Wirecard: inside an accounting scandal
A preliminary report by a top law firm has unveiled a pattern of suspected book-padding across the group’s Asian operations
One year ago, Edo Kurniawan, a jovial 33-year-old Indonesian who runs the Asia-Pacific accounting and finance operations for global payments group Wirecard AG, called half a dozen colleagues into a Singapore meeting room. He picked up a whiteboard pen and began to teach them how to cook the books.
His company would soon become one of Germany’s most valuable financial institutions, but as Mr Kurniawan spoke, the immediate task at hand was to create figures that would convince regulators at the Hong Kong Monetary Authority to issue a licence so Wirecard could dole out prepaid bank cards in the Chinese territory.
The group was seeking to take over payment operations from Citigroup, covering 20,000 retailers in 11 countries stretching from India to New Zealand. Regulatory approvals in every territory were crucial, even if it meant inventing numbers to be used in the Hong Kong licence application.
Mr Kurniawan then sketched out a practice known as “round tripping”: a lump of money would leave the bank Wirecard owns in Germany, show its face on the balance sheet of a dormant subsidiary in Hong Kong, depart to sit momentarily in the books of an external “customer”, then travel back to Wirecard in India, where it would look to local auditors like legitimate business revenue.
In isolation, Mr Kurniawan’s scheme might have appeared to be the act of a rogue employee in the provincial outpost of a little known financial group. But the account of what happened, in a preliminary report on the investigation by one of Asia’s most eminent legal firms, indicated it was part of a pattern of book-padding across Wirecard’s Asian operations over several years. Documents seen by the Financial Times show two senior executives in the Munich head office had at least some awareness of the round-tripping scheme: Thorsten Holten and Stephan von Erffa, respectively the company’s head of treasury and head of accounting.
The revelations call into question the figures reported by one of Europe’s few technological success stories, a German fintech group that has grown into a €20bn global payments institution. Before the FT exposed the existence of the investigation last week, the group was more valuable than Deutsche Bank or Commerzbank, whose place it has taken in Germany’s main stock market index. Wirecard is a favourite of retail investors, who saw its rapid expansion into Asia as a sign that it can challenge the world’s biggest banks for primacy in the $1.4tn market for payments.
Markus Braun has run the company since helping to recapitalise it in 2002, an investment which made the 49-year-old Austrian a billionaire. In the field of digital money, Wirecard presents itself as best in class.
In response to the news of the preliminary investigation, Wirecard initially said no material compliance findings had resulted. This week the company told the FT that while its investigation was ongoing, it had made no conclusive findings of criminal misconduct and it would be wrong to draw conclusions from the preliminary report.
It is not the first time the group’s accounting practices have been called into question. Accusations of suspect accounting were levelled in 2008, 2015 and 2016. Each time Wirecard has alleged market manipulation, sparking investigations by the German market regulator, BaFin.
This time questions about its Asian operations began internally, prompted by a whistleblower left stunned by Mr Kurniawan’s January meeting last year. Notifying Wirecard’s senior legal counsel in the region on March 26, the whistleblower identified two senior finance executives, James Wardhana and Irene Chai, as accomplices in the book-cooking operation. A separate whistleblower also raised concerns in February, and on April 3 that person supplied the compliance team with a suspect contract they had received via Telegram, the encrypted messaging app.
Daniel Steinhoff, Wirecard’s head of compliance in Munich, flew in to Singapore for a briefing. On April 13 he ordered the email archives of these individuals “mirrored”, with copies seized.
Compliance staff, who evidently found the accounts of the whistleblowers credible, soon found enough in the documents to warrant a snap investigation, codenamed Project Tiger. They called in Singapore-based Rajah & Tann, which sent in a team of former prosecutors.
On May 4 R&T submitted a preliminary report, running to 30 pages of bombshell allegations: evidence in the documents of “forgery and/or of falsification of accounts”, as well as reasons to suspect “cheating, criminal breach of trust, corruption and/or money laundering” in multiple jurisdictions.
The trio in Singapore, led by Mr Kurniawan, appears to have been fabricating invoices and agreements to create a paper trail which could be shown to auditors at EY, as if money was moving in and out of Wirecard for legitimate purposes.
The job of his finance team was to oversee the figures put together by the various Wirecard companies in the region, then supply the accounts to head office. But the book-keepers were also putting together contracts and signing off on technology projects.
Not only were there no emails from certain supposed customers and suppliers to Wirecard, the preliminary investigation found that Wirecard lawyers, salespeople and technology staff did not appear to be involved in the deals either.
For example, in March last year Mr Wardhana, sitting at his computer, sent himself a digital copy of the logo for Flexi Flex, a hydraulics and piping company with offices in Singapore and Malaysia. The image was on invoices he presented to colleagues for payments, according to documents seen by the FT. These documents, including contracts for the supply and purchase of obscure software products signed by Mr Kurniawan, made it appear Flexi Flex was doing substantial business with Wirecard.
In an April 9 2018 email chain, Mr Wardhana drafted answers for queries from EY in Germany needed to close out that year’s audit. He described Flexi Flex as “a new client engaged in 2017” which generated €4m of revenue for Wirecard Malaysia.
Wirecard has since confirmed it had no genuine business relationship with Flexi Flex. Mr Wardhana’s email also attributed €3m of Hong Kong revenue to Right Momentum Consulting, another third party business partner. The Kuala Lumpur address for the company on documents seen by the FT could not be traced.
The R&T preliminary report said: “We may draw strong and irrefutable inferences from the documentary evidence there has been at the very least several accounting irregularities which take the shape of forged agreements. In the best-case scenario, the purpose behind these deliberate acts may be limited to the false creation of revenue, with no wrongful misappropriation of monies.”
Suspect transactions, while individually small in the context of Wirecard revenues, appear to have been designed to stop Wirecard entities missing profit targets, by filling holes after the end of a financial year with fake and backdated sales agreements according to the preliminary report and certain emails reviewed by the FT.
Wirecard told the FT on Wednesday that, subsequent to R&T’s preliminary report, a separate internal investigation with access to accounting systems determined that the allegations were unsubstantiated and no regulations were broken. Notwithstanding those findings, the external R&T investigation — ongoing for more than 8 months — reflected a commitment to good corporate governance, it said.
Since 2012 the company has raised €500m from shareholders, and spent it on a collection of obscure payments companies. Missing profit targets could have called into question the basis of Wirecard’s Asian expansion over the past decade.
R&T’s preliminary review of the documentary evidence and whistleblower testimony identified potential for accounting irregularities in numbers reported to Germany for businesses in the Philippines, New Zealand, Hong Kong, Indonesia, Malaysia and India.
It also indicated another potentially significant issue. Singapore and Hong Kong, like Germany, have put in place strict reporting requirements to combat money laundering. Suspicious transactions, such as those identified by Project Tiger, should be brought to the attention of the authorities in a reasonable timeframe.
As the owner of a bank, and as a member of the Visa and Mastercard payment networks, Wirecard has a responsibility to file such reports. It distributes hundreds of millions of euros in credit and debit card transactions every day. It is a gatekeeper with responsibilities to help police flows of cash as governments try to restrict the ability of criminals and terrorists to move money. Wirecard this week said it has complied with applicable regulatory requirements.
Yet, faced with evidence that a rogue unit in its fast-growing Asian business was forging documents, inventing money flows and sending real cash out the door to fictitious suppliers, the reaction of senior executives in Munich was curious.
A briefing document dated May 7 2018 was prepared for a meeting of Wirecard’s four most senior executives. Alexander von Knoop, chief financial officer, thanked the author in an email following the meeting “for the great job you are doing to clarify the circumstances and to prevent Wirecard Group from any financial and reputational damage”.
The email also announced that Jan Marsalek, Wirecard’s chief operating officer, had been appointed to co-ordinate the inquiry, “to get the necessary pressure on the investigation”, Mr von Knoop said.
Mr Marsalek, a 38-year-old Austrian with a military haircut, tailored suits and novelty solid gold credit card, was renowned within the company. He was also the management board member responsible for the Asia-Pacific region.
Wirecard’s lawyers in Singapore warned Mr Marsalek’s proposed role presented “a perceived and potential conflict of interest”. He was a material witness of fact who had worked closely with Mr Kurniawan on certain projects, they said.
R&T said in a May 9 email that his appointment could “invite forceful queries by regulators and enforcement agencies”. It was a potential conflict which could be managed, but that “in the worst case the investigation may be seen as fatally flawed to begin with — with the consequence that regulators and enforcement agencies may swoop in suddenly to conduct a full investigation of their own”.
One matter under scrutiny was Wirecard Singapore’s relationship with a third party, Matrimonial Global. R&T believed a sales agreement with the company had been backdated. A November 8 2017 email from Mr von Erffa pointed to Mr Marsalek’s knowledge of the deal. Outlining the transaction, it said “Jan will support us for contracts and communication etc.”
Ms Chai appears to have thought he had a stake in Matrimonial Global. On January 9 last year she wrote to a colleague: “If not mistaken this agreement is something like the one with Wirecard Dubai, I think the company belong to Jan.”
The colleague replied: “Yup, is the additional ‘revenue’ that was put in last Q [quarter].”
Wirecard told the FT that Mr Marsalek does not own Matrimonial Global, and that he has had no involvement in the investigations.
The COO had worked closely with Mr Kurniawan for years. For instance, a few days before the end of 2015 a Wirecard subsidiary in Indonesia, Aprisma, needed income of €3.3m to hit its profit target for the year. The two men discussed options. The target was reached thanks to what was described as an “additional project from Jan”, according to subsequent emails. The backdated sales agreement which resulted did not appear to be genuine, according to R&T’s preliminary report.
A year later Mr Kurniawan and Mr Marsalek had worked together to provide answers to questions from EY during a tough audit, according to documents seen by the FT.
In October 2015, Wirecard agreed to pay €325m for a collection of businesses in India, its biggest-ever takeover. The deal came after the FT published a series of articles highlighting apparent inconsistencies in Wirecard’s accounting and what looked like a growing hole in its balance sheet. The India deal attracted the attention of sceptical analysts and investors, who reported difficulty finding the scale of operations the company claimed. Inside Wirecard, EY directed a team at the end of 2016 to take a close look, now that a full year of ownership had passed.
In April 2017 Mr Kurniawan told a colleague he could not sleep because of Hermes, Wirecard’s main business in India. And the entity’s CFO, appointed only months before, submitted a disclaimer to the Hermes board that he “should not be held in any way responsible” for many of the documents relating to the 2016 audit, due to his recent arrival. EY eventually signed off on the revenues Wirecard reported.
The clean audit in early 2017 helped to reassure investors. Wirecard’s share price proceeded to quadruple, amid global enthusiasm for fintech companies.
Yet some of the documentary evidence placed in front of R&T, and since seen by the FT, raises fresh questions about the scope of accounting irregularities and the authority extended to the young book-keeper in Singapore.
Indeed, a central question remains. What did management in Munich know about Mr Kurniawan’s activities, and what should it have known?
A February 15 2018 email chain indicates that some in Germany were at least made aware of a version of the round-trip scheme Mr Kurniawan had sketched on the whiteboard weeks earlier. Documents show that Mr Holten, whose signature was needed to authorise payments from head office, wrote: “I need to know the whole cash flow.”
Mr Kurniawan replied 13 minutes later with a plan to move €2m into India, via Wirecard Hong Kong and an outside entity. “Hope it’s clear?” he asked.
“Very good, thx,” Mr Holten replied. Copied into the email was Mr von Erffa, whose signature would also be required.
When the FT broke news of the investigation last week, Mr Kurniawan was still head of international finance and his alleged accomplices were still employed. The company on Wednesday said certain individuals had been temporarily assigned to other roles, pending the outcome of the probe, and any disciplinary action would be determined by the evidence.
Wirecard also said there had been significant developments and substantial new information taken into account since R&T’s preliminary report.
A whistleblower, who initially approached the FT due to the apparent lack of action, this week said: “If a payments company can do this, how can you have trust in the system?”