In early March 2017, long before they became two of the world’s most-wanted white collar fugitives, Wirecard’s chief operating officer Jan Marsalek and a young colleague in the payments company’s finance team, Edo Kurniawan, were worried about India.
Wirecard’s auditor EY had launched an investigation, codenamed Project Ring, focused on businesses the company had purchased in the Indian city of Chennai.
Although EY had overseen Wirecard’s books for several years without incident, Project Ring was in the hands of a new team of investigators, acting on a tip that senior managers at the German group may have committed fraud and that one had attempted to bribe an auditor.
Exchanging messages with Mr Kurniawan, Mr Marsalek passed on a warning from someone at EY. “A junior staff told our staff ‘off the record’ that they have doubts about our software billings and may withhold the audit confirmation,” according to a copy of chats Mr Kurniawan shared with a friend, which have been seen by the Financial Times.
Mr Marsalek instructed Mr Kurniawan, who led Wirecard’s Asian finance team, to speak to the person in charge of the India audit on the following Monday: “We should treat it as if we believe it was a misunderstanding or some India weirdness,” Mr Marsalek advised his subordinate.
The deflection effort did not work. Having endured three months of delay and prevarication, EY’s fraud team demanded documents and data by the end of that week, according to correspondence reviewed by the FT.
It prompted Mr Marsalek to follow up by email: “Hi Edo, do you have this under control? This seems quite worrying. Cheers, Jan.”
Yet if Project Ring was a chance to expose accounting fraud inside one of Germany’s most-lauded technology companies, it was missed. Internal documents, correspondence and a review of Project Ring by rival Big Four firm KPMG, all seen by the FT, paint a picture of the determined efforts of Wirecard executives to kill off the investigation and ensure EY continued to give the once high-flying payments group a clean bill of health.
It would be another three years before the scale of deception at Wirecard was uncovered, during which time the company raised billions of euros in fresh capital. EY now faces an investigation by Germany’s auditor oversight body Apas, lawsuits from Wirecard investors and the departure of clients such as Deutsche Bank’s asset management arm DWS and Germany’s Commerzbank.
According to the KPMG review of Project Ring, written this year as part of a wide-ranging special audit of Wirecard prior to the group’s collapse in June but not made public, EY’s forensic investigation in India was terminated prematurely and left key questions unanswered.
“KPMG sees evidence that argued against a termination of the Project Ring special audit and that should have been investigated conclusively,” the report said. The review added that EY should have mandated a third party to investigate given the alleged attempt to bribe a member of its staff.
The mystery Mauritian fund
The allegations investigated by the EY fraud team centred on a takeover Wirecard announced in October 2015. It paid €340m to an opaque Mauritius entity named Emerging Markets Investment Fund 1A for three Indian payments companies: Hermes i Tickets, GI Technology and Star Global.
The role of the Mauritius fund — which had purchased the Indian businesses for about €50m only weeks earlier and so reaped huge profits from the sale — was not disclosed by Wirecard at the time.
Someone inside EY smelt a rat. In May 2016, an unnamed EY whistleblower filed a letter to the firm’s German headquarters in Stuttgart asserting that “Wirecard Germany senior management” directly or indirectly held stakes in EMIF 1A.
The whistleblower also accused senior Wirecard managers of artificially inflating the operating profit of the purchased businesses, whose price tag was linked to their profitability.
According to the KPMG report, Stephan von Erffa, Wirecard’s deputy chief financial officer, was the only manager in Germany named by the EY whistleblower. He was not interviewed by the fraud team, and Wirecard refused them access to his email account. He has denied any wrongdoing.
On March 23 2017, Mr von Erffa responded to Project Ring requests for information by attempting to shut down further inquiries. “If we start now again with totally new audit fields, we will never get to an end. Therefore I mandate my team to concentrate on the local EY India audit and not to work on those new tasks,” Mr von Erffa wrote in an email seen by the FT.
A lawyer for Mr von Erffa did not respond to an FT request for comment.
Flying visit to Chennai
Among the recipients of the email was Andreas Loetscher, the lead EY partner on Wirecard’s audit, who is now Deutsche Bank’s head of accounting. The following month, Wirecard received its usual unqualified audit opinion from EY.
That December, Mr Loetscher flew into Chennai for a two-day site visit at Hermes, one of the businesses Wirecard acquired in 2015. Afterwards he wrote to Mr Kurniawan to thank him for the “preparation, discussions, explanations and entertainment”.
But as EY’s group audit of Wirecard was under way in January 2018, the undisclosed role of the Mauritius fund, EMIF 1A in the Indian deal and the much lower price it paid for the assets was revealed by a non-profit group now called the Foundation for Financial Journalism. Denying that shareholders were “robbed”, Wirecard responded by pointing to the oversight of EY as reassurance.
But EY’s fraud team still had suspicions. It shared a status update with Wirecard’s top management in March 2018: “Some of the observations could potentially sustain some indicators of the allegation that selected revenues had a significant impact on ebitda, triggering higher earn-out payments to the seller of Hermes.”
Killing Project Ring
Less than a month later, Wirecard’s management brought Project Ring to an end.
Explaining the decision via email to EY’s fraud team on April 3, copied to Mr Loetscher, Mr Marsalek asserted that “we take note that the investigation and analysis of the allegations in the ‘whistleblower letter’ from May 2016 did not uncover evidence supporting the accusations”. He added that an internal probe by Wirecard also concluded that there was no evidence for misconduct by an employee at the payments group.
“Hence we rate the allegations as baseless and won’t conduct any further investigation,” the email continued, with the COO thanking EY for its “always transparent and highly professional analysis and the corresponding reporting”.
A week later, the heads of EY’s fraud team replied to Mr Marsalek’s mischaracterisation of their work. They pointed out that the analysis did identify “business transactions and links” that might support the allegations raised in the whistleblower letter, but did not explicitly challenge their client’s assessment.
A day later, on April 11 2018, Mr Loetscher and his colleague Martin Dahmen* signed off the audits for Wirecard’s 2017 results.
Mr Loetscher declined to comment.
The whistleblower’s accusations and Project Ring received only a brief mention in the 42-page audit report EY provided to Wirecard’s supervisory board for the 2017 results. The report, seen by the FT, stated that the forensic investigation had been “concluded” without delivering “any evidence indicative of flawed accounting or other violations of law”. The same was stated in EY’s audit report for the 2018 results.
For Hansrudi Lenz, an accounting professor at Würzburg University, that qualifies as misrepresentation by EY’s auditors. “If the events happened as described, in my view, [EY’s] description of the ‘Whistleblower India’ topic in the audit reports for 2017 and 2018 is inadequate,” Mr Lenz told the FT.
The ultimate beneficial owners of EMIF 1A remained a mystery. When faced with questions about the fund, Wirecard always pointed to the reputable external advisers involved in the deal, such as Linklaters, the UK magic circle law firm.
This carried weight even after Wirecard imploded this year. In July a UK High Court judge threw out a civil fraud claim against the company, writing: “Crucially, in my view, EMIF was [sic] been advised by Linklaters. As a reputable law firm they would have investigated EMIF’s position and been satisfied as to matters such as EMIF’s beneficial ownership, compliance with money-laundering and terrorist financing laws, and the absence of tax and other fraud.”
However, the KPMG report showed that when considering wider allegations of accounting irregularities in 2019, EY’s fraud team had identified one person who might have links to the Mauritius fund: Mr Marsalek.
There was no hard evidence, however, and Mr Marsalek denied any ties when interviewed by lawyers for Wirecard’s supervisory board. Unsatisfied, the supervisory board demanded a confirmation from his tax adviser, certifying that Mr Marsalek had never received income from Mauritius, according to several people with direct knowledge of the matter. The chief operating officer ignored the request over many months, those people said.
Today, Mr Marsalek’s face is on posters plastered across Germany as part of an Interpol manhunt. Mr Kurniawan, who told lawyers for Wirecard he always acted on the instructions of Wirecard’s COO, was last sighted in Dubai 18 months ago. Mr von Erffa is in police custody accused of accounting fraud, embezzlement and market manipulation.
EY told the Financial Times this week that “issues relating to potential fraud and bribery concerns in India” were raised by an employee who was following “established protocols”.
The firm stressed that the allegations “were investigated by the company as well as the EY Germany audit and forensics teams” and that their observations were reported to Wirecard. “Based on the information available to us, we believe that personnel from EY India and elsewhere performed their procedures professionally and in good faith,” said EY.
It said that standard industry practice was for auditors “to be on-site, engaging and challenging local management. These meetings have clear audit procedure agendas.” EY added that Wirecard’s India transaction “was the subject of extensive due diligence by law firms and international accounting firms”.
*This article has been updated to correct Mr Dahmen’s first name
Get alerts on Wirecard AG when a new story is published