Structured investigations to clarify the facts have not yet been conducted. The public prosecutor's office has not even obtained the complete accounts of UAB Alternative Payments at Wirecard Bank, let alone the company's foreign accounts. The account opening documents are also missing. To clarify the facts, it would have been essential to investigate the extent to which third-party business was transferred from Wirecard to UAB Alternative Payments, what third-party revenues this company received, and where these revenues went. An analysis of the depositors' accounts would have been necessary to determine the background of the payment transactions.  

The whereabouts of the capital should have been investigated in light of the payment outflows. Nothing has been done to date, so it remains unclear whether and to what extent Wirecard AG and its shareholders and investors were harmed by the transfer of real, existing third-party business. Furthermore, had the public prosecutor's office conducted the necessary investigations, it would have become apparent that Bellenhaus once again lied to the public prosecutor's office to cover up the embezzlement he committed. The entire matter is omitted from the indictment. Dr. Braun only learned of this from the case file.  

Evidence of a shift of Wirecard's third-party partner business to UAB Paypay Holding
The fact that PayEasy's TPA volume was also apparently to be transferred to a company in Lithuania is evident from Christopher Bauer's founding of UAB Paypay Holding, based in Vilnius, on October 20, 2016. The company's address is Mesiniu str. 5, 01133 Vilnius, which is the same address as UAB Alternative Payments (SoBa XIV-3-1, p. 189). Bellenhaus stated in his interrogation of February 7, 2022, that he was familiar with a PayPay. He was not questioned further on this matter (EA III-1-IV, p. 657).  

It is likely that Bellenhaus founded several other companies in Lithuania between 2014 and 2018. Between March 4, 2015, and April 1, 2018, he traveled to Vilnius at least 11 times. This is evident from Bellenhaus's credit card statements, which included charges for hotel stays and restaurant visits in Vilnius:
March 4, 2015  

March 10, 2016 (SoBa IX 1-2, p. 22)
October 28/29, 2016 (Exhibit 10.15.5.1., Credit card 4611389203)
November 1, 2016 (Exhibit 10.15.5.1., Credit card 4611389203)
July 25, 2017 (Exhibit 10.15.5.1., Credit card 4611389203)
September 9, 2017 (Exhibit 10.15.5.1., Credit card 4611389203)
September 12, 2017 (Exhibit 10.15.5.1., Credit card 4611389203)
October 19, 2017 (SoBa IX 1-1, page 72)
December 2, 2017 (SoBa IX 1-1, page 72)
January 18, 2018  

(Exhibit 10.15.5.1., Credit Card 4611389203)
February 2, 2018 (Exhibit 10.15.5.1., Credit Card 4611389203)
April 1, 2018 (Exhibit 10.15.5.1., Credit Card 4611389203)  

It is consistent with this that the law firm Ecovis Lithuania appears very frequently on Bellenhaus's travel expense reports. In particular, the names of the firm's employees Karulaityte-Kvainauskiene and Loreta Andziulyte are often mentioned. An obvious connection to PayEasy also exists because Christopher Bauer often appears in connection with these two names (SoBa XIV-3-1, p. 189). It is also noteworthy that, according to Bellenhaus's expense reports, the following individuals, among others, were guests of Wirecard at the 2019 Oktoberfest: Abdallah Turki, Andreas Sichel, Stephan Heintz (epay), Karulaityte-Kvainauskiene, Loreta Andziulyte, Ramanantan (Invest Lithuania), Wolf Kring (2000charge), and Ines Kring (2000charge). That both employees  

The fact that representatives of the law firm were invited to the meeting demonstrates that an ongoing business relationship apparently existed.

Bellenhaus did not disclose any of this in his interrogations and statements. The public prosecutor's office has not yet conducted any investigations into this matter. In particular, it remains completely unclear whether and to what extent third-party business from Wirecard, especially from the Wirecard third-party partner PayEasy, was shifted to UAB Paypay Holding, to what extent Wirecard AG and its shareholders were harmed as a result, and who profited from this. Dr. Braun first learned of the activities in Lithuania from the files.  

The payments received in the accounts of Wirecard's third-party partners and shadow TPAs ​​represent revenue from Wirecard's third-party business.

(1) Previous findings
It is already evident from the existing findings that a very significant portion of the payments received in the accounts of Wirecard's third-party partners Centurion, PayEasy, Al Alam, and Conepay, as well as the shadow TPAs ​​CQR, Firstline, Testro, Tritract, Paradigm, DR Technologies, and Canada Inc., represent revenue or commission payments from Wirecard's third-party business.  

This follows solely from the fact that the depositors paid billions into accounts of Wirecard's third-party partners PayEasy, Al Alam, Centurion and Conepay, and that the coordinator responsible for Wirecard's third-party partner business, who controlled all payment flows and accounts, managed these payments – including payments to the so-called shadow TPAs: Oliver Bellenhaus.  

A large proportion of the depositors are registered on the Wirecard Merchant List and are responsible for the area  

The transactions were coded as Adult/Dating or Gaming/Gambling (MCC 7995, 5967). This confirms that the payers originated from the Wirecard network and belong to the digital sector, which was processed within Wirecard's TPA structure. Large sums came from traditional payment service providers, particularly acquirers, aggregators, or processors (e.g., Onestopmoneymanager, Merchant Optimisation, Lateral Payment Solution Ltd., E-Pay International Ltd., Legacy Eight Malta Ltd., Globebill).  

The transfer and payment structure of the deposits is typical for transactional business arising from the processing of credit card transactions. Commission payments are typically made in odd amounts, at regular billing intervals, and in roughly comparable quantities. The transfer texts for payments to Wirecard's third-party partners frequently refer to specific agreements ("CCS"). The transfer texts for payments to so-called shadow TPAs ​​were often manipulated to conceal the embezzlement; however, this did not change the payment structure.  

Most accounts show that the balances were cleared either after the publication of the KPMG report in April 2020 or in connection with the collapse of Wirecard AG. Frequently, revenue declines were also recorded in 2019 as a result of the Financial Times reporting, for example, in the account of Wirecard's third-party partner Centurion, account number 59111. This can only be explained if these are revenue payments from Wirecard's third-party business. If these were payments unrelated to Wirecard's third-party business, the drastic changes in payment volume would not be plausible.  

The accounts of Wirecard's third-party partners and shadow TPAs ​​show, at the beginning of the period in question in 2015/2016, some accounts exhibit striking increases in revenue that cannot be explained by organic sales activities, but only by the fact that third-party partner revenues from existing third-party business were processed through these accounts. For example, it is inconceivable that Centurion, as a company without any significant business operations, could have generated over €200 million in revenue on its own in three years, with some very high revenue increases within a short period (e.g., on the account of Wirecard's third-party partner Centurion, account number 59111, an increase of 800% from 2016 to 2017).  

It can definitely be ruled out that Wirecard's third-party partners and the shadow TPAs, which are exclusively – contrary to Bellenhaus's claims – shell companies without operational business activities, will generate billions in revenues within just a few years unrelated to Wirecard's third-party business.  

If – as the public prosecutor's office claims in the indictment – ​​there really was no third-party partner business, what interest would the Wirecard third-party partners' UBOs have had in feigning these revenues during the financial statement audits and the forensic KPMG audit? Why were the payment descriptions manipulated and obscured for payments to so-called shadow TPAs ​​if these were not embezzled revenue payments from Wirecard's third-party partner business? The manipulations – including and especially those described in the indictment – ​​were carried out to conceal the embezzlement of TPA revenues.  

The deposits cannot be volume payments, as is already evident from the fact that the payment amount due to the merchants...  

The volume could not have been embezzled. No parallels are discernible between the incoming and outgoing payments; that is, the payer and the payee are completely different. The same applies to the payment amounts and the payment dates.  

The deposits cannot be explained by round-tripping, as is evident from the amount of the deposits. According to current findings, particularly based on the Steinhoff expert opinion, there is evidence for so-called round-tripping payments amounting to only €91 million (SB XIV-3-1, p. 19). Even assuming this amount to be correct, it is offset by at least €1.9 billion in incoming payments – almost a multiple of that amount. Furthermore, the payment structure of so-called round-tripping payments is completely different from the deposits from payment transaction business. While the deposits into the accounts of Wirecard's third-party partners and the shadow TPA followed typical transaction patterns, the so-called...  

Round-tripping was carried out in a few transactions involving larger sums. Furthermore, the vast majority of payments did not return to Wirecard, but were instead diverted and embezzled through payments to known embezzlement companies.  

The fact that the embezzlement of third-party partner revenues from Wirecard did not involve round-tripping is also demonstrated by the chart mentioned earlier, which shows possible payment flows to Senjo with a total volume of €500 million.  

The chart shows various payment flows that go exclusively to Senjo, including those from E-Pay, Manboo, Payment Asia, Lithuania (which could indicate the portion of TPA's business that was relocated to Lithuania), Kalixa (which apparently relates to PXP), and Walpay.

All payments end up at Senjo; none of the payment flows return to Wirecard.  

In summary: The payments received in the domestic accounts of Wirecard's third-party partners and the shadow TPA are revenue payments from Wirecard's third-party business. No other explanation, which does not rely on baseless assumptions and speculation, is apparent. The complete picture of the payment flows emerges from the domestic accounts of the payment service providers Onestopmoneymanager, Merchant Optimisation, and Powercash21, which document all payment flows, from the volume payments from the credit card companies Mastercard and Visa to the acquirer, the disbursement of the transaction volume to the merchants, the commission payments to the Wirecard third-party partners, and their subsequent misappropriation.  

The fact that this complete picture of a Wirecard third-party partner transaction is so far only reflected in the three domestic accounts of the aforementioned payment service providers is solely due to the fact that, according to the files, the public prosecutor's office has not obtained any further account documents from depositors to this day – almost two years after the initiation of the investigation – nor has it carried out any other investigative measures to clarify the background of these payments. That in the present proceedings, in which the core thesis of the indictment is that the three Wirecard third-party partners generated "zero revenue"