CASE STUDY · ICFR FAILURE

Wirecard: when cash reconciliation fails

€1.9B

The cash that didn't exist — roughly a quarter of Wirecard's consolidated balance sheet, supposedly sitting in trustee accounts no auditor had independently confirmed for years.

Company
Wirecard AG (former DAX 30)
Discipline
Cash existence & bank confirmations
Outcome
Insolvency — first DAX member ever
Reading time
9 min
01THE SETUP

Germany's fintech champion.

On September 24, 2018, Wirecard AG entered the DAX 30 — Germany's blue-chip index — replacing Commerzbank, a 148-year-old institution. Weeks earlier its market value had briefly topped €24 billion, more than Deutsche Bank. The share price peaked above €190.

The bull case was intoxicating: a Munich-based payments processor riding the global shift to digital payments, with high-growth, high-margin Asian operations run through third-party acquiring (TPA) partners in markets where Wirecard lacked its own licenses. In October 2018, management unveiled "Vision 2025" — aggressive multi-year targets for transaction volume, revenue, and EBITDA. Most covering analysts stayed positive deep into the company's final years, treating critical reporting as short-seller noise.

That TPA business — the engine of the story — purportedly generated roughly half of group revenue and substantially all of its operating profit. It was also, as the world would learn, largely a fiction.

€24B+
Peak market value, September 2018 — briefly worth more than Deutsche Bank
DAX 30
Entered Germany's blue-chip index on September 24, 2018
~50%
Of group revenue — and substantially all operating profit — attributed to the TPA business
02WHAT WENT WRONG

Nobody confirmed the cash.

The TPA profits supposedly accumulated in escrow accounts held by a trustee — first said to be in Singapore, later at two Philippine banks, BDO Unibank and Bank of the Philippine Islands. By 2019 the claimed balance reached €1.9 billion: about a quarter of Wirecard's total assets.

Here is the part every CFO and audit committee should sit with. For the 2016–2018 audits, EY did not obtain independent bank confirmations for those balances. It relied on documents and screenshots provided by the trustee and by Wirecard itself. Singapore's OCBC — where the escrow was then supposedly held — later said it had no such accounts and had received no confirmation request from EY between 2016 and 2018.

The most basic control in the audit toolkit — write to the bank, get the balance directly — was skipped for three consecutive years on a quarter of the balance sheet.

The Financial Times had been pulling the thread since 2015, when Dan McCrum's first "House of Wirecard" pieces ran on FT Alphaville. Germany's response was instructive: when critical reports surfaced in 2016 and 2019, regulator BaFin investigated the critics, and in February 2019 imposed an unprecedented two-month ban on short-selling Wirecard shares. In January 2019, the FT published evidence of forged and backdated contracts in Wirecard's Singapore office, sourced from whistleblower Pav Gill, the company's own Asia-Pacific legal counsel.

Under investor pressure, Wirecard commissioned a KPMG special investigation in October 2019. KPMG's report, published April 28, 2020, said the quiet part out loud: it could not verify the majority of TPA revenues for 2016–2018, nor the existence of the escrow balances. The endgame took eight weeks.

April 2015
FT Alphaville publishes the first "House of Wirecard" investigations.
January 30, 2019
FT reports forged contracts in Wirecard's Singapore operations. Shares plunge.
February 18, 2019
BaFin bans short-selling of Wirecard shares for two months — protecting the company, not investors.
April 28, 2020
KPMG special investigation published: cannot verify TPA revenues 2016–2018 or escrow balances.
June 18, 2020
EY refuses to sign the 2019 audit opinion. €1.9 billion in cash cannot be evidenced. The Philippine banks call the account documents forgeries.
June 22, 2020
Wirecard admits a "prevailing likelihood that the bank trust account balances in the amount of €1.9 billion do not exist."
June 25, 2020
Insolvency filing — the first DAX member ever to collapse into insolvency.
03THE SPECIFIC DISCIPLINE

Cash existence: the one assertion you never outsource.

Cash is the easiest balance on the entire balance sheet to verify — which is exactly why a failure here is unforgivable. The discipline has three layers, and Wirecard failed all three.

THE STANDARD · CONFIRMATIONS

PCAOB AS 2310 — The Auditor's Use of Confirmation

For US filers, AS 2310 governs the confirmation process: the auditor — not management, not a trustee — must maintain control over confirmation requests and responses. Evidence routed through the client is not independent evidence. The PCAOB modernized this standard in 2023 (effective for audits of fiscal years ending on or after June 15, 2025), explicitly strengthening requirements around confirming cash held by third parties — a change widely read as a post-Wirecard correction. The international equivalent is ISA 505, External Confirmations. Read AS 2310 at pcaobus.org

THE STANDARD · INTERNAL CONTROL

SOX Section 404 / COSO 2013 — Internal Control over Financial Reporting

Wirecard, a German issuer, sat outside SOX's reach — but the lesson lands squarely on US filers, where management owns ICFR. Under the COSO framework that underpins every SOX 404 assessment, an effective ICFR design includes a control activity reconciling every account — including escrow and trustee accounts — to statements obtained directly from the depository institution. A balance equal to 25% of total assets sitting outside the company's own banks, evidenced only by trustee letters, is not a reconciliation. It is a story. COSO Internal Control framework · SEC rulemaking on Section 404 management reporting

THE STANDARD · SKEPTICISM

ISA 240 / professional skepticism

Fraud standards require auditors to treat unusual structures — like routing a quarter of the balance sheet through third-party escrow in another hemisphere — as a risk to corroborate, not a quirk to accommodate. Germany's audit regulator APAS ultimately found EY breached its professional duties on the 2016–2018 audits. IAASB standards

04THE CONSEQUENCES

Nine days from blue chip to wreckage.

The share price went from €104.50 on June 17, 2020 to €1.28 on June 26 — nine days, roughly 99% down from the 2018 peak. More than €20 billion of market value was destroyed. Around 50,000 shareholders filed approximately €8.5 billion in damages claims; Germany's Federal Court of Justice has since ruled those claims subordinated in the insolvency, meaning shareholders will likely recover nothing.

CEO Markus Braun resigned on June 19, 2020 and was arrested four days later; his criminal trial in Munich, running since December 2022, was still awaiting verdict as of this writing. COO Jan Marsalek fled and remains a fugitive, with reported links to Russian intelligence. In April 2023, audit regulator APAS fined EY Germany €500,000 and barred it from accepting new audits of public-interest entities for two years; five individual auditors were fined personally.

€104.50 → €1.28
Share price, June 17–26, 2020 — nine days
€20B+
Market value destroyed; ~€8.5B in shareholder claims, since subordinated
2-yr ban
APAS sanction on EY Germany for new public-interest audits, plus €500K fine (April 2023)
05THE LESSON

The boring control is the load-bearing one.

Wirecard wasn't a sophisticated derivative blow-up. It failed at the first thing a first-year staff accountant learns: confirm the cash with the bank, directly, every period. If a balance can't survive a direct confirmation — or if anyone in the chain resists one — that resistance is itself the finding.

For a small public company the stakes scale down but the mechanics don't. Escrow accounts from a financing. Cash sitting at a foreign subsidiary. A payment processor holding your float. Every one of those balances needs a reconciliation to a statement your team obtained directly from the institution — and your auditor will (and should) test exactly that. The companies that get hurt are rarely the frauds; they're the honest filers whose reconciliation discipline quietly decayed until an auditor, a lender, or the SEC asked a question nobody could answer cleanly.

THIS IS WHAT WE HELP YOU PREVENT

Cash controls that survive scrutiny.

Unfolding Values builds and remediates exactly this layer for small US-listed companies: bank reconciliation discipline, escrow and trustee account controls, ICFR documentation that holds up under SOX 404 and an auditor's confirmation testing. Built by an operator whose filing record is public on EDGAR. Serious about fixing this? Email rohit@unfoldingvalues.com with your company, ticker, and one sentence on the pain point.

Email rohit@unfoldingvalues.com

Not ready yet? Follow Rohit on LinkedIn and watch the work first.

Sources & further reading

  1. KPMG special investigation report (English), April 2020 — archived from wirecard.com
  2. BaFin general administrative act banning Wirecard net short positions, February 18, 2019 — archived from bafin.de
  3. European Parliament study on the Wirecard case, IPOL_STU(2020)651383 — europarl.europa.eu
  4. "EY failed to ask for Wirecard bank statements for three years" — Fortune, June 30, 2020
  5. EY Germany fined and banned from new public-interest audits — CNN, April 3, 2023
  6. PCAOB AS 2310, The Auditor's Use of Confirmation — pcaobus.org
  7. Dan McCrum, Money Men and the FT Wirecard archive — ft.com/wirecard

Facts verified as of June 5, 2026; the Braun criminal trial was ongoing at that date. This case study is commentary on public information for educational purposes; it is not investment, legal, or accounting advice, and Unfolding Values had no engagement with any company discussed.

← All case studies
Insights & case studies