Article · FinCrime history

Nobody Was Watching the Money

HISTORY 2020-06-25 · History Ops voice · no personal byline

Wirecard booked €1.9 billion in trust cash that could not be proven, slipped between AML supervisors, and left banks and investigators with a payments-group case study in unverifiable partners.

Bavarian police wanted poster for Jan Marsalek, former Wirecard board member, alleging fraud in the billions — Munich / Bavarian police wanted notice for Jan Marsalek (Wirecard). Credit: Polizeipräsidium München / Bavarian police wanted poster

On 22 June 2020, Wirecard AG told the market there was a "prevailing likelihood" that €1.9 billion in bank trust-account balances, about a quarter of its consolidated balance sheet, did not exist. Three days later it filed for insolvency in Munich on grounds of impending insolvency and over-indebtedness. Proceedings opened on 25 August. The firm became the first DAX member to go bust. Creditors were left with claims on the order of nearly $4 billion.[1][2]

Wirecard is usually taught as accounting fraud, and the Munich prosecutor's preliminary findings support that frame: fabricated third-party-acquirer (TPA) revenue and balance-sheet assets used to obtain credit and attract investors. For FinCrime desks the sharper lesson is anti-money-laundering. A payments group routed reported volume through opaque partners, booked partner escrow as its own cash, drew years of bank exits and suspicious-activity reports, and sat largely outside meaningful group-level AML supervision. The accounting failure was the proximate cause of collapse. The control failures were the conditions that let unverifiable cash and merchants survive for years.[3][4]

A model that kept risk one step removed

Wirecard marketed itself as payments technology. A material share of reported growth came from TPA arrangements: local partners processed transactions for a fee share in markets where Wirecard lacked a license or where the traffic was unsuitable for direct processing. The structure is not inherently improper. It does require independent proof of who the merchants are, who controls each intermediary, how settlement moves, and whether reported volume reconciles to cash and transaction evidence outside management's chosen paper trail.[3][4]

German reporting described the commercial incentive. High-fee merchants, including dubious online sellers, were attractive, yet Wirecard preferred not to carry them on its own books, so they were referred to third-party acquirers. By 2018, whistleblowers put TPA at about half of reported global volume. 2019 reporting found three opaque, poorly audited partners handling about half of worldwide revenue and almost all profit. Cash held in partners' trustee accounts was counted on Wirecard's balance sheet.[4]

In September 2026, the presiding judge in the Munich criminal trial said the court had found no indication that this third-party business existed at all. Partners had been described as located in Dubai, Singapore, and the Philippines. That judicial statement is part of an ongoing trial record; it is not a final judgment against every defendant. For investigators the operational point is older: when half the story sits with partners who resist audit, the principal has already lost the ability to verify.[5]

The banks saw it first

FinCEN Files records show Bank of New York Mellon closed a Wirecard account in 2009 over problematic transactions. A 2014 BNY Mellon review found that most of the Wirecard wires examined "represented payments to online casinos, pornography websites" and billing processors.[6] After BNY Mellon flagged Wirecard Bank as high risk and froze accounts, Turkey's Aktif Bank continued to move Wirecard money through BNY Mellon under an undisclosed name, a nesting pattern. BNY Mellon identified up to 12 suspicious Wirecard transactions worth more than $110,000 routed through Aktif between May and July 2014.[7]

Domestic lenders saw the same risk. Commerzbank's chief risk officer told the Bundestag inquiry the bank raised money-laundering concerns with German authorities in early 2019, reviewed the relationship after critical Financial Times reporting, and chose a "soft exit." Commerzbank sat in a lending consortium that had made €1.8 billion in credit available. At collapse it still held €197 million of exposure and wrote off €187 million.[8] BaFin said it received Commerzbank's warning and placed Wirecard Bank's AML controls under close supervision in mid-2019.[8]

The reporting volume was large. German officials told lawmakers the Financial Intelligence Unit received 132 suspicious activity reports on Wirecard from June 2017 to August 2020. Thirty-six flagged transactions involving company managers and board members; fifty-four were forwarded to law enforcement.[4] Soft exits and unconnected SARs do not equal a network view. A de-risked originator returning through a respondent bank is a textbook correspondent failure mode.

Merchants, cash, and physical red flags

Wirecard's merchant book carried more than reputational risk. The Financial Times reported in 2020 that Wirecard processed payments for CenturionBet, a Maltese gaming company Italian courts identified as a vehicle for the 'Ndrangheta to launder money.[4]

Physical cash moved in ways that should stop any compliance review. Witnesses told German police that staff carried as much as €700,000 at a time out of Wirecard's offices, at times in supermarket shopping bags. On one occasion €500,000 arrived while the office safe was already full. Reports linked the withdrawals to a former executive who allegedly also moved large sums to private accounts electronically.[9] Large unexplained corporate cash, combined with high-risk merchant categories and opaque partners, is not a public-relations problem. It is a funds-flow investigation.

Regulated in name, unsupervised in practice

The central AML failure was structural. BaFin and the Bundesbank did not classify Wirecard AG as a financial holding company for group AML purposes. Money-laundering supervision of non-bank financial companies fell to regional authorities; the Bavarian authority took the view that Wirecard did not fit the definition. Only Wirecard Bank AG, the licensed subsidiary acquired in 2007 as XCOM Bank, fell under BaFin's AML oversight.[10][4] When the Bundestag opened its inquiry, lawmakers said they first needed to determine why the holding company had never been classified as a financial institution. The inquiry mandate expressly covered federal conduct in financial supervision, money-laundering supervision, and tax law.[4][10]

A Berlin lawyer summarized the result: "no one was really regulating Wirecard." Chancellor Angela Merkel later told the inquiry that, speaking objectively, "the entire German supervisory side was not well enough set up."[4][9] The parliamentary final-report page records criticism of audit and supervisory failures, the handling of critical journalists, missing or disregarded compliance controls, and a parliamentary view that Wirecard was a money-laundering scandal in which nobody appeared responsible for AML supervision.[11] That is a finding about institutional accountability, not a substitute for court findings against named defendants.

ESMA's fast-track peer review found deficiencies in Germany's supervision of Wirecard's financial reporting: late or absent risk-based selection of reports for examination between 2016 and 2018; examination scopes that did not adequately address material business areas or media and whistleblower allegations; insufficient professional skepticism, timeliness, analysis, and documentation; and ineffective information exchange among BaFin, the Financial Reporting Enforcement Panel (FREP), and relevant BaFin teams.[12] Financial-reporting supervision is not AML adjudication. The same fragmentation pattern (signals split across compliance, finance, risk, legal, and operations) is how AML programs also miss a group-level picture.

Pointing the watchdog at the critics

Instead of treating adverse media and short-seller research as risk events, German authorities repeatedly investigated the critics. BaFin conducted multiple market-manipulation probes against journalists and short sellers after negative coverage. In February 2019, after the Financial Times reported forged and backdated contracts in Wirecard's Singapore operation, BaFin banned short selling of Wirecard stock for two months, citing falling investor confidence.[4] Wirecard sued the Financial Times and Singaporean authorities and, in 2019, hired a former Libyan intelligence chief to run sting operations against journalists and short sellers.[4]

After the collapse, BaFin President Felix Hufeld called it "a scandal that something like this could happen." He and his deputy left the agency in January 2021 as part of a reform plan.[2][4] When a supervisor treats the people documenting the problem as the threat, the subject gains time.

Whistleblowers, Singapore, and document-based assurance

KPMG's special investigation recorded that in spring 2018 Wirecard AG's compliance department received a whistleblower report alleging fraudulent acts at Singapore subsidiaries: overstated revenue, backdated contracts, and circular bookings, followed by a compliance review and internal investigation. The report also describes allegations of potential Singapore-law violations, including falsification of accounts and money laundering.[13] Allegations of circular flows, backdating, revenue integrity, or laundering are risk events. They require protected escalation, independent forensic scoping, data preservation, conflict checks on reviewers, and testing of funds and counterparties outside the management reporting chain, not a narrowing debate about the critic's motives.

KPMG's April 2020 work could not verify most TPA revenue from 2016 to 2018 and could not check roughly €1 billion in third-party transactions, citing lack of cooperation from Wirecard and its partners.[13] EY, the long-time statutory auditor, had failed to verify cash existence against what appeared to be fraudulent bank statements, according to that special-audit record.[4]

The €1.9 billion and the confirmations behind it

The missing cash ended the franchise. When EY sought direct confirmation in June 2020, two Philippine banks, BDO Unibank and Bank of the Philippine Islands, said Wirecard was not a client. BDO said the document claiming a Wirecard account "carries forged signatures of bank officers." BPI called its document spurious. The Philippine central bank said the money never entered the country's financial system.[1][14]

Earlier assurances had come through a different intermediary. In January 2026 a Singapore court sentenced R Shanmugaratnam, director of Citadelle Corporate Services, to 10 years' imprisonment for issuing 13 confirmation letters between March 2016 and April 2018 falsely representing that Citadelle held more than €1.1 billion in Wirecard funds in escrow. British national James Henry O'Sullivan received 6.5 years for instigating five of those letters. The court found the letters were issued to maintain a business relationship with O'Sullivan and Wirecard executives Jan Marsalek and Oliver Bellenhaus. Both defendants indicated they would appeal.[15]

Singapore Police had already stated in 2023 that its Wirecard investigation involved several entities and possible offences; seven individuals had been charged with offences including criminal breach of trust, falsification of accounts, and money laundering, with ongoing cooperation with German authorities.[16] A balance confirmed only through the subject or its chosen intermediary is unconfirmed. Authenticated confirmation with the regulated depository, legal ownership and restriction status, transaction-level movement, and reconciliation to a credible merchant population are the minimum.

Network failure beyond Munich

Wirecard's collapse was not only a German accounting event. In June 2023 the Monetary Authority of Singapore imposed S$3.8 million in AML/CFT penalties on Citibank Singapore, DBS, OCBC, and Swiss Life Singapore for inadequate controls when dealing with people involved in transactions with, or linked to, Wirecard or related parties.[17] DBS said the historical lapses covered July 2015 through February 2020 and a customer network ultimately traceable to Wirecard, involving complex corporate structures, nominee arrangements, and financial products that concealed actual control or beneficial ownership. It detected and exited some activity but did not unravel the scheme completely.[18]

Alert detection without network mapping is incomplete. When a payment company, trustee, corporate-service provider, merchant aggregator, or nominee is implicated, institutions should map directors, signatories, beneficial owners, related accounts, shells, counterparties, and shared addresses, devices, agents, or introducers, and decide STR filing, restriction, or exit on the network, not only the first account that fired an alert.

Downstream partners felt the freeze immediately. On 26 June 2020 the UK Financial Conduct Authority ordered Wirecard Card Solutions to stop all regulated activity and not dispose of assets or funds, to protect customer e-money; the unit was allowed to resume on 30 June. Fintech customers including Curve, Pockit, and ANNA Money lost access in the interim.[19]

The COO who disappeared

Former chief operating officer Jan Marsalek was fired, disappeared, and later surfaced in Belarus. He remains on Europol's most wanted list and is subject to an Interpol Red Notice.[4] In May 2025 six Bulgarian nationals were sentenced in London for spying for Russia between August 2020 and February 2023. British prosecutors said ringleader Orlin Roussev took instructions from Marsalek, who acted as an intermediary for Russian intelligence services.[20] Media investigations have concluded Marsalek worked with Russian intelligence since at least 2010 and later obtained Russian citizenship under a false identity; those claims rest on open-source and journalistic work and have not been adjudicated in a German Wirecard verdict.[20]

Marsalek has not been tried on the Wirecard fraud charges and is presumed innocent of them. For institutions the control lesson does not wait on a verdict: a senior executive who owns opaque partner relationships, cash confirmations, and board access can create hostile-state exposure alongside ordinary fraud risk.

Accountability still open

The Munich public prosecutor said in July 2020 that its investigation supported suspicion that executives and others had agreed in 2015 to inflate revenue and the balance sheet through purported TPA income; that genuine business had been loss-making by late 2015; and that loans were negotiated knowing the €1.9 billion purported assets did not exist. It estimated banks in Germany and Japan and other investors had provided roughly €3.2 billion on the strength of false financial statements. Those were preliminary prosecutorial findings, not final findings against every named person.[3]

In Germany, Markus Braun and two former executives, former head of accounting Stephan von Erffa and former Dubai unit head Oliver Bellenhaus, went on trial in Munich in December 2022 on charges including commercial gang fraud and market manipulation. Prosecutors in the trial context have alleged falsified accounts caused about €3.1 billion in losses to lending banks (a figure that differs slightly from the July 2020 €3.2 billion estimate; both stand as each source stated them). Bellenhaus reached an agreement and became the prosecution's key witness.[5]

By April 2026 the court had held more than 260 sessions and heard from more than 220 witnesses. Braun has been in pretrial detention since 2020 and denies all charges, casting himself as a victim of a fraud run by Marsalek. In a December 2025 detention ruling the Munich Higher Regional Court found the fraud suspicion strengthened. On 14 September 2026 the trial court called the victim theory speculation and said extensive investigation had turned up nothing to support it. Closing arguments were proposed to begin on 19 October 2026. No verdict has been issued; Braun is presumed innocent until the court rules.[5]

In Singapore, courts in June 2023 sentenced Wirecard's international finance manager to 21 months and the head of finance for Wirecard Asia to 10 months; the Citadelle convictions followed in January 2026, with appeals indicated.[4][15] In the United States, a federal court in Manhattan in November 2023 sentenced Israeli investigator Aviram Azari to 80 months for a hacking-for-hire scheme; reporting indicated targets included companies critical of Wirecard, though prosecutors did not name his clients.[4]

What investigators still pull from the file

The red flags travel. Reported revenue concentrated in a few offshore partners who resist audit. Cash balances held by trustees and confirmed only by intermediaries. High-risk merchant categories (gambling, adult content, nutraceuticals) kept off the regulated books through TPA referral. Wires that arrive through a respondent bank after the originator was exited by a correspondent. Large unexplained corporate cash withdrawals. Aggressive litigation and surveillance aimed at journalists and critics. Whistleblower claims of circular bookings and backdated contracts treated as a reputation fight rather than a funds-flow investigation.[4][13][6][7]

For desk practice, five moves still follow. Verify the business, not the presentation: independently validate merchant populations, TPA contracts, payment volumes, settlement accounts, and cash custody; evidence from the relationship owner alone is insufficient. See beneficial ownership through intermediaries with network analysis of nominees, trustees, signatories, accounts, and counterparties; escalate when control cannot be established. Treat fraud claims, adverse media, and short-seller dossiers as AML triggers for enhanced due diligence, transaction review, and reporting decisions, not solely a legal or communications response. Independently reconcile trust and client funds with the depository institution; establish legal ownership and restrictions; reconcile to transaction-level evidence; test whether cash movement matches the commercial story. Give boards decision-quality information that distinguishes a missing document from an inability to establish a fact, and treat soft exits as incomplete risk transfer when lending exposure remains.[3][8][13][17]

Ask for the complete relationship record: onboarding files, beneficial-ownership analysis, partner due diligence, merchant data, trust deeds, bank-confirmation provenance and metadata, bank statements, payment records, alert and case histories, internal communications, and audit workpapers. The most probative evidence often sits at the boundary between the commercial claim and its independent support.

Wirecard sold itself as the future of payments. The record that remains is narrower. A financial company supervised as if it were only technology, banks that exit quietly rather than escalate a network, and critics of the cash story treated as the threat: nobody is watching the money until the money is gone.[1][3][11]

Sources

← All articles