FEATURE ANALYSIS OF A FRAUD

Global Governance Lessons From Europe’s Enron

FOR ITS SHEER SCOPE, DARING, AND SIZE, WIRECARD IS BEING COMPARED TO ENRON. WHAT HAPPENS NEXT SEEMS BOTH PREDICTABLE AND INEVITABLE.

By Andrea Bonime-Blanc and Michael Marquardt

ast June, members of the Wirecard ­supervisory board dialingL into a hastily convened emergency call could hardly believe what they were hearing. The fast-growing ­German ­financial services provider that they were charged with over- seeing only recently had been rumored to be in takeover talks with Deutsche Bank. Now, Wirecard board members were being told that €1.9 billion ($2.2 billion) in cash was missing and the company was €3.2 billion ($3.7 billion) in debt. Could Wirecard’s vast international business empire really have been based on lies and obfuscation? Indeed, it appears so.

36 Directorship January/February 2021 January/February 2021 NACDonline.org 37 FEATURE ANALYSIS OF A FRAUD

KEY PLAYERS IN THE On June 25, 2020, Wirecard filed for clude organized commercial criminal WIRECARD STORY insolvency. Then, on Aug. 25, a court-­ fraud, breach of trust, false accounting, appointed administrator issued a press and market manipulation. All of the for- 1. Founders/Management Board release stating that it had been able “to mer Wirecard executives now awaiting tri- „ Oliver Bellenhaus, managing stabilize the ongoing business and create al have declared their innocence. director of Dubai-based Wirecard a basis for [Wirecard’s] continuation.” As unit (currently in jail awaiting trial) part of the stabilization efforts, all mem- OMINOUS QUESTIONS „ Markus Braun, CEO (currently in a bers of Wirecard’s management board—at Wirecard, like Enron until its own spectac- German jail awaiting trial) least those who had not already resigned or ular demise in 2001, had been on a wild „ Burkhard Ley, CFO of Wirecard fled Germany—and some 730 employees and aggressive trajectory of growth. When from 2006 to 2017 (in a German jail were let go. the dot-com bust threatened Wirecard’s for three months in 2020; released As of mid-December, senior Wirecard existence in 2002, Braun was recruited as on bail) executives including ex-CEO Markus CEO. With the benefit of hindsight and „ Jan Marsalek, chief operating Braun and former chief financial offi- courageous reporting—notably by the officer (whereabouts unknown) cer Burkhard Ley have been criminally Financial Times (FT)—it is clear that the „ Stephan von Erffa, head of charged and are awaiting trial in Germany. company’s lifespan was fueled by hubris accounting (currently in a German Another executive was released from jail as and a win-at-all-costs corporate culture. jail awaiting trial) a cooperating witness for the prosecution. Braun provided Wirecard with a cash in- Former chief operating officer Jan Mar- fusion, and under his leadership proceed- 2. Supervisory Board Members (2018) salek, who also served on the management ed to allegedly perpetrate an intentional „ Thomas Eichelmann, chair board, is a fugitive from the country. accounting fraud over a period of years „ Bettina Funk Wirecard leadership is accused of that escaped the notice of key stakeholders „ Stefan Klestil having conspired with others to inflate including regulators, auditors, and Wire- „ Anastassia Lauterbach ­revenues and its balance sheet by fak- card’s own supervisory board. „ Vuyiswa V. M’Cwabeni ing business with third-party partners, Now, in the aftermath of Wirecard’s in- „ Wulf Matthias said Anne Leiding, a spokesperson for solvency, and as lawsuits add up, regulators „ Iris Stöckl the Munich­ State Prosecutor’s Office, and stock exchanges are reevaluating their 3. Watchdogs during a press conference in which she checks and balances, looking to repair „ BaFin (Germany’s financial announced the charges. The creation of a fault lines, and taking aim mostly at the regulator) false impression of financial strength en- corporate audit function—both internal „ Deutsche Börse abled Wirecard executives to borrow €3.2 and external. Many corporate governance „ Financial Reporting Enforcement billion from banks and investors. observers expect to see regulatory reform Panel “In reality, it was clear, at the latest by in the European Union and in Germa- the end of 2015, that Wirecard’s real busi- ny on a scale akin to the Sarbanes-Oxley 4. Short Sellers and Investors ness was losing money,” Leiding told re- Act, the US federal law that was passed PHOTO ON PREVIOUS PAGE, ASSOCIATED PRESS „ Matt Earl and Fraser Perring, who porters in Munich. Wirecard executives in 2002 after corporate accounting scan- published the “Zatarra” report are also suspected of harming investors by dals—including at Enron, Tyco Interna- „ David Einhorn overpaying for acquisitions and for creating tional, and Worldcom—came to light. „ Fahmi Quadir and perpetuating a culture “characterized Sarbanes-Oxley­ essentially gave board au- by an esprit de corps and oaths of loyalty” to dit committees greater authority and thus 5. Third-Party Consultants/Advisors Braun as their leader. increased both the responsibilities and „ EY Braun resigned after Wirecard auditor oversight of the committee. „ KPMG EY said it could not verify the €1.9 billion Given the sheer scope, daring, and size „ McKinsey supposedly held in escrow on behalf of the of Wirecard’s fraud, comparisons to Enron „ PwC third-party partners. are both inevitable and predictable. The Altogether, the formal charges made business community and the public began against Wirecard’s leadership team in- asking two ominous questions: Where was

38 Directorship January/February 2021 the board? And where were the regulators? After all, the Wirecard Examining Wirecard’s evolution in retrospect, the business was fraud was not discovered by these governance stakeholders but and did anything but the “usual.” It was founded in 1999 to provide instead by a cadre of short sellers and FT journalists, ultimately payment processing largely for gambling and pornographic web- aided by lower-level­ whistleblowers who were paying much closer sites, according to a detailed FT timeline that it published on June attention than those lawfully entrusted and compensated to do so. 25, 2020, as part of its five-year-plus “House of Wirecard” inves- tigative series. Wirecard, backed initially by venture capital, grew BUSINESS AS UNUSUAL through acquisition, eventually expanding into banking. In 2005, What seemed like the sudden demise of Germany’s premier Wirecard began trading on the Frankfurt stock exchange by acquir- publicly traded fintech company was a shock to most in the ing a defunct call center’s listing, thus avoiding any scrutiny result- global investment world, and seemingly to Wirecard’s super- ing from the more traditional route of going public. It moved into visory board, shareholders, and most of its 5,300 employees banking by acquiring XCOM, which it renamed Wirecard Bank. (as of June 2019). Unsurprised were astute readers of the FT The FT reported that the “unusual” banking and non-banking hy- and those who paid attention to the reports of Wirecard in- brid “makes its accounts harder to compare with peers, and helps vestors, including hedge funds and short sellers, and at least persuade investors to rely on the company’s adjusted versions of fi- three daring Wirecard employees in Singapore who became nancial statements.” (See “Wirecard: Key Milestones and Reputation whistleblowers. Risk” on page 40).

A SAMPLING OF LARGE CORPORATE FRAUDS Wirecard filed for insolvency in June 2020 after admitting that billions of dollars in cash probably did “not exist,” making it one of the biggest corporate scandals in EU history. Below is a list of some of the larger recent US and global corporate frauds and their consequences.

AMOUNTS INVOLVED YEAR COMPANY COUNTRY CRIME CONSEQUENCES (FINES/LIABILITY/ LOSSES)

Systemic existential US $74B losses Liquidation fraud 2001 Systemic existential US $175B losses Liquidation fraud

$70B in fines Deepwater Horizon UK Restructuring and other costs environmental disaster 2012–2020

$35B in fines Emissions cheating Germany Compliance reforms 2020 2016– (as of December 2020) scandal

Compliance reforms, execu- tive compensation clawbacks, Malaysia and 1MDB corruption $3.9B in fines and industry prohibitions; United States scandal several ex-employee criminal 2020 guilty pleas $2B+ in fraud losses Systemic existential Bankruptcy, additional con- Germany (and counting) fraud sequences to be determined

Source: Gloom to Boom: How Leaders Transform Risk Into Resilience and Value by Andrea Bonime-Blanc (Routledge, 2020)

January/February 2021 NACDonline.org 39 FEATURE ANALYSIS OF A FRAUD

In the annals of scandal, Germany has been home to its fair American corporate directors tend to follow the “noses in, fingers share. While Volkswagen (emissions), Siemens (bribery), and out” dictum, German supervisory board members tend to act more Deutsche Bank (spying and LIBOR issues) emerged intact, any along the line of “eyes on, hands off.” While it is difficult to gener- number of lesser-known German businesses wracked by scandal alize across hundreds of well-managed and ethical publicly traded have not been as fortunate. What these scandals all seem to have corporations in Germany, it is fair to say that supervisory boards in common, though, is repeated systematic failures of German and tend to get less deeply involved in the operations of the companies European governance and regulatory watchdogs. they serve than their American counterparts. Germany’s corporate governance code mandates a two-tiered Even the most vigilant, skeptical board may be led to believe board model comprising management and supervisory boards, corporate management over external sources armed with potential the latter of which most closely resembles the boards of American axes to grind. Some of the problems revealed by the Wirecard fraud, companies. The roots of the two-tiered corporate governance struc- in the opinion of these authors, stem from Germany’s business cul- ture go back more than a century, with well-intentioned measures ture overall and fundamental deficiencies in corporate governance enacted to allow workers greater influence and support for their practices more specifically. Obedience, stoicism, pride, and a com- interests and to provide stability in crises. In practice, it has resulted mand-and-control bent often met by complacency are to varying in corporate supervisory boards that are a good degree removed degrees characteristic of German business, which may help explain from day-to-day operations while focusing their attention on the why disconnects between a supervisory board and senior manage- performance and compensation of the management board. While ment are prevalent in the country’s corporate scandals.

WIRECARD: KEY MILESTONES AND REPUTATION RISK Zurich-based data science firm RepRisk uses artificial intelligence to quantitatively gauge how key events increase or decrease a company’s ESG risk exposures. In August 2015, RepRisk began tracking Wirecard, which reached its peak RepRisk Index score of 69 in July 2020. 1999—2014 2015 2016 2017 2018 2019 2020

„ 1999 Wirecard is founded in Munich, backed „ Financial Times begins its “House of by venture capital, as a payments processor. 80 ­Wirecard” investigative series questioning „ 2002 Markus Braun takes over as CEO after the company’s rapid growth and reporting the company almost goes bust. 70 a €250M hole in the balance sheet. „ 2005 Wirecard is listed on Frankfurt stock exchange by taking over the listing of a defunct 60 Paul Murphy, the FT’s investigations team group. editor (left) and Dan McCrum, part of the FT’s investigations team. „ 2005 Its core businesses now include 50 managing payments for online gambling and pornography. 40 „ 2006 Wirecard moves into banking by purchasing XCOM, a small bank licensed by Visa 30 and Mastercard, to become an unusual hybrid financial firm. 20 „ 2010 Jan Marsalek, a protégé of Braun, is 10 appointed COO. „ 2011–2014 Wirecard raises €500M for a global 0 merger-and-acquisition spree, buying up obscure „ Under the pseudonym “Zatarra,” short companies in Asia. „ Wirecard responds to FT news stories sellers Matt Earl and Fraser Perring publish „ Markus Braun by having lawyers send threatening letters a dossier of allegations related to money (right) allegedly REPUTATIONAL RISK LEGEND and launching a public relations campaign. laundering; Wirecard denies the claims. borrows €150M A quantitative measure of a company’s „ Wirecard buys a payments business in „ BaFin, the German financial regulator, in a margin reputational risk exposure to ESG issues. India for €340M, its biggest purchase ever. investigates Zatarra. loan secured 0 = no risk exposure by 7 percent „ More analyst reports assert operations „ FT journalists and others receive “spear- 100 = extremely high risk exposure of Wirecard’s in Asia are much smaller than Wirecard phishing” emails in an apparent hacking equity. claims. campaign. Wirecard’s reputation risk level

Source: Data40 compiledDirectorship from the January/February Financial Times. Reputation 2021 risk data compiled by Furthermore, an analysis by the authors of Wirecard’s supervi- Wirecard. Instead of investigating Wirecard, BaFin pursued inves- sory board as it was composed in 2015 shows a lack of technical tigations into the FT and the short sellers who were alleging fraud. ­financial expertise and diversity. It was not until 2018 that two A small number of BaFin investigators were later found to have women were named to Wirecard’s six-member supervisory board, traded Wirecard shares based on insider information. and that was only because new mandates by Germany’s federal The Wirecard insolvency also reflects the absence of sufficiently government went into effect that year. And until 2018, environ- robust and resilient internal controls for compliance and risk man- mental, social, and governance issues—including ethics and com- agement, especially for a fintech business with cutting-edge and pliance—were just not part of the board’s oversight for any Ger- somewhat opaque products and services. man company. Add in a German government intent on promoting Wirecard was listed among Deutsche Börse Group’s DAX 30 a robust start-up economy, and possibly looking the other way to on Sept. 24, 2018, at the height of its reported market valuation allow innovation to flourish, and what results is an almost perfect of €21.57 billion ($24.81 billion), replacing Commerzbank. (The breeding ground for malfeasance. DAX is a blue-chip stock market index of the 30 major German Germany’s principal financial regulator, BaFin, is alleged in companies trading on the Frankfurt exchange. Admission to the lawsuits filed by shareholders in the aftermath of Wirecard’s insol- DAX 30 makes it an automatic investment by pension funds around vency to have, at a minimum, failed to do a proper investigation the globe.) Of note, the Wirecard supervisory board at that time did and assigned officials who had little to no experience with fintech not have a single board committee, a standard requirement of US companies to conduct the inquiry. BaFin repeatedly sided with stock exchanges. The Wirecard supervisory board in early 2019

1999—2014 2015 2016 2017 2018 2019 2020

„ FT publishes its first story on the Singapore „ BaFin issues a criminal complaint against 80 investigation; Wirecard denies the claims. Wirecard. „ BaFin files a criminal complaint against 70 short sellers and FT journalists, arguing that their claims of fraud resulted in market 60 manipulation.

50

40

30

20

„ Police raid Wirecard’s Singapore offices. 10 „ Police search Wirecard offices after Munich „ prosecutors launch a criminal investigation. „ BaFin announces a ban on short-selling 0 Wirecard lawyers in Singapore begin Wirecard after its share price plunges to „ Philippine banks inform EY that €1.9B in an internal look at the finance team under €10. after allegations of “round-tripping” balances are “spurious.” „ Wirecard’s risk and compliance committee with India. „ Wirecard states that €1.9B are “missing.” retains McKinsey & Co. „ In October, whistleblowers in „ Jan Marsalek is suspended; James Freis „ Wirecard sues Singapore authorities who Singapore contact FT after an joins as chief compliance officer. internal investigation is squashed. named five employees as suspects. „ Braun resigns; Freis becomes interim CEO. „ Softbank injects €900M into Wirecard. „ Wirecard announces that €1.9B does not „ Wirecard announces new compliance exist. measures. „ Braun is arrested. „ Wirecard issues €500M in bonds classified as investment grade. January/February„ Wirecard 2021 files NACDonline.org for insolvency. 41 PHOTOS OF FINANCIAL TIMES REPORTERS COURTESY OF FT; PHOTO OF MARKUS BRAUN, REUTERS/MICHAEL DALDER FEATURE ANALYSIS OF A FRAUD

did, however, create a risk and compliance committee that immediately ordered an audit of its internal func- German Chan- tions. Hired to conduct the review was McKinsey & cellor Angela Co. Its report included the recommendation that the Merkel takes off Wirecard supervisory board oversee the creation of an her face mask at internal 50- to 60-person compliance program office the beginning run by an executive-level compliance officer. The risk of a cabinet and compliance committee proceeded to hire PwC to meeting in De- create the program. cember 2020 Altogether, whether the two-tier supervisory board where passage structure that exists in several countries including of a reform pack- Germany has the right duties entrusted to them by age tightened law and to oversee the interests of key stakeholders finance and is open for debate. And, whether such a board could accounting rules be properly empowered to supervise or regulate a and expanded failed to meet sustainability requirements. rapidly growing tech company with opaque prod- the power of Beyond the stock market, the German government ucts in an emerging industry will certainly also be banking regula- is making changes to how accounting firms are regu- cause for renewed inspection. tor BaFin. lated. The Financial Reporting Enforcement Panel (FREP), a private entity that works on behalf of the FORGING AHEAD government, has audited public companies’ financial Stock exchange operator Deutsche Börse in ­November reports in Germany since 2005. And while BaFin can 2020 announced that it was making a number of ask FREP to launch an investigation, until the Ger- changes to the DAX index. Beginning in March 2021, man cabinet passed a package of reform measures, it member companies will be obligated to release audit- had no investigative authority. Given FREP’s limited ed annual and quarterly financial reports. Companies staff—15 employees total—investigations can take a that don’t comply will have a 30-day grace period, after considerable amount of time. Only one FREP inves- which failure to produce this information will result tigator was assigned to Wirecard after BaFin asked for in being removed from the index. In addition, listed an audit in early 2019. companies will undergo reviews twice a year (up from The German government announced in June once a year), and supervisory boards will be required 2020 that its relationship with FREP will terminate at to have an audit committee. In September 2021, the the end of this year and that BaFin will be permitted DAX will increase its membership to 40 companies, to launch its own investigations, a restructuring that with new members being required to prove that they will make BaFin more akin to the US Securities and have positive earnings before interest, tax, deprecia- Exchange Commission. tion, and amortization. In addition to providing greater Board duties today encompass traditional areas accountability, these revisions are designed to provide such as CEO succession and compensation, strategy, greater resiliency, with an increased number of mem- and enterprise risk management; in the past decade, ber companies reducing the market shock of a finan- they also have come to comprise digital technolo- cially underperforming company. gy and transformation, cybersecurity oversight, and While some were pleased by the new measures on more recently, a growing list of environmental, social, speculation that they would increase confidence and and governance issues.

international investors, others believe that not enough Each of these oversight areas is deeply interconnect- ASSOCIATED PRESS was done to correct the failings of corporate oversight ed, which means that the good, the bad, and the ugly and responsibility. For example, there are no provisions can all move that much more quickly. In turn, boards that outline qualifications for sitting on the audit com- must be acutely attuned to what is being said about mittee of the supervisory board. In addition, Deutsche them and the companies they govern by key stakehold- Börse declined a proposal to exclude companies that ers—be they regulators, journalists, or short sellers. D

42 Directorship January/February 2021