What due diligence cannot outsource, as Wirecard’s partners found

The week

On June 18, 2020, Wirecard postponed its annual results. Its auditor, EY, could not confirm the existence of €1.9 billion in cash balances said to be held in trust accounts in Asia. A trust account is an account held by a third party on someone else’s behalf. In this case, a large share of the company’s reported cash was supposed to be held in such accounts, and the auditor could not verify that it was there. Wirecard said there were indications that “spurious balance confirmations” had been presented to deceive the auditor.

Its chief executive, Markus Braun, resigned the next day. Over the weekend, two banks in the Philippines where the money was said to be held stated that documents bearing their names were not authentic. Philippine authorities said the funds had not entered the country’s financial system. On June 22, the company said there was a prevailing likelihood that the money did not exist. Braun was arrested in Munich the same week. Jan Marsalek, the board member responsible for the Asian business, was dismissed and disappeared. On June 25 Wirecard filed for insolvency, the legal process a company enters when it cannot pay its debts.

The company before the week

For years, Wirecard had looked like a European technology success story. The German payments company had grown fast, joined the DAX, the index of Germany’s largest listed companies, in 2018, and processed card payments for merchants around the world. Fintech firms in several countries relied on it to issue the debit and prepaid cards their customers carried in their wallets. It owned a German bank and regulated e-money businesses, including one in the United Kingdom. Because German authorities had classified the group as a technology company rather than a financial holding company, BaFin supervised the bank subsidiary but not the parent that controlled it. Then, in a single week, it unraveled.

A large part of its reported profit came from what it called third-party acquiring. Rather than processing certain payments itself, Wirecard said it referred merchants to partner firms in places such as Dubai, Singapore and the Philippines, and earned commissions on their volumes. The cash from that business was the cash held in trust. If the partners’ business was not real, neither was the cash.

The warnings that came first

The collapse had not come entirely out of the blue. The Financial Times had published reporting questioning Wirecard’s accounts for more than a year, including allegations about its Singapore operations and, in October 2019, internal documents suggesting that profits had been inflated. Short sellers had made similar allegations for longer.

Germany’s reaction at first fell on the critics. In February 2019, BaFin, the German financial regulator, banned new short positions in Wirecard shares for two months, the first time it had done so for a single company. It also filed a criminal complaint against journalists who had reported on the company. Wirecard’s board commissioned KPMG to carry out a special audit. Its report, published in April 2020, said KPMG had been unable to verify the existence of the revenue from the third-party acquiring business for the years it examined. The company’s shares fell sharply on the report. Seven weeks later, the cash was gone.

The effect on customers

The collapse did not stay inside Germany. In the United Kingdom, the Financial Conduct Authority, the country’s financial regulator, then restricted the activities of Wirecard’s e-money subsidiary. E-money is electronic money held on behalf of customers, such as the balance behind a prepaid card or an app-based account. Because several fintech firms relied on that subsidiary, including the card app Curve and the account provider Pockit, the restriction temporarily froze accounts and cards for their customers. People who had never heard of Wirecard suddenly could not pay for groceries or reach their balances. The FCA allowed the subsidiary to resume regulated activity a few days later.

The warning signs were public. Many partners had relied instead on the signals that said all was well: the index listing, the audited accounts, the licenses and the famous clients. Some of the world’s best-known investors had backed the company too; SoftBank had agreed a large convertible bond investment in 2019.

For any executive who chooses suppliers that touch customer money, the week raised a blunt question. Which of those reassurances had they actually checked themselves?

Wirecard had every conventional marker of a reliable partner. It had a listing on a major index, audited accounts, a banking license through a subsidiary, regulated e-money entities and many well-known clients. Each marker was produced by someone else: an auditor, a regulator, an index provider, other customers.

Banks, credit unions and fintechs choosing payment and card partners routinely rely on such signals, and usually that is reasonable. Nobody can re-audit every supplier. Three checks, though, cannot be delegated to them: whether the partner’s revenue and cash are plausible, whether customer funds are visible to you, and whether you can leave quickly if the partner fails anyway.

The analysis begins with how payment partnerships are built, because the three checks only make sense against that structure. It then takes each check in turn. It shows how the three run as a routine inside an institution, why they matter beyond operations, and what evidence a well-run program can produce. The final section sets out the questions that test whether any of this is in place.

How payment partnerships work, and where the risk lies

When you tap a card at a shop, a surprising number of companies are involved. There is the bank or e-money firm that issued your card. There is often an issuing processor, a company that runs the technology to approve or decline each transaction and keep track of balances. On the shop’s side there is an acquirer, the firm that signs up merchants to accept cards and passes their transactions into the card networks. Many of these roles are outsourced.

A fintech offering a card or an app-based account usually does not do most of this itself. It designs the customer experience and the brand. Behind the scenes, it relies on partners: a licensed entity to hold the money, a processor to run the transactions, sometimes a program manager to coordinate the whole thing. Wirecard played several of these roles for different clients, which made it a single point of failure for many of them.

Two features of this arrangement matter for risk. First, customer money is often held not by the brand the customer knows, but by a partner further back in the chain. In the UK and Europe, e-money firms must “safeguard” customer funds, keeping them separate from the firm’s own money so that they are protected if the firm fails. Second, the records that show which balance belongs to which customer may be held by the partner too.

A coat check works the same way. You hand over your coat and get a ticket. If the company running it goes bust, your coat is still yours, but if the ledger matching tickets to coats is locked in their office, you may wait a long time to get it back.

How safeguarding works, and where it stops

Under the UK’s e-money and payment services rules, a firm can safeguard in one of two main ways. It can segregate customer money into a designated account at a bank, labeled as holding customer funds, or invest it in approved secure assets. Alternatively, it can arrange an insurance policy or a guarantee that pays out the equivalent amount if the firm fails. Either way, the firm must reconcile the funds it should hold against the funds it does hold, regularly.

Safeguarding protects ownership. It does not guarantee speed. When a safeguarding firm fails, an insolvency practitioner has to establish who is owed what, deduct its own costs from the pool and then distribute. In 2020 that process ran under general insolvency law, which was not designed for thousands of small customer balances, and earlier UK e-money failures had taken a long time to resolve. If the firm’s records are poor, every step slows down.

The US version of the same structure

In the United States the structure looks different but carries the same risk. A fintech usually partners with a sponsor bank, which holds customer money in a pooled account “for the benefit of” the fintech’s customers. If the bank fails, FDIC deposit insurance can pass through to each customer, but only if the records identify each customer’s share. If the fintech or its middleware provider fails, deposit insurance does not apply at all, because the bank has not failed. Customers then depend entirely on whether the records can be reconstructed.

How exposure differs by institution

The three checks apply differently by type of organization. A UK or European fintech that relies on a partner’s e-money license is most exposed, because its customers’ money and its legal permission to operate both depend on that partner. A US fintech is in a similar position with its sponsor bank and any middleware provider between them.

A community bank that acts as a sponsor bank is on the other side of the same relationship. It holds the money and the regulatory responsibility, and it depends on the fintech’s records to know whose money it holds. A credit union that outsources card processing to a large processor or a credit union service organization has a narrower exposure: members’ funds stay in their share accounts, but card access and transaction records depend on the processor. A broker-dealer that relies on a clearing firm faces the same questions in a different regime, with SEC customer protection rules governing how customer cash and securities are held.

Check one: whether revenue and cash are plausible

An unqualified audit opinion and a large market capitalization are not proof of financial strength. An unqualified, or “clean,” audit opinion means the auditor has signed off on the accounts without reservations. Market capitalization is the total value the stock market puts on a company’s shares. Both are useful signals. Neither is a guarantee.

Wirecard’s reported profits depended heavily on third-party acquiring partners in Asia whose business could not be confirmed. Detailed press reporting and short-seller allegations had raised questions for more than a year. Short sellers are investors who bet that a company’s share price will fall, and they sometimes publish research explaining why. German authorities had at one point pursued the journalists and short sellers instead of examining the company. That episode is a reminder that official silence is not the same as official confirmation.

What each outside signal actually certifies

Precision about what each signal promises pays off. An audit opinion gives reasonable assurance that the accounts are free of material misstatement. It rests on samples, on management’s representations and on confirmations from third parties. A determined fraud that produces convincing confirmations can defeat it for a time. Later investigations of Wirecard reported that, for years, much of the trust cash had been evidenced by documents passed through the trustee rather than by confirmations obtained directly from the banks.

A license is narrower still. It means a regulator has authorized a specific legal entity to carry out specific activities and supervises that entity. It says little about the group around it. Wirecard’s bank was supervised; its parent, classified as a technology company, was not supervised as a financial group. A partner that relies on “regulated” as a seal for the whole group is reading more into the license than it contains.

An index listing certifies size and trading liquidity, not quality. Blue-chip clients certify that other firms reached the same conclusion, often relying on the same signals. Each is evidence, and none is a check on the specific risk the institution is taking.

Testing the story without forensic accountants

A partner committee can test plausibility without forensic accountants. It can ask where the partner’s revenue comes from, by business line and region; whether margins look like those of comparable firms; whether cash is concentrated in accounts or jurisdictions that are hard to verify; and whether reported growth matches the transaction volumes the institution itself sees. The answers cannot prove fraud. Together they show whether the story holds together, and they flag when a closer look is warranted.

Some red flags are specific to payments. Revenue booked through partners rather than through the firm’s own processing is harder to verify. Large receivables from those partners, rather than cash, deserve questions. Profit margins well above those of listed competitors call for an explanation. So does a pattern of acquisitions of small companies in distant markets at prices that are hard to reconcile with their size. Wirecard showed several of these features, and they were visible in its published accounts and in the press.

Private partners and young partners

Many critical partners are not listed, so the market signals described below do not exist. A private processor, program manager or middleware provider should still produce audited financial statements, a clear ownership structure and, for a venture-backed firm, an honest account of its funding runway. A partner that will run out of money in eighteen months is a risk even if nobody is lying. Concentration matters too: a middleware provider whose revenue depends on a handful of fintech clients, or on one sponsor bank, can fail because a single relationship ends.

The questions change with the partner’s role. For a firm that holds customer money, the focus is its cash, its safeguarding and its records. For a firm that only processes transactions, the focus is its financial staying power and the portability of its data. For a firm in the middle of the chain, the focus is whether its ledger reconciles with the bank’s, because that ledger may be the only record of who owns what.

A processor that does not add up

Suppose a credit union is choosing a card processor. The leading candidate reports profit margins far above those of its competitors, most of it from a region where it has few known clients, and much of its cash sits in accounts held by intermediaries abroad. Meanwhile, the transaction volumes the credit union’s own peers report through the processor are growing slowly, while the processor’s headline growth is rapid. No single fact is damning. Together they tell the credit union’s committee that the numbers do not hang together, and that it should ask for more evidence before signing.

Credible public allegations deserve a recorded response. A committee that notes an allegation, asks the partner for evidence, and decides whether the answer is sufficient has done its job, even if it continues the relationship. A committee that dismisses the allegation because the auditor and regulator have not acted has delegated a judgment it was supposed to make.

Watching for change

Ongoing monitoring matters as much as onboarding. A partner that looked sound at selection can change: new owners, rapid expansion, a change of auditor, delayed filings or key executives leaving. Each is a trigger for a fresh review. Institutions that set those triggers in writing, and assign someone to watch for them, catch deterioration earlier than those relying on an annual questionnaire.

Market signals count too. A falling share price, widening credit spreads or a regulator’s public statement are free information that a vendor management team can track at little cost. A credit spread is the extra interest investors demand to lend to a company compared with a safe borrower; when it widens, lenders are getting nervous. These are signals that professional investors watch daily. A procurement team can watch them too.

A delayed audit, a special audit commissioned under pressure, or an auditor unable to verify a material item deserve particular weight. Wirecard showed all three in the months before it failed. A KPMG special audit that could not verify a key revenue stream, published seven weeks before the collapse, was a trigger in any reasonable monitoring scheme.

The strongest objection

The fair objection is that Wirecard fooled professionals with far more resources than a credit union or a mid-sized fintech. Its auditor signed clean opinions for years. Large investors backed it. Its supervisor went after its critics. If they could not see the fraud, the argument runs, a partner committee could not either, and asking it to try is unrealistic.

The objection is right about detection and wrong about the purpose of the check. A partner committee does not set out to prove fraud. Its task is to decide how much of its business to place with a partner whose story has unresolved questions, and what protections to require. A committee that saw the allegations and the KPMG findings might reasonably have stayed, but with a second processor in place, direct statements for customer funds and a tested exit plan. Checks two and three exist precisely because check one will sometimes fail.

Check two: whether customer funds are visible to you

When the UK regulator restricted Wirecard’s e-money subsidiary, end customers of several fintech firms could not use cards or reach balances for days. The funds were meant to be safeguarded, and largely were. Access was the problem. For an end customer, that distinction mattered little while the freeze lasted. A customer who cannot pay rent does not take comfort from knowing the money is technically safe.

For any arrangement in which a partner holds or moves customer money, the institution should know where funds are held, in whose name, and how each balance ties to a customer. It should receive account statements directly from the bank holding the funds, as well as from the partner.

Reconciliation should run daily for active programs, comparing the institution’s own customer ledger with those statements. Reconciliation is the accounting discipline of checking that two independent records agree. A “break” is any difference between them. Breaks should go to a named owner with a deadline. Reconciliation that relies solely on the partner’s reports is not independent at all; it checks the partner’s figures against the partner’s own figures.

What direct visibility requires

Direct visibility has three parts. The first is a legal right: the contract with the partner, and ideally an agreement with the holding bank, entitles the institution to receive statements and balance information directly. The second is a technical feed: a daily file or an interface from the holding bank, not a spreadsheet forwarded by the partner. The third is a ledger of its own: the institution keeps, or can independently reconstruct, the balance of each customer, rather than relying on the partner’s system as the only record.

The third part is the hardest for a young fintech, because building its own ledger costs money and duplicates what the partner already provides. The trade-off is clear in hindsight. A fintech with its own ledger can tell an administrator, a regulator or a new partner exactly what each customer is owed. One without it has to wait for someone else’s records, and hope they are right.

What reconciliation catches, and what it misses

A daily reconciliation catches most operational problems: missing settlements, fees taken from the wrong pool, transactions posted twice, customer balances that do not add up to the account total. It also catches a partner that has started to dip into customer money, because the pooled balance falls below what customers are owed. The earlier a shortfall is found, the smaller it usually is.

It misses anything that corrupts both records at the source. If the statement the institution receives is produced by the partner rather than the bank, a fabricated statement will reconcile perfectly with a fabricated ledger. Wirecard’s auditors were shown documents of exactly that kind. That is why the statement must come from the holding bank directly, through a channel the partner does not control, and why the institution should occasionally confirm balances with the bank by a second route.

Different structures, same test

For a UK e-money firm, visibility means knowing the safeguarding account details, seeing the bank’s acknowledgment that the account holds customer funds, and reconciling against it daily. For a US fintech, it means seeing the pooled account at the sponsor bank and holding records good enough for pass-through deposit insurance to work. For a sponsor bank, it means insisting that the fintech’s ledger, or the middleware provider’s, reconciles to the bank’s own records every day, with the bank able to see the detail. For a credit union, it means confirming that the processor’s records of card authorizations and settlements match the share accounts they draw on.

The chain behind the chain

Fourth parties complicate the picture. A fourth party is your supplier’s supplier. A fintech partner may depend on an issuing processor, a program manager and a sponsor bank, any of which can fail. Mapping that chain, and knowing which link holds the authoritative record of each customer’s money, is part of the same check. If no party can produce those records quickly and independently, safeguarding exists only on paper.

In practice, a map of this kind can fit on a single page: each entity, what it does, what customer data and money it holds, and who has the definitive ledger. Many institutions discover, when they draw it for the first time, that a critical link is a company they have never met.

Check three: whether you can leave quickly

Partners fail even after careful diligence. The question is how fast customers can be moved, and who controls the data needed to move them. Fintechs that relied on Wirecard as their sole issuing processor had to find replacements urgently. Their customers bore the disruption while cards were reissued and balances transferred.

Exit readiness has concrete parts. Contracts should give the institution rights to customer and transaction data in a usable format, delivered on demand, plus transition assistance at agreed rates. A written exit plan should estimate migration time realistically, including card reissuance and customer communications. Card reissuance alone involves producing and mailing new plastic to every customer, getting it activated and updating every merchant and subscription the old card was linked to.

For critical services, a pre-qualified alternative provider shortens the timeline from months to weeks. Pre-qualified means you have already done the diligence, agreed basic terms and confirmed the technical fit, so that switching is an execution problem rather than a procurement project. Testing a data extract once a year confirms the rights are real. A contract clause promising data “on request” is worth little if, when requested, the file turns out to be incomplete or in a format nobody can load.

Why card migrations take so long

Moving a card program is slower than moving most services, for reasons that are easy to miss. The card number range, known as the BIN, usually belongs to the issuer, so cards issued under one partner cannot simply be moved to another; new numbers mean new cards. Customers have stored the old card in mobile wallets and with merchants for recurring payments, and each of those links breaks. Customer identity records gathered for anti-money-laundering checks may need to be transferred or redone, which raises consent and data protection questions. The card network may need to approve the new arrangement. Each step depends on the failing partner cooperating, at a moment when it may have no incentive or no staff to do so.

These steps can be prepared in advance. A data extract that includes identity verification records, a communication plan for customers, and a pre-agreed process with the alternative provider for issuing new cards all shorten the timeline. None of it can be improvised in a week.

Rehearsing the failure

An exit plan that has never been rehearsed tends to fail on details. A tabletop exercise built around a partner’s sudden insolvency tests them: who tells customers, and through which channel, if the app itself depends on the failed partner; who calls the regulator; how customers in hardship get emergency access to funds; which staff handle the inevitable flood of complaints. Many institutions find that their customer messaging, their status page or their support tools run on the very partner whose failure they are rehearsing. Others discover that nobody has the authority to sign an emergency contract with the alternative provider over a weekend. Both are cheap to fix before the event and expensive after it.

What supervisors already expected

Exit planning was not a new idea in 2020. The European Banking Authority’s outsourcing guidelines, applied from September 2019, required banks, payment institutions and e-money institutions to have documented exit strategies for critical or important outsourced functions. US banking supervisors had long expected banks to plan for the termination of third-party relationships. What many firms lacked was the evidence that the plan would work: a tested data extract, a realistic timeline and an alternative ready to receive customers.

The cost of a second provider

Pre-qualifying an alternative costs money and attention, and running two providers in parallel costs more. Volume split between two processors may mean higher unit prices from each. Some institutions will decide that the cost is not justified for every service, and that can be a legitimate choice, as long as it is made explicitly, by someone with authority, with an honest estimate of the migration time if the sole provider fails. What should not happen is the default: a single provider, no tested exit and no record that anyone accepted the risk.

How the three checks run inside an organization

Listing checks is easier than making them part of the working week. Take the same credit union a year after it signed with a processor, running them the way a careful institution does.

Every day, an operations analyst opens two files: the credit union’s own ledger of what each cardholder should have, and the statement that arrives directly from the bank holding the pooled customer funds. A short automated comparison flags any difference. This morning there are three small breaks, all timing differences from late-evening transactions. Each is assigned to a named person, who must explain or fix it by the end of the next business day. A break that is not explained within the deadline goes to the head of operations.

Every month, the vendor management team reviews a short dashboard for each critical partner. It covers service performance, but also the free signals: the partner’s share price or bond prices if it is listed, any change of auditor or senior executives, delayed filings, regulator statements and notable press coverage. Most months nothing changes. When something does, it trips a written trigger and the partner goes back to the committee.

Every quarter, the partner committee meets. It reviews any triggers that fired, any public allegations and the evidence requested in response. It minutes its decision on each, including the decision to continue. It also reviews the map of the program chain, because suppliers change their own suppliers more often than their clients realize.

Every year, the credit union asks each critical partner for a full extract of customer and transaction data, as its contract permits, and has its own team load it into a test environment to confirm it is complete and usable. It refreshes the exit plan, updates the timeline estimate and confirms that the pre-qualified alternative processor is still a realistic option. The board receives a one-page summary of all of this.

The routine needs no forensic accountants or large team. What it does require is clear ownership, a modest budget and the discipline to keep doing it when nothing seems wrong. The purpose is simple: if something does go wrong, the institution sees it early and already has a plan.

Who owns each piece

Ownership is where these routines usually fail. The business line that sponsors the partnership owns the relationship and the decision to continue it. Finance or treasury owns the plausibility review, because it reads financial statements for a living. Operations owns daily reconciliation and the breaks. Vendor management owns the triggers, the chain map and the annual extract test. Internal audit checks, periodically, that all of this actually happens. A board risk committee receives the summary and decides on any risk accepted outside appetite.

Smaller institutions combine these roles, and that is fine. What matters is that each task has one named owner and that the person who wants the partnership to succeed is not the only one judging whether it should continue.

Money, customers, regulators, reputation

These checks can feel like back-office hygiene, yet each one connects directly to money, customers, regulators and reputation.

• Money. A partner whose finances are not what they seem can fail suddenly, taking fees, prepaid balances and revenue streams with it.
• Customers. When customers cannot reach their money, they blame the brand on their card, not the processor they have never heard of. Complaints, churn and social media criticism land on you.
• Regulators. Supervisors expect firms to manage outsourcing and third-party risk. “Our partner was audited” is not an answer they accept as a substitute for your own oversight.
• Reputation. A freeze of even a few days can undo years of brand building, especially for a young fintech whose promise is convenience.

These checks cost money and attention at selection time, when the partner looks strongest and the business is eager to launch. That is why they get cut. Budgeting for them as part of the price of the relationship, scaled to how much customer money the partner touches, keeps them from becoming optional. A partner that holds customer funds or issues cards under your name warrants all three. A vendor with no access to money or customers may need none.

Who is accountable to whom

The regulatory accountability differs by institution, and it is worth being exact. A UK e-money institution answers to the FCA for safeguarding its own customers’ funds, even when a partner holds them. A US bank answers to its prudential regulator for the conduct of its third parties, including fintech partners that bring in deposits. A federally insured credit union answers to the NCUA, which, unlike the bank regulators, lacks general authority to examine credit unions’ vendors directly; the credit union’s own oversight therefore carries more of the weight. A broker-dealer answers to the SEC and FINRA, and outsourcing a function does not outsource its supervisory obligations. In each case, the obligation stays with the regulated firm.

What a well-run program can show

An institution that handles critical partners well can show:

• A written assessment of each critical partner’s revenue sources and cash, updated when triggers fire.
• A log of credible public allegations, the evidence requested and the committee’s decision.
• Statements for safeguarded funds arriving directly from the holding bank, and a daily reconciliation with named owners for breaks.
• A one-page map of the full chain of partners, showing who holds the authoritative customer record.
• A tested annual data extract and a written exit plan with a realistic timeline.

The failures are the shortcuts. Treating a famous name or index listing as due diligence. Dismissing press reports because no regulator has acted. Reconciling against the partner’s own reports. Not knowing the fourth parties. Writing exit rights into the contract and never testing them. And cutting all of this at launch because the partner looks strong and the business is in a hurry.

Measures that show the program is working

A few measures tell a board whether the routine is alive. The number of reconciliation breaks older than their deadline, and the trend. The number of monitoring triggers fired in the quarter and how many reached the committee. The date of the last successful data extract test for each critical partner, and whether it loaded completely. The estimated migration time in each exit plan, compared with what the business could tolerate. And the share of critical partners for which a pre-qualified alternative exists, or for which the board has explicitly accepted the absence of one.

Checks nobody else can do for you

1. For each, can we explain where its revenue and cash come from, and does the story hold together against what we see ourselves?
2. Are there credible public allegations about any of them, and what did we ask for and decide in response?
3. Do we receive statements for customer funds directly from the bank holding them, and do we reconcile daily against our own ledger?
4. Can we draw the full chain of processors, program managers and sponsor banks behind each program, and say who holds the authoritative customer record?
5. If a critical partner failed on Friday, how long would it take to move our customers, including reissuing cards?

Behind those sit two further tests of readiness: a full data extract from each critical partner, loaded and checked every year, and an alternative provider pre-qualified for each critical service. Answers that point to someone else’s seal of approval are a sign the check has been outsourced.

With hindsight

Wirecard’s former chief executive went on trial in Munich in December 2022, in what is widely described as one of the largest accounting frauds in postwar German corporate history. The trial ran for years. The former board member responsible for the Asian business remained a fugitive for years. The case became a reference point for how long a well-told story, backed by respected names, can outlast the evidence against it.

The fallout reached the institutions whose signals partners had relied on. Germany reformed financial supervision and gave BaFin, its financial regulator, stronger powers. A 2021 law strengthened the regulator’s forensic capabilities, required listed companies to rotate auditors more often and tightened auditor liability. The head of BaFin left office early in 2021, and a parliamentary inquiry examined the failures of the regulator, the auditor and the government. EY faced regulatory sanctions and civil claims in Germany over its audits; in 2023 Germany’s auditor oversight body fined it and barred it for two years from taking on new audit mandates for public-interest companies. The auditor and the regulator had not been the safeguard many had assumed.

The UK changed the plumbing for customers. In 2020 the FCA issued additional guidance on safeguarding for payment and e-money firms. In 2021 the government introduced a special administration regime for payment and e-money institutions, designed to return customer funds faster when such a firm fails. The FCA later consulted on a stricter safeguarding regime, with more frequent reconciliation, annual safeguarding audits and plans for returning funds in a failure, and published final rules in 2025.

Exit planning became an explicit legal duty in Europe. The EU’s Digital Operational Resilience Act, applying from January 2025, requires financial entities to keep a register of their technology third-party arrangements and to have exit strategies for those supporting critical or important functions. In the United States, the federal banking agencies issued joint guidance on third-party risk management in June 2023. It covers the full life cycle of a relationship, including termination.

The partnership problem recurred in the United States. Between 2022 and 2024, bank regulators took a series of enforcement actions against sponsor banks over weak oversight of their fintech partners. In 2024, the bankruptcy of Synapse, a middleware provider connecting fintech apps with partner banks, left many end users unable to reach their funds for months. Middleware is the technology layer in the middle of the chain that passes instructions between the app and the bank and keeps track of balances. Records of who owned what did not reconcile. One of the partner banks, Evolve Bank & Trust, had already been placed under a Federal Reserve enforcement action that year over its fintech partnerships. In September 2024, the FDIC proposed recordkeeping requirements for custodial deposit accounts with transactional features. Banks would have to keep records identifying each beneficial owner of the funds and reconcile each owner’s balance daily, even when a third party kept the records. A custodial account is one held by one party for the benefit of many others, as when a fintech pools its customers’ money at a bank.

As with Wirecard, the money was not the only problem; the ability to see and move it was. Two collapses, four years and an ocean apart, failed in the same place: the gap between where money sits and who can prove whose it is. The regulatory responses on both sides of the Atlantic converged on the same remedies: independent records, frequent reconciliation and a tested way out.

Outside assurance is an input, not a substitute. Auditors, regulators and other customers can tell you a lot. They cannot tell you whether your customers can reach their money on Monday morning if a partner fails on Friday night. Only your own reconciliations, maps and tested exit plans can.