What due diligence cannot outsource, as Wirecard’s partners found
Wirecard had audited accounts, licenses and blue-chip clients, and €1.9 billion of its cash probably never existed. Partners relying on those signals learned that three checks cannot be delegated: where the money comes from, whether customer funds are visible, and how to leave.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 18, 2020, Wirecard, the German payments company and DAX index member, postponed its annual results. Its auditor, EY, could not confirm the existence of €1.9 billion in cash balances said to be held in trust accounts in Asia. Its chief executive resigned the next day. On June 22, the company said there was a prevailing likelihood that the money did not exist, and on June 25 it filed for insolvency. In the United Kingdom, the Financial Conduct Authority then restricted the activities of Wirecard’s e-money subsidiary, temporarily freezing accounts and cards for customers of fintech firms that relied on it. The Financial Times had published reporting questioning Wirecard’s accounts for more than a year.
Wirecard had every conventional marker of a reliable partner. It had a listing on a major index, audited accounts, a banking license through a subsidiary, regulated e-money entities and many well-known clients. Each marker was produced by someone else: an auditor, a regulator, an index provider, other customers. Banks, credit unions and fintechs choosing payment and card partners routinely rely on such signals, and usually that is reasonable. Three checks, though, cannot be delegated to them: whether the partner’s revenue and cash are plausible, whether customer funds are visible to you, and whether you can leave quickly if the partner fails anyway.
Whether revenue and cash are plausible
An unqualified audit opinion and a large market capitalization are not proof of financial strength. Wirecard’s reported profits depended heavily on third-party acquiring partners in Asia whose business could not be confirmed. Detailed press reporting and short-seller allegations had raised questions for more than a year. German authorities had at one point pursued the journalists and short sellers instead of examining the company.
A partner committee can test plausibility without forensic accountants. Where does the partner’s revenue come from, by business line and region? Do margins look like those of comparable firms? Is cash concentrated in accounts or jurisdictions that are hard to verify? Does reported growth match the transaction volumes the institution itself sees? None of these questions proves fraud. Together they show whether the story holds together, and they flag when a closer look is warranted.
Credible public allegations deserve a recorded response. A committee that notes an allegation, asks the partner for evidence, and decides whether the answer is sufficient has done its job, even if it continues the relationship. A committee that dismisses the allegation because the auditor and regulator have not acted has delegated a judgment it was supposed to make.
Ongoing monitoring matters as much as onboarding. A partner that looked sound at selection can change: new owners, rapid expansion, a change of auditor, delayed filings or key executives leaving. Each is a trigger for a fresh review. Institutions that set those triggers in writing, and assign someone to watch for them, catch deterioration earlier than those relying on an annual questionnaire. Market signals count too. A falling share price, widening credit spreads or a regulator’s public statement are free information that a vendor management team can track at little cost.
Whether customer funds are visible to you
When the UK regulator restricted Wirecard’s e-money subsidiary, end customers of several fintech firms could not use cards or reach balances for days. The funds were meant to be safeguarded, and largely were. Access was the problem. For an end customer, that distinction mattered little while the freeze lasted.
For any arrangement in which a partner holds or moves customer money, the institution should know where funds are held, in whose name, and how each balance ties to a customer. It should receive account statements directly from the bank holding the funds, not only from the partner. Reconciliation should run daily for active programs, comparing the institution’s own customer ledger with those statements. Breaks should go to a named owner with a deadline. Reconciliation that relies solely on the partner’s reports is not independent.
Fourth parties complicate the picture. A fintech partner may depend on an issuing processor, a program manager and a sponsor bank, any of which can fail. Mapping that chain, and knowing which link holds the authoritative record of each customer’s money, is part of the same check. If no party can produce those records quickly and independently, safeguarding exists only on paper.
Whether you can leave quickly
Partners fail even after careful diligence. The question is how fast customers can be moved, and who controls the data needed to move them. Fintechs that relied on Wirecard as their sole issuing processor had to find replacements urgently. Their customers bore the disruption while cards were reissued and balances transferred.
Exit readiness has concrete parts. Contracts should give the institution rights to customer and transaction data in a usable format, delivered on demand, plus transition assistance at agreed rates. A written exit plan should estimate migration time realistically, including card reissuance and customer communications. For critical services, a pre-qualified alternative provider shortens the timeline from months to weeks. Testing a data extract once a year confirms the rights are real.
These checks cost money and attention at selection time, when the partner looks strongest and the business is eager to launch. That is why they get cut. Budgeting for them as part of the price of the relationship, scaled to how much customer money the partner touches, keeps them from becoming optional. A partner that holds customer funds or issues cards under your name warrants all three. A vendor with no access to money or customers may need none.
With hindsight
Wirecard’s former chief executive went on trial in Munich in December 2022, in what is widely described as one of the largest accounting frauds in postwar German corporate history. Germany reformed financial supervision and gave BaFin stronger powers, and EY faced regulatory sanctions and civil claims in Germany over its audits.
The partnership problem recurred in the United States. In 2024, the bankruptcy of Synapse, a middleware provider connecting fintech apps with partner banks, left many end users unable to reach their funds for months. Records of who owned what did not reconcile. The FDIC proposed recordkeeping requirements for custodial deposit accounts with transactional features later that year. As with Wirecard, the money was not the only problem; the ability to see and move it was.