affect the contents of the financial statements and it is possible that actual results may differ from estimates.

Estimates made in connection with the preparation of financial statements are based on management's best knowledge at the reporting date. Estimates build upon past experience as well as assumptions of the future development of the economic environment of the Group. Possible changes in estimates and assumptions are recognized in the period they occur and in all future periods.

The key assumptions concerning the future of the Group and estimates at the reporting date are related to:

  • Revenue recognition: Judgment is applied related to timing of revenue recognition of fixed priced operator agreements as those contracts are typically negotiated separately and different contract terms could have significant impact on revenue recognition. In addition, there is judgement involved in assessing timing of revenue recognition for other contracts especially related to allocation of license agreement revenue between license revenue and maintenance revenue.
  • Impairment of assets: At each reporting date, the Group assesses whether there is any indication that an asset may be impaired. In impairment testing, recoverable amount is determined based on value in use calculations. The key variables used in the calculations are profitability, growth rate and the discount rate. The key assumptions used to determine the recoverable amount for goodwill, including sensitivity analysis, are further explained in note 13.
  • Deferred tax assets: The Group has assessed how much unused tax losses can be utilized in the future. Further details are disclosed in note 14.
  • Development expenditures carried forward: Initial capitalization of cost is based on management's judgment on technological and economic feasibility. The Group has made assumptions regarding the expected future cash generation of the projects. Further details are disclosed in note 12.
  • Recognizing share-based payment transactions: The cost of share-based payment transactions is based on the

fair value at the date at which they were granted. The cost of cash-settled transactions is measured by reference to the fair value at the date of balance sheet. The assumptions and models used for estimating fair value for share-based payment transactions are disclosed in note 20.

Principles of consolidation

Companies controlled directly or indirectly by F-Secure Corporation are consolidated in the financial statements using the acquisition method. Subsidiaries are consolidated from the date on which the Group obtains control on them. The consolidation stops when the control ceases. The Group does not have any associated companies nor is there any noncontrolling interest in the Group.

All intra-group transactions and balances, including unrealized profits arising from intra-group transactions, have been eliminated on consolidation. Where necessary, accounting policies of the subsidiaries have been adjusted to ensure consistency with the policies adopted by the Group.

Segment reporting

The Group has one segment, data security. Segment reporting is consistent with the internal reporting submitted to the chief operating decision-maker. The Leadership Team has been appointed the chief operating decision-maker, responsible for allocating resources and assessing performance as well as making strategic decisions.

Transactions in foreign currency

The consolidated financial statements of F-Secure Group are presented in euros, which is the parent company's functional currency. The income statements of foreign Group companies are translated at the average exchange rates for the financial year. The balance sheets are translated using the European Central Bank's exchange rates prevailing on the balance sheet date. Translation differences are recognized in shareholders' equity and the change in other comprehensive income.

The consolidated statement of cash flows is prepared by combining each subsidiary's individual cash flow statements and eliminating intra group cash flows. Individual cash flows are translated using average exchange rates for the financial year.

Foreign currency transactions are translated using the exchange rates prevailing at the dates of the transactions. At the balance sheet date, assets and liabilities denominated in foreign currencies are translated using the European Central Bank's exchange rates prevailing at that date. Exchange rate gains and losses of financial transactions are recognized in financial items in the income statement.

INTANGIBLE ASSETS

Goodwill

Goodwill is formed in a business combination, and it is measured as the amount by which the consideration transferred, the non-controlling interest in the acquiree and the previously held equity interest in the acquiree exceed the fair value of the net assets acquired.

Goodwill is not amortized but is instead tested for impairment yearly and whenever there is an indication that it may be impaired. For this purpose goodwill has been allocated to cash-generating units. Goodwill is recorded at historical cost less accumulated impairment losses.

Research and development costs

Research expenditure is recognized as an expense at the time it is incurred. Development expenditures on new products or product versions with significant new features are recognized as intangible assets when they fulfill the requirements set out in IAS 38. Amortization is recorded on a straight-line basis over the estimated useful life, which is 3–8 years for these assets.

Other intangible assets

Other intangible assets include intangible rights, software licenses and customer relationships, all with a finite useful life. Customer relationships have been acquired in a business combination, and they were originally valued using Multi-Period Excess Earnings model.

Other intangible assets with finite useful life are recorded at historical cost less accumulated amortization and possible impairment. Amortization is recorded on a straight-line basis over the estimated useful life of an asset. The estimated useful lives of other intangible assets are as follows:

Intangible rights 3–8 years
Other intangible assets 5–10 years
Customer relationships 8 years

Tangible assets

Tangible assets are recorded at historical cost less accumulated depreciation and possible impairment. Depreciation is recorded on a straight-line basis over the estimated useful life of an asset. The estimated useful lives of tangible assets are as follows:

Machinery and equipment 3–8 years
Other tangible assets 5–10 years

Other tangible assets include renovation costs of rented office space. Gains or losses on disposal of tangible assets are shown in other operating income or expense.

Government grants

Government grants are recognized as income over those periods in which the corresponding expenses arise. These grants are recognized as other operating income in the income statement.

Inventories

Inventories are valued at the lower of cost and net realizable value. Cost is determined by first-in first-out method. Net realizable value is the estimated selling price that is obtainable, less estimated costs of completion and the estimated costs necessary to make the sale.

Leases

Leases where the lessor retains substantially all the risks and benefits of ownership of the asset are classified as operating leases. Operating lease payments are recognized as an expense in the income statement on a straight-line basis over the lease term. The Group has only operating leases.

Impairment of assets

At each reporting date, the Group assesses whether there is any indication that an asset may be impaired. Where an indicator of impairment exists, the Group makes a formal estimate of recoverable amount. The recoverable amount is estimated annually for the following assets regardless of whether any indication of impairment: goodwill, intangible assets with an indefinite useful life and intangible assets under construction.

Where the carrying amount of an asset exceeds its recoverable amount the asset is considered impaired and written down to its recoverable amount. The recoverable amount is the fair value of an asset less costs to sell or its value in use, whichever is higher. An impairment loss is recorded in the income statement.

A previously recognized impairment loss is reversed only if there has been a change in the estimates used to determine the asset's recoverable amount since the last impairment loss was recognized. The maximum reversal of an impairment loss amounts to no more than the carrying amount of the asset if no impairment loss had been recognized, net of depreciation. Impairment losses relating to goodwill cannot be reversed in future periods.

Pensions

All of F-Secure Group's pension arrangements are in accordance with local statutory requirements, and they are defined contribution plans. Contributions to defined contribution plans are recognized in the income statement in the period to which the contributions relate. The Group recognizes disability commitment of Finnish TyEL pension plan when disability appears.

Share-based payment transactions

In F-Secure's industry it is common practice that incentives are provided to employees in the form of equity-settled share-based instruments. The Company has two kinds of incentive programs; a synthetic warrant-based program and a share-based program.

F-Secure's synthetic warrant-based programs cover the Group's key personnel. The synthetic warrant-based program is settled as cash-settled payments. The liability is valued at fair value at grant date and the expense is recognized evenly in the income statement over the vesting period. The Group revalues the liability to fair value at each reporting date. The fair value is determined by using the binomial model. The cumulative expense recognized at grant date is based on the Group's estimate of the number of warrants that will ultimately vest at the end of the vesting period. If a person leaves the company before vesting, the warrant is forfeited. The Group updates its estimate of the ultimate number of warrants at each reporting date. Changes in the estimate are recorded in the income statement.

F-Secure's share-based incentive program is targeted to the Group's key personnel. The program is divided into an equity-settled and a cash-settled part. The equity-settled part is valued at fair value at grant date, and the expense is recognized evenly in the income statement over the vesting period with the counter-entry in retained earnings. Fair value is determined using the market value of the share of F-Secure Corporation. The cash-settled part is valued at fair value at grant date, and the expense is recognized evenly in the income statement over the vesting period with the counter-entry in liabilities. The cash-settled part is revalued to fair value at each reporting date. The cumulative expense recognized at grant date is based on the Group's estimate of the number of shares that will ultimately vest at the end of the vesting period. If a person leaves the company before vesting, the reward is forfeited. The Group updates its estimate of the ultimate number of shares at each reporting date. These changes in the estimate are recorded in the income statement.

Provisions

Provisions are recognized when the Group has a present obligation (legal or constructive) as a result of a past event, the outflow of resources is probable, and a reliable estimate of the amount of the obligation can be made.

Income taxes

Current income taxes are calculated on the taxable income in all Group companies in accordance with the local tax rules. Deferred taxes, resulting from temporary differences between the financial statement and the income tax basis of assets and liabilities, use the enacted tax rates in effect in the years in which the differences are expected to reverse. Deferred tax assets are recognized to the extent that it is probable that future taxable profit will be available.

Revenue recognition

Revenue is derived from corporate and consumer businesses. Corporate security business revenue includes cyber security products, managed services, and cyber security consulting. Cyber security products comprise endpoint protection solutions (Protection Service for Business, Business Suite), as well as solutions targeted at detecting and responding to advanced attacks (Rapid Detection Service, RDS) and vulnerability management (F-Secure Radar), which may be sold either as cyber security products or as managed services. Consumer security business revenue comes through operator and direct consumer channels, and the main products include F-Secure SAFE, F-Secure Freedome, and F-Secure KEY.

Cyber security product sales include license sales. In the corporate and direct consumer businesses, license agreements consist of initial license agreements and periodic maintenance agreements covering product updates and customer support. License fee revenue included in those agreements is recognized when the product is initially delivered, whereas the license agreements' maintenance revenue is recognized over the maintenance period. In the operator business, most of the license sales are usage-based and booked based on usage

reports, but there are also fixed price operator agreements. The terms of these agreements vary significantly and their revenue recognition is therefore defined case-by-case.

Service revenue, including cyber security consulting and managed services, is recognized at the time of delivery of the service.

Other operating income

Other operating income includes e.g. gain on sale of fixed assets, rental revenue, and government grants received for research and development projects.

Presentation of expenses

Classification of the functionally presented expenses has been made by presenting direct expenses in their respective functions and by allocating other expenses to operations on the basis of average headcount in each function.

Operating result

IAS 1 Presentation of Financial Statements standard does not define the concept of operating result. The Group has defined it as follows: operating result is the net amount, which consists of the net sales and other operating income less cost of purchase which is adjusted for changes in inventories, employee benefit costs, depreciation and amortization, possible impairment losses, and other operating expenses.

Treasury shares

Parent company has acquired treasury shares in 2008–2011. The purchase price of the shares has been deducted from equity.

Financial assets

According to IAS 39 standard, financial assets have been classified into financial assets at fair value through profit or loss, held-to-maturity, loans and receivables, and available-for-sale financial assets. The classification is made at original acquisition based on the purpose for which the assets were acquired. The

cost of purchase includes transaction costs for other than assets at fair value through profit or loss. Purchases and sales of financial assets are recognized on the trade date. F-Secure currently has loans and receivables, available-for-sale financial assets, and financial assets at fair value through profit or loss (derivatives).

Loans and receivables originated by the enterprise are measured at amortized cost. Trade receivables are carried at the original invoice amount to customers less an estimate made for doubtful receivables. The Group records an impairment when there is objective evidence that the trade receivables will not be recovered in full. Evidence of impairment include debtor's significant financial difficulty, probability of bankruptcy, non-payments, and delay of payment for more than 90 days. Outstanding receivables are reviewed periodically and bad debts are written off when identified.

Available-for-sale financial assets consist mainly of interestbearing debt securities and shares in mutual funds invested in similar instruments. For assets that are actively traded in organized financial markets, fair value is determined by reference to Stock Exchange quoted market prices. Assets, the fair value of which cannot be measured reliably, are recognized at cost less impairment. The fair value changes of availablefor-sale financial assets are recognized in shareholders' equity under fair value reserve. When financial assets recognized as available-for-sale are sold or impaired, the accumulated fair value changes are released from equity and recognized in the income statement.

Cash and cash equivalents in the Consolidated Statement of Financial position comprise cash at bank and in hand and other highly liquid short-term investments.

Financial liabilities

According to IAS 39 standard, financial liabilities are classified into financial liabilities at fair value through profit or loss, and loans and liabilities. Financial liabilities are initially recognized at fair value. The Group's financial liabilities consist of short-term trade payables and derivatives.

Derivative financial instruments and hedging

The Group uses derivative financial instruments such as forward currency contracts to hedge its risks associated with foreign currency fluctuations. Derivatives are valued at fair value. The fair value of forward currency contracts is calculated based on current forward exchange rates at the reporting date for contracts with similar maturity profiles. The gains and losses arising from the change of fair value are booked through the income statement as the Group does apply hedge accounting.

Discontinued operations

In February 2015 F-Secure concluded the sale of its personal cloud storage business to Synchronoss Technologies Inc. The personal cloud business is reported as discontinued operations according to the IFRS 5.

The result of discontinued operations is presented as a separate item in the consolidated statement of comprehensive income. Assets and liabilities of discontinued operations are presented separately from other items in balance sheet. Further details are disclosed in note 2.

The new and amended standards adopted by the Group

The group has applied the following amendments for the first time for their annual reporting period commencing 1 January 2016:

– Disclosure initiative – amendments to IAS 1 Presentation of Financial Statements

The adoption of these amendments did not have a significant impact on the current period or any prior period. Other new or amended standards or interpretations had no impact on the consolidated financial statements.

New standards and interpretations not yet adopted

The Group has not yet adopted the following new and amended standards and interpretations already issued by the IASB:

– IFRS 15 Revenue from Contracts with Customers (effective for annual periods beginning on or after 1 January 2018). The standard outlines the principles an entity must apply to measure and recognize revenue. The new standard is based on the principle that revenue is recognized when control of a good or service transfers to a customer. F-Secure has analyzed most types of customer contracts, from different business lines. The analysis requires management judgement and final conclusions have not been drawn yet.

Based on the analyses performed, vast majority of F-Secure's sales form a single performance obligation that will be recognized as revenue over time. No material changes to revenue recognition of managed services are expected. Cyber security consultancy sales revenue recognition will remain as it is.

For licenses in cyber security product sales and direct consumer sales, F-Secure expects the revenue recognition to be partially delayed, as the license is no longer considered a distinct service and therefore no longer recognized as revenue at initial delivery.

In the operator business, revenue recognition of usage-based license agreements and fixed price license agreements will not be significantly affected by the new standard.

Sales commissions are currently recorded as expenses at initial delivery. IFRS 15 requires capitalization of these kinds of incremental costs of obtaining a contract, which will delay the recognition of expenses compared to the current accounting policy.

The effects of the changes have not yet been quantified. The impact assessment will become more accurate during 2017.

The standard permits either a full retrospective or a modified retrospective approach for the adoption. F-Secure has not yet decided the transfer approach.

– IFRS 9 Financial Instruments and subsequent amendments (effective for financial years beginning on or after 1 January 2018). The new standard replaces IAS 39 Financial Instruments: Recognition and Measurement. IFRS 9 changes the classification and valuation of financial assets and includes a new model for estimating impairment of financial assets, which is based on expected credit losses.

F-Secure has significant investments in fixed income funds, classified as available-for-sale financial assets under IAS 39. F-Secure is planning to classify these as fair value through profit or loss under IFRS 9. The classification change would result in increased volatility of the net result. However, this increase is not expected to be significant due to the nature of the funds.

The new impairment model requires the recognition of impairment provisions based on expected credit losses rather than only incurred credit losses as is the case under IAS 39. F-Secure does not expect the expected credit loss model to have a material impact on the consolidated financial statements.

The effects of the changes have not yet been quantified.

– IFRS 16 – Leases (effective for financial year beginning on or after 1 January 2019, not yet endorsed for use by the European Union). IFRS 16 will result in almost all leases being recognized on the balance sheet, as the distinction between operating and finance leases is removed. Under the new standard, an asset (the right to use the leased item) and a financial liability to pay rentals are recognized. The only exceptions are short-term and low-value leases.

F-Secure currently has only operating leases, which consist mainly of rented office premises and leased cars. As at the reporting date, the group has non-cancellable operating lease commitments of EUR 17.5 million, see note 25. The new standard will increase both assets and liabilities significantly, and operating profit will improve as part of the lease-related expense will be reported as financial costs. The effects of the changes have not yet been quantified.

Other new or amended standards or interpretations are not expected to have an impact on the consolidated financial statements.

1. SEGMENT INFORMATION

The Group has one business segment, security. The chief operating decision maker i.e. the Leadership Team gets financial information on a monthly basis of the revenue by sales channel. For the geographical information, revenue is presented based on the location of the customer and the long-term assets based on the location of the assets.

Consolidated
2016
Consolidated
2015
Sales channels
Revenue from external customers, continuing
operations
Consumer security 95,780 95,541
Corporate security 62,509 52,065
Total 158,289 147,608

Protection Service for Business sales in the operator channel are now reported in consumer security along with other operator channel sales (previously in corporate security). 2015 has been restated accordingly.

Geographical information

Revenue from external customers, continuing operations

57,449 49,922
65,019 63,691
14,583 13,087
21,238 20,906
158,289 147,608
23,179 22,094
357 249
265 361
562 472
24,364 23,176

2. DISCONTINUED OPERATIONS

On 24 February 2015 F-Secure Corporation sold its personal cloud storage business to Synchronoss Technologies Inc (NASDAQ: SNCR). The value of the transaction was USD 60 million in cash. As a part of the transaction, the companies also agreed on certain intellectual property and patent rights. The Group has classified the personal cloud storage business as discontinued operations.

A French service provider has issued claims against F-Secure based on a contract relating to purchase of services. The matter is subject of an ongoing appeal process in a French court instance. A provision of EUR 1.2 million has been recognized in the discontinued operations based on the ongoing litigation. F-Secure does not anticipate the presented claims and the eventual outcome of the dispute to materially impact its financial position.

Result for the financial period from the
personal cloud business
Consolidated
2016
Consolidated
2015
Revenue 3,275 8,535
Expenses –3,880 –9,737
Result before taxes –605 –1,202
Taxes 121 233
Result for the period –484 –969
Net gain on disposal 18,595
Attributable taxes –7,646
Result after taxes –484 9,980
Earnings per share, discontinued operations, EUR 0.00 0.06
Earnings per share, discontinued operations,
diluted, EUR
0.00 0.06
Discontinued operations, items of statement
of financial position
Goodwill 19,398
Other intangible assets 222
Capitalized development 4,785
Net assets 24,405
Cash flow statement
Cash flow from operations 2,667 –5,274
Cash flow from investments 44,255
Change in cash 2,667 38,981

FINANCIAL STATEMENTS F-SECURE CONSOLIDATED F-SECURE 2016

3. ACQUISITIONS

.

On 2 June 2015, F-Secure acquired 100% of the shares of nSense Group ApS, a privately held Danish company providing security consultation and vulnerability assessment services and products to large enterprises. nSense is headquartered in Denmark, and it has offices in Finland, Poland and Norway.

The purchase price for nSense consisted of an EUR 11 million cash payment made at closing, a deferred payment of EUR 4 million in shares and an earn-out element worth a maximum of EUR 3 million in cash subject to the achievement of certain milestones in 2015–2016.

The deferred payment and earn-out elements are recognized as expense through the consolidated income statement. For 2016, these elements amounted to EUR 3.4 million in total (2015: EUR 1.5 million). In 2017 EUR 1.3 million is expected to be paid and EUR 0.6 million in 2018. The costs are recognized as administration expense.

4. OTHER OPERATING INCOME

EUR 1,000 Consolidated 2016 Consolidated 2015
Government grants 3,797 3,818
Rental revenue 319 52
Other 193 89
Total 4,309 3,959

5. DEPRECIATION, AMORTIZATION, AND IMPAIRMENT

EUR 1,000 Consolidated 2016 Consolidated 2015
Depreciation and amortization
Other intangible assets –1,355 –1,390
Capitalized development –2,250 –1,596
Intangible assets –3,605 –2,986
Machinery and equipment –1,479 –2,691
Other tangible assets –188 –196
Tangible assets –1,668 –2,886
Total depreciation and amortization –5,272 –5,872
Depreciation and amortization by function
Sales and marketing –2,203 –3,363
Research and development –2,831 –2,277
Administration –238 –232
Total depreciation and amortization –5,272 –5,872

6. PERSONNEL EXPENSES

EUR 1,000 Consolidated 2016 Consolidated 2015
Personnel expenses
Wages and salaries –61,754 –56,777
Pension expenses – defined contribution plan –8,375 –7,639
Share-based payments –2,522 –395
Other social expenses –8,545 –6,341
Total –81,196 –71,153

Employee benefits of the management are stated in disclosure 27. Related party transactions. Share-based payments are stated in disclosure 20. Share-based payment transactions.

Average number of personnel 981 894
Personnel by function December 31
Sales and marketing 570 500
Research and development 325 279
Administration 131 147
Total 1,026 926

7. AUDIT FEES

EUR 1,000 Consolidated 2016 Consolidated 2015
Group auditor
Audit fees, PricewaterhouseCoopers –145
Audit fees, Ernst&Young –89 –161
Tax consulting, Ernst&Young –65 –56
Other consulting, PricewaterhouseCoopers –77
Other consulting, Ernst&Young –43 –149
Total –419 –366
Other auditors
Audit fees –46 –24
Tax consulting –38 –41
Total –84 –65

8. FINANCIAL INCOME AND EXPENSES

EUR 1,000 Consolidated 2016 Consolidated 2015
Financial income
Dividends from available-for-sale financial assets 11 12
Other financial income from available-for-sale
financial assets
579 1,203
Interest income from loans and receivables 93 47
Exchange gains 2,576 2,205
Other financial income 10 27
Total 3,269 3,494
Financial expenses
Interest expense from loans and liabilities –9 –1,008
Exchange losses –1,635 –1,793
Other financial expenses –78 –38
Total –1,722 –2,839

Interest expense in 2015 includes EUR 0.9 million late payment interest related to withholding taxes from 2009–2011.

9. FINANCIAL INCOME AND EXPENSES IN OTHER COMPREHENSIVE INCOME

EUR 1,000 Consolidated 2016 Consolidated 2015
Components of other comprehensive income
Available-for-sale financial assets
Gains/(losses) arising during the year 954 35
Reclassification to profit or loss –52 –218
Total 901 –183

10. INCOME TAX

EUR 1,000 Consolidated 2016 Consolidated 2015
Current income tax for the year –7,137 –6,220
Adjustments for current tax of prior periods –58 –2,134
Change in deferred tax 2,142 –257
Total –5,053 –8,611
Components of other comprehensive income
Available-for-sale financial assets –180 37

A reconciliation of income tax expense in the income statement and income tax calculated at the parent company's country of residence income tax rate (20%):

Result before taxes 20,778 20,683
Income tax at Finnish tax rate of 20% –4,156 –4,137
Effect of overseas tax rates –90 51
Effect of changes in tax rates 30
Non-deductible expenses/tax-exempt revenue –788 –2,439
Unrecognised tax losses –17
Adjustments for prior period tax 866 –2,134
Other –899 48
Total –5,053 –8,611

The 2016 adjustments for prior period tax include a positive EUR 0.9 million correction to the 2015 deferred tax asset in Japan. The misstatement is not considered material and has been booked through the change in deferred tax in the income statement in 2016. Other taxes in 2016 consist mainly of non-creditable withholding taxes.

The Finnish tax authority conducted a partial tax audit of F-Secure Corporation concerning withholding tax in 2015. Based on the audit, the tax authority considers the revenue F-Secure Corporation has received from certain countries not to be royalties as defined in the tax agremeents between Finland and these countries, but rather business profits. As a result, the tax authority reassessed the company's taxation so that withholding tax paid to these countries are not credited in the Finnish taxation, and tax credits received by the company for years 2009–2011 were reclaimed. Based on the reassessment decisions, F-Secure recorded EUR 2.1 million of additional withholding tax and EUR 0.9 million of late payment interest in its 2015 financial statements. F-Secure has appealed the reassessment decisions with the Tax Administration's Board of Adjustment.

24

11. EARNINGS PER SHARE

Basic earnings per share amounts are calculated by dividing net profit for the year attributable to ordinary equity holders of the parent by the weighted average number of ordinary shares outstanding during the year. Diluted earnings per share amounts are calculated by dividing the net profit attributable to ordinary shareholders by the weighted average number of ordinary shares outstanding during the year adjusted for the effects of dilutive options.

EUR 1,000 Consolidated 2016 Consolidated 2015
Net profit attributable to equity holders from
continuing operations
15,241 22,052
Weighted average number of ordinary shares
(1,000)
156,023 155,801
Adjusted weighted average number of ordinary
shares for diluted earning per share
156,023 155,801
Basic and diluted earnings per share (EUR/share),
continuing operations
0.10 0.08
Basic and diluted earnings per share (EUR/share),
discontinued operations
0.00 0.06

The weighted average number of shares take into account the effect of change in treasury shares.

12. NON-CURRENT ASSETS

INTANGIBLE ASSETS TANGIBLE ASSETS
Other
Intangible
Capitalized
development
Goodwill Advance
payments
Total Machinery &
equipment
Other tangible Total
Acquisition cost Jan 1, 2015 25,072 19,931 19,398 1,056 65,457 29,725 3,558 33,283
Translation difference –68 –68 192 –102 90
Acquisitions and divestments 2,251 1,110 7,599 10,960 34 106 140
Additions 929 315 1,989 3,233 1,242 122 1,364
Disposals –8,261 –8,987 –19,398 –36,646 –2,128 –49 –2,177
Acquisition cost Dec 31, 2015 19,923 12,369 7,599 3,044 42,936 29,065 3,635 32,700
Translation difference 3 32 36 95 10 105
Additions 174 69 4,586 4,828 1,987 112 2,098
Transfers 3,526 –3,526 30 –30
Disposals –2,036 –1,310 –3,346 –3,376 –562 –3,938
Acquisition cost Dec 31, 2016 18,064 14,654 7,632 4,104 44,454 27,800 3,165 30,965
Acc. depreciation Jan 1, 2015 –22,299 –9,700 –31,999 –22,857 –3,185 –26,042
Translation difference 77 77 –43 101 58
Acquisitions and divestments –500 –500 –3 –27 –30
Depreciation for the period –1,389 –1,596 –2,985 –4,712 –194 –4,906
Depreciation of disposals 8,039 4,202 12,241 1,620 7 1,627
Acc. depreciation Dec 31, 2015 –15,649 –7,517 –23,166 –25,995 –3,298 –29,293
Translation difference 8 –2 6 –71 3 –69
Depreciation for the period –1,355 –2,250 –3,605 –1,824 –188 –2,013
Depreciation of disposals 1,301 2,041 3,342 3,188 554 3,741
Acc. depreciation Dec 31, 2016 –15,694 –7,728 –23,423 –24,703 –2,930 –27,633
Book value as at Dec 31, 2015 4,273 4,852 7,599 3,044 19,769 3,070 337 3,407
Book value as at Dec 31, 2016 2,370 6,926 7,632 4,104 21,031 3,097 236 3,332

FINANCIAL STATEMENTS F-SECURE CONSOLIDATED F-SECURE 2016

13. IMPAIRMENT TESTING OF GOODWILL

In impairment testing the Group's assets are tested against cash flow generated by the Group's Cyber Security Service and license sales.

The cash flow estimates have been reviewed by the management and cover the next five years. The estimates are based on value in use calculations using cash flow projections from the 2016 budget and financial forecasts for 2018–2021. Cash flows after the forecast period are taken into account by a terminal value calulated assuming a steady 1% per annum growth. The forecast profitability level is based on previous year's profitability, 2016 budget and longer term communicated profitability target level. The used discount rate is 8.5% before taxes. The impairment test, based on these assumptions, shows no need to impair assets and/or goodwill.

Sensitivity to changes in assumptions

The main parameters in the calculations are profitability, growth rate and discount rate. If any of the main parameters would change so that the discounted cash flows would meet the book value, need for impairment would arise. However, the Group estimates such a change not to be reasonably possible.

14. DEFERRED TAX

EUR 1,000 Consolidated 2016 Consolidated 2015
Deferred tax assets relate to following:
Fixed assets 841 554
Accruals and provisions 2,289 679
Tax losses carried forward 88 97
Total 3,218 1,330
Offset against deferred tax liabilities –483
Net deferred tax assets 2,734 1,330
Change in deferred tax assets:
Recognized in profit or loss 1,887 –248
Deferred tax liabilities relate to the following:
Fixed assets 576 834
Available-for-sale financial assets 269 89
Total 845 923
Offset against deferred tax assets –483
Net deferred tax liabilities 361 923
Change in deferred tax liabilities:
Recognized in profit or loss 259 11
Recognized in other comprehensive income –180 –37

At December 31, 2016 the Group had 0.4 million euro losses carried forward that are available for offset against future taxable profits in the companies in which the losses arose.

15. INVENTORIES

EUR 1,000 Consolidated 2016 Consolidated 2015
Other inventories 109 134

No impairment was recognized for inventories in 2016 and 2015.

16. RECEIVABLES

EUR 1,000 Consolidated 2016 Consolidated 2015
Non-current receivables
Other receivables 77 11
Current receivables
Trade receivables 36,390 29,189
Loan receivables 15 17
Other receivables 2,364 6,560
Prepaid expenses and accrued income 7,413 6,678
Accrued income tax 342 285
Total 46,525 42,729

Ageing of trade receivables (including discontinued operations)

Not fallen due 26,339 24,662
1–90 days past due 10,051 7,297
Over 90 days past due 2,624 3,589
Less provision for bad debt –1,090 –2,550
Total 37,924 32,998

Movements in the provision for impairment of trade receivables

Book value as at Jan 1 2,550 964
Change for the year –460 1,876
Receivables written off during the year –1,000 –290
Book value as at Dec 31 1,090 2,550

Material items included in prepaid expenses and accrued income

2,982 2,357
2,722 2,410
1,709 1,921
7,413 6,689

19. SHAREHOLDERS' EQUITY

All shares issued are fully paid.

EUR 1,000 Number of
shares
Share
capital
Share
premium
fund
Unrestricted
equity
reserve
Treasury
shares
Dec 31, 2014 155,793,927 1,551 165 5,102 –6,989
Board
compensation
8,763 23
Dec 31, 2015 155,802,690 1,551 165 5,102 –6,966
Deferred
payment
455,510 109 1,224
Dec 31, 2016 156,258,200 1,551 165 5,211 –5,741

The share capital amounted to 1,551,311 euro and the number of shares was 158,798,739 (including own shares 2,540,539) at the end of 2016. A share has no nominal value. Accountable par value is EUR 0.01.

Share premium fund

Proceeds from exercised warrants were recognized under the share capital and share premium fund until March 26, 2008.

Unrestricted equity reserve

On March 20, 2007, the shareholders' meeting decided to decrease the share premium fund. The decreased amount of 33,582 thousand euro was transferred to unrestricted equity reserve. On March 26, 2008, the shareholders' meeting decided that the total amount of the subscription prices paid for new shares issued after the date of the meeting, based on stock options under the F-Secure Stock Option Plan 2005, be recorded in Companys' unrestricted equity reserve. Any excess after settling treasury shares as share based incentive and as board compensation is recorded in unrestricted equity reserve.

Translation differences

The translation difference is used to record exchange difference arising from the translation of the financial statements of foreign subsidiaries.

Dividends proposed and paid

Proposed for approval at AGM for financial year 2016 is 0,12 euro per share (18.750.984 euro in total).

Final dividend for financial year 2015 was 0.12 euro per share, paid during 2016 (18,696,322.80 euro in total).

Final dividend for financial year 2014 was 0.16 euro per share, paid during 2015 (24,928,430.40 euro in total).

17. AVAILABLE-FOR-SALE FINANCIAL ASSETS

Available-for-sale financial assets consist mainly of interest-bearing debt securities and shares in funds invested in similar instruments. For assets that are actively traded in organized financial markets, fair value is determined by reference to Stock Exchange quoted market bid prices at the close of business on the balance sheet date. Net asset value (NAV) is used as a practical expedient to measure fair value for the investments in non-listed funds. Assets, for which fair value cannot be measured reliably, are recognized at cost less impairment. The fair value changes of available-for-sale financial assets are recognized in shareholders' equity under fair value reserve.

EUR 1,000 Consolidated 2016 Consolidated 2015
Fair value as at Jan 1 64,437 40,309
Additions 9,527 35,718
Decreases –11,731 –12,611
Gain on sale in the income statement 579 1,204
Change in fair value 901 –183
Impairment –43
Fair value as at Dec 31 63,671 64,437
Shares – unlisted 27 70
Shares – listed 157 128
Funds 63,487 64,240
Fair value as at Dec 31 63,671 64,437

18. CASH AND SHORT-TERM DEPOSITS

EUR 1,000 Consolidated 2016 Consolidated 2015
Cash at bank and in hand 29,050 29,919

Available-for-sale financial assets are considered a part of the Group's ongoing cash management activities. See note 23. Financial risk management objectives and policies.

29

FINANCIAL STATEMENTS F-SECURE CONSOLIDATED F-SECURE 2016

Treasury shares

Treasury shares contains the purchase value of own shares owned by the Group. The cost of acquisition is reported as a deduction in shareholders' equity. The shares were acquired through public trading on NASDAQ OMX Helsinki. The parent company has not acquired treasury shares during the period. The parent companys' treasury shares were used in a deferred payment of the 2015 acquisition.

The total number of acquired treasury shares was 2,540,539 at the end of 2016. This represents 1.60 percent of the Company's voting power on December 31, 2016.

Fair value reserve

The reserve is used to record increments and decrements in the fair value of available-for-sale financial assets.

EUR 1,000 Before tax Tax After tax Total
Fair value reserve Dec 31, 2014 627 –125 502 502
Available-for-sale, net 35 –7 28 28
Fair value gains/losses to PL –218 44 –175 –175
Fair value reserve Dec 31, 2015 444 –89 355 355
Available-for-sale, net 954 –191 763 763
Fair value gains/losses to PL –52 10 –42 –42
Fair value reserve Dec 31, 2016 1,346 –269 1,077 1,077

20. SHARE-BASED PAYMENT TRANSACTIONS

During the period the Group has had three different incentive plans which cover the key personnel of the Group.

Synthetic option-based incentive program

The synthetic option-based incentive programs have been established on November 2012 and April 2015 as part of the key employee incentive and retention system within F-Secure Group. The programs offer for the participants a possibility to receive synthetic options of F-Secure Corporation as a long-term incentive compensation. No reward can be given to any participating employee, whose employment has terminated before the end of the vesting period.

The synthetic option-based incentive programs will last five years. Both comprise three granting periods and a subsequent vesting period of two years after each granting year. The program 2012–2014 ends on December 31, 2016. The program 2015–2017 ends on December 31, 2019. Within the framework of each program, the aggregate number of options to be given as reward cannot exceed 5 million. The actual compensation is the difference of subscription price and the vesting price, and will be paid to the participating employees as a cash-settled payment.

The subscription price of the synthetic option is the weighted average share price in the period of October to December prior to the granting year. The vesting price is the weighted average share price in period of September to November prior to the payment month. The

subscription price for the granting period of 2012 is 1.85 by Board decision on November 22, 2012. The subscription price for the granting period of 2013 is 1.57. The subscription price for the granting period of 2014 is 1.88. The subscription price for the granting period 2015 is 2.01.The subscription price for the granting period of 2016 is 2.65.

Changes during the period in options outstanding

EUR 1,000 2016 2015
Outstanding Jan 1 1,455,000 Outstanding Jan 1 1,710,000
Granted 715,000 Granted 900,000
Forfeited –95,000 Forfeited –505,000
Exercised –595,000 Exercised –650,000
Expired 0 Expired 0
Outstanding Dec 31 1,480,000 Outstanding Dec 31 1,455,000

Expense arising from share-based payment transactions during the period was 1,121 thousand euro (769 thousand euro in 2015). The carrying amount of liability at December 31, 2016 was 1,715 thousand euro.

The fair value of options granted during the period was determined by using the Binomial model.

Parameters used: Synthetic option program
2016 2015
Weighted average share price EUR 2.78 3.00
Weighted average exercise price EUR
Expected volatility 29.00% 29.00%
Option life in years 2.0 2.0
Risk-free interest rate 0.63% 0.55%
Expected dividends

Expected volatility reflects the assumption that the historical volatility is indicative of future trends, which may also not necessarily be the actual outcome. Based on previous years, the company has estimated that 2–3% of granted options will be forfeited.

Share-based incentive programs

During the period the Group had one share-based incentive program. The share-based incentive program has been established as part of the key employee incentive and retention system within F-Secure Group. The program will offer for the participants a possibility to receive shares of F-Secure Corporation as an incentive reward if the Company's financial targets set for the earning period have been achieved. No reward can be given to any participating employee, whose employment has terminated before the end of the lock-up period.

The share-based incentive program 2014–2016 has been established in March 2014. The program will last five years. It comprises three earning periods. Each earning period lasts three

30

years. The program ends on December 31, 2018. The rewards will be settled in two phases so that one part is settled as equity-settled payment and one part as cash-settled payment. On the basis of the program maximum total of 10,000,000 shares and a cash payment corresponding to the registration date value of the shares shall be given as reward. The Board approves the metrics, targets and participants on annual basis for each earning period.

The participating employee shall be entitled to the shareholder rights of the reward shares (e.g. dividend) from the moment the shares have been entered into the participating employee's book-entry account.

Expense arising from the share-based payment transactions during the period was 1,356 thousand euro (–374 thousand euro in year 2015). The costs of equity-settled transactions are measured by reference to the fair value of the F-Secure Corporation share at the date on which they are granted. The costs of cash-settled transactions are measured by reference to the fair value of the F-Secure Corporation share on date of balance sheet. The Group updates the estimate of the number of equity instruments that will ultimately vest at each reporting date.

21. LIABILITIES

EUR 1,000 Consolidated 2016 Consolidated 2015
Non-current liabilities
Deferred tax liability 361 923
Deferred revenue 13,737 12,101
Other non-current liability 179 139
Provisions 158
Total 14,436 13,163
Current liabilities
Deferred revenue 40,514 35,996
Trade payables 6,556 6,864
Other liabilities 5,058 4,753
Accrued expenses 20,474 16,678
Income tax liabilities 2,516 3,981
Total 75,117 68,272
Material amounts shown under accruals and
deferred income
Accrued personnel expenses 14,984 12,598
Deferred royalty 980 1,186
Other accrued expenses 4,510 2,894
Total 20,474 16,678

22. FINANCIAL ASSETS AND LIABILITIES

EUR 1,000 Consolidated 2016 Consolidated 2015
Loans and other receivables 15 17
Trade receivables 36,390 29,189
Available-for-sale financial assets 63,671 64,437
Cash and bank accounts 29,050 29,919
Trade payables –6,556 –6,864
Total 122,570 116,697

The carrying amounts of the Group's financial instruments are equivalent to fair values.

Fair value hierarchy

The Group uses the following hierarchy for determining and disclosing the fair value of financial instruments:

Level 1: quoted prices in active markets for identical assets or liabilities

Level 2: other techniques for which all inputs which have a significant effect on the recorded fair value are observable, either directly or indirectly

Level 3: techniques which use inputs which have a significant effect on the recorded fair value that are not based on observable market data

Assets measured at fair value Total Level 1 Level 2 Level 3
Available-for-sale financial assets Dec 31, 2016 63,671 157 63,487 27
Available-for-sale financial assets Dec 31, 2015 64,437 128 64,240 70

Interest-bearing debt securities and shares in funds invested in similar instruments have been transferred to level 2 (previously level 1) as the valuation of these instruments is not based solely on quoted prices. Comparison year has been restated accordingly.

23. FINANCIAL RISK MANAGEMENT OBJECTIVES AND POLICIES

General

The goal of risk management is to identify risks that may hinder the Group from achieving its business objectives. The responsibility for the Company's risk management lies with the CEO, the management and ultimately with the Board of Directors. The risks related to the Group's financial instruments are mainly related to credit risks and foreign currency fluctuations. The Group's available-for-sale assets are also exposed to interest rate fluctuations.

Credit risk

The Group trades only with recognized, creditworthy third parties. Receivable balances are monitored and collected on an ongoing basis. The maximum exposure to credit risk at the reporting date is the carrying value of financial assets. There are no significant concentrations of credit risk within the Group. See notes 16. Receivables and 22. Financial assets and liabilities.

Liquidity risk

Despite of the economic downturn the Group's liquidity remained good. At the end of the year the market value of the available-for-sale financial assets was 63.7 million euro (64.4 million euro in 2015) and cash and bank 29.0 million euro (29.9 million euro in 2015). The Group's financial management makes cash flow forecasts regularly to ensure the financial needs of the business operations are met. The management has not identified any significant concentrations of liquidity risks in the financial assets or in sources of finance.

Foreign currency risk

The Group invoices mainly in Euros. However, there are some transactional currency exposures that arise from sales or purchasing in other currencies. The other main measurement currencies are USD, JPY, SEK, GBP and BRL. In order to minimize the impact of the fluctuation of the exchange rates, the goal is to use forward currency contracts to eliminate the currency exposure of the estimated cash flow of these currencies for a period of three months.

Derivatives

Currency instruments – Currency forward contracts

EUR 1,000 Consolidated 2016 Consolidated 2015
Nominal value 2,970 439
Fair value 14 4

F-Secure Corporation has hedged receivables denominated in USD, SEK, JPY and GBP with forward rate contracts. The forward rate contracts expire on January 26, 2017. The company does not have other derivatives.

F-Secure Corporation does not hedge investements made in its subsidiaries because the impact of changes of exchange rates would not be relevant in the Group's balance sheet.

Sales in different currencies % %
EUR 69 70
SEK, GBP 7 8
USD, JPY 16 16
Other currencies 7 6
100 100

The risk involved in the sales in foreign currency is notabaly diminished by the operational expenses in subsidiaries that use the same currency.

Financial assets and liablilities in

different currencies % %
EUR 75 75
SEK, GBP 5 7
USD, JPY 12 13
Other currencies 8 6
100 100

The table below demonstrates how sensitive the Group's profit before taxes is to reasonably possible changes in the USD, JPY, SEK, GBP and BRL exchange rate, assuming that all other variables are held constant. The analysis is based +/– 10% exchange rate change on trade receivables and does not include forward currency contracts.

USD, JPY +550/–550 +770/–770
GBP, SEK +293/–293 +300/–300
BRL +237/–237 +174/–174

Interest rate risk

The Group does not have any interest bearing liabilities. Based on the Group's conservative investment policy, it invests its cash mainly in short term and low risk funds. Investments are made in creditworthy funds. These available-for-sale investments are exposed to market risk for changes in interest risks.

The Group's objective is to maintain a balance between continuity of funding and flexibility through the use of cash and available-for-sale financial assets. See note 17 and 18.

Consolidated 2016 Consolidated 2015

Capital management

The Group's shareholders' equity is managed as capital. There are no external capital requirements related to the equity. The objective of the Group's capital management is to maintain an efficient capital structure that ensures the functioning of business operations and promotes shareholder value. The Group's capital structure is reviewed as a part of financial performance monitoring.

The capital structure can be adjusted among other things by distribution of dividends, share repurchase or capital repayment. The dividend policy of F-secure Corporation is to pay approximately half of its annual profit as dividend. Subject to circumstances, the Company may deviate from this policy.

24. ADJUSTMENTS TO CASH FLOW FROM OPERATIONS

EUR 1,000 Consolidated 2016 Consolidated 2015
Adjustments
Deferred income 5,856 4,056
Depreciation and amortization 5,610 7,871
Profit / loss on sale of fixed assets 183 –18,871
Other adjustments 4,663 –1,344
Financial income and expenses –1,547 –655
Income taxes 4,932 16,024
Total 19,696 7,082

25. OPERATING LEASE COMMITMENTS

The Group has entered into commercial leases on office space and on motor vehicles. Motor vechicle leases have an average life of three years and office space between two and five years with renewal terms included in the contracts.

Future minimum rentals payable under non-cancellable operating leases as at 31 December are as follows

As lessee

EUR 1,000 Consolidated 2016 Consolidated 2015
Within one year 5,989 4,835
After one year but not more than five years 11,482 3,603
Total 17,470 8,439
Rents during the period 5,569 4,474

26. CONTINGENT LIABILITIES

EUR 1,000 Consolidated 2016 Consolidated 2015
Other liabilities
Others 222 40

F-Secure is a party in some disputes and is defending itself accordingly. Currently the Company is not able to give an exact estimate of the likelihood or the amount of possible damages. Taking into account all available information to date the outcome is not expected to have a material impact on the financial position of the Group.

27. RELATED PARTY DISCLOSURES

The Group's related parties include Parent Company and subsidiaries, as well as members of the Board, Managing Director and members of the Leadership Team.

Compensation of key management

EUR 1,000 Consolidated 2016 Consolidated 2015
Wages and other short-term employee benefits 2,423 1,825
Share-based payments 768 755
Total 3,191 2,580

Wages and other short-term employee benefits

EUR 1,000 Consolidated 2016 Consolidated 2015
Managing Directors 631 378
Members of the Board of Directors 279 223

FINANCIAL STATEMENTS F-SECURE CONSOLIDATED F-SECURE 2016

33

Board of Directors and Managing Directors 2016

EUR 1,000 Wages Fees Incentive
reward
Christian Fredrikson, Managing Director 518
Samu Konttinen, Managing Director 113 189
Risto Siilasmaa, Chairman of the Board 69
Jussi Arovaara 38
Pertti Ervi 50
Matti Heikkonen 38
Juho Malmberg 8
Anu Nissinen 38
Bruce Oreck 30
Janne Pirttilahti 10
Total 631 279 189

Incentive reward granted to Managing Director is measured as following; the equity-settled part to the fair value of the F-Secure Corporation share at the date which it was granted and cashsettled part to the fair value of the share on the date of balance sheet. The cost is recognized over the period in which the performance conditions are fullfilled 9 June 2016–31 December 2018.

The Managing Director's retirement age and the determination of his pension conform to the standard rules specified by Finland's Employee Pension Act (TyEL). The pension cost of the Managing Director over the period was 117 thousand euro (70 thousand euro in 2015). The period of notice for the Managing Director is six (6) months both ways and Managing Director is entitled to severance payment equivalent of six (6) months' salary.

28. SUBSIDIARIES

Company Country of
incorporation
Group (%)
Parent F-Secure Corporation, Helsinki Finland
DF-Data Oy, Helsinki Finland 100
F-Secure Inc., San Jose United States 100
F-Secure (UK) Ltd, London Great-Britain 100
F-Secure KK, Tokyo Japan 100
F-Secure GmbH, Munich Germany 100
F-Secure eStore GmbH, Munich Germany 100
F-Secure SARL, Maisons-Laffitte France 100
F-Secure SDC SAS, Bordeaux France 100
F-Secure BVBA, Heverlee-Leuven Belgium 100
F-Secure AB, Stockholm Sweden 100
F-Secure Srl, Milan Italy 100
F-Secure SP z.o.o.,Warsaw Poland 100
F-Secure Corporation (M) Sdn Bhd, Kuala Lumpur Malaysia 100
F-Secure Pvt Ltd, New Delhi India 100
F-Secure Pte Ltd, Singapore Singapore 100
F-Secure B.V., Utrecht The Netherlands 100
F-Secure Limited, Hong Kong Hong Kong 100
F-Secure Pty Limited, Sydney Australia 100
F-Secure Iberia SL, Barcelona Spain 100
F-Secure do Brasil Tecnol. da Informãcao Ltda, Saõ Paulo Brazil 100
F-Secure Chile Limitada, Santiago Chile 100
F-Secure Informatica S de RL de CV, Mexico City Mexico 100
F-Secure Software (Shanghai) Co Ltd, Shanghai China 100
nSense Danmark A/S, Copenhagen Denmark 100
F-Secure Cyber Security Services Oy, Helsinki Finland 100
nSense Polska Sa, Poznan Poland 100
nSense Estonia OÛ, Tartu Estonia 100
nSense Norge AS, Baerum Norway 100

29. SHARES AND SHAREHOLDERS 31 DECEMBER 2016

Share ownership distribution by size

Shares Number of
shareholders
% of share-
holders
Total shares % of shares
1–100 3,691 17.28% 218,647 0.14%
101–1,000 13,553 63.43% 5,030,411 3.17%
1,001–50,000 4,055 18.98% 16,496,805 10.39%
50,001–100,000 52 0.24% 8,679,376 5.47%
100,001– 15 0.07% 128,373,500 80.84%
Total 21,366 100.00% 158,798,739 100.00%
Share ownership distribution by shareholder type Total shares % of shares
Corporations 7,137,226 4.49%
Financial and insurance institutions 42,416,956 26.71%
General government 21,187,237 13.34%
Non-profit organizations 339,352 0.21%
Households 86,915,378 54.73%
Other countries and international organizations 802,590 0.51%
Total 158,798,739 100.00%

Largest shareholders and administrative register

Owner Shares % of shares % of votes
Risto Siilasmaa 59,963,819 37.76% 38.37%
Varma Mutual Pension Insurance Company 8,210,660 5.17% 5.25%
Elo Mutual Pension Insurance Company 7,770,000 4.89% 4.97%
Nordea Nordic Small Cap Fund 7,294,539 4.59% 4.67%
Mandatum Life Insurance Company 5,791,936 3.65% 3.71%
The State Pension Fund 3,500,000 2.20% 2.24%
Ismo Bergroth 3,000,000 1.89% 1.92%
Kaleva Mutual Insurance Company 1,836,073 1.16% 1.18%
Ilmarinen Mutual Pension Insurance Company 1,502,835 0.95% 0.96%
Taaleritehdas Mikro Markka Fund 1,500,000 0.94% 0.96%

Administrative register

Skandinaviska Enskilda Banken 13,409,337 8.44% 8.58%
Nordea Pankki Suomi Oyj 9,857,479 6.21% 6.31%
Other registers 1,722,215 1.08% 1.10%
Other shareholders 30,899,307 19.46% 19.77%
Total 156,258,200 98.40% 100.00%
Own shares F-Secure Corporation 2,540,539 1.60%
Total 158,798,739 100.00%

Ownership of management

Board of Directors Shares % of shares
Risto Siilasmaa 59,963,819 37.76%
Pertti Ervi 46,617 0.03%
Jussi Arovaara 38,833 0.02%
Anu Nissinen 38,833 0.02%
Matti Heikkonen 20,251 0.01%
Bruce Oreck 4,809 0.00%
Janne Pirttilahti 3,603 0.00%
Total 60,116,765 37.86%
Executive team Shares % of shares
Samu Konttinen 74,603 0.05%
Jari Still 100,657 0.06%
Mari Heusala 1,800 0.00%
Mika Ståhlberg 24,263 0.02%
Jens Thonke 232,642 0.15%
Total 433,965 0.27%

Ownership of management

The Board of Directors owned a total of 60,116,765 shares on December 31, 2016. This represents 37.9 percent of the Company's shares and 38.5 percent of votes. Management ownership includes both directly owned shares and shares held by entities controlled by members of management.

FINANCIAL STATEMENTS F-SECURE CONSOLIDATED F-SECURE 2016

30. KEY FIGURES

Economic indicators IFRS
2016
IFRS
2015
IFRS
2014
IFRS
2013
IFRS
2012
Net sales (MEUR) * 158.3 147.6 137.4 155.1 157.2
Net sales growth % 7% 7% –11% –1% 8%
Operating result (MEUR) * 19.2 20.0 22.3 27.1 20.3
% of net sales 12.1% 13.6% 16.2% 17.5% 12.9%
Result before taxes (MEUR) * 20.8 20.7 23.4 26.3 19.9
% of net sales 13.1% 14.0% 17.0% 17.0% 12.7%
ROE (%) 19.9% 28.1% 20.7% 24.9% 22.6%
ROI (%) 28.6% 52.1% 26.7% 40.9% 34.9%
Equity ratio (%) 66.7% 64.1% 74.9% 74.3% 72.7%
Investments (MEUR) 6.9 14.6 5.8 3.7 10.3
% of net sales 4.4% 9.9% 4.2% 2.4% 6.6%
R&D costs (MEUR) * –28.4 26.9 30.1 41.7 49.3
% of net sales –17.9% 18.2% 21.9% 26.9% 31.4%
Capitalized development (MEUR) 3.2 2.3 2.3 0.3 4.9
Gearing % –122.1% –122.4% –76.6% –65.6% –50.9%
Wages and salaries (MEUR) –61.8 56.8 57.4 54.1 56.1
Personnel on average 981 894 937 949 970
Personnel on Dec 31 1,026 926 921 939 931
Share related key ratios IFRS
2016
IFRS
2015
IFRS
2014
IFRS
2013
IFRS
2012
Earnings / share (EUR) 0.10 0.14 0.10 0.11 0.09
Earnings / share (EUR), continuing
operations
0.10 0.08 0.12
Earnings / share (EUR) diluted 0.10 0.14 0.10 0.11 0.09
Earnings / share (EUR) diluted,
continuing operations
0.10 0.08 0.12
Shareholders' equity per share (EUR) 0.49 0.49 0.50 0.46 0.41
Dividend per share (EUR) * 0.12 0.12 0.16 0.06 0.06
Dividend per earnings (%) 122.8% 85.7% 160.0% 54.5% 66.7%
Effective dividends (%) 3.4% 4.7% 7.1% 3.2% 3.9%
P/E ratio 35.6 18.2 22.2 17.6 17.1
Share price, lowest (EUR) 2.19 2.08 1.78 1.55 1.32
Share price, highest (EUR) 3.60 3.84 2.90 2.15 2.14
Share price, average (EUR) 2.87 2.71 2.03 1.81 1.79
Share price Dec 31 (EUR) 3.48 2.58 2.25 1.87 1.55
Market capitalization (MEUR) 552.6 409.7 357.3 297.0 246.1
Trading volume (millions) 35.9 61.2 44.3 31.8 23.0
Trading volume (%) 22.6% 39.3% 28.4% 20.5% 14.9%

* Board proposal

* For 2016, 2015, and 2014, only continuing operations.

Number of shares IFRS 2016 IFRS 2015 IFRS 2014 IFRS 2013 IFRS 2012
Average during the period * 156,022,774 155,801,466 155,756,751 155,374,231 155,056,557
Average during the period,
diluted *
156,022,774 155,801,466 155,756,751 155,382,904 156,774,495
Shares on Dec 31 158,798,739 158,798,739 158,798,739 158,798,739 158,798,739
Shares on Dec 31, diluted 158,798,739 158,798,739 158,798,739 159,178,330 159,115,294

* Weighted average number of outstanding shares

Turnover and average share price per month 2016

l Average price

35

CALCULATION OF KEY RATIOS

Equity ratio, % Total equity � 100
Total assets – advance payments received
ROI, % Result before taxes + financial expenses � 100
Total assets – non-interest bearing liabilities (average)
ROE, % Result for the period � 100
Total equity (average)
Gearing, % Interest bearing liabilities – cash and bank and AFS financial assets � 100
Total equity
Earnings per share, euro Profit attributable to equity holders of the company
Weighted average number of outstanding shares
Shareholders' equity Equity attributable to equity holders of the company
per share, EUR Number of outstanding shares at the end of period
P/E ratio Closing price of the share, end of period
Earnings per share
Dividend per earnings, % Dividend per share � 100
Earnings per share
Effective dividends, % Dividend per share � 100
Closing price of the share, end of period

37

INCOME STATEMENT JAN 1–DEC 31, 2016

EUR 1,000 FAS 2016 FAS 2015
NET SALES (1) 134,108 133,176
Material and service –6,550 –5,880
GROSS MARGIN 127,558 127,296
Other operating income (2) 5,947 37,385
Sales and marketing (3, 4) –75,781 –77,749
Research and development (3, 4) –26,233 –26,705
Administration (3, 4) –10,237 –9,916
OPERATING RESULT 21,254 50,310
Financial income and expenses (6) 1,403 428
PROFIT (LOSS) BEFORE APPROPRIATIONS AND
TAXES
22,657 50,738
Change in depreciation reserve –145 229
Income taxes (7) –5,828 –13,385
RESULT FOR THE FINANCIAL YEAR 16,684 37,582

38

BALANCE SHEET DEC 31, 2016

EUR 1,000 FAS 2016 FAS 2015
ASSETS
NON-CURRENT ASSETS
Intangible assets (8) 13,456 9,342
Tangible assets (8) 1,947 2,208
Investments in group companies (9) 18,581 18,591
Total non-current assets 33,984 30,142
CURRENT ASSETS
Inventories (10) 109 134
Long-term receivables (11) 740 697
Short-term receivables (11) 45,768 46,343
Short-term investments (12) 63,670 64,437
Cash and bank accounts (13) 15,141 18,672
Total current assets 125,429 130,283
TOTAL ASSETS 159,413 160,425
EUR 1,000 FAS 2016 FAS 2015
SHAREHOLDERS' EQUITY AND LIABILITIES
SHAREHOLDERS' EQUITY (14, 15)
Share capital 1,551 1,551
Share premium 165 165
Treasury shares –5,741 –6,966
Fair value reserve 1,077 355
Reserve for invested unrestricted equity 5,211 5,102
Retained earnings 47,443 28,558
Profit for the financial year 16,684 37,582
Total shareholders' equity 66,390 66,347
APPROPRIATIONS
Depreciation reserve 1,056 911
LIABILITIES
Deferred tax liabilities (17) 269 89
Long-term liabilities (17) 12,629 11,749
Short-term liabilities (17) 79,069 81,329
Total liabilities 91,967 93,166
TOTAL SHAREHOLDERS' EQUITY
AND LIABILITIES
159,413 160,425

CASH FLOW STATEMENT JAN 1–DEC 31, 2016

EUR 1,000 FAS 2016 FAS 2015 EUR 1,000 FAS 2016 FAS 2015
Cash flow from operations Cash flow from investments
Result for the financial year 16,684 37,582 Investments in intangible and tangible assets –8,073 –4,010
Adjustments
(19)
14,138 –15,408 Investments in subsidiary shares –11,091
Cash flow from operations before change in Other investments –9,527 –35,718
working capital 30,823 22,173 Proceeds from sale of intangible and
tangible assets
22 43,912
Change in net working capital Proceeds from sale of associated companies
Current receivables, increase (–), decrease (+) 482 321 Proceeds from sale of other investments 11,731 11,407
Inventories, increase (–), decrease (+) 26 –27 Dividends received 11 12
Non-interest bearing debt, increase (+),
decrease (–)
3,959 3,989 Cash flow from investments –5,837 4,512
Cash flow from operations before financial items
and taxes
35,289 26,457 Cash flow from financing activities
Dividends paid
–18,696 –24,928
Interest expenses paid –1,003 –1
Interest income received 83 23 Cash flow from financing activities –18,696 –24,928
Other financial income and expenses –613 2,163
Income taxes paid –12,753 –3,240 Change in cash –3,531 4,986
Cash flow from operations 21,002 25,402 Cash and bank at the beginning of the period 18,672 13,686
Cash and bank at period end 15,141 18,672

For the purposes of the consolidated statement of cash flows F-Secure has previously recognized available-for-sale financial assets as part of cash equivalents. However, as the AFS assets are short term nvestments as defined under IAS 7, this has been a misstatement. The misstatement is not considered material and it has no effect on the statement of income or the statement of financial position. The AFS assets have been reclassified as of the beginning of 2016 and they are now recognized in cash flow from investments. The comparison period has been restated accordingly, resulting in the transfer of EUR –24.3 million cash flow from cash and bank to the cash flow from investments in 2015.

NOTES TO THE PARENT COMPANY FINANCIAL STATEMENTS

Basic information

F-Secure produces online security and privacy services for consumers and businesses against malware and other threats.

F-Secure Corporation is the parent company of F-Secure Group, incorporated in Finland and domiciled in Helsinki. Company's registered address is Tammasaarenkatu 7, 00180 Helsinki. Copy of consolidated financial statements can be downloaded from www.f-secure.com or can be received from the Company's registered address.

ACCOUNTING PRINCIPLES

The financial statement of F-Secure Corporation has been prepared in accordance with Finnish Accounting Standards (FAS).

Foreign currency translation

Foreign currency transactions are translated into the local currency using fixed monthly exchange rates. At the balance sheet date, assets and liabilities denominated in foreign currencies are translated at the European Central Bank rates of exchange prevailing at that date. Exchange rate gains and losses of financial transactions are recognized in the income statement under financial items. Forward rate contracts for hedging purposes are recognized using the exchange rate prevailing at the balance sheet date.

Tangible and intangible assets

Intangible assets include intangible rights and software licenses. Intangible assets recognized on merger consist of technology-based intangible assets. Tangible and intangible assets are recorded at historical cost less accumulated depreciation, amortization, and possible impairment. Depreciation and amortization is recorded on a straight-line basis over the estimated useful life of an asset. The estimated useful lives of tangible and intangible assets are as follows: Machinery and equipment 3–8 years Capitalized development costs 3–8 years Intangible rights 3–8 years Intangible assets 5–10 years

Ordinary repairs and maintenance costs are charged to the income statement during the financial period in which they are incurred. The cost of major renovations is included in the assets' carrying amount when it is probable that the Company will derive future economic benefits in excess of the originally assessed standard or performance of the existing asset. Any gain or loss arising on derecognition of the asset (calculated as the difference between the net disposal proceeds and the carrying amount of the asset) is included in the income statement.

Research and development costs

Research expenditure is recognized as an expense at the time it is incurred. Development expenditures incurred on individual projects of totally new products or product versions with significant new features are capitalized.

Inventories

Inventories are valued either by cost or net realizable value, whichever is lower. Cost is determined by first-in first-out method. Net realizable value is the estimated selling price that is obtainable, less estimated costs of completion and the estimated costs necessary to make the sale.

Leases

Leases where the lessor retains substantially all the risks and benefits of ownership of the asset are classified as operating leases. Operating lease payments are recognized as an expense in the income statement on a straight-line basis over the lease term. The Company has only operating leases.

Pensions

Pension arrangement is a local statutory arrangement, which is a defined contribution plan. Contributions to defined contribution plans are recognized in income statement in the period to which the contributions relate. The Company recognizes the disability commitment of TyEL pension plan when disability appears.

Share-based payment transactions

In F-Secure's industry it is common practice that incentives are provided to employees in the form of equity-settled share-based instruments. The Company has two kinds of incentive programs; a synthetic warrant-based program and a share-based program.

F-Secure's synthetic warrant-based programs cover the Company's key personnel. The synthetic warrant-based program is settled as cash-settled payments. The liability is valued at fair value at grant date and the expense is recognized evenly in the income statement over the vesting period. The Company revalues the liability to fair value at each reporting date. The fair value is determined by using the binomial model. The cumulative expense recognized at grant date is based on the Company's estimate of the number of warrants that will ultimately vest at the end of the vesting period. If a person leaves the Company before vesting, the warrant is forfeited. The Company updates its estimate of the ultimate number of warrants at each reporting date. Changes in the estimate are recorded in the income statement.

The share-based incentive program is targeted to the Company's key personnel. The program is divided into an equity-settled and a cash-settled part. The cash-settled part is valued at fair value at grant date, and the expense is recognized evenly in the income statement over the vesting period with the counter-entry in liabilities. The cash-settled part is revalued to fair value at each reporting date. The cumulative expense recognized at grant date is based on the Company's estimate of the number of shares that will ultimately vest at the end of the vesting period. If a person leaves the company before vesting, the reward is forfeited. The Company updates its estimate of the ultimate number of shares at each reporting date. These changes in the estimate are recorded in the income statement. The share-settled part is valued at fair value and recorded as an expense in the income statement at the end of the vesting period. Fair value is defined using the market value of the share of F-Secure Corporation.

Income taxes

Current income taxes are calculated in accordance with the local tax and accounting rules. Deferred taxes, resulting from temporary differences between the financial statement and the income tax basis of assets and liabilities, use the enacted tax rates in effect in the years in which the differences are expected to reverse.

Revenue recognition

Revenue is derived from corporate and consumer businesses. Corporate security business revenue includes cyber security products and managed services. Cyber security products comprise endpoint protection solutions (Protection Service for Business, Business Suite), as well as solutions targeted at detecting and responding to advanced attacks (Rapid Detection Service, RDS) and vulnerability management (F-Secure Radar), which may be sold either as cyber security products or as managed services. Consumer security business revenue comes through operator and direct consumer channels, and the main products include F-Secure SAFE, F-Secure Freedome, and F-Secure KEY.

Cyber security product sales include license sales. In the corporate and direct consumer businesses, license agreements consist of initial license agreements and periodic maintenance agreements covering product updates and customer support. License fee revenue included in those agreements is recognized when the product is initially delivered, whereas the license agreements' maintenance revenue is recognized over the maintenance period. In the operator business, most of the license sales are usage-based and booked based on usage reports, but there are also fixed price operator agreements. The terms of these agreements vary significantly and their revenue recognition is therefore defined case-by-case.

Service revenue is recognized at the time of delivery of the service.

Other operating income

Other operating income includes e.g. profits from the sale of fixed assets, rental revenue, and government grants received for research and development projects.

Presentation of expenses

Classification of the functionally presented expenses has been made by presenting direct expenses in their respective functions and by allocating other expenses to operations on the basis of average headcount in each function.

Treasury shares

The company has acquired treasury shares in 2008–2011. The purchase price of the shares has been deducted from equity.

Financial assets

Short-term investments are measured at fair value. Short-term investments consist of interest-bearing debt securities and shares in mutual funds invested in similar instruments. For assets that are actively traded in organized financial markets, fair value is determined by reference to Stock Exchange quoted market bid prices at the close of business on the balance sheet date. Assets, for which the fair value of which cannot be measured reliably, are recognized at cost less impairment. The fair value changes of short-term investments are recognized in shareholders' equity under fair value reserve. When financial assets recognized as available-for-sale are sold, the accumulated fair value changes are released from equity and recognized in the income statement.

Cash and cash equivalents in the balance sheet comprise cash at bank and in hand and other highly liquid short-term investments.

FINANCIAL STATEMENTS F-SECURE CORPORATION F-SECURE 2016

42

1. NET SALES

EUR 1,000 FAS 2016 FAS 2015
Geographical information
Nordic countries 43,380 41,727
Rest of Europe 68,294 70,807
North America 8,354 5,495
Rest of the world 14,080 15,147
Total 134,108 133,176

2. OTHER OPERATING INCOME

EUR 1,000 FAS 2016 FAS 2015
Rental revenue 67 52
Government grants 3,759 3,302
Sale of personal cloud business operations 31,484
Other 2,121 2,547
Total 5,947 37,385

3. DEPRECIATION, AMORTIZATION, AND IMPAIRMENT

EUR 1,000 FAS 2016 FAS 2015
Depreciation and amortization of non-current
assets
Other intangible assets –993 –1,355
Capitalized development –2,001 –1,467
Intangible assets –2,995 –2,822
Machinery and equipment –1,262 –2,778
Tangible assets –1,262 –2,778
Total depreciation and amortization –4,257 –5,601
Depreciation and amortization by function
Sales and marketing –1,613 –3,345
Research and development –2,509 –2,132
Administration –135 –124
Total depreciation and amortization –4,257 –5,601

4. PERSONNEL EXPENSES

EUR 1,000 FAS 2016 FAS 2015
Personnel expenses
Wages and salaries –34,408 –33,526
Pension expenses –6,019 –5,863
Other social expenses –2,130 –1,818
Total –42,557 –41,207
Compensation of key management personnel
Wages and other short-term employee benefits –2,240 –1,735
Wages and other short-term employee
benefits
Managing Directors –631 –378
Members of the Board of Directors –279 –223

Wages and other short-term employee benefits of the Board of Directors and Managing Director: see group disclosure 27. Related party disclosure.

The Managing Director's retirement age and the determination of his pension conform to the standard rules specified by Finland's Employee Pension Act (TyEL). The pension cost of the Managing Director over the period was 117 thousand euro (70 thousand euro in year 2015). The period of notice for the Managing Director is six (6) months both ways and Managing Director is entitled to severance payment equivalent of six (6) months' salary.

FAS 2016 FAS 2015
Average number of personnel 555 505
Personnel by function Dec 31
Sales and marketing 230 222
Research and development 253 228
Administration 47 47
Total 530 497

5. AUDIT FEES

EUR 1,000 FAS 2016 FAS 2015
Audit fees, PricewaterhouseCoopers –139
Audit fees, Ernst&Young –78 –138
Tax consulting, Ernst&Young –65 –56
Other consulting, PricewaterhouseCoopers –77
Other consulting, Ernst&Young –43 –147
Total –403 –342

FINANCIAL STATEMENTS F-SECURE CORPORATION F-SECURE 2016

43

6. FINANCIAL INCOME AND EXPENSES

EUR 1,000 FAS 2016 FAS 2015
Interest income 83 23
Interest expense –11 –1,013
Other financial income 581 1,205
Dividends 11 12
Exchange gains and losses 724 140
Other financial expenses 15 59
Total 1,403 428

Interest expense in 2015 includes EUR 0.9 million late payment interest related to withholding taxes from 2009–2011.

Other taxes consist mainly of non-creditable withholding taxes.

The Finnish tax authority conducted a partial tax audit of F-Secure Corporation concerning withholding taxes in 2015. Based on the audit, the tax authority considers the revenue F-Secure Corporation has received from certain countries not to be royalties as defined in the tax agremeents between Finland and these countries, but rather business profits. As a result, the tax

7. INCOME TAXES

EUR 1,000 FAS 2016 FAS 2015
Income tax for the year –5,740 –11,323
Adjustments for income tax of prior periods –87 –2,062
Total –5,828 –13,385
Result before tax 22,657 50,738
Income tax at statutory rate of 20.0% –4,531 –10,148
Tax-exempt income 0 4
Non-deductible expenses –185 –616
Adjustments for income tax of prior periods –87 –2,062
Other –1,023 –562
Total –5,828 –13,385

authority reassessed the company's taxation so that withholding taxes paid to these countries are not credited in the Finnish taxation, and tax credits received by the company for years 2009–2011 were reclaimed. Based on the reassessment decisions, F-Secure recorded EUR 2.1 million of additional withholding taxes and EUR 0.9 million of late payment interest in its 2015 financial statements. F-Secure has appealed the reassessment decisions with the Tax Administration's Board of Adjustment.

8. NON-CURRENT ASSETS INTANGIBLE ASSETS TANGIBLE ASSETS Other intangible Capitalized development Advance payments Total Machinery & equipment Other tangible Total Acquisition cost Jan 1, 2015 30,283 18,620 1,056 49,959 20,925 5 20,930 Additions 985 1,989 2,974 1,207 1,207 Disposals –12,733 –8,987 –21,720 –844 –844 Acquisition cost Dec 31, 2015 18,536 9,633 3,044 31,214 21,288 5 21,293 Additions 2,312 211 4,586 7,109 1,001 1,001 Transfers 3,526 –3,526 0 Disposals –1,125 –731 –1,856 –238 –238 Acquisition cost Dec 31, 2016 19,723 12,639 4,104 36,466 22,051 5 22,056 Acc. depreciation Jan 1, 2015 –20,727 –8,465 –29,192 –17,067 –17,067 Depreciation for the period –1,355 –1,467 –2,822 –2,778 –2,778 Acc. depreciation of disposals 5,941 4,202 10,143 760 760 Acc. depreciation Dec 31, 2015 –16,142 –5,731 –21,871 –19,085 –19,085 Depreciation for the period –993 –2,001 –2,995 –1,262 –1,262 Acc. depreciation of disposals 1,125 731 1,856 238 238 Acc. depreciation Dec 31, 2016 –16,010 –7,001 –23,010 –20,108 –20,108 Book value as at Dec 31, 2015 2,394 3,903 3,044 9,342 2,203 5 2,208 Book value as at Dec 31, 2016 3,713 5,639 4,104 13,456 1,942 5 1,947

9. INVESTMENTS IN GROUP COMPANIES

EUR 1,000 Shares in group
companies
Total
Book value as at Jan 1 18,591 18,591
Decrease –10 –10
Book value as at Dec 31 18,581 18,581
Company Country of
incorporation
Share of
ownership (%)
Parent F-Secure Corporation, Helsinki Finland
DF-Data Oy, Helsinki Finland 100
F-Secure Inc., San Jose United States 100
F-Secure (UK) Ltd, London Great Britain 100
F-Secure KK, Tokyo Japan 100
F-Secure GmbH, Munich Germany 100
F-Secure eStore GmbH, Munich Germany 100
F-Secure SARL, Maisons-Laffitte France 98
F-Secure SDC SAS, Bordeaux France 100
F-Secure BVBA, Heverlee-Leuven Belgium 100
F-Secure AB, Stockholm Sweden 100
F-Secure Srl, Milan Italy 100
F-Secure SP z.o.o., Warsaw Poland 100
F-Secure Corporation (M) Sdn Bhd, Kuala Lumpur Malaysia 100
F-Secure Pvt Ltd, New Delhi India 100
F-Secure Pte Ltd, Singapore Singapore 100
F-Secure B.V., Utrecht The Netherlands 100
F-Secure Limited, Hong Kong Hong Kong 100
F-Secure Pty Limited, Sydney Australia 100
F-Secure Iberia SL, Barcelona Spain 100
F-Secure Chile Limitada, Santiago Chile 99
F-Secure Informática S. de R.L. de C.V, Mexico City Mexico 100
nSense Danmark A/S, Copenhagen Denmark 100

45

10. INVENTORIES

EUR 1,000 FAS 2016 FAS 2015
Other inventories 109 134

11. RECEIVABLES

EUR 1,000 FAS 2016 FAS 2015
Non-current
Other receivables 69
Total 69
Receivables from group companies
Other receivables 671 697
Total 671 697
Non-current receivables total 740 697
Current receivables
Trade receivables 24,270 25,008
Loan receivables 15 17
Other receivables 532 4,791
Prepaid expenses and accrued income 6,947 5,954
Total 31,764 35,770
Receivables from group companies
Trade receivables 14,004 10,570
Other receivables 3
Total 14,004 10,572
Current receivables total 45,768 46,343
Material items included in prepaid expenses
and accrued income
Prepaid royalty 2,982 2,357
Grant receivables 2,657 2,328
Other prepaid expenses 1,308 1,269
Total 6,947 5,954

12. SHORT-TERM INVESTMENTS

Short-term investments consist mainly of interest-bearing debt securities and shares in funds invested in similar instruments. For assets that are actively traded in organized financial markets, fair value is determined by reference to Stock Exchange quoted market bid prices at the close of business on the balance sheet date. Net asset value (NAV) is used as a practical expedient to measure fair value for the investments in non-listed funds. Assets, for which fair value cannot be measured reliably, are recognized at cost less impairment. The fair value changes of short-term investments are recognized in shareholders' equity under fair value reserve.

EUR 1,000 FAS 2016 FAS 2015
Fair value as at Jan 1 64,437 40,309
Additions 9,527 35,718
Decreases –11,152 –11,407
Change in fair value 901 –183
Impairment –43
Fair value as at Dec 31 63,670 64,437
Shares – unlisted 26 70
Shares – listed 157 128
Funds 63,487 64,240
Fair value as at Dec 31 63,670 64,437
Original purchase price as at Dec 31 62,325 63,992

13. CASH AND SHORT-TERM DEPOSITS

EUR 1,000 FAS 2016 FAS 2015
Cash at bank and in hand 15,141 18,672

14. STATEMENT OF CHANGES IN SHAREHOLDERS' EQUITY

Parent Company Unrestricted
EUR 1,000 Share capital Share premium
fund
Treasury
shares
Fair value
reserve
equity
reserve
Retained
earnings
Total equity
Equity Dec 31, 2014 1,551 165 –6,989 502 5,102 53,487 53,817
Available-for-sale financial assets, net –146 –146
Result of the financial year 37,582 37,582
Dividend –24,928 –24,928
Other change 23 0 23
Equity Dec 31, 2015 1,551 165 –6,965 355 5,102 66,140 66,348
Available-for-sale financial assets, net 721 721
Result of the financial year 16,684 16,684
Dividend –18,696 –18,696
Other change 1,224 109 1,333
Equity Dec 31, 2016 1,551 165 –5,741 1,077 5,211 64,128 66,390

FINANCIAL STATEMENTS F-SECURE CORPORATION F-SECURE 2016

15. SHAREHOLDERS' EQUITY

The Company's share capital amounted to 1,551,311 euro and the number of shares was 158,798,739 at the end of the year 2016. See group disclosure 19. Shareholders' Equity.

Treasury shares

See group disclosure 19. Shareholders' Equity.

Distributable shareholders' equity on December 31, 2016

EUR 1,000
Unrestricted equity reserve 5,211
Retained earnings 41,703
Result of the financial year 16,684
Less capitalized development expense –5,639
Distributable shareholders' equity on December 31, 2016 57,960

16. SHARE-BASED PAYMENT TRANSACTIONS

See group disclosure 20. Share-based payment transactions.

17. LIABILITIES

EUR 1,000 FAS 2016 FAS 2015
Non-current liabilities
Deferred revenue 10,224 9,244
Deferred tax liabilites
Tax charged to shareholders' equity
– Change in fair value, available-for-sale financial
assets
269 89
Total 10,493 9,332
Liabilities to Group companies
Other liabilities 2,405 2,505
Total 2,405 2,505
Total non-current liabilities 12,898 11,837
Current liabilities
Deferred revenue 30,647 28,414
Trade payables 4,275 5,541
Other liabilities 6,402 9,731
Accrued expenses 17,112 22,307
Total 58,437 65,993

Other liabilites includes the purchase price of nSense as a deferred payment of EUR 2.7 million in shares and earn-out element worth of EUR 2.1 milloin in cash subject to the achievement of certain milestones.

Liabilities to Group companies
Advance payments 6,563 5,013
Trade payables 14,069 10,323
Total 20,632 15,336
Total current liabilities 79,069 81,329
Material amounts shown under accruals and
deferred income
Accrued personnel expenses 10,639 9,345
Deferred royalty 980 1,186
Accrued expenses 3,637 1,994
Accrued tax 1,856 9,782
Total 17,112 22,307

18. FINANCIAL RISK MANAGEMENT OBJECTIVES AND POLICIES

See Group disclosure 23. Financial risk management objectives and policies.

19. ADJUSTMENTS TO CASH FLOW FROM OPERATIONS

EUR 1,000 FAS 2016 FAS 2015
Adjustments
Deferred income 3,053 1,811
Depreciation and amortization 4,257 5,601
Profit / loss on sale of fixed asset 31 –32,348
Other adjustments 2,373 –3,430
Financial income and expenses –1,403 –428
Income taxes 5,828 13,385
Total 14,138 –15,408

20. OPERATING LEASE COMMITMENTS

The Group has entered into commercial leases on office space and on motor vehicles. Motor vehicle leases have an average life of three years and office space between two and five years with renewal terms included in the contracts.

Future minimum rentals payable under non-cancellable operating leases as at 31 December are as follows:

As lessee

EUR 1,000 FAS 2016 FAS 2015
Within one year 3,262 2,704
After one year but not more than five years 8,078 751
Total 11,340 3,455

21. CONTINGENT LIABILITIES

EUR 1,000 FAS 2016 FAS 2015
Guarantees for other group companies 101 40
Other liabilities
Others 121

Derivatives see Group disclosure 23. Financial risk management objectives and policies.

22. SHARES AND SHAREHOLDERS

See Group disclosure 29. Shares and shareholders.

23. KEY RATIOS

See Group disclosure 30. Key ratios.

49

AUDITOR'S REPORT

(Translation from the Finnish Original)

To the Annual General Meeting of F-Secure Oyj

Report on the audit of the financial statements

Opinion

In our opinion,

  • the consolidated financial statements give a true and fair view of the financial position, financial performance, and cash flows of the group in accordance with International Financial Reporting Standards (IFRS) as adopted by the EU
  • the financial statements give a true and fair view of both the consolidated and the parent company's financial performance and financial position in accordance with the laws and regulations governing the preparation of the financial statements in Finland and comply with statutory requirements.

What we have audited

We have audited the financial statements of F-Secure Oyj (Business ID: 0705579–2) for the year ended 31 December, 2016. The financial statements comprise:

  • the consolidated statement of financial position, income statement, statement of comprehensive income, statement of changes in equity and statement of cash flows, and notes to the consolidated financial statements, which include a summary of significant accounting policies; and
  • the parent company's balance sheet, income statement, cash flow statement and notes to the financial statements

Basis for opinion

We conducted our audit in accordance with good auditing practice in Finland. Our responsibilities under good auditing practice are further described in the Auditor's responsibilities for the audit of the financial statements section of our report.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Independence

We are independent of the parent company and of the group in accordance with the ethical requirements that are relevant to our audit of the financial statements in Finland, and we have fulfilled our other ethical responsibilities in accordance with these requirements.

Our audit approach

Overview

  • Overall group materiality: EUR 1,200,000, which represents 5% of adjusted profit before tax.
  • Audit scope: We have audited parent company and we have performed audit procedures related to the most significant subsidiary. In addition, we have performed group level procedures over specific consolidated accounts and analytical procedures to assess unusual movements across all entities.
  • Revenue recognition
  • Creditability of foreign withholding taxes in parent company's taxation

As part of designing our audit, we determined materiality and assessed the risks of material misstatement in the financial statements. In particular, we considered where management made subjective judgements; for example, in respect of significant accounting estimates that involved making assumptions and considering future events that are inherently uncertain.

Materiality

The scope of our audit was influenced by our application of materiality. An audit is designed to obtain reasonable assurance whether the financial statements are free from material misstatement. Misstatements may arise due to fraud or error. They are considered material if individually or in aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements.

Based on our professional judgement, we determined certain quantitative thresholds for materiality, including the overall group materiality for the consolidated financial statements as set out in the table below. These, together with qualitative considerations, helped us to determine the scope of our audit and the nature, timing and extent of our audit procedures and to evaluate the effect of misstatements on the financial statements as a whole.

Overall group materiality EUR 1,200,000
How we determined it 5% of adjusted profit before tax. Profit before
tax is adjusted for accrued costs of earn-out
payments related to acquisition of nSense as
those costs are considered as non-recurring in
nature.
Rationale for the materiality
benchmark applied
We chose adjusted profit before tax as the
benchmark because, in our view, it is the
benchmark against which the performance of
the Group is most commonly measured by users,
and is a generally accepted benchmark. We
chose 5% which is within the range of acceptable
quantitative materiality thresholds in auditing
standards.

How we tailored our group audit scope

We tailored the scope of our audit, taking into account the structure of the Group, the accounting processes and controls, and the industry in which the Group operates.

Group operates globally through several legal entities. Group's sales are mainly generated by the parent company and we have audited the parent company as part of our audit of the consolidated financial statements. In addition, we have performed audit procedures related to the most significant subsidiary. We have considered that the remaining subsidiaries don't present a reasonable risk of material misstatement for consolidated financial statements and thus our procedures have been limited to targeted audit procedures over significant balances and to analytical procedures performed at Group level.

By performing the procedures above at legal entities, combined with additional procedures at the Group level, we have obtained sufficient and appropriate evidence regarding the financial information of the Group as a whole to provide a basis for our opinion on the consolidated financial statements.

Key audit matters

Key audit matters are those matters that, in our professional judgment, were of most significance in our audit of the financial statements of the current period. These matters were addressed in the context of our audit of the financial statements as a whole, and in forming our opinion thereon, and we do not provide a separate opinion on these matters.

As in all of our audits, we also addressed the risk of management override of internal controls, including among other matters consideration of whether there was evidence of bias that represented a risk of material misstatement due to fraud.

Key audit matter in the audit of the Group

Revenue recognition

Accounting principles for the consolidated financial statements (note 1)

Revenue is derived from corporate and consumer businesses. Corporate security business revenue includes cyber security products, managed services, and cyber security consulting. Consumer security business revenue comes through operator and direct consumer channels.

In the corporate and direct consumer businesses, license agreements consist of initial license agreements and periodic maintenance agreements covering product updates and customer support. License fee revenue included in those agreements is recognized when the product is initially delivered, whereas the license agreements' maintenance revenue is recognized over the maintenance period. In the operator business, most of the license sales are usage-based and booked based on usage reports, but there are also fixed price operator agreements. The terms of these agreements vary significantly and their revenue recognition is therefore defined case-by-case.

Service revenue, including cyber security consulting and managed services, is recognized at the time of delivery of the service.

Judgment is applied related to timing of revenue recognition of fixed priced operator agreements as those contracts are typically negotiated separately and different contract terms could have significant impact on revenue recognition. In addition, there is judgement involved in assessing timing of revenue recognition for other contracts especially related to allocation of license agreement revenues between license revenue and maintenance revenue.

Due to materiality and judgment associated with the timing of revenue recognition we have considered timing of revenue recognition as key audit matter in the audit of the Group.

How our audit addressed the Key audit matter

We evaluated the design and tested the operating effectiveness of controls over revenue recognition.

We tested sample of invoices recognized during the year.

We assessed appropriateness of the company's revenue recognition policy and tested sample of revenue agreements to ensure those have been recognized based on contractual terms and based on the company's revenue recognition policy. We have also tested deferred revenue on a sample basis to assess appropriateness of revenue recognition.

In addition, we tested sample of fixed priced agreements.

51

Key audit matter in the audit of the Group

Withholding taxes

The parent company sells software products globally and in certain countries these sales are subject to withholding taxes. These taxes withheld can be deducted in Finnish taxation if the company generates taxable income and these withholding taxes have originated from royalties as meant by the tax treaties between Finland and other countries. As mentioned in the note 10, the Group recognized material tax charge in 2015 based on the reassessment decision obtained from the Finnish tax authority.

Due to materiality and judgment associated with the withholding taxes we have considered withholding taxes as key audit matter in the audit of the Group.

How our audit addressed the Key audit matter

We tested sample of withholding taxes paid in foreign countries that were treated as foreign tax credit in the parent company's taxation. We assessed the creditability against tax treaties between Finland and respective countries and against tax audit report related to the parent company's tax audit for years 2009–2011.

We have no key audit matters to report with respect to our audit of the parent company financial statements.

Responsibilities of the Board of Directors and the Managing Director for the financial statements

The Board of Directors and the Managing Director are responsible for the preparation of consolidated financial statements that give a true and fair view in accordance with International Financial Reporting Standards (IFRS) as adopted by the EU, as well as for the preparation of financial statements that give a true and fair view in accordance with the laws and regulations governing the preparation of the financial statements in Finland and comply with statutory requirements. The Board of Directors and the Managing Director are also responsible for such internal control as they determine is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, the Board of Directors and the Managing Director are responsible for assessing the Group's ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless they either intend to liquidate the Group or to cease operations, or have no realistic alternative but to do so.

Auditor's responsibilities for the audit of the financial statements

Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor's report that includes our opinion. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit conducted in accordance with good auditing practice will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these financial statements.

As part of an audit in accordance good auditing practice, we exercise professional judgment and maintain professional skepticism throughout the audit. We also:

  • Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinion. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control.
  • Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the parent company's or the group's internal control.
  • Evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by management.
  • Conclude on the appropriateness of the Board of Directors' and the Managing Director's use of the going concern basis of accounting and based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on the parent company's or the group's ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in our auditor's report to the related disclosures in the financial statements or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditor's report. However, future events or conditions may cause the parent company or the group to cease to continue as a going concern.
  • Evaluate the overall presentation, structure and content of the financial statements, including the disclosures, and whether the financial statements represent the underlying transactions and events in a manner that achieves fair presentation.
  • Obtain sufficient appropriate audit evidence regarding the financial information of the entities or business activities within the group to express an opinion on the consolidated financial statements. We are responsible for the direction, supervision and performance of the group audit. We remain solely responsible for our audit opinion.

We communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

We also provide those charged with governance with a statement that we have complied with relevant ethical requirements regarding independence, and to communicate with them

FINANCIAL STATEMENTS F-SECURE CORPORATION F-SECURE 2016

all relationships and other matters that may reasonably be thought to bear on our independence, and where applicable, related safeguards.

From the matters communicated with those charged with governance, we determine those matters that were of most significance in the audit of the financial statements of the current period and are therefore the key audit matters. We describe these matters in our auditor's report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Other reporting requirements

Other information

The Board of Directors and the Managing Director are responsible for the other information. The other information comprises information included in the report of the Board of Directors and in the annual report, but does not include the financial statements and our auditor's report thereon. We obtained the report of the Board of Directors prior to the date of this auditor's report and the Annual report is expected to be made available to us after the date of this auditor's report.

Our opinion on the financial statements does not cover the other information.

In connection with our audit of the financial statements, our responsibility is to read the other information identified above and, in doing so, consider whether the other information is materially inconsistent with the financial statements or our knowledge obtained in the audit, or otherwise appears to be materially misstated. With respect to the report of the Board of Directors our responsibility also includes considering whether the report of Board of Directors has been prepared in accordance with the applicable legal requirements.

In our opinion,

  • the information in the report of the Board of Directors is consistent with the information in the financial statements
  • the report of the Board of Directors has been prepared in accordance with the applicable legal requirements.

If, based on the work we have performed on the other information that we obtained prior to the date of this auditor's report, we conclude that there is a material misstatement of this other information, we are required to report that fact. We have nothing to report in this regard.

Helsinki February 15th 2017

PricewaterhouseCoopers Oy Authorised Public Accountants

Janne Rajalahti Authorised Public Accountant

F-SECURE'S CORPORATE GOVERNANCE STATEMENT 2016

General governing principles

F-Secure's corporate governance practices comply with applicable Finnish laws as well as the rules, regulations and guidelines of NASDAQ Helsinki Oy and the Finnish Financial Supervisory Authority. This statement has been prepared in accordance with the Finnish Corporate Governance Code (publicly available at http://cgfinland.fi/en/) issued by the Securities Market Association of Finland in 2015.

Up-to-date information about F-Secure's governance is available on the Company's website at www.f-secure.com/ investors.

2016:

In July, governance of insider issues was updated to comply with the new Market Abuse Regulations (EU, N:o 596/2014, "MAR"), effective as of 3 July 2016. More information is available in the "Insider issues" section of this statement.

Governing bodies

F-Secure's ultimate decision-making body is the General Meeting of Shareholders. The Board of Directors is responsible for F-Secure's strategy and overseeing and monitoring the Company's business. The CEO, assisted by the Leadership Team, is responsible for managing the Company's business and implementing its strategic and operational targets.

General Meeting of Shareholders

Under the Limited Liability Companies Act, shareholders exercise their decision-making power at the General Meetings.

The General Meeting is normally held once a year as an Annual General Meeting (AGM). A shareholder may propose items to be included on the agenda provided they are within the authority of the meeting and the Board of Directors has been informed of the requests in due time. The invitation to the AGM is published on the Company's website.

The AGM decides on matters stipulated by the Company's Articles of Association and the Limited Liability Companies Act, including:

  • the adoption of the Financial Statements
  • the distribution of profit for the year
  • discharging the members of the Board of Directors and CEO from liability
  • the selection of members of the Board and the decision on their remuneration
  • the election of the auditor and the decision on auditor's remuneration, and
  • other proposals made by the Board or shareholders Each share carries one vote in the General Meeting.

2016:

The AGM was held on 7 April 2016 at F-Secure premises in Helsinki.

Further details on the resolutions by the AGM are available on the Company website (release published on 7 April 2016) and in the Board of Directors report in the Annual Report.

Board of Directors

The objective of the Board of Directors is to direct the Company with the aim of achieving the best possible return on invested capital for shareholders in the long term.

The Board's responsibilities and duties are defined in detail in the Board's Charter (available on the Company website) and cover the following main areas:

  • approving the strategy of F-Secure, overseeing its operations and annual budgets
  • approving any major investments, acquisitions, changes in corporate structure or other significant decisions
  • ensuring that the supervision of the Company's accounting and financial management is duly organized
  • ensuring that internal control and risk management systems are in place
  • approving personnel policies and rewards systems
  • preparing matters to be handled by the General Meeting

F-SECURE 2016 54

Members of the Board of Directors

Members Independence of the
Company
Independence of major
shareholders
Board
(Meeting attendance)
Audit Committee
(Meeting attendance)
Executive Committee
(Meeting attendance)
Risto Siilasmaa Yes No 1) Chairman (14/14) Chairman (4/4)
Pertti Ervi Yes Yes Vice Chairman (13/14) Chairman (4/4)
Jussi Arovaara Yes Yes Member (14/14) Member (4/4)
Matti Heikkonen Yes Yes Member (10/14) Member (0/1)
(until 7 Apr 2016)
Juho Malmberg (until 7 Apr 2016) Yes Yes Member (2/3) Member (2/2)
Anu Nissinen Yes Yes Member (12/14) Member (2/2)
Bruce Oreck (as of 7 Apr 2016) Yes Yes Member (6/11) Member 2/3
Janne Pirttilahti (as of 7 Apr 2016) No 2) Yes Member (11/11) Member 3/3

1) Risto Siilasmaa is the founder of F-Secure and on 31 December 2016 owned 37,76% of F-Secure shares.

2) Janne Pirttilahti was elected from F-Secure Corporation's personnel, according to the process described below.

The Board of Directors meets as frequently as necessary, at least five times during its term. The Board of Directors has quorum when more than half of the members are present. An annual self-assessment is carried out by the Board to evaluate its operations.

In accordance with F-Secure's Articles of Association, the Board of Directors comprises three to seven members, which are elected at the Annual General Meeting for a period of office that extends to the following AGM. The majority of Board members shall be independent from the Company and from its major shareholders.

One member of the Board of Directors is elected from F-Secure Corporation's personnel in the following manner: an election is arranged for F-Secure personnel. Each permanent employee of F-Secure Corporation is eligible as a candidate. The Executive Committee interviews three persons who have obtained the highest number of votes in the elections, and chooses a candidate from amongst them to be proposed for election as a new member of the Board by the Annual General Meeting.

The Board's Executive Committee prepares the proposals for board candidates to be approved by the shareholders at the General Meeting. Proposals are based on candidates' skills and qualifications and on maintaining diversity on the Board of Directors. Currently both genders are represented in the Board of Directors.

For a detailed description of the members of the Board of Directors and their shareholdings see pages 58–60.

Board Committees

The Board has two permanent Committees: Audit Committee and Executive Committee (nomination and remuneration issues). The duties of both Committees are defined in their charters, available on the Company's website.

Audit Committee

The Audit Committee reviews, instructs and evaluates risk management, internal controls, IT strategy and practices, financial reporting as well as auditing of the accounts. The Audit Committee also prepares proposal for the election of auditor to the Board of Directors and regularly considers the need for a separate internal audit function. Members of the Audit Committee must have broad business knowledge, as well as an adequate knowledge of and experience in financial and supervisory matters.

Members of the Audit Committee are listed in the table in the previous section. According to the Finnish Corporate Governance Code, majority of the members of an audit committee must be independent of the company.

2016:

The charter of the Audit Committee was revised. While previously the Audit Committee directly proposed the election of the auditor to the Annual General Meeting, the Committee now prepares the proposal for the Board of Directors.

Executive Committee

The Executive Committee prepares material and instructs with issues related to the composition and compensation of the Board of Directors and the remuneration and incentives of key managerial personnel. The Committee also prepares the proposals for the Board composition and remuneration for the Annual General Meeting of Shareholders.

Members of the Executive Committee are listed in the table in the previous section.

Management remuneration

Compensation for members of the Board of Directors, the CEO and the members of the Leadership Team of the Group:

2016 2015
Wages and other short-term employee benefits 2,423 1,825
Share-based payments 768 755
Total 3,191 2,580

Compensation for Board of Directors and CEO:

Wages Fees Incentive
reward
Other
compensations
Christian Fredrikson, CEO (until 31 July 2016) 518
Samu Konttinen, CEO (as of 1 August 2016) 113 189
Risto Siilasmaa, Chairman of the Board 69
Jussi Arovaara 38
Pertti Ervi 50
Matti Heikkonen 38
Juho Malmberg (until 7 Apr 2016) 8
Anu Nissinen 38
Bruce Oreck (as of 7 April 2016) 30
Janne Pirttilahti (as of 7 April 2016) 10
Total 631 279 189 0

President and CEO

The Board of Directors appoints the CEO and decides upon his/ her remuneration and other benefits. The CEO is responsible for the day-to-day management of the Company. His/her duties include:

  • managing the business according to the instructions issued by the Board of Directors
  • presenting the matters to be handled in the Board of Directors' meetings
  • implementing the decisions made by the Board of Directors
  • other duties determined in the Limited Liability Companies Act

For a description of the CEO and his shareholdings see page 61 and for his remuneration see Annual Report, Notes to financial statements, 28. Related party disclosures.

Leadership Team

The Leadership Team supports the CEO in the daily operative management and development of the Company. The CEO appoints the Leadership Team members and decides upon the terms and conditions of their employment.

2016:

Members of the Company's Leadership Team on 31 December 2016 were:

  • Samu Konttinen, CEO
  • Mari Heusala, Executive Vice President, Human Resources and Office Services
  • Kristian Järnefelt, Executive Vice President, Consumer Business Unit
  • Saila Miettinen-Lähde, Chief Financial Officer
  • Jyrki Rosenberg, Executive Vice President, Corporate Security Business Unit
  • Jari Still, Vice President, Chief Information Officer
  • Mika Ståhlberg, Chief Technology Officer
  • Jens Thonke, Executive Vice President, Cyber Security Services
  • Jyrki Tulokas, Executive Vice President, Strategy & Corporate Development

Current information on the F-Secure Leadership Team can be found on our website: www.f-secure.com/investors.

For descriptions of all members of the Leadership Team as of 1 January 2016 until the publication of this statement, their roles, respective membership periods and shareholdings see pages 61 –64 this document.

F-SECURE 2016

F-SECURE 2016 56

CONTROLS AND OTHER GOVERNANCE ISSUES

MAIN FEATURES OF INTERNAL CONTROL AND RISK MANAGEMENT SYSTEMS PERTAINING TO THE FINANCIAL REPORTING PROCESS

Risk management

Risk management is used as a tool to help managers make better risk-balanced decisions in an uncertain environment. The objective of F-Secure's risk management is to ensure a current, correct and comprehensive understanding and prioritized management of key uncertainties related to strategy implementation and business operations.

The foundation for risk management is defined in the Company's Risk Management Policy. The Board of Directors approves the Risk Management Policy and determines the Company's overall attitude towards risks. The Board of Directors and its Audit Committee monitor the Company's key risks and related controls and the effective implementation of the policy. The Audit Committee annually conducts a key risk review and evaluates the effectiveness of the risk management framework. The risk management framework consists of risk management responsibilities, related policies, operating principles and tools.

The CEO and Leadership Team are accountable to the Board for approving the Company's risk management standards and ensuring that they are applied in a consistent manner across the organization. The Leadership Team conducts a Companylevel risk review biannually as part of the operational planning and approves the Company-level risk profile.

The Corporate Risk Management function provides and maintains a process to identify, analyze, evaluate, and treat risks. Risk assessment is regularly conducted and aligned with the Company strategy process and annual operational planning. Risk management processes follow an annual cycle including both top-down and bottom-up reviews.

The same tools are applied to assess uncertainties related to key projects and business decisions, e.g. M&A transactions, major investments and new business initiatives.

Major risks

Risks are defined as uncertainties which can impact the achievement of the Company's short and long term objectives. Risks are assessed as a combination of probability and impact.

F-Secure uses the following categories to group the risks: strategic, operational, financial and compliance risks.

The most significant risks for F-Secure are related to the following factors:

  • Volatility of the economic environment and its potential impact on business volumes
  • Security market transformation and changes in customer demand
  • Changes in the competitive environment
  • Potential loss of key customers and partnerships
  • Failure to attract and retain required human capital
  • Competitiveness of F-Secure's product portfolio in the rapidly changing market
  • Intellectual property (IPR) claims against F-Secure
  • Risk exposure from contractual liability requirements
  • Failure to successfully complete acquisitions or divestments
  • Failure of new product launches
  • Potential security threats related to F-Secure's products and services
  • Credit risk due to regional political or financial climate and regulation
  • Tax risk relating to changing laws and regulations and interpretations of said regulations by the relevant authorities

2016:

F-Secure adopted a new risk modeling method with the aim of more accurately capturing all elements of operational security risks. The latest risk assessment cycle was started using the new method and focusing on key assets.

Internal control

The purpose of Internal Control is to ensure that operations are effective and aligned with the strategy, and that financial reporting and management information is reliable and in compliance with applicable regulations and operating principles.

Internal control consists of all the guidelines, policies, processes, practices and relevant information about organizational structure that help ensure that the business conduct is in compliance with all applicable regulations. The purpose of internal control is also to ensure that accounting and financial information provides a true and accurate reflection of the activities and financial situation of the company. Actual performance is monitored against sales and cost targets by operative reporting systems on a daily, weekly, or monthly basis.

The Company constantly monitors its key financial processes linked to sales, revenue, costs and profitability as well as incoming and outgoing payment transactions. If any inconsistencies appear, the issues are handled without delay. The Company's finance department is responsible for the consistency and reliability of internal control methods. The finance team works in close cooperation with the CFO and business units, providing relevant data for business planning purposes and sales estimates. The team also regularly assesses and monitors the reliability of estimates and revenue recognition.

2016:

F-Secure commenced a comprehensive project to renew its IT systems for finance and HR. The project involves also a review, further development and documentation of internal processes and controls to be applied with the new systems. The implementation of the new systems and processes is planned for 2017.

Internal audit

F-Secure's Audit Committee considers regularly the need for and appropriateness of a separate Internal Audit function. To date, the Audit Committee has concluded that, due to the

F-SECURE 2016 57

size, organizational structure and largely centrally controlled financial management of the Company, a separate Internal Audit function is not necessary.

In the absence of an Internal Audit function, attention is paid to periodical review of the written guidelines and policies concerning accounting, reporting, documentation, authorization, risk management, internal control and other relevant matters in all departments. Related controls are also tested from time to time. The guidelines and policies are coordinated by the Company's finance department with active involvement by the legal team.

The absence of a separate Internal Audit function is considered when defining the scope of the Company's external audit. Where necessary, the Board may also purchase Internal Audit services from an external provider.

To facilitate transparency and exchange of information on Internal Audit related matters, the financial management team has frequent meetings with the auditors. The Audit Committee also meets regularly with the auditors and head of the Company's legal team to discuss related matters of their areas of responsibility.

The Company has taken into use two direct lines for all employees to notify the Board and Leadership Team of any unethical activity or abuse.

Insider issues

F-Secure's IR-function is in charge of the company's insider issues, with the exception of project based insider issues, which are managed by the Legal department. The Company follows the insider regulations of NASDAQ Helsinki Oy and has adopted the new Market Abuse Regulations (EU, N:o 596/2014, "MAR"), which came into force on 3 July 2016. F-Secure has published an internal guideline on insider issues and regularly trains employees and management on insider issues.

Insider registries

Until 2 July 2016, F-Secure maintained three separate lists of insiders:

– permanent public insiders including the members of the Board, the auditors, CEO and the Leadership Team of the company

  • permanent company-specific, non-public insiders, including persons who by virtue of their position or tasks learn inside information on a regular basis
  • project-based insiders (maintained by the Legal team)

As of 3 July 2016, F-Secure maintains three separate lists of insiders and other persons relevant for insider issues:

  • project based insiders (maintained by the Legal team)
  • list of persons discharging managerial responsibilities, as well as persons closely associated with them, as specified by MAR
  • other insiders, including people participating in the preparation of financial reporting or otherwise having access to significant non-published financial information.

Managers' transactions

Persons discharging managerial responsibilities ("Managers") comprise the Board of Directors, the CEO, the CFO and the heads of F-Secure's three business units (Corporate security, Consumer security, Cyber Security Services). These persons have a duty to notify within three business days F-Secure and the Finnish Financial Supervisory Authority of every transaction in their own account relating to Financial Instruments of F-Secure. The Company shall publish these notifications as a stock exchange release, as specified by MAR. All releases published on managers' transactions are available on the Company's website.

Closed window

All insiders or their interest parties are not entitled to trade shares, options, or other securities 30 days prior to the publication of financial reports. Additionally, project-based insiders are never entitled to trade shares, options, or other securities during the duration of an insider project, including the day the insider information is made public.

Silent period

F-Secure observes a silent period of 21 days before each quarterly report announcement. During the silent period, the Company will arrange neither meetings nor conference calls with the investor community.

2016:

In July, governance of insider issues was updated to match the new Market Abuse Regulations (MAR), effective as of 3 July 2016.

Auditors

The auditor is elected by the Annual General Meeting for a term of service ending at the close of the next Annual General Meeting. The auditor is responsible for auditing the consolidated and parent company financial statements and accounting. The auditor reports to the Board of Directors or the Audit Committee at least once a year.

2016:

F-Secure has been audited by PricewaterhouseCoopers with Janne Rajalahti, Authorized Public Accountant, as the responsible auditor.

F-Secure paid to the auditor EUR 144,500 in audit fees (2015: EUR 160,593), and EUR 77,280 (2015: EUR 205,249) for non-audit services.

BOARD OF DIRECTORS

In this section are the biographies of the Members of the Board of Directors during 2016. Shareholdings are listed as of 31 December 2016 unless otherwise stated.

JUSSI AROVAARA

Board member since 2010 Born 1966

Main employment history:

Vice President, Global Sales, Corel Corporation (UK) 2012– Vice President, Global Operations, Corel Corporation (UK), 2010–2012 Senior Director, International Sales and Marketing Operations, Corel Corporation (UK), 2005–2009 Director, International Product Marketing, Corel Corporation (UK), 2004–2005 Vice President, EMEA Sales, Corel Corporation (UK), 2002–2004 Vice President, Sales Operations, Corel Corporation (Canada), 1999–2001 Earlier has worked in several sales and marketing positions in computer wholesaling. Holdings: number of shares 38,833

RISTO SIILASMAA

Chairman of the Board of Directors since 2006 Board member since 1988 Born 1966, M.Sc. (Engineering)

Main employment history:

Currently Chairman of the Board, F-Secure Corporation, 2006– President and CEO, F-Secure Corporation, 1988–2006 Founder, F-Secure Corporation Interim CEO, Nokia Corporation, 2013–2014

Main board memberships and public duties:

Chairman of the Board of Directors, Nokia Corporation Chairman of the Board, The Federation of Finnish Technology Industries

Member of the Board of Directors, Confederation of Finnish Industries, EK

Member of ERT European Round Table of Industrialists Holdings: number of shares 59,963,819, holding 37.76%

PERTTI ERVI

Board member since 2003, Chairman of the Audit Committee Born 1957, B.Sc. (Electronics)

Main employment history:

Currently an independent management consultant Co-CEO, Member of the Executive Board, Computer 2000 AG, 1995–2000 Co-founder, Managing Director, Computer 2000 Finland Oy,

1983–1995

Has worked at international management levels with major IT vendors such as Cisco, IBM, Intel, HP, and Microsoft.

Main board memberships and public duties:

Chairman of the Board of Directors, Efecte Corporation Chairman of the Board of Directors, Comptel Corporation Member of the Board of Directors, Teleste Corporation Holdings: number of shares 46,617

MATTI HEIKKONEN

Board member since 2013 Born 1976, M.Sc. (Eng.)

Main employment history:

Senior Executive Vice President, Global Operations and Partner, QuestBack AS, 2010– Entrepreneur and CEO, Digium Ltd, 2007–2010 Head of Nokia-Cisco Systems Global Alliance, Nokia Corporation, 2004–2007 Entrepreneur and CEO, Triple Check Ltd, 2002–2004 Researcher, Aalto University, Finland, 2002–2004 Group Marketing Director, Business Unit Manager and Partner, Done Solutions Corp, 2000–2002 Entrepreneur and CEO, Identia Ltd, 1998–2000 Main board memberships and public duties: Chairman of the Board of Directors, Finnish Software Entrepreneurs Association

Board member of Mobile Wellness MWS Oy Holdings: number of shares 20,251

ANU NISSINEN

Board member since 2010 Born 1963, M.Sc. (Economics)

Main employment history:

Founder, Digma Design Oy 2016– Founding partner, Era Content Oy, 2016 Founding partner and CEO, Era Content Oy, 2014–2015 CEO, Sanoma Media Finland Ltd, and a Member of the Executive Management Group of Sanoma, 2011–2013 President, Sanoma Entertainment Ltd, 2008–2011 Member of the Executive Management Group, Sanoma, 2008–2010 President, SW Television Ltd/Welho, 2004–2008 Marketing Director, Helsinki Televisio Ltd, 2001–2004 Marketing Manager, Oy Sinebrychoff Ab, 1998–2000 Main board memberships and public duties:

Member of the Board, DNA Oy Member of the Board, Siili Solutions Oyj Member of the Board, Kesko Oyj Member of the Board, Viestilehdet Oy Holdings: number of shares 38,833

BRUCE ORECK Board member since April 2016 Born 1953, LL.M. (Taxation)

Main employment history:

Executive in Residence, Aalto University, 2016– Ambassador to Finland, United States, 2009–2015 Founding and managing partner, Oreck, Bradley, Crighton, Adams & Chase, 2005–2009 Executive Vice-President and General Counsel, Oreck Corporation, 1993–2003 Main board memberships and public duties:

Member of the Board of Directors of U.S. Green Building Council (USGBC), 2016– Member of the Board of Directors of Earth Day Network, 2016 Holdings: number of shares 4,809

JANNE PIRTTILAHTI

Board member since April 2016 Born 1976, Undergraduate Student of Science

Main employment history:

Vice President, R & D, Corporate Security, F-Secure, 2016– Various roles, F-Secure, 2005– Sales manager, Rommon Oy, 2003–2005 Product Manager, Bonware Oy, 2001–2003 Main board memberships and public duties: Member of the Board of Directors, Loopback Oy, 2005– Holdings: number of shares 3,603

Non-current members

JUHO MALMBERG

Board member since 2008 (until April 2016) Born 1962, M.Sc. (Computer Science) Main employment history: CIO, OP Financial Group 2015– CEO, ZenRobotics Ltd. 2012–2014 Executive Vice President, Development and Member of Executive Board, KONE Corporation 2006–2012 Director, Nordic Outsourcing, Accenture, 2005 Managing Director, Accenture Finland 2002–2005 Deputy Managing Director, Accenture 1999–2002 Technology Director, Accenture 1992–1999 Main Board Memberships and public duties: Member of the Board, Kemppi Oy Member of the Board, QPR Software Plc Senior advisor, ZenRobotics Ltd. Holdings: number of shares 53,655

LEADERSHIP TEAM

In this section are the biographies of all the members of the Leadership Team during 2016. Shareholdings are listed as of 31 December 2016 unless otherwise stated.

SAMU KONTTINEN

President and CEO (as of August 2016),

Executive Vice President, Corporate Security (until July 2016) Born 1973

Member of the Leadership Team since 2009 Mr. Konttinen joined F-Secure in 2005. Previously, he has served F-Secure as Executive Vice President (Corporate security), Executive Vice President (Sales and Marketing), Vice President of Sales and Geographical Operations, and Vice President of Mobile Business Unit. Prior to that, he worked in sales and channel management, including as Director of Regional Operations, covering operations in EMEA. Before joining F-Secure, Mr. Konttinen held a Vice President position at Valimo Wireless Ltd, 2001–2005.

Main Board Memberships: Mr. Konttinen is currently a board member in Ixonos Plc and a board member in the Information Technology branch group of the Technology Industries of Finland.

Holdings: number of shares 74,603

MARI HEUSALA

Executive Vice President, Human Resources and Office services Born 1966, M.Sc. (Economics)

Member of the Leadership Team since 2015 Mrs. Heusala joined F-Secure in 2015. Previously she worked at Basware Corporation as SVP Human Resources & Development, heading the global Human Resources team. (2009–2015). Mrs. Heusala has also held various global HR director positions at Nokia (1997–2009). Prior to that Mrs. Heusala worked at Northrop Grumman International Aircraft Inc. as an international project coordinator related to the Hornet F/18 military aircraft offset project. (1993–1996) Holdings: number of shares 1,800

KRISTIAN JÄRNEFELT

Executive Vice President, Consumer security (as of February 2016)

Born 1965, M.Sc (Economics)

Member of the Leadership Team since 2016

Mr. Järnefelt joined F-Secure in 2016. Previously, he worked for Fujitsu Finland Oy as Sales Director (2014–2015), as CEO and partner at Miradore Oy (2010–2014), CEO and partner at Concilio Networks Oy (2006–2009) and in several senior leadership roles at Hewlett-Packard (1994–2006). Holdings:

JYRKI ROSENBERG

Executive Vice President, Corporate Security (as of October 2016)

Born 1971, M.Sc. (Communication), MBA Member of the Leadership Team since 2016 Mr. Rosenberg joined F-Secure in 2016. Prior to joining F-Secure, he was the CEO and a member of the Board of Directors of MixRadio Ltd, a global streaming music and personal radio service. Previously, Mr. Rosenberg was the Vice President of Entertainment Businesses in Microsoft Devices Group and led digital music and video services globally for Nokia Corporation. Jyrki joined Nokia in 1996 and held a number of senior roles in marketing, sales, product development and general management across the company. Holdings:

JARI STILL

Chief Information Officer (until January 2016), Vice President, Information and Business Services (as of February 2016) Born 1965, B.Sc

Member of the Leadership Team since 2012 Mr. Still joined F-Secure in 2000. Previously, he worked as the Head of Research and Development of Mobile Business Unit. Prior to joining F-Secure, he worked as a co-founder and Chief Executive Officer in Modera Point Oy and in its subsidiary in San Jose, CA. Earlier in his career, Mr. Still worked for different Finnish telecommunication and software companies in product development and management positions. Mr. Still maintains several positions of trust in software and business forums. Main board memberships: Mr. Still is e.g. a member of the VTT ICT and Electronics Advisory Board.

Holdings: number of shares 100,657

MIKA STÅHLBERG

Chief Technology Officer (as of February 2016) Born 1973, M.Sc. (Engineering), Officer's degree Member of the Leadership Team since 2016 Mr. Ståhlberg joined F-Secure in 2004 and has served in various positions including Director of Security Research and VP of F-Secure Labs. Previously he has been employed by the Finnish Defense Forces (1998–2004). Holdings: number of shares 24,263

ERIIKKA SÖDERSTRÖM

Chief Financial Officer (as of February 2017)

Born 1968, M.Sc. (Econ.)

Member of the Leadership Team since 2017 Ms. Söderström has joined F-Secure in February 2017. Previously she has worked as a CFO for KONE Corporation, Vacon Corporation and Oy Nautor Ab. She also has held several senior finance leader roles in Nokia Networks and Nokia Siemens Networks.

Main board memberships: Ms. Söderström has been a member of the Board of Comptel Corporation since 2012. Holdings: number of shares 10,000 (on 16 February 2017)

JENS THONKE

Executive Vice President, Cyber Security Services Born 1966

Member of the Leadership Team since 2015

Mr. Thonke joined F-Secure in 2015. Previously, he was the CEO of nSense, a leading cyber security company providing security consultation and vulnerability assessment services and products to large enterprises. nSense was acquired by F-Secure in June 2015.

Holdings: number of shares held directly 11,338 and 221,304 by a controlled entity

JYRKI TULOKAS

Executive Vice President, Strategy and Corporate Development (as of February 2016)

Born 1975, M.Sc. (Economics)

Member of the Leadership Team since 2016 Mr. Tulokas joined F-Secure in 2007. He has a long experience in leading product management, product marketing, strategy and business development operations. Before joining F-Secure in 2007 he worked for Suunto as Head of Business Development.

Holdings:

Non-current members

CHRISTIAN FREDRIKSON

President and CEO (until July 2016) Born 1964, M.Sc. (Engineering) F-Secure CEO between 2012–2016

Mr. Fredrikson joined F-Secure in 2012. Prior to joining F-Secure he was responsible for global sales for the Network Systems business unit at Nokia Siemens Networks. His past positions at Nokia Siemens Networks include Head of Asia Pacific Region and Head of OBS Business Unit (Operations and Business Software). Mr. Fredrikson left F-Secure in July 2016 to pursue a leadership opportunity outside the Company. Main board memberships: Member of the Board in Remedy Entertainment Ltd, member of the Communications Administration Committee of Ministry of Transport and Communications in Finland, member of the Board in DIGI.FI and member of the Stiftelsen för Åbo Akademin. Holdings: number of shares 40,000 (31 July 2016)

JANNE JUVONEN

Executive Vice President, Customer and Market Operations (until January 2016)

Born 1966, eMBA

Member of the Leadership Team between 2014–2016 Mr. Juvonen joined F-Secure in 2014. Previously, he worked for Rovio Entertainment Ltd. Prior to that he held sales and management positions in several domestic and international companies, including Rautakirja Oy, Carlsberg Baltics, Carlsberg Singapore, and Carlsberg Asia. He has also worked for Oy Sinebrychoff Ab, Coca Cola Juomat Oy, Anttila Oy, and Masterfoods Oy. Mr. Juvonen left F-Secure in February 2016. Holdings:

SAILA MIETTINEN-LÄHDE

Chief Financial Officer (until February 2017)

Born 1962 M.Sc. (Engineering)

Member of the Leadership Team between 2015–2017 Mrs. Miettinen-Lähde joined F-Secure in 2015. Prior to joining F-Secure, Mrs. Miettinen-Lähde worked as Deputy CEO (2012–2014) and CFO (2005- January 2015) of Talvivaara Mining Company Plc, where her area of responsibility covered the Group's financial management, treasury, risk management, investor relations, and communications. Her other previous employers include SIDOS Partners Ltd (2004), D. Carnegie AB (2000–2003), Orion Pharma (2000), Finnish National Fund for Research and Development (1998–1999), and various positions at Leiras Oy.

Main board memberships: member of the board of Outokumpu Oyj, and LeaseGreen Group Oyj. Holdings:

PEKKA USVA

Vice President, Corporate Security (until February 2016) Born 1969, Datanome

Member of the Leadership Team between 2012–2016. Mr. Usva joined F-Secure in 1995, and has served in various positions at the company, including Director in Corporate Business Solutions, Director of Product Management and Development in Corporate Business, and a Director of Solution Management in Corporate Business. In February 2016, Mr. Usva was appointed to lead the development of a new Advanced Threat Protection solution for corporate customers. Holdings:

INFORMATION FOR SHAREHOLDERS

The main goal of F-Secure's investor communications is to make available correct, up-to-date information about F-Secure and its operations – impartially and simultaneously to all interest groups.

All published investor information including annual reports, interim reports, as well as stock exchange and press releases are available on the Group's website www.f-secure.com/ investors. All investor information is published in English and in Finnish.

Subscriptions for the emailing list for stock exchange releases can be made by sending your contact details to [email protected].

F-Secure publishes a financial statement release, a half year report and two interim reports during 2017 and arranges news conferences for media and analysts at the time of publishing of the quarterly reports. F-Secure observes a three-week silent period before the publishing of each quarterly report. During this time, F-Secure neither arranges meetings nor phone conferences with investors or analysts.

Annual General Meeting

The Annual General Meeting of F-Secure Corporation is scheduled to be held on Wednesday, 5 April 2017. More information on how to attend as well as the documents for the meeting are available on the Group's webpage www.f-secure. com/agm.

Financial calendar for 2017

Q1 Interim Report 4 May Q2 Interim Report 10 August Q3 Interim Report 9 November

F-Secure share facts

Listing since (1999) NASDAQ OMX Helsinki Ltd. Trading symbol FSC1V Number of shares 158,798,739

IR Contacts

For any inquiries on F-Secure as an investment target, please contact:

Tapio Pesola, Investor Relations Manager [email protected] +358 44 373 4693

F-Secure Corporation

Corporate Headquarters Tammasaarenkatu 7 P.O. Box 24 00181 Helsinki, Finland Tel. +358 9 2520 0700 E-mail: [email protected] www.f-secure.com

content F-Secure design and layout Kreab photographs F-Secure

CYBER SECURITY LIVES HERE

F-Secure Corporation Tammasaarenkatu 7 P.O. Box 24, 00181 Helsinki Tel. +358 9 2520 0700 [email protected] www.f-secure.com

Talk to a Data Expert

Have a question? We'll get back to you promptly.