One thousand nine hundred million euro of cash is not a difficult balance to audit. Cash is the easiest item on a balance sheet: it is either there or it is not, exactly one independent party knows the answer, and that party is a regulated bank with a legal department and a letterhead. The procedure that settles it costs roughly the price of a courier.
What follows is an accounting reading of Wirecard AG. I am leaving out the fugitive and the espionage reporting, both of which are more entertaining and neither of which is the point. Wirecard joined the DAX on 24 September 2018, taking Commerzbank's place. Twenty-one months later it filed for insolvency.
Wirecard processed card payments. In markets where it lacked the necessary licences it worked through third-party acquirers, and cash held in trustee accounts belonging to those acquirers was counted on Wirecard's own balance sheet.
A trustee account, or escrow account, is an account held by one party in its own name for the benefit of another. Two things follow, and the second gets lost.
A confirmation that a trustee holds an amount is worth little if the beneficiary named is somebody else. And a confirmation from the trustee that the trustee holds money on your behalf is worth nothing at all, because the trustee is a party to the arrangement being tested. Independence is the entire content of the procedure. Remove it and you have a photocopy.
The relevant standard is ISA 505, External Confirmations. The version in force from December 2004 puts it like this:
When performing confirmation procedures, the auditor should maintain control over the process of selecting those to whom a request will be sent, the preparation and sending of confirmation requests, and the responses to those requests.
The auditor ensures that it is the auditor who sends out the confirmation requests, that the requests are properly addressed, and that it is requested that all replies are sent directly to the auditor. The auditor considers whether replies have come from the purported senders.
It also carries forward the reliability ranking from ISA 500: independent beats internal, obtained directly beats obtained indirectly, originals beat photocopies. That ranking is not fussiness. It is the reason the procedure has any value at all.
An audit is not an investigation, and most of the angry questions about Wirecard are really complaints that it was not one. An audit produces an opinion on whether financial statements give a true and fair view, formed by testing selected assertions against a materiality threshold, assuming the accounting records exist. Fraud is in scope (ISA 240 puts it there in the title) but the auditor need not start from the position that the counterparties are confederates. An investigation starts from exactly that position, has no materiality threshold, produces no opinion, and is permitted to be rude. The narrower and worse point about Wirecard is that confirming cash is an ordinary audit step.
1. The asset was of the easiest possible type. Not a valuation, not an estimate, not goodwill from an acquisition in a market nobody can price. Cash. There is no judgement to exercise and no model to argue about. The assertion is existence, and existence is confirmable in one letter.
2. Control over the confirmation process, as reported, was not maintained. The Financial Times reported in June 2020 that between 2016 and 2018 EY, then Wirecard's auditor, did not go directly to OCBC in Singapore to confirm cash held there, relying instead on documents and screenshots provided by a third-party trustee and by Wirecard itself. OCBC later said no such escrow account had ever existed. Read that against the paragraph quoted above: the requests were not sent by the auditor, the replies did not come from the bank, and the question of whether replies had come from the purported senders was answered by the party being audited.
3. The confirming party was supplied by the arrangement rather than chosen by the auditor. This part is not reported, it is adjudicated. On 22 September 2025 a Singapore court convicted R Shanmugaratnam, director of Citadelle Corporate Services Pte Ltd, on 13 charges under section 477A of the Penal Code, for issuing 13 confirmation letters between March 2016 and April 2018 representing to Wirecard, its subsidiaries and its auditors that Citadelle held over 1.1 billion euro of Wirecard funds in escrow. James Henry O'Sullivan was convicted of five charges of abetting. On 6 January 2026 they were sentenced to 10 years and 6 years 6 months respectively. Both indicated an intention to appeal, so neither conviction is final.
4. Changing the trustee changed nothing that mattered. By the 2019 audit the money was said to sit in trustee accounts at two banks in the Philippines. On 18 June 2020 the auditors told the management board they could not confirm the balances. BDO Unibank and the Bank of the Philippine Islands both said the documents were spurious. The Bangko Sentral ng Pilipinas said none of the money had entered the Philippine financial system. A Manila lawyer whose law office appears in the paperwork has publicly denied wrongdoing and says he was framed. On 22 June 2020 Wirecard announced there was a prevailing likelihood that the trustee account balances did not exist. On 25 June 2020 it filed for insolvency.
The trustee moved jurisdiction, the confirming institutions changed, and the defect stayed identical, because the defect was never about which bank. It was that nobody independent ever asked one.
5. A special investigation that cannot obtain the data is not a clean opinion. Wirecard's own disclosure of 28 April 2020, released at 07:52 CET, is a primary source and worth reading twice:
Incriminating evidence for the public allegations of balance sheet forgery has not been identified.
According to the increased forensic requirements of the audit by KPMG, however, not all data could be obtained that would have been required to proof the revenues in these years, because the required data are primarily in the control of third parties.
Both passages are in the same announcement, in that order. The first is a statement about a search. The second says the search could not be completed. The shares fell about 26 percent that day, so the market read the second paragraph, which is more than can be said for much of the commentary.
6. The procedures that would have settled it. None of these are exotic. Every one is in a first-year audit programme.
7. The interest test is the cheapest one on that list and I would have started there. A balance of 1.9 billion euro at even half a percent a year throws off
nine and a half million euro of interest income. Any real account has a rate, a credit frequency and a statement showing the credits, so the balance sheet is making a prediction about the profit and loss account, and the two either agree or they do not. That arithmetic fits on the back of a boarding pass and requires nobody's cooperation.
8. Digit analysis would not have found this, and I should be honest about that. Benford and its relatives need a population of hundreds or thousands of independently generated amounts. The Wirecard cash question is one number, and a single number has no digit distribution. If you came here for a statistical detection story, I have already written the disappointing version: @ledger/benfords-law-and-when-it-lies-to-you. The instrument for a single large balance is a letter.
| Matter | Forum | Position |
|---|---|---|
| Criminal case against Markus Braun and two former executives, charged March 2022 with fraud, breach of trust and accounting manipulation | Munich Regional Court | Opened 8 December 2022, still running. Reporting in April 2026 put it beyond 260 sessions and 220 witnesses with no verdict. Braun denies wrongdoing and says he is himself a victim of fraud |
| Civil claim by the insolvency administrator | Munich Regional Court I, 5 September 2024, case 5 HK O 17452/21 | Three former board members held liable for about 140 million euro plus interest under section 93 of the German Stock Corporation Act, reported at the time as not final |
| Audit oversight proceedings against EY | APAS, Germany, April 2023 | Fine of 500,000 euro and a two-year bar on new audits of public interest entities in Germany, plus fines on five individual auditors reported at 23,000 to 300,000 euro |
| Falsification of accounts, Citadelle letters | Singapore | Convicted 22 September 2025, sentenced 6 January 2026, appeals indicated |
| Jan Marsalek, former chief operating officer | Fugitive since June 2020 | Wanted by German authorities, listed among Europe's most wanted |
Five years of hearings, an insolvency, a regulator sanctioning one of the four largest audit firms in the world, and a ten-year sentence in another jurisdiction, all downstream of a question with two possible answers.
Somewhere in an alternative version of this, a second-year looks up a bank's switchboard number on the central bank's register of licensed institutions, dials it, and asks whether an account exists. I have read a great deal about Wirecard and I have never got past that.