Wirecard Scandal - Quick Summary
What happened:
Wirecard, once valued at nearly €25bn, collapsed in 2020 after €1.9bn in cash was found to be missing.
Core issue:
A sustained pattern of false reporting, enabled by weak oversight and aggressive denial of criticism.
Key failure:
Every layer of governance – board, auditors and regulators – failed to challenge management effectively.
Why it matters:
The case exposed fundamental weaknesses in how modern governance systems detect (or fail to detect) reality.
ACG insight:
The absence of independent, stakeholder-informed intelligence allowed false narratives to persist unchecked for years.
Key facts
-
Collapse: June 2020
-
Peak valuation: ~€25bn (2018)
-
CEO: Markus Braun
-
COO: Jan Marsalek (fugitive)
-
Auditor: EY
-
Regulator: BaFin (Germany)
-
Audit oversight: APAS
-
Financial reporting enforcement: FREP
-
EU oversight: ESMA
-
Key investigations:
-
Financial Times reporting (2014–2019)
-
Zatarra Report (2016)
-
KPMG special audit (2019–2020)
-
-
Critical structural issue:
Use of Third Party Acquirers to inflate reported revenue
🔎 Key Questions This Case Answers
What was the Wirecard scandal and how did it unfold?
What warning signs were visible before the collapse?
Why did regulators such as BaFin fail to act?
What role did auditors (EY) play?
How did the supervisory board fail in its duties?
Why did multiple investigations fail to uncover the truth?
What systemic weaknesses did Wirecard expose?
What could have prevented the collapse?
📑 Contents
This case study examines how repeated warnings over many years failed to trigger effective corrective action – and what this reveals about the limits of conventional governance, audit and regulation.
The story
One might say that this was an accident waiting to happen. The first intimations of problems go back to 2008, when the German shareholder association, SdK, challenged the accounts on the basis that Wirecard was counting client deposits as its own revenue, and its profits looked too high. Wirecard’s response was to appoint EY to conduct a special audit, and when that audit cleared them, to sue SdK.
In 2014, investigative journalism from the FT suggested problems with their Asian operations – in particular that rapid and suspicious looking acquisitions of new businesses just before the year end were being used to disguise an unfavourable cash position. Again, Wirecard’s response was to deny the allegations and sue the media responsible.
In 2016, specialised research firms produced a detailed document they called the Zatarra Report, which suggested that the Asian operations were very much smaller than reported, and there was evidence of major fraud and money laundering. This caused a big hit to the share price, and management angrily accused Zatarra of being a front for stock manipulators. The German regulator, BaFin, took the accusation seriously and commissioned an investigation into possible market manipulation.
New challenges followed a whistleblower’s accusations of accounting manipulation and attempted auditor bribery in India. A particular focus now was on what was called Third Party Acquirers, partners who processed payments in regions where Wirecard didn’t have a licence. The suspicion was that this was being used as a way of inflating reported revenue. Management’s response was to get EY to set up a special investigation to put the auditor’s mind at rest over the issues raised. However, this project, named Project Ring, made very slow progress and threatened EY’s willingness to sign off the accounts for 2016.
Come 2018, and internal legal staff in Singapore discovered evidence of “roundtripping” and serious fraud. The FT reported that senior staff had probably tried to hide these fraudulent activities, and there were reports that a significant proportion of Wirecard’s Asia activities were actually coming from their third-party acquirers rather than from their own platforms, but the revenue was being declared as Wirecard’s income. An independent investigation also suggested that at least half the purchase price of the 2015 Indian acquisition had never been paid to the seller. The regulator, BaFin, however, took a different view about these reports and conducted an investigation into short selling by journalists, and the auditors passed the accounts without qualification.
In 2019 the pressures became intense, as the FT published a report showing that serious fraud had happened for many years in the Singapore office with forged and back-dated contracts to inflate revenue, and fake partners who didn’t exist. Management commissioned KPMG to conduct yet another independent enquiry, which resulted in the finding that KPMG couldn’t verify the existence of €1bn in cash. The regulator’s initial response was still to investigate the FT for possible market manipulation, but then the Singapore police raided Wirecard’s offices. Again, though, Wirecard’s response was to sue the FT for alleged involvement in market manipulation, and to employ private investigators to shadow the journalists involved, while denying all the allegations and claiming to be the victims of fraud.
In 2020 the roof finally fell in. KPMG’s finding, announced in April, that €1bn in cash was missing, was followed up by EY in June refusing to sign the accounts because it couldn’t verify the existence of €1.9bn of assets. At this point, Wirecard acknowledged that the €1.9bn was probably missing, the CEO resigned and was arrested for suspected market manipulation and fraud, and the company filed for insolvency.
So the fintech darling of German industry which reached a peak market value in 2018 of nearly €25bn, despite all the red flags mentioned above, and had employed McKinsey to plan the potential takeover of Deutsche Bank, was bankrupt eighteen months later. How could this have happened in a mature, highly regulated market?
Let’s look at how the various key parties conducted themselves in the years
before the curtain came down.
🚩 Early warning signs that were missed
The warning signs in the Wirecard case were not subtle. They were repeated, public and persistent over more than a decade.
Key indicators included:
Repeated allegations from credible external parties (FT, Zatarra, whistleblowers)
Aggressive legal action against critics instead of transparent engagement
Complex and opaque third-party structures (Third Party Acquirers)
Rapid acquisitions used to support reported performance
Persistent difficulty verifying cash balances
Multiple “independent investigations” producing limited clarity
Regulatory focus on critics rather than underlying issues
Key point: The issue was not a lack of warning signals – it was the failure to interpret and act on them.
Responses of key parties
Supervisory board (Aufsichtsrat)
There is very little mention of the supervisory board until near the end of the story, notwithstanding the importance of its role. The members of the German supervisory board comprise the representatives of the main stakeholders, and its role is to approve the company’s strategy, look after the long-term future and appoint the members of the management board, monitor and supervise them, and dismiss them if appropriate. This, of course, includes review and approval of the financial statements.
It would be fair to say that the supervisory board of Wirecard completely failed in pretty well every respect over the twenty years before Wirecard’s demise. Its excuse was that it hadn’t been properly informed about what was going on, notwithstanding all the rumours and court challenges over the years. .In the end, the chairman had to step down.
Management board (Vorstand)
The management board, headed since 2002 by Markus Braun, was independently responsible for creating and implementing the company’s strategy and ensuring compliance with laws and regulations while safely managing risk. And keeping the supervisory board fully informed. There is a fiduciary duty on the members of the board to put the company’s interests over all personal interests.
Markus Braun was clearly a totally dominant personality, and his number two, Jan Marsalek, was clever and devious. Between them they created the culture which allowed Wirecard to build the business which achieved a market value approaching €25bn, but whose actual value was a fraction of this.
Much has been revealed about Marsalek since his disappearance, though how it all hangs together is still largely a mystery. He certainly didn’t have the best interests of Wirecard as a priority though, and the complex structures he set up were clearly designed to further his own objectives rather than Wirecard’s.
What about Braun? Again, the story is not totally clear, and the still on-going trial bears witness to the confusion. What is plain is that his leadership of Wirecard turned into one of the biggest and most embarrassing disasters to hit the German financial sector in many years. Either Braun was misled and defrauded like most other people – his defence – or he was a party to the plan, in collusion with Marsalek. Either way, his performance as head of the management board was catastrophically bad, and he had to fall on his sword when Wirecard folded, along with his key lieutenants.
Auditor (EY)
From all that has emerged, the audit partners involved with Wirecard seem unbelievably naïve. No-one has accused them of collusion or corruption, but incompetent doesn’t begin to describe the way they accepted answers to their enquiries without reliable, independent checks – something, the importance of which, they would have been taught in their early days of training. And this pattern continued over the years, notwithstanding all the warning signs.
EY’s excuse was that it was misled, pleading the traditional defence of the auditor that its job is to check that the accounts present a fair view on the basis of the information that they are given. It is not expected to look for criminal activities, and an audit cannot be expected to discover complex fraud. Again, eventually EY had to admit their failings, it cost the careers of the key officers involved, and there is still the possibility of further financial damage for the partnership.
BaFin (Federal Financial Supervisory Authority)
BaFin is Germany’s supervisory authority for the financial services sector, regulating banks, insurers and financial institutions.
What was BaFin’s response to the growing suspicions about the veracity of Wirecard’s published financial results? Answer: not to conduct their own checks into the allegations, but to challenge the motives of the journalists and researchers ferreting out the truth behind the suspicions.
BaFin defended its role as being limited to Wirecard Bank. Its argument was that any fraud occurred in Wirecard, which was a tech business and hence outside its purview.
What it did do was to ban shorting of Wirecard shares, notwithstanding the Bundesbank advising it that in its view such action wasn’t necessary, as there was no risk to financial stability from the shorting of Wirecard shares.
Moreover, BaFin gave the EU watchdog what was described as a selective and biased briefing on the Wirecard challenges, since it apparently believed that Wirecard was innocent of the charges.
APAS (Auditor Oversight Authority (Abschlussprüferaufsichtsstelle or APAS)
This is the body which is responsible for oversight of the auditing profession in Germany. It seems to be regarded as relatively ineffectual, criticised for being understaffed, and with weak powers.
Nevertheless, this is the supervisory body that should have ensured that a Big Four firm like EY was conducting its audits to the highest standard. And it didn’t in the case of Wirecard.
Part of its defence for taking so little interest was the view that the implied support behind the shorting ban made them relaxed about Wirecard.
FREP (Financial Reporting Enforcement Panel)
This is an independent body set up by representatives of professional and industry associations to discover infringements of accounting standards and report these back to the companies concerned and to the Financial Service Authority for it to take any follow-up action.
What was FREP doing in response to all the challenges regarding Wirecard’s financial reporting? Far from investigating, FREP told Wirecard it wasn’t convinced about the fraud claims. The failure of FREP in properly fulfilling its role in relation to Wirecard resulted in the president later stepping down.
ESMA (European Securities and Markets Authority)
ESMA’s declared mission is to enhance investor protection, promote orderly financial markets and safeguard financial stability. Beyond this, it is to foster supervisory convergence amongst Member States’ national competent authorities with responsibility for securities and capital markets supervision. It aims to do so across financial sectors by working closely with the other European Supervisory Authorities competent in the field of banking, and insurance and occupational pensions.
Its own concern about the performance of BaFin, caused it to set up an assessment of the supervisory response, in the financial reporting area by BaFin and FREP, to the events leading to the collapse of Wirecard in 2020.
German government
The role of the ruling party is to safeguard the financial stability of Germany by making sure there are proper regulations in place, and they are properly enforced. Additionally, it includes promoting German business interests in export markets.
No-one seems to have held the government responsible for the Wirecard scandal, but there was criticism of Angela Merkel for promoting Wirecard in an overseas trip in her role as Chancellor without paying due regard to the rumours about the company.
The German finance minister defended the current regulations, but a report to the Bundestag, following an investigation into EY’s performance as auditor, said EY’s audits had serious flaws.
Investors
Who was looking after the interests of investors in Wirecard? In early 2020 a small group of shareholders pressed for an independent enquiry. Later in the year a big shareholder called for the sacking of Braun if KPMG’s investigative report was unfavourable, and one of the top ten shareholders called for the supervisory board to appoint new managers. There was criticism by Softbank investors of EY’s lack of competence.
Lawsuits were filed in relation to the loss in value of the shares as Wirecard sank.
Prosecutors
The Munich prosecutors initially looked into possible market manipulation by the publishers of reports and articles challenging Wirecard’s figures, but said they were not investigating malpractice on the part of Wirecard itself.
The prosecutors apparently decided, on the initial discovery of the missing €1.9bn, that it wasn’t serious enough to issue an arrest warrant for Marsalek, who disappeared the next day.
Later an arrest warrant was issued for Marsalek, and later still Braun was arrested.
The Singapore prosecutors took earlier action when they raided Wirecard’s local offices to follow the allegations of fraud in Asia.
Press and special investigators
The FT, in particular, fought a long and tough battle to uncover the truth, as did the various independent researchers. The motivations of the different groups varied, but their dogged determination to uncover the truth was eventually rewarded.
However, they were met with a ferocious response from Braun and Wirecard with court actions and personal threats.
🧭 What was missing: a system that detects reality
The fundamental failure in the Wirecard case was not simply fraud.
Fraud exists in many organisations.
The critical failure was the absence of an independent system capable of identifying the gap between reported performance and underlying reality.
All key parties – supervisory board, auditors and regulators – relied, directly or indirectly, on information shaped by management.
When that information was false, the entire system became compromised.
The ACG Approach
The approach developed by Applied Corporate Governance addresses this exact gap through three integrated elements:
1. A holistic performance framework
Monitoring not only financial outcomes, but:
Culture
Business model integrity
Compliance and risk exposure
2. An independent board information system
Built around the holistic framework
Fed by independently conducted stakeholder surveys
Providing continuous, forward-looking insight
Reporting directly to the supervisory board
3. Independent data flows
Delivered not only to the board
But also, where appropriate, to auditors and regulators
Reducing reliance on management-controlled narratives
Solution
This model creates a continuous, external view of organisational reality.
It enables:
Early identification of misalignment between reported and actual performance
Detection of cultural and operational risks before financial impact
Faster and more informed corrective action
Benefits
Applied to Wirecard, such a system would have delivered one of two outcomes:
1. Early exposure of a fundamentally flawed model
Preventing further escalation and limiting losses
2. Early identification of operational issues
Allowing corrective action and potential recovery
❓ Common Questions - and the More Important Ones
Common question:
Why didn’t regulators stop Wirecard?
Better question:
Why were regulators dependent on the same flawed information as everyone else?
Common question:
Was EY incompetent?
Better question:
Why was there no independent verification beyond management-provided evidence?
Common question:
Who was to blame?
Better question:
What system failure allowed all parties to be misled simultaneously?
Common question:
Why didn’t the board act sooner?
Better question:
What information were they actually receiving — and what was missing?
📌 Key governance lessons from Wirecard
Governance systems must not rely solely on management-generated information
Independent verification must extend beyond financial audit
Persistent external criticism should be treated as a signal, not dismissed
Culture and incentives are leading indicators of risk
Regulators and auditors are not substitutes for board responsibility
Early warning systems must be forward-looking, not retrospective
Conclusion and core governance insight
Wirecard was not merely a failure of ethics or accounting. It was a failure of visibility. Too many decision-makers relied on information shaped by the very people whose conduct most needed independent scrutiny.
The collapse was a systemic failure of governance.
A failure to question
A failure to verify
A failure to see reality clearly
The lesson is not just about preventing fraud.
It is about building systems that ensure truth can be seen – even when it is inconvenient.
