Wirecard Scandal: When All Lines of Defense Against Corporate Fraud Fail

Capital markets are a powerful instrument to allocate resources from investors to issuers—ie, firms and states. A well-functioning capital market is a key determinant of economic growth as well as of private and public wealth. As in banking, trust in the proper functioning of the capital market is a prerequisite for it to play its beneficial role. It is, for instance, critical for broad investor participation.

Scandals such as Wirecard can destroy investor trust in capital markets working fairly and with integrity, which in turn creates negative spillover effects. Scandals can make it harder for other, non-fraudulent firms to raise capital as investors raise the risk premium or choose to no longer participate in the market (eg, Aggarwal and Wu (2006); Kyle and Viswanathan (2008); Giannetti and Wang (2016); Gurun et al.  (2018)). It is for this reason that fraud deserves attention. In essence, trust in the capital market is a (valuable) public good. Among other things, it requires assurance that corporate insiders do not embezzle investors’ money (eg, Shleifer and Wolfenzon (2002)).

In a recent policy brief commissioned by the European Parliament, we discuss the policy implications of the Wirecard scandal and explore possible policy lessons from its downfall.

Wirecard was initially founded as a German fintech in Munich in 1999. After an interlude of insolvency in 2001, it was listed in 2005 in the Deutsche Börse’s Prime Standard market segment and became a leading fintech company in Germany, focusing on payment and risk management services in the debit and credit card business in Europe, Asia, and America. It moved up to the Tec Dax in 2006 and, in 2018, to the DAX, the top index segment of the German market.

Starting in 2015, there were allegations about accounting inconsistencies, especially in the Financial Times, which wrote about a ‘House of Wirecard’, partly based on whistleblower information about the Singapore operations of the firm. In 2016, an analyst report, known as the Zatarra Report, accused Wirecard of money laundering and fraud. Following this report, there was significant short selling of the Wirecard stock, some of which BaFin, Germany’s top financial regulator, referred to the German prosecutor for market abuse, leading to indictments and settlements.

After another detailed report in the FT in January 2019, BaFin requested an investigation of Wirecard’s financial statements by the Financial Reporting Enforcement Panel (FREP). FREP is a private agency, entrusted with a public mandate. It has been set up as the ‘first step’ in the German ‘two-step procedure’ of financial reporting enforcement. When short selling peaked again, BaFin intervened and prohibited increases in net short sale positions for a period of two months, in accordance with ESMA. It also filed a criminal complaint against a number of short-sellers as well as the journalist who had authored the January FT article. The FT continued to report on allegedly inflated sales and profit numbers at Wirecard, backed up with internal documents. In October 2019, KPMG was hired by Wirecard to conduct a forensic investigation. The report was published with several delays in April 2020, stating that KPMG was unable to verify the existence of 1 billion in foreign bank accounts. BaFin filed a criminal complaint against Wirecard in June 2020 and, a few days later, the company filed for bankruptcy acknowledging that financial assets of €1.9 billion were missing.

It is natural to ask: Why did the scandal—fraud and deception at Wirecard—remain undetected for so long? Who or what is to blame? Was it due to deficiencies in institutional and legal design, supervisory failures, professional negligence, or (moral) failures of the perpetrators? Common sense dictates that, in the end, the scandal is due to a mix of reasons. In our briefing, we try to identify major reasons for the occurrence and slow detection of the scandal, emphasizing the role of institutional deficiencies. These deficiencies can, in principle, be mitigated by reforming market and oversight institutions as well as supervisory agencies.

The Wirecard case has revealed major weaknesses in market and institutional oversight, especially with respect to investor protection and market integrity. It shows that when serious allegations and concerns arise, especially when they come from credible sources (eg, a reputable newspaper), an effective capital market supervisor must both be willing and capable to act. Moreover, the first lines of defense against fraud and manipulation are companies’ internal controls, their supervisory boards, and external audits along with transparency vis-à-vis the public and market participants to facilitate market discipline. All these elements of market and institutional oversight have failed in one way or another in the Wirecard case. Thus, the lessons of the Wirecard case go beyond reforms to the current supervisory system. The scandal uncovered weaknesses in the oversight system more generally, demonstrating the need for broader reforms in Germany and in Europe at large.

In our view, all five lines of defense against corporate fraud and deception have failed in one way or another: the company’s internal control system, its supervisory board, its external audit, the oversight bodies for financial reporting and auditing, and, last but not least, the market supervisor BaFin. The slow unraveling of Wirecard is surprising, as there were a number of signals suggesting fraudulent behavior years before its eventual revelation.

Our analysis finds a root cause to be a flawed market and institutional oversight architecture, implicating all five lines of defense. In its current form, it is not sufficiently fit to preserve market integrity and investor protection. To improve the system, we suggest changes at the national as well as the European level. In fact, we understand the Wirecard scandal in Germany as a potentially pivotal event for Europe’s capital market, triggering a regulatory reform of financial market oversight that ultimately improves its competitiveness among global capital markets.

Our policy conclusions aim to ensure the integrity of the capital market by strengthening accountability. Towards this end, we make eight suggestions on how to improve the current market and institutional oversight for publicly listed firms. These suggestions represent in our opinion the wider implications of the Wirecard case. Taken together, these suggestions are meant to strengthen the oversight architecture in Europe, without unduly burdening markets and firms. The goal should be to increase the attractiveness of Europe’s capital market for domestic and international investors and issuers.

1. Information flow: whistleblowing

To start investigations in a timely manner, early providers of information (whistleblowers) must be heard by the relevant parties and be taken seriously. We recommend developing a supervisory strategy allowing for an effective screening of the many voices raised and encouraging whistleblowing from within or outside publicly listed firm. Such a strategy may include substantial financial incentives for whistleblowers.

2. Information flow: short-selling

A short sale ban is an asymmetric intervention that prevents critical information to be reflected in price. As prices are also important signals to market participants, management, and supervisors, having such information in price is important. Therefore, we recommend making the conditions under which supervisors may enact short sale prohibitions significantly more restrictive.

3. External audits

We suggest a reform of external audits to strengthen auditor accountability. It is not that Wirecard is different, or a special case, but that there is a common refrain to accounting scandals. Therefore, the law, not just professional standards, should unmistakably state that auditors’ professional skepticism and reasonable checks to uncover accounting manipulations and accounting fraud are an integral part of an external audit. The market supervisor and the audit oversight body also need to spell out their expectations for auditors that certify financial statements as providing a true and fair view. To strengthen auditor incentives as well as penalties for weak audits, auditor liability should be raised considerably.

Finally, we recommend reviewing the effectiveness of existing public audit oversight bodies. At a minimum, these bodies should publicly disclose summary metrics about their inspection findings for individual audit firms, as this would provide valuable information about auditor quality to clients and investors.

4. Internal controls and supervisory board oversight

The Wirecard experience suggests strengthening companies’ internal controls and the oversight role of supervisory boards. At a minimum, the law should require that publicly listed firms have an appropriate and effective internal control system. External auditing of this control system should be considered. A mandate would reinforce our Suggestion 3 as it would clarify the role of auditors in detecting accounting fraud. Supervisory boards need access to critical information independent from management. Therefore, the head of the internal control function should report to the supervisory board (as external auditors already do). To strengthen supervisory board oversight of external audits, publicly listed companies should be required to have a dedicated audit committee. The chair of this committee needs to be independent and a financial expert. In addition, the majority of the audit committee members need to be independent.

5. Enforcement of financial reporting

The legal framework for enforcement is shaped by EU law but includes German specificities. While general market oversight is entrusted to BaFin, the Wirecard case shows that its investigative powers are too limited as far as financial reporting oversight is concerned. Additionally, a Germany-specific two-step enforcement structure has made the system prone to latency and created unclear responsibilities and accountability in cases of accounting fraud. We suggest reforming the two-step enforcement procedure, making BaFin the only competent authority. BaFin can enlist the help of bodies like FREP for the enforcement of financial reporting, if they wish so, but the powers and accountability remain entirely with BaFin. As to the European framework, we suggest strengthening the mandatory competencies granted to supervisory authorities under the Transparency Directive. They should have investigative and enforcement powers modeled on the strictest standards available under Market Abuse Regulation

6. Overarching market oversight mandate

More generally, the Wirecard case shows that BaFin, as the responsible agency, did not or could not live up to its overarching mandate to protect investors and market integrity. Along with strengthening its powers, we propose to clearly establish the supervisory agency’s accountability for fulfilling this overarching oversight mandate in substance. This accountability requires an appropriate level of institutional independence as well as sufficient resources to fulfill its tasks.

7. Market oversight agency

The Wirecard experience offers lessons beyond the failure of internal controls, auditors, and the market supervisor. We read it also as an illustration of a mismatch between national Member State’s historically grown institutions (and cultures) and the introduction of a European regime. Reaping the benefits of a truly unified European CMU will require addressing such mismatches. We propose to create a single, responsible market oversight institution at the European level, which may be called the European Single Capital Market Supervisor (ESCMS). Such an institution would address ripple effects to other countries within the same European capital market that scandals like Wirecard create. In addition, it would help to overcome regulatory fragmentation, conflicts of interest due to national competition in the markets for goods and services as well as regulatory arbitrage and capture.

8. European market oversight

A Europe-wide market oversight system will require the expertise of national markets, with their idiosyncrasies in corporate law, insolvency law, and more. We propose to build the European oversight architecture with the existing national agencies as branches of an integrated European supervisory network. The ESCMS serves as the apex layer in the network, to which all national agencies are reporting. A hub-and-spoke architecture of this type will also introduce an element of institutional independence into national agencies.

This piece is adapted from a policy brief requested by the European Parliament. The full brief can be found here.

This post was originally published on ProMarket—the blog of Stigler Center at the University of Chicago Booth School of Business—and is available here.

Jan Pieter Krahnen is the Scientific Director of the Leibniz Institute for Financial Research SAFE, and a Professor of Finance at Goethe University’s House of Finance.

Katja Langenbucher is a Law Professor at Goethe-University's House of Finance in Frankfurt, Affiliated Professor at SciencesPo, Paris, and Long-term Guest Professor Fordham Law School, NYC.

Christian Leuz is the Joseph Sondheimer Professor of International Economics, Finance and Accounting at the University of Chicago's Booth School of Business.

Loriana Pelizzon is the head of the Financial Market department and coordinator of Gender Equality at the Leibniz Institute for Financial Research SAFE and Full Professor at Goethe University Frankfurt, Chair of Law and Finance.