Wirecard … the biggest accounting fraud? Is the customers money safe? The end of Banking-as-a-Service?

Some of us are old enough to remember Arthur Anderson and Enron, a mixture of two companies that created an accounting mess bigger than any seen before in corporate history. That was until Ernst & Young (EY) and Wirecard.

Interestingly, there have been many auditing mess ups in the past few decades, but there are some really surprising issues with this latest one, such as EY not bothering to even check the company’s bank statements for the past three years. Even my accountant does that!

In fact, what is astounding is that the missing €1.9 billion was only discovered as an irregularity when EY finally did check the financial dealings of Wirecard in Singapore, Manila and Dubai. When EY asked two banks in the Philippines for the Wirecard account balance and the banks said: What Wirecard account? We don’t deal with them.  Hmmmm … Wirecard claimed they had over two billion dollars in those accounts. How strange?

Anyway, you can read all about it in the links at the end of this blog, but there’s two other things that come to mind. One, this is the biggest accounting fraud in post-war European history and, two, it involves a licensed and regulated financial firm with not just direct customers but also many, many third parties like Anna Money, British Airways Executive Club, Curve, Ramsdens and more.

Being such a big story, I got a call on Friday from a journalist in the UK who asked me: is the customers’ money safe?

... and the more I thought about it, the more I realised that I have no idea.

This is because Wirecard was a company within a company within a company. The holding company – Wirecard AG – went bust, but they have many subsidiaries from Wirecard Card Solutions (UK) to Wirecard Bank (Germany) to Al Alaam (UAE) and further.

As a result, BaFin, the German regulator, claims that they did not regulate Wirecard AG. They regulated Wirecard Bank, and that bank passed its audit with flying colours. According to a friend in Germany, they passed the BaFin inspection just a few weeks ago.

yes but the bank is fully supervised by bafin and just a few weeks ago they passed a special bafin audit according to article 44 of German Banking law. My speculation: The bank was/is part of the good/clean european business and accouting issues „just“ in the APAC business.

— Jochen Siegert (@jochensiegert) June 27, 2020

All in all, it is a debacle in the making that is as big as Enron and Parmalat. In particular, EY will have questions, as will the whole audit industry.

“People with first-hand knowledge told the Financial Times that the auditor between 2016 and 2018 did not check directly with Singapore’s OCBC Bank to confirm that the lender held large amounts of cash on behalf of Wirecard. Instead, EY relied on documents and screenshots provided by a third-party trustee and Wirecard itself.” 

And you may say: so, what? They couldn’t have known. Yet the FT, who have been in a ding-dong battle with Wirecard for years, reported as far back as April 2015:

“An accumulation of questions: why does the company pay big sums upfront, months before deals complete? Why are key parts of transactions not fully transparent? Why spend millions on struggling Asian businesses? Why do accounts filed in Singapore not match totals reported in Germany? What are €670m of intangibles on the balance sheet really worth?”

Five years and EY did nothing to check these issues. Who was in this, where, when? Something really smelly here.

My issue is that Wirecard were integral to so many startups. Not only that, but they have billions of companies’ funds on their account. Where is it? When my friend asked me: are UK customers funds safe (over $500m), my answer is honestly: no idea. Who has the money? Where? Which company? And how did they get away with it?

It begs fundamental questions about regulation, audit and more. How can BaFin say the bank is fine and not check the balance sheet of the holding company? How would EY sign off accounts for years, without any checks and balances? And how come no one listened to the FT and, instead, took them to court?

My real issue is that the ecosystem model of Banking-as-a-Service could implode because of Wirecard. When you have a company within a company within a company dealing with financial service, and no one can point at which company actually has the money: that’s a problem.

Anyways, I got two great answers to my question over the weekend re: what happens to funds?

The first is from David Brear of 11:FS which goes:

Dear Chris

The money is now frozen, as they have filed for insolvency. So, everyone who uses them has had to freeze access to accounts for their customers.

Wirecard because of the type of licence they have been operating under in the UK is using EU passport licensing and also has an emoney licence. This means it does not have FSCS protection for customer balances like a bank in the UK would have under our regime.

What should have happened is that Wirecard should have, under Electronic Money Regulations and Payment Services Regulations, set aside under the “safeguarding” regulations enough money to cover the balances and reduce their exposure.

What we are yet to find out though is how their balance sheet is made up - even EY doesn't know this - which is why it's all iffy. If UK corporate customer money is under the safeguarding part of Wirecard's balance sheet, then this is going to get so much worse for customers if that money has gone or never existed. It will also make a massive mockery of UK and EU regulations.

If that has happened and they haven’t provisioned the safeguarding balances though, then for me the question isn’t why did they do this (as it’s obvious to liquidate investable assets).

So what’s going to happen? Wirecard has gone under, major regulatory reform will have to happen, real worry about outsourcing or critical infrastructure will have and the FCA / PRA will def investigate that as an industry wide issue and EY will be getting a huge fine. In fact, the biggest issue is the growing 'ecosystem' model where many, many companies are working to deliver financial services under Open Banking. This could be a house of cards ...

The second is from Richard Davies, CEO of Banking at Revolut:

The simple answer is e money funds are required to be safeguarded in segregated accounts. Eg Anna [Money]I believe the money is with Barclays. So the funds should be protected provided safeguarding has been accurate (ie the right amount of money being set aside under the e money procedures). However the suspending of regulatory permissions means card services have also been suspended, so many users are finding their funds unusable even if safe behind the scenes. And for many users it’s quite confusing and worrying I imagine. What is done in terms of compensation for disruption to services remains to be seen (eg refunding subscriptions, redress for customers for whom it was a primary account).

Given there was been speculation about material fraud issues at Wirecard since 2019, and financial market warning signs (eg CDS/bonds), fintechs really should have been acting on this earlier if it’s a critical service provider. Thinking a U.K. subsidiary is immune to the group’s problems is not right - the history of FS insolvencies would typically show contagion to subsidiaries. I suspect this will rightly lead to greater regulation / scrutiny of fintechs’ outsourced service provider arrangements, as the focus can’t just be on the happy path.

Oh, and if you wanted to know who the journalist was, it was Paul Lewis over at the BBC’s MoneyBox. Here’s the programme for those who can access BBC radio content, and more background here if you want to follow the story:

• Wirecard versus The Financial Times: a FinTech poster child on trial, May 5 2020
• Wirecard or Weirdcard?, June 26 2020

Meantime, for Anna Money, Pockit, Curve, Asda, British Airways and others who used Wirecard processing services, here are ten alternative providers you might want to talk to. Oh, and if you want the full version of what really happened, listen to Dan’s story at the FT (he broke the story first back in 2015 and was hauled up in court in Germany because of it).

Finally, here’s the full time-line of what happened:

The early years

1999

Wirecard is founded in a Munich suburb, backed by venture capital in the late stages of the dotcom boom. A payment processor, it helps websites collect credit card payments from customers.

2002

After the group almost goes bust, Markus Braun, a former KPMG consultant, takes over as chief executive and merges Wirecard with a Munich rival, Electronic Business Systems.

2005

Wirecard joins the Frankfurt stock market by taking over the listing of a defunct call centre group, a route that avoids the scrutiny of an initial public offering. It has 323 employees and the core of its business is managing payments for online gambling and pornography.

2006

Wirecard moves into banking with the purchase of XCOM. The renamed Wirecard Bank is licensed by Visa and Mastercard, meaning it can both issue credit cards and handle money on behalf of merchants. This unusual hybrid of banking and non-banking operations makes its accounts harder to compare with peers, and helps persuade investors to rely on the company’s adjusted versions of financial statements.

The first attack

2008

The head of a German shareholder association publishes an attack on Wirecard, suggesting balance sheet irregularities. EY is appointed to conduct a special audit, and the following year replaces the small Munich firm that had previously acted as group auditor. The German authorities eventually prosecute two men in connection with the attack, who had not disclosed positions in Wirecard stock.

2010

Jan Marsalek, a young protégé of Markus Braun and a fellow Austrian, is appointed chief operating officer. They tell staff that Wirecard has global aspirations, so the company will operate in English and plot an international expansion.

2011 to 2014

Wirecard raises €500m from shareholders and goes on a shopping spree. It buys up obscure payments companies across Asia in a series of oddly structured deals, starting in Singapore, which becomes its headquarters in the region. Investors are drawn to Wirecard’s rapid growth and claims of superior payments technology.

Profits and questions grow fast

2015

The Financial Times begins to publish its House of Wirecard series on FT Alphaville, raising questions about inconsistencies in the group’s accounts. When the FT suggests that there appears to be a €250m hole in the group’s balance sheet, Wirecard responds with letters from Schillings, a UK law firm, and hires FTI Consulting in London to manage its external public relations.  In October, Wirecard announces its largest-ever takeover, of Indian payments businesses in a €340m deal. J Capital Research reports that Wirecard’s operations dotted across Asia are far smaller than it claims. Wirecard says short sellers paid for the report. Investment bank analysts report back favourably from a tour of the group’s Asian offices.

2016

Anonymous short sellers publish a dossier of allegations related to money laundering under the pseudonym Zatarra. Wirecard denies everything and BaFin, the German financial regulator, investigates Zatarra and others for alleged market manipulation.  A European private investigations agency outlines plans to target the FT and a group of London financiers. Journalists, researchers, hedge funds and short sellers critical of Wirecard begin to receive “spear-phishing” emails in a campaign of hacking that continues for years. It is not clear who was behind these efforts. Wirecard announces it is buying a prepaid payment card business from Citigroup, entering the North American market.

2017

A clean audit from EY and a marked improvement in reported cash generation prompt renewed investor enthusiasm for Wirecard shares, which more than double in price. The group announces a deal to take over Citi’s payment processing operations across 11 countries in Asia, a transaction designed to make Wirecard a household name in the region.  Markus Braun ends the year by borrowing €150m from Deutsche Bank in a margin loan secured with large parts of his 7 per cent stake in Wirecard.

March 2018

Inside Wirecard’s Singapore headquarters the group’s own legal staff begin an investigation into three members of the finance team. The probe is launched after an internal whistleblower raises allegations about a plan to fraudulently send money to India via third parties in a type of scheme known as “round tripping”.

August 2018

Wirecard shares hit a peak of €191, valuing it at more than €24bn. The group claims it has 5,000 employees, who process payments for about 250,000 merchants, issue credit and prepaid cards and provide technology for contactless smartphone payments. Clients include German discounters Aldi and Lidl, as well as close to 100 airlines.

September 2018

Wirecard replaces Commerzbank in the prestigious Dax 30 index, making it an automatic investment for pension funds around the world. As Europe’s largest fintech, it is seen as a rare German tech company able to challenge the giants of Silicon Valley. Mr Braun, whose personal stake in the group is now worth €1.6bn, tells investors that sales and profits will double in the next two years.

Singapore scandal, SoftBank and spies

October 2018

Whistleblowers contact the FT concerned that the internal investigation in Singapore has been squashed.

January 2019

The FT publishes its first story on the Singapore investigation, which is immediately described as “false” by Wirecard. BaFin starts to investigate the FT over an allegation of market manipulation.

February 2019

The Singapore police raid Wirecard’s offices. BaFin announces a two-month ban on short selling, citing Wirecard’s “importance for the economy” and the “serious threat to market confidence”, after the share price falls below €100.

March 2019

The FT reports that half of Wirecard’s business is actually outsourced, with the payments processing handled by partners who pay Wirecard a commission. Attempting to visit some of these Wirecard partners in the Philippines, the FT instead discovers a retired seaman and his family, who are bemused to learn that their house is supposedly the site of an international payments business. Wirecard announces it will sue the Financial Times. Wirecard sues the Singapore authorities, challenging the criminal investigation. Prosecutors there name five Wirecard staff and eight Asian subsidiaries of the group as suspects.

April 2019

Wirecard announces a €900m injection of cash from SoftBank, an apparent vote of confidence from a Japanese conglomerate known for large tech investments.  On the same day the FT publishes further details of Wirecard’s outsourced payments processing. It appears that arrangements with three partner companies in the Philippines, Singapore and Dubai were responsible for most of the group’s worldwide profits. Mr Braun rubbishes the figures in a press conference, calling them inaccurate. EY approves the 2018 accounts with minor qualifications relating to Singapore, and Wirecard announces a dozen new compliance measures.

July 2019

The FT sends pre-publication questions to Wirecard regarding its relationship with the Dubai partner. In response Wirecard alleges collusion with short sellers, based on a tape recording obtained in a sting operation overseen by Rami El Obeidi, former head of foreign intelligence in Libya’s National Transitional Council, which governed the country temporarily in the wake of Muammer Gaddafi’s death. The German newspaper Handelsblatt reports Wirecard’s allegations. The FT appoints a law firm to conduct an investigation into the claims by a London financier in the recording to have advance warning of stories, which finds them groundless.

September 2019

Wirecard issues €500m of bonds classified as investment grade by Moody’s, the credit rating agency. Credit Suisse also sells SoftBank’s €900m convertible bond on to other investors.  Mr El Obeidi oversees private investigators conducting a sprawling surveillance operation targeting London financiers, including Crispin Odey, the hedge fund manager who has publicly shorted Wirecard.  The FT is served with court documents. Wirecard is suing for “misuse of trade secrets”, in relation to January and February’s articles.

To Dublin and Dubai with KPMG as the new referee

October 2019

The FT publishes documents indicating that profits at Wirecard units in Dubai and Dublin were fraudulently inflated, and that customers listed in documents provided to EY did not exist. Wirecard says the documents are not authentic and reiterates again its staff and executives have done nothing wrong. Under pressure from investors it appoints KPMG to conduct a special audit, which it says will clear it of wrongdoing.

December 2019

The FT reports that Wirecard appears to have counted cash held in escrow accounts managed by trustees within the cash balances declared on its financial statements. Wirecard says judgments about cash are subject to detailed review in its audit process.

March 2020

The KPMG audit is supposed to conclude, but publication of a report from the accounting firm and full-year results audited by EY are postponed to the end of April.  EY receives documents purporting to be from a trustee in the Philippines that list €1.9bn said to be held in accounts at two banks in the country.

April 28 2020

KPMG’s report is published. The accounting firm says it cannot verify that arrangements responsible for “the lion’s share” of Wirecard profits reported from 2016 to 2018 were genuine, citing several “obstacles” to its work. KPMG also queries €1bn of cash balances, on the basis that the only evidence for the sum were documents provided by a Singapore trustee that cut ties with Wirecard around the time the special audit began.

Internal company spreadsheets appeared to indicate efforts to fraudulently inflate sales and profits at businesses in Dubai and Ireland Mr Braun tells investors that “E&Y informed us this morning that they have no problem at all to sign off the audit 2019”. Publication of results is postponed to June, a delay attributed to coronavirus. Any wrongdoing is denied.

June 5  

Police search Wirecard’s offices after Munich prosecutors launch a criminal investigation against chief executive Markus Braun and the payment group’s three other executive board members.  The search follows a criminal complaint submitted a few days earlier by BaFin, Germany’s financial watchdog. The complaint relates to potentially misleading statements made by Wirecard to investors ahead of the publication of the KPMG report.

The collapse

June 16

The Philippine banks BPI and BDO inform EY that documents supposedly detailing €1.9bn in balances are “spurious”.

June 18

Wirecard is supposed to publish audited results for 2019. Instead it announces that €1.9bn is “missing”.  Mr Marsalek is suspended. James Freis joins the management board as chief compliance officer.

June 19

Markus Braun resigns. On his second day in the job Mr Freis becomes interim CEO.  The accountancy firm was supposed to give Wirecard a clean bill of health. That did not happen. Wirecard announces it is in “constructive talks” with banks that have the right to terminate €2bn of loans due to the lack of audited accounts.

June 22

Wirecard acknowledges for the first time the potential scale of a multiyear accounting fraud, warning that the €1.9bn of cash probably does “not exist”. The payments company says it is assessing “whether, in which manner and to what extent such business has actually been conducted for the benefit of the company”. Previously announced financial figures may not be reliable, it adds. Mr Marsalek, who had direct oversight of the areas concerned, is sacked.

June 23

Mr Braun is arrested on suspicion of false accounting and market manipulation. A spokeswoman for the Munich prosecutors’ office tells the FT that the company’s former management board is also under investigation.

June 25

Wirecard says it will file for insolvency.