Wirecard's Auditor Signed Off for a Decade. Its Regulator Investigated the Journalists Instead.

At 9pm on 22 June 2020, Wirecard told the market what its auditor had spent four days failing to hear back on: the €1.9 billion sitting in Philippine trust accounts, the cash that anchored roughly a quarter of the balance sheet of a DAX-30 payments company, probably did not exist.³ Two banks, BDO Unibank and Bank of the Philippine Islands, said Wirecard had never been a client. The documents bearing their letterheads were fabrications.³ Within days the company that had bumped Commerzbank out of Germany's blue-chip index in September 2018, at a market capitalization near €24 billion, was worth a rounding error.¹⁸

The instinct, looking at a number that large disappearing that completely, is to assume the fraud was brilliant. It wasn't, particularly. What was reasonably sophisticated was the fact that four separate institutions were legally positioned to catch it years earlier, and each one had a rule, a mandate, or an org chart that let it conclude, correctly according to its own paperwork, that this was somebody else's job.

Confirming that money in a bank account is real is not advanced forensic accounting. It is the oldest control in the profession: the auditor writes to the bank directly, the bank writes back directly, and nothing the client says or forwards in between counts as evidence of anything except what the client wants the auditor to believe.

For 2016 through 2018, that is not what happened at Wirecard's Singapore trust arrangement. EY verified the balance at OCBC Bank using screenshots and documents that came from Wirecard and from a third-party trustee the company had appointed.² OCBC later confirmed that neither Wirecard nor its trustee had ever held an escrow account there at all.² An audit opinion is a professional promise that the auditor checked under the cushions. For three years, EY's method of checking under Wirecard's cushions was asking Wirecard for a photograph of the cushions.

By spring 2020, under pressure from the Financial Times' reporting and a special audit already underway, EY finally tried to do it properly, and spent months asking the two Philippine banks for original, direct confirmation of the €1.9 billion. What came back instead were copies, scans, and PDFs, routed through intermediaries, never a document straight from either bank.¹⁴ On 18 June, EY told the management board it could not confirm the money existed. On 22 June, Wirecard stopped pretending it did.²³

Germany's audit oversight body later reviewed the whole ten-year engagement and concluded EY's work was, at minimum, negligent, and in places grossly negligent, having failed to identify fraud risk indicators, deviated from professional standards, and relied on verbal assurances from executives rather than verification.⁶ None of that required breaking a code. It required not asking the bank.

Wirecard's supervisory board going into the scandal had five members.¹⁴ Its chairman, Wulf Matthias, a former head of Credit Suisse's German subsidiary, took on the additional role of chairing the audit committee starting in the first quarter of 2019.⁷ Officially, this was described as streamlined governance. In practice it meant the person who was supposed to oversee the audit relationship and the person who was supposed to oversee the person who oversaw the audit relationship were on a first-name basis, on account of being the same name.

Independent financial expertise, in the form of former Deutsche Börse CFO Thomas Eichelmann taking the chair, arrived on the board in January 2020.¹⁴ An academic board-effectiveness analysis scored Wirecard's pre-scandal supervisory board low on financial and governance competency, and found that board independence measurably improved only between December 2019 and June 2020, which is another way of saying the fixes and the collapse happened in the same six months.¹⁴

To its credit, the board did eventually act. Facing continued reporting from the Financial Times, it commissioned KPMG in October 2019 to conduct an independent special audit and, presumably, put the allegations to rest.¹² KPMG's report, delivered after repeated delays in April 2020, did the opposite: it could not verify roughly $1 billion in the Asian trust accounts, could not confirm the majority of third-party revenue from 2016 through 2018, and could not verify the greater part of the profit the company had reported over that period.⁹¹² A special audit commissioned to clear a company's name had instead produced something closer to a resignation letter nobody had signed. Wirecard's board treated it as inconclusive. EY kept auditing for another two months.

A board that cannot separate "chair" from "audit chair," and that reads "we cannot verify a billion dollars" as ambiguous, has not delegated oversight. It has outsourced the appearance of it. Directors sitting on any board with a fiduciary duty to shareholders exist specifically to be the people in the room who ask the second question. At Wirecard, for most of a decade, there was nobody structurally required to.

Here is the part that is less a story about individual failure and more a story about institutional design working exactly as specified. Germany's accounting-fraud enforcement ran, at the time, on a two-tier system: the Deutsche Prüfstelle für Rechnungslegung, a privately organized, industry-funded self-regulatory body, handled the first stage, with BaFin as a backstop only if that first stage failed to resolve a problem.¹³ Wirecard AG, despite wholly owning a licensed German bank, was not itself classified as a financial holding company, which meant the group's accounting sat with the private first-tier body rather than under BaFin's direct institutional supervision.¹³ "Technology company" was, in this context, a jurisdictional finding, not a technological one.

In February 2019, after irregularities in Wirecard's half-year balance sheet, BaFin directed the DPR to open an examination.¹³ Germany's Federal Audit Office later reported that none of the key actors, the DPR included, recognized the severity of the case early enough or exhausted the tools available to push for urgent clarification. The complex review was handled, in practice, by essentially one employee, for sixteen months, on a case that would turn out to be the largest corporate fraud in postwar German history.¹³ The single most consequential accounting question on the Frankfurt exchange in a decade got a staffing plan built for a routine compliance letter.

The system did not survive contact with its own case study. The Bundestag's committee of inquiry catalogued the failures, Germany passed the Finanzmarktintegritätsstärkungsgesetz in May 2021 to tighten balance-sheet controls and audit rules, and the DPR was formally abolished on 1 January 2022, with financial reporting oversight consolidated entirely under BaFin.¹³¹⁹ That reform is worth sitting with for a second: the regulator's own postmortem concluded that the correct fix for "our fraud-detection body was privately run, industry-funded, and structurally under-resourced" was to stop having a privately run, industry-funded, structurally under-resourced fraud-detection body. Nobody had needed Wirecard to tell them that. Wirecard just made it politically survivable to say so.

The strangest part of the record is that outside skeptics found the shape of this years before anyone official did, and got treated as the suspects.

Financial Times reporter Dan McCrum published his first piece questioning Wirecard's numbers in April 2015.¹⁵ In February 2016, an anonymous outfit calling itself Zatarra Research published a report alleging money laundering and accounting irregularities; the stock fell as much as 25 percent in a day, and BaFin's response was to open an investigation into Zatarra and the short sellers around it for market manipulation, not into Wirecard.¹⁰ In 2018, McCrum received roughly 70 gigabytes of leaked internal correspondence from a former Wirecard lawyer, and in January 2019 the FT published its findings on forged and backdated contracts.¹⁵

BaFin's answer to that reporting, the following month, was to ban short-selling of Wirecard shares for two months, the first time it had ever shielded a single listed company that way, and to file criminal complaints against McCrum and his colleague Stefania Palma on suspicion of market manipulation, alleging their reporting had been coordinated with short-sellers.¹⁰¹¹ Being placed under a market-manipulation investigation by a national regulator is a specific kind of institutional statement. It says the state finds your reporting credible enough that collusion is the only remaining explanation. German prosecutors closed that investigation in September 2020, three months after Wirecard's collapse, having found the reporting fundamentally accurate and no evidence the journalists had coordinated with anyone.¹¹

Every other actor in this piece can plausibly claim it was fooled. BaFin had two competing hypotheses on the table in February 2019, chose to formally investigate the one that was wrong, and used a tool it had never used before to do it.

Accountability, once it arrived, arrived slowly and in pieces. EY was fined €500,000 as a firm, five of its individual auditors were fined between €23,000 and €300,000, and the firm was barred from new public-interest audit mandates in Germany for two years, a ban that only lifted this spring.⁵⁶ A Munich court separately ruled in February 2025 that EY was not liable for shareholder damages, on the technical ground that its audit reports did not qualify as "public capital market information" under German law, a threshold ruling rather than a finding that the audits were fine; shareholders are appealing.⁸ Braun and two other former board members were found liable in September 2024 for €140 million over two specific transactions, an unsecured €100 million loan to an Asian lender that already owed Wirecard money it hadn't repaid, and a bond subscription taken without verifying who was actually good for it.¹⁷ Recovering that money from defendants with limited personal assets is a separate problem from having won the judgment.

Braun's criminal trial, on charges including commercial gang fraud tied to an indictment alleging fraud since 2015 and roughly €3.1 billion in losses to lending banks, opened in December 2022 and is still running, with closing arguments scheduled for late October 2026 and a Munich appellate signal that a conviction would likely carry a sentence of ten to fifteen years.²⁰²¹ Braun maintains he was the fraud's victim, not its author.

Jan Marsalek, the chief operating officer who ran the businesses that turned out not to exist, fled to Belarus and then Russia within days of the collapse and has not faced any of this. Investigations published between 2023 and 2025 identified him as a Russian military intelligence asset of roughly a decade's standing, later also working for the FSB, holding Russian citizenship since 2023 under the alias Nelidov, and in December 2024 named as the ringleader of a spy network whose members were convicted in a London court of plotting to kidnap and assassinate dissidents and journalists.²²²³²⁴ That last part is not a punchline; the people targeted were real. But it is worth noting, coldly, what it says about the underlying business: the one executive who built Wirecard's most convincing fictions, the ones that survived a decade of audits from a respected accounting firm, is now doing paid work for a government that specifically values people who can build convincing fictions. The talent transferred cleanly.

None of this requires a DAX listing or a Munich prosecutor to become relevant to a smaller company. Three questions travel directly from Wirecard's file to yours.

Does your auditor confirm your largest cash and receivable balances directly with the counterparty, or does the confirmation come back through someone at your company first? This is a question you are entitled to ask before your next audit closes, and if the honest answer is "we're not sure," you have just found out how much your last opinion letter was actually worth.

Does the person chairing your board also chair your audit committee, or effectively run it through a small group with no independent financial expertise? Wirecard's answer to that question was yes for the years that mattered and no for the five months that didn't.

Do you know exactly which regulator has authority over your company's books, and do you know why? A corporate structure chosen for tax, licensing, or fundraising reasons can quietly carry a side effect: it decides which regulator's job it is to check you, and sometimes the honest answer is closer to none of them than founders expect.

The fourth lesson is softer but no less real. When outside skepticism arrives, an anonymous short report, an analyst note, a journalist asking pointed questions, the instinct to treat it as an attack to be managed rather than a claim to be tested is exactly the instinct that cost Wirecard four extra years. The company that gets this backward doesn't win the argument. It just spends longer being wrong in public.

Yes, and the mechanism is well documented. Verifying a bank balance without a confirmation sent and returned directly between the auditor and the bank is not really verifying it. Germany's audit watchdog found EY relied on screenshots and documents relayed through Wirecard and its own trustee for years before attempting direct confirmation, which is when the fraud actually surfaced.²⁶

Not in its original form. The private-sector first-tier body, the DPR, was abolished on 1 January 2022, and Germany's Finanzmarktintegritätsstärkungsgesetz, passed in May 2021, centralized financial reporting oversight under BaFin and restricted BaFin employees' own trading in the securities they supervise.¹³¹⁹ Whether centralizing power in one regulator that had already missed this case is sufficient reform is a live debate, not a settled one.

Every institution in this story can point to a document that technically authorized its inaction. EY had an audit opinion built on confirmations it never insisted on receiving directly. The supervisory board had a chairman doing two jobs and calling it efficiency. BaFin had a two-tier system that made the accounting regulator someone else's employee. All of that paperwork was real, and none of it caught anything.

The people who did catch it were unpaid, unaccredited, and got investigated for their trouble. So ask your own auditor, this week, whether the last confirmation on your largest account came back from the bank directly, or came back through somebody at your company first. If you don't know, you are not more careful than Wirecard's board. You just haven't had your June yet.