How the paper trail went cold in KPMG’s special audit of Wirecard
The accounting firm struggled to verify €1bn of payments held by an uncooperative trustee
In the decade that carried Wirecard from obscurity in a Munich suburb to membership of the Dax stock index, the group rarely dwelled on the arcane details of its payment processing operations.
So when the findings of KPMG’s six-month special audit were published last week, the 74-page report provided for the first time a description of the inner workings of a company that has long been inscrutable.
Whether aspects of the structure described were real or fraudulent remains unproven — KPMG did not come to a conclusion, citing “obstacles” compounded by a lack of data — and that lack of clarity has knocked a third, close to €5bn, off the market valuation of a group that had been worth more than Deutsche Bank.
What is now clear is Wirecard’s extensive reliance on a convoluted network of outside parties responsible for handling and supervising a large proportion of the transactions it claims to process.
Three important partners
Wirecard helps businesses accept credit and debit card payments from their customers.
In the first nine months of 2019, it reported processing €124bn of transactions, up 38 per cent on the year before, and predicted similar rapid growth this year even in the face of Covid-19 disruption.
In Europe it owns a bank licensed by Visa and Mastercard to act as a so-called “acquirer”, payments jargon for the entity that collects money from card issuers and distributes it to merchants.
As it lacks similar licences in some countries, Wirecard has said it uses other companies to help transact around half the payments it processes. Wirecard co-ordinated such third-party business primarily through Dubai, Dublin and Munich, where three of the group’s largest and most profitable subsidiaries are based.
In November it told investors that it worked with around 100 acquirers in 60 countries. KPMG’s report said that just three “third-party acquiring-partners” were responsible for “the vast majority of sales revenues generated” at the three Wirecard subsidiaries.
KPMG also said that, before the allocation of central costs, those three units accounted for the “lion’s share” of Wirecard’s operating profit between 2016 and 2018, which totalled €985m.
In those years Wirecard reported group sales of €4.5bn generated from processing €278bn of payments, indicating that the three partners were responsible for tens of billions of euros worth of transactions.
The KPMG report does not name the partners, but past FT reporting has identified these as: Al Alam Solutions, based in a largely unmanned office suite in Dubai; PayEasy Solutions, which shares an office with a Manila tour bus company in the Philippines; and Senjo, part of a Singapore payments group. All have denied wrongdoing.
KPMG expressed doubts about whether the risks associated with so much business being conducted through these partners was properly disclosed to shareholders.
A complex process, missing paperwork
According to KPMG’s report, Wirecard referred payment-processing clients to the three partners.
Processing international payments across time zones via multiple parties requires precise reconciliation of transactions to ensure exchange rates and commission payments are accurate.
Once a quarter, each partner emailed statements to Wirecard that outlined “credit card transactions processed in the respective periods and the commissions subsequently due”, KPMG said. Two of the partners broke down the data by “account names”, while the third sent only a summary.
On the basis of those emailed spreadsheets, Wirecard, a financial technology provider, booked revenues and costs.
Actions taken by Wirecard’s finance team to minimise risks, known as “control activities”, were limited to “plausibility assessments” and comparison of the figures provided by the partners “with the ‘sales forecasts’ of the Wirecard sales units responsible for the respective customers”, KPMG said.
The set-up was not sufficient “to fully ascertain the amount and existence of the revenues”, KPMG said, adding that Wirecard provided contracts governing the relationship with the partners that in some cases were incomplete or lacked signatures.
No losses, no bank statements
Wirecard treated its three key partners as extensions of its own operations, including within its own financial statements their revenues and costs from processing payments.
The German group also undertook to cover any losses its partners might incur, including those caused by reversed transactions or fines imposed by the card networks, KPMG said.
Those three partners were supposed to send money to Wirecard, reflecting its share of the business, but little of it flowed directly to the group.
Accounting journals showed that two partners together paid €85m to accounts at Wirecard Bank during the period, KPMG said.
Instead, €1bn of payments — equivalent to almost a quarter of the worldwide revenues reported by Wirecard in the period — went to escrow accounts supervised by an unnamed trustee.
KPMG said it was not provided with bank statements to verify the €1bn of payments. Moreover, in an unexplained move, the trustee terminated its relationship with Wirecard around the time that the investigation began late last year.
KPMG was told that the trustee — who had worked for Wirecard for more than three years — stopped responding to requests and did not co-operate.
The report said the special auditors were not given evidence that Wirecard assessed the reliability of the trustee or its replacement, which was hired on the advice of its departing predecessor. The bank handling the escrow account was also replaced.
From 2016 to 2018, sums in the escrow accounts were included in Wirecard’s calculation of cash reserves, a key figure used by investors and lenders to assess a company’s financial health. The report challenged those published figures: “KPMG comes to the conclusion that there are arguments against Wirecard’s accounting of escrow accounts as cash or cash equivalents,” the report said.
Mystery customers
At the end of any transaction chain should be the ultimate customer, a business accepting credit card payments.
Wirecard is subject to strict regulations that require it to know the identity of its customers, conduct anti-money-laundering checks, and maintain archives of transaction data.
Markus Braun, Wirecard’s longstanding chief executive and largest shareholder, was asked about the underlying customers of the third-party acquirer partners in November on a conference call with investors. He said that KPMG “will have full access to the information”; “we can give full comfort there, so there is no risk”; and emphasised that “we, of course, know exactly what is in the books”.
On Sunday, Wirecard said in a statement about the special audit that the company “does not generate sales through the TPA partners, but de facto via the individual customers”.
KPMG, however, reported that it was not provided with the transaction data it requested for the years 2016 to 2018 in relation to Wirecard’s partners.
Some of the turnover data was reported to Wirecard under account name groups which were “aliases”. Such account names were retained beyond the existence of the customer relationship which had shaped them to avoid “the adjustment effort”, the report said.
KPMG also described another layer between Wirecard and the underlying clients. It said customers referred to the partners by Wirecard were so-called “aggregator merchants” or “payment facilitators” responsible for groups of merchants.
The report said that the partners were responsible for the compliance and know-your-customer (KYC) checks when taking on new customers. KPMG said that Wirecard “would neither track nor monitor these KYC compliance checks carried out by the TPA-Partners”, nor would Wirecard request proof that the checks had occurred.
Lending its partners a hand
While KPMG was unable to verify that the underlying customers were real, or the source of €1bn in payments to the escrow accounts, it did report that money moved in the opposite direction in the form of large loans to the partners.
In late 2018 Wirecard told shareholders about a new product line called Merchant Cash Advance, short-term loans to merchants who would otherwise wait 30 days or more to receive the money from credit card purchases. At the end of that year it said €285m had been lent in this way.
According to KPMG, €250m of such loans reported on Wirecard’s balance sheet was unsecured lending to two of the partners. The report said there was no evidence an evaluation of the financial circumstances of the partners had been made.
Awaiting the verdict of EY
Speaking on a conference call for investors after KPMG’s findings were published last week, Mr Braun said: “To summarise, I think we can present today the forensic audit and we can, again, say that in terms of restatement, there are no restatement needs, and in terms of major findings, we have no major findings.”
Publication of Wirecard’s full-year figures, which its longstanding auditor EY must approve, was postponed from April 30 to June 4. Mr Braun said the reason was coronavirus. “E&Y informed us this morning that they have no problem at all to sign off the audit 2019,” he said.