In the public imagination, Wirecard was Germany’s biggest tech company success story – a €24 billion high-growth payment processor doing deals across the globe and pioneering new technologies.  While naysayers complained about its opaque corporate and financial practices and raised doubts about its business model, most observers admired its nimble approach to surmounting regulatory barriers to international expansion. In a world intoxicated by companies with unlimited growth prospects, it was a winner.

The reality was much different.  Most of Wirecard’s reported business didn’t exist.  And the company hadn’t made any money in years.  How could something like this happen in our modern, ostensibly transparent world?

It will take years to sort out questions of liability, but responsibility is a different matter.  There the answer is clear.  The supervisory board at Wirecard – which was amply warned over many years that something was amiss – utterly failed  to protect shareholders, creditors, employees, and customers from malfeasance by management.

Wirecard was formed in Munich in 1999 as a merchant payment processer, a straightforward business in which the company acted as a middleman between retailers and their customers’ banks in originating and settling credit card transactions.  CEO Markus Braun – a former consultant – joined the company in 2002, took it public through a “back-door” listing in 2005, and acquired its German banking unit, Wirecard Bank, in 2006.  This last action allowed it to become a credit card issuing bank as well as a payments processor.

Wirecard began its breakneck international expansion in 2010 and acquired large payments processors in Asia, India, and the U.S. over the next decade, raising more than €500 million in equity from shareholders along the way. By mid-2018, Wirecard had a market value of €24 billion and claimed to be a financial technology leader, processing payments for almost 250,000 merchants while also issuing credit cards and building contactless smartphone payments technology. It reported operating margins over 20 percent and EBIT of €439 million in 2018. Wirecard ultimately assumed Commerzbank’s former place in the Dax 30 index, which automatically added its stock to pension fund portfolios around the world. By then CEO Braun’s 7 percent equity stake was worth €1.6 billion, and management was forecasting doubled sales and profit over the next two years.

The first questions about the company’s business and accounting were raised publicly in 2008 (prompting vigorous pushback by the company’s PR team and the prosecution of two German short sellers).  Pressure on the company resumed during a multi-year effort by the Financial Times (FT) to investigate discrepancies in the company’s accounts beginning in 2015. In response to the bad publicity, the company learned to investigate and attack its enemies aggressively and publicly.  CEO Braun was particularly vocal in defending the company’s record and asserting that anyone who questioned the company was in cahoots with short sellers looking to make a quick Euro off negative news. In 2016, anonymous allegations of money laundering were made by a pseudonymous writer. Subsequently, the FT reported that a private investigator proposed targeting the FT and prominent London investors critical of Wirecard.

Renewed investigations by the FT beginning in 2019 uncovered allegations of accounting fraud in the company’s Asian business and reported that half of the company’s reported business was outsourced to third party processors, with Wirecard receiving only a commission (something the company had, amazingly, never disclosed).  Further reporting suggested that many of the third-party processors were shell companies, raising questions about the large cash balances shown on the company’s balance sheet.

Amazingly, the company prospered despite the drumbeat of fraud allegations.  Germany’s financial regulator – BaFin – was publicly sanguine about the company and even appeared to be cheerleading from the side.  BaFin in 2019 took the unprecedented step of banning short selling of Wirecard stock for two months and filing criminal charges against the two Financial Times journalists who had broken the whistleblower story.

But audit problems were – finally – catching up with Wirecard. More reporting from the FT, this time covering fraudulently inflated profit from the Middle East and Europe and the misclassification of cash held in escrow accounts, and shareholder pressure led the company to commission a special audit by KPMG.

When that report was delivered in March 2020, KMPG stated that it couldn’t verify most of Wirecard profits reported from 2016 to 2018 or €1 billion in purported cash balances.  Further news came from Ernst &Young.  Although it had been Wirecard’s auditor for more than a decade, in the last three years, EY hadn’t done routine audit verification checks with a Singapore bank that Wirecard claimed held large cash balances. The auditor admitted that almost €2 billion in cash balances allegedly transferred by that Singapore bank to two Philippine banks had been rejected as “spurious” by those banks and probably didn’t exist.  At least half of the company’s business appears to have been fictitious, and the “real” business – conducted in the EU and the U.S. – was reported by KPMG to have been unprofitable since 2016. The non-fictitious business was also, contrary to the company’s public disclosures, dominated by a small number of customers, some legitimate but many others involved in pornography and gambling businesses shunned by other large payment processors.  CEO Braun was charged with crimes, COO Jan Marsalak disappeared, and the company declared insolvency.

So, who is responsible for the highest profile corporate collapse since Enron in 2001? EY blames management.  Although the firm appears to have failed to follow basic procedures  in auditing Wirecard, it casts itself as the victim of “an elaborate and sophisticated fraud, involving multiple parties around the world in different institutions, with a deliberate aim of deception.” Perhaps. EY is claiming that it followed all appropriate procedures and discovered the discrepancy and reported it to the Wirecard supervisory board – coincidentally after KPMG said it couldn’t verify the purported cash balances. EY management has told the FT that “We’ve established that third parties, with a deliberate aim to deceive, provided E&Y with false documentation in connection with its 2019 Wirecard audit. The extent and sophistication of these suggest a large-scale international fraud at Wirecard.”  No mention is made of 2018 and earlier years.

The German accounting watchdog, the Financial Reporting Enforcement Panel (FREP), isn’t talking publicly but appears to blame a lack of resources.  FREP is a private, nongovernmental panel responsible under German law for examining the financial reporting of publicly listed companies like Wirecard.  According to news reports, FREP has only 15 employees and a small annual budget.  News reports further suggest that BaFin asked FREP to start an investigation of Wirecard in early 2019.  According to the FT, “only one investigator at FREP has been working on the case and little progress was made…” before the company’s failure.

BaFin blames the law and its fellow regulators. Since the Wirecard collapse, BaFin has been on the defensive, especially about its decisions to ban short selling of the company’s shares in 2019 and to criminally charge two FT reporters who wrote about the Singapore whistleblower’s allegations of accounting fraud.  It has criticized the law governing accounting investigations for blocking it from probing  Wirecard until FREP finished its investigation (which never happened).

The head of BaFin has also reportedly told members of the German Bundestag in closed hearings that BaFin had no authority to supervise Wirecard as a whole, because BaFin, the European Central Bank, and the Bundesbank had all “agreed” that Wirecard was a technology company, not a financial services company.  As a result, he asserted that BaFin could only regulate Wirecard Bank. The legal effect of such an agreement is unclear.  He also reportedly  denied that BaFin was trying to protect Wirecard by banning short selling of company shares and charging the two FT reporters.

Sometimes failure can be its own bureaucratic reward.  The German government is expected to announce soon that BaFin will take over direct responsibility for financial statement fraud.

What about the large investors like Softbank that kept providing financing even after credible allegations of misconduct were made?  Softbank Investment Advisers blames EY.  “I’m totally baffled by the lack of competence and responsibility displayed by E&Y,” tweeted the Softbank executive responsible for the financing.  “As an organisation that is meant to protect all stakeholders — creditors and shareholders — in companies, both public and private, they have materially failed in their fiduciary duties.”

The Softbank financing transaction in 2019 was unusual, to say the least. As the FT reported:

SoftBank Investment Advisers, which manages the group’s $100bn Vision Fund, last year structured a €900m investment in Wirecard through a convertible bond, providing a vital vote of confidence… after a series of reports in the Financial Times raised serious doubts about the validity of its accounting. At the same time, SoftBank also announced it would pursue a “strategic co-operation agreement’ with Wirecard … presenting the impression that one of the world’s most powerful technology investors was forging a deep business relationship with the German company and inspiring confidence in its shares. But the day after SoftBank formally signed the strategic tie-up with Wirecard in September, SBIA cut its exposure to the German payments group through a sale of new bonds exchangeable for the payments company’s stock in a “structured equity” trade. Bankers at Credit Suisse sold the €900m debt instrument to a broad group of investors, which essentially allowed SBIA to fund its entire investment without putting in a cent of its own money, while also gaining tens of millions of upfront cash profits.

There’s more to this story as well, as it turns out Softbank executives, not SBIA, were the beneficiaries of the structured equity trade.  Credit Suisse hasn’t commented.

Deutsche Bank, Wirecard’s main bank lender, is in a particularly tight spot.  Deutsche was also a large lender to Wirecard CEO Braun, and the bank’s chief accounting officer was a former EY partner who had overseen several audits of Wirecard’s results.  Bloomberg has reported that there were big internal disagreements between the credit and asset management arms of Deutsche Bank over Wirecard’s prospects.  According to the Bloomberg story, Deutsche unwound or hedged most of its credit exposure to Wirecard at the same time that its equity analysts were supporting the stock and its investment bankers were managing debt placements for the company. Deutsche’s chief accountant is now facing possible criminal liability for his work at EY on Wirecard audits, and the bank is reportedly considering buying Wirecard Bank and providing emergency financing to keep its operations going until the company can be broken up.

And what about Wirecard management and supervisory boards? Ex-CEO Braun has said nothing since his arrest and release on bail, nor have any other members of the prior management board.  COO Marsalak’s whereabouts are still unknown, although someone appears to have faked records of his entry into the Philippines and exit to China in recent days.  The German authorities are certain to investigate and prosecute members of the company’s management board aggressively.

Under German corporate law, the Wirecard supervisory board appoints, supervises, and advises the members of the management board and is directly involved in fundamental decisions. The legal obligations of supervisory board members are similar to those of directors of U.S. corporations, and members can be liable for failing to exercise the due care and diligence of a prudent and conscientious supervisory board member. In cases not involving an infringement of duty, members are protected from liability if they reasonably believed, based on appropriate information, that they were acting in the best interest of the company.  The latter provision is essentially the familiar “business judgment” rule found in American corporate law.

As with U.S. boards, a supervisory board establishes an audit committee which, under German law:

handles the monitoring of the accounting process, the effectiveness of the internal control system, risk management system and internal audit system, the audit of the Annual Financial Statements, here in particular the independence of the auditor, the services rendered additionally by the auditor, the issuing of the audit mandate to the auditor, the determination of auditing focal points and the fee agreement, and – unless another committee is entrusted therewith – compliance. The chairman of the Audit Committee shall have specialist knowledge and experience in the application of accounting principles and internal control processes….

In its statement in Wirecard’s 2018 annual report, the supervisory board emphasized how deeply it was involved in overseeing Wirecard’s operations and ensuring the integrity of its accounts and operations, as well as indicating that it had satisfied itself with management’s explanation of the Singapore allegations reported by the FT. The statement indicated that, “[a]dditional control measures, such as the inspection of company documentation and the appointment of special experts, were not necessary….”

The Wirecard supervisory board has as yet said nothing publicly about the collapse of the company. We can expect it to blame the management board and EY, relying on the business judgment rule to protect its own  members from liability.

That’s not good enough if we want to prevent more situations like Wirecard.  While the company’s executives are directly responsible for the many years of malfeasance at Wirecard, the buck stops one level higher, at the supervisory board.  Years of apparent good results and a high stock price are no excuse.  The five members of the company’s supervisory board –distinguished names in German business all – appear to have failed profoundly in their oversight duties.  And their failure goes far deeper than the details of their legal obligations and defenses and whether they, or their insurance company, will end up liable for damages or whether they will face criminal sanctions.  Theirs is a failure of corporate culture and of independence and integrity – reflected in their blind loyalty to management despite mounting problems and their hostility to those who asked legitimate questions about the company’s operations.

This post comes to us from Todd H. Baker, a senior fellow at the Richman Center for Business, Law and Public Policy at Columbia Business School and Columbia Law School.