Third-party acquiring: Wirecard's partner business

analysisWirecard's own reports described the arrangement only in general terms. The 2017 annual report says that Wirecard UK & Ireland, Wirecard Brasil, cardSystems Middle East in Dubai and many East Asian subsidiaries worked with banks and financial service providers so that they could offer acquiring and issuing services where Wirecard could not use its own licence, and that the purchases from Citigroup expanded the network of these unnamed acquiring partners. The 2018 report explains that when an external acquiring partner processed transactions, the partner recorded the payment volumes and Wirecard showed as receivables only its commissions and rolling security reserves; its risk report says Wirecard bore the main opportunities and risks whether transactions ran through its own licensed acquirers or external partners, and that Wirecard Bank in some cases lent to strategic partners. Volumes increasingly ran through a "technical acquiring model" and, outside the European licensing area, through BIN-sponsorship models with third-party banks that the report does not name. The 2019 prospectus states that CardSystems Middle East's accounts for 2017 and 2018 were not audited and that it had not appointed its own auditor. ^{1 2 3}

analysisMost of what is known about the business comes from the special investigators appointed by the Bundestag's third committee of inquiry. They examined EY's audits of the 2014–2018 accounts, with emphasis on 2014–2016, and where necessary the reporting packages of CardSystems Middle East, Wirecard Technologies, Wirecard UK & Ireland and Wirecard Bank, using EY's electronic working papers; their report was delivered on 16 April 2021. They describe two models: Wirecard's own business across the whole payment chain with Wirecard Bank as acquirer, and third-party acquiring (TPA), in which payment processing and the acquiring bank's services were outsourced to Al Alam, PayEasy and Senjo, which used other acquiring banks and alone held contracts with the merchants, while Wirecard kept customer acquisition and support. According to EY's papers, merchants in adult content and dating, gambling and gaming, multi-level marketing, pharmacy, health and beauty were moved to the partners because they were no longer to be processed on Wirecard's platform or because Wirecard Bank had no acquiring licence for their countries. ¹

analysisThe business rested on reseller agreements that, according to EY's notes, were identical for the three partners: Wirecard earned a commission for referring merchants, payable six to nine months later, deposited cash collateral with the partners (in Al Alam's case first EUR 10 million, later up to EUR 20 million), indemnified them against losses not caused by their own technical errors and provided a rolling 12-month reserve on volumes with long-term risk such as subscriptions. EY's concurrence memorandum of 3 March 2016, as the special investigators read it, gave as the essential business reason the legal carving-out of critical transactions such as adult entertainment, gambling and food supplements and the circumvention of Visa and Mastercard rules and Wirecard Bank's internal rules; the underlying description came from Wirecard's management. The investigators note that Wirecard had contracts neither with the acquiring banks nor with the merchants, and that the extended liability for residual risks served the accounting purpose of showing revenue and costs gross. ¹

analysisIn practice, the investigators found, settlement departed considerably from the agreements: by agreement between Wirecard and each partner, receivables were not paid after six to nine months but "reclassified" into claims arising from security deposits, so that with fast-growing high-risk business the partners paid Wirecard little or nothing while receivables and reserves accumulated, and no claims were ever made on these securities. The safekeeping of funds at the partners was monitored only through meetings between the management board and the partners' management, without formal documentation. This is the investigators' evaluation of EY's audit files for the parliamentary committee, not a court finding. ¹

analysisThe investigators' table shows TPA revenue rising from EUR 308 million in 2014 to EUR 376 million, EUR 541 million, EUR 727 million and EUR 1,034 million in 2018, when group revenue was EUR 2,016 million, while escrow balances counted as cash rose from EUR 114 million (2015) to EUR 976 million (2018) and merchant cash advance loans of EUR 250 million appear for 2018. In 2014 the business accounted for half of revenue, about two thirds of receivables and three quarters of EBITDA (EUR 132.7 million of EUR 172.3 million), in 2015 for 48.7% of revenue and 72.2% of EBITDA, although the 2015 group management report never named it explicitly. Because Wirecard booked the business gross but received money only net, the investigators calculate that about 27% of 2015 group revenue and about 51% of the cost of materials were non-cash transactions, which the notes to the 2015 accounts did not disclose. ¹

analysisAccording to the investigators' evaluation, receivables from PayEasy, Al Alam and Senjo (formerly Rising Sun), claims on escrow accounts and merchant cash advance loans reached EUR 1,465.5 million at the end of 2018; individual TPA transactions could not be traced from origination to payment in Wirecard's accounting, and EY's 2018 group audit report did not mention bookkeeping deficiencies in the business. Comparing margins, they note that Wirecard Bank's own acquiring fell to a gross margin of 10% in 2018 while the TPA business showed 43–56%, although Wirecard did less of the work there, and regard Wirecard's explanation that the business carried high risks as contradicted by the absence of any liability claims. ¹

analysisSupervisors' figures point the same way. ESMA notes that the 2014 accounts showed acquiring deposits at Wirecard Bank of EUR 240 million as a separate item, which the 2015 accounts no longer did. Figures from the financial reporting enforcement panel (FREP) in ESMA's report show trust account balances of EUR 849 million at 30 June 2018 and EUR 1.9 billion at the end of 2019, which could not be verified and were most likely inaccessible, and revenue with questionable partners in the first half of 2018 of about EUR 460 million, 51% of EUR 898 million, with gross profit of about EUR 250 million against EBITDA of EUR 245 million. ²

analysisMoney mostly flowed from Wirecard to the partners. The investigators found that Wirecard kept permanent cash collateral of EUR 15–20 million with PayEasy and Al Alam although the acquirer was already protected by four lines of security, agreed in 2016 to raise PayEasy's collateral to EUR 50 million and financed growing collateral, including EUR 14.5 million paid to PayEasy Solutions Inc., from its own and borrowed funds, while the partners' payments were small relative to turnover and arrived only net; their report calls this economically very unusual, and EY performed no analytical procedures on these flows. In 2018, while the business grew sharply, only one payment arrived from the partners, about EUR 15 million from PayEasy in the first quarter, against receivables from PayEasy, including merchant cash advances, of about EUR 278 million at the end of the year; it was booked as a lump sum without reference to particular invoices. ¹

analysisThe payments that did arrive did not refer to invoices, and some came from unknown third parties. On 30 December 2014 Ressource Management Systems Pte. of Singapore paid EUR 23.0 million into an account at Wirecard Bank with the reference "SETTL. INV PEASYGRP 02-14", which EY noted as a payment by an unknown third party without further work; in 2015 Tuscany Capital Advisors Pte. Ltd. paid EUR 10 million for Rising Sun/Senjo, and Senjo's management said Tuscany belonged to its group, although Senjo's 2018 accounts do not list it as a subsidiary. Al Alam paid mainly by cheques without payment references, EUR 39.9 million in 2015–2017, drawn on its own accounts at Wirecard Bank, including EUR 14,267,271 on 29 December 2017; the slip for a cheque of EUR 2,997,988.82 dated 9 July 2015 named Wirecard Bank itself, not Al Alam, as the issuing client. The investigators count Al Alam's several accounts at the bank and its German-language cheque forms among the signs of the partners' particular closeness to Wirecard. ¹

analysisPayEasy Solutions Inc. accounted at the end of 2014 for receivables of EUR 62.5 million, about 18% of the group's, and for 2014 revenue of EUR 75.8 million and EBITDA of EUR 31.4 million. In March 2015 EY's forensic team could not confirm its existence and location: it was not registered with the Philippine Department of Trade and Industry, was no longer a tenant at its address in Makati, its website was down and its latest filing with the Philippine securities regulator was a general information sheet for 2011. A letter of 13 March 2015 from PayEasy's financial controller explaining the gaps went to Marsalek, who forwarded it to Ley, who passed it to EY; the investigators found no check of these letters, and EY's forensic review ended without remarks before the audit opinion of 7 April 2015 despite warning signs, including two management board members personally obtaining the evidence. The working papers do not document how PayEasy's status was finally clarified. ¹

analysisInstead of financial statements, EY received from PayEasy a letter of 26 March 2015 with a few 2014 figures, from which the investigators calculate that Wirecard's 2014 revenue with PayEasy (EUR 75.8 million) exceeded PayEasy's own total revenue (EUR 72.2 million). By 2018 PayEasy reported revenue of EUR 666.1 million on transaction volume of EUR 5,519.9 million with personnel costs of EUR 267,000, and audited accounts were available to Wirecard's auditor only for that year. Drawing on EY's compliance check and working papers, the investigators observe that PayEasy received rates of 2.15–3% plus fees and Al Alam only 2%, yet PayEasy reported a gross margin of 0.24% in 2017; that both partners' personnel costs were extremely small for their turnover; and that from September 2016 two registrations of PayEasy Solutions Inc. existed with the same name but different numbers and addresses. PayEasy's main merchant, Escalion, accounted for EUR 1.238 billion in the fourth quarter of 2018, 90% of its volume, which EY reconciled on 20 February 2019 only on totals together with Oliver Bellenhaus; for another merchant, Wirecard's payment system showed 23,033 transactions for October 2018 while a controlling export showed 286,921, differences of an order of magnitude that the auditor did not investigate. ¹

analysisFor Al Alam Solutions Provider FZ-LLC, a credit report in EY's files showed 2016 revenue of about USD 3 million, far below the mid-three-digit million US dollar figures Al Alam reported for 2015–2018, and its website's registrant e-mail used a different domain. The investigators found that EY had only management estimates or forecasts from Al Alam, no actual accounts; that its volumes for the first and second quarters were identical in 2016 and 2017 (EUR 866,491,337 and EUR 963,579,293); and that its gross margin rose from 20.6% to 51.0% while Wirecard Bank's fell, which the auditor did not examine. Al Alam's own position is not in the record. More generally, EY received no audited or other financial statements from any partner for 2015–2017, only unverified summary figures, and for 2018 only from PayEasy and Senjo Group. During the 2014 audit EY's forensic specialists had run compliance quick checks on Al Alam, PayEasy, Rising Sun, Hamesh Ltd and Bonatal Trading Industries Ltd. ¹

analysisSenjo's leading managers had earlier done business with Wirecard. According to EY's 2016 compliance check, as the investigators summarise it, they sold E-Creditplus Pte. Ltd. to Wirecard for EUR 12.8 million and later bought it back for a net EUR 0.1 million, which the short-seller Zatarra called roundtripping; a director of Senjo Payment Asia had worked at Wirecard Asia; and the secretary of Senjo Payments Asia, R. Shanmugaratnam, matched by name and document number the signatory of a trustee confirmation of 25 May 2016. The investigators say this could indicate a link between Senjo and the trustee and a conflict of interest, an inference rather than an established fact. The annexes to the insolvency administrator's TPA report include an e-mail of 2 June 2015 in which Marsalek asked that Senjo be supported, remarking that this would not create a competitor. Senjo bought Kalixa Payments Group as of 1 June 2017 for EUR 29.0 million, EUR 25.0 million of it lent by Wirecard Bank with the approval of Wirecard's management and supervisory boards; Senjo was the only partner whose creditworthiness was checked, and the group auditor did not take into account the bank auditors' doubts about its ability to service debt. ¹

analysisWirecard gave the auditor no external documents on the partners' financial stability, the investigators found, but memos by Marsalek as chief operating officer explaining why they had been chosen, and had no formalised assessment of them; for receivables from other debtors not confirmed at the end of 2014 EY also obtained internal memos from Marsalek, while Al Alam (EUR 18.1 million), PayEasy (EUR 62.5 million) and Rising Sun (EUR 47.8 million) confirmed their balances without the slightest deviation. In the 2015 audit, documentation and reconciliations for the business came from senior managers: Bellenhaus as managing director of CardSystems Middle East, the head of Wirecard Sales International, Marsalek, and Stephan von Erffa as executive vice president accounting; Marsalek personally joined the auditor's enquiries. ¹

analysisESMA, drawing on Financial Times reporting, names Al Alam Solution Provider FZ LLC of Dubai, Senjo Payment Asia Pte Ltd of Singapore and PayEasy Solution Inc. of the Philippines as the three largest partners in 2018, with their revenue reaching the group through CardSystems Middle East, Wirecard UK & Ireland and Wirecard Technologies; Wirecard itself had stated that neither Wirecard Bank nor other group companies outside the EU held their own acquiring licence in the third countries concerned. Al Alam went into liquidation on 15 May 2020. From 18 May 2020 BaFin's market-abuse team investigated whether the liquidation of CardSystems Middle East and Al Alam was inside information Wirecard should have disclosed; BaFin received documents on Al Alam from a third-country regulator in September 2020, and the investigation was unfinished when ESMA reported. ²

analysisWith the switch to IFRS 15 Wirecard concluded new contracts with all partners as of 1 January 2018. According to the investigators' second addendum, CardSystems Middle East bought the e-payment platforms of Senjo Payment Asia (contract of 16 April 2018) and of Al Alam (30 July 2018), each retroactively to 1 January 2018 and for EUR 6.5 million; the two contracts have identical technical specifications, the Al Alam contract names Senjo instead of Al Alam six times, and there is no sign that the systems were integrated. PayEasy's transactions moved to Wirecard's "Elastic Engine" platform, a "liability notice" was introduced, and Wirecard could withdraw money from the trust accounts without the partners' consent. The investigators conclude that gross accounting and the treatment of trust funds as cash looked formally justified from 2018, but that EY's files contain no evidence that Wirecard actually controlled the business. ¹

analysisIn the 2018 audit EY could not perform the prescribed test of ten cash transactions at CardSystems Middle East because TPA transactions could not be traced individually. To test whether the business existed it made five test purchases with Wirecard cards at the partners' merchants, on websites that Bellenhaus proposed on 16 February 2019; EY's files do not say how the merchants were chosen. The confirmation e-mail for one purchase came from an unrelated hosting address hours before the purchase recorded in the auditor's screenshots, which the investigators note may have been altered, and Bellenhaus supplied screenshots of a bitcoin purchase only on 8 April 2019. ¹