REPORT V: WIRECARD AG. Nov 28, 2016.

STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE

Project VisMas

REPORT V: WIRECARD AG
November 28, 2016

STRICTLY CONFIDENTIAL

PROFESSIONAL LEGAL PRIVILEGE

REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
Tasking

1. This company was tasked with carrying out investigative research on Wirecard AG in order to
examine allegations of improper conduct and ties to illegal activity.

2. This phase of the investigation focused on Wirecard’s relationship between Wirecard Asia
Pacific Inc and Asia Pacific E-Serv Corporation, with the aim of identifying false and misleading
statements made by the management of Wirecard.

Background

3. Wirecard has been alleged to have conducted illegal activity and falsified transaction payment
details for high risk merchants.

4. Wirecard Bank has been alleged to have a relationship with Asia Pacific E-Serv Corporation,
Uni-Channel, and a number of other Philippine based entities. Wirecard’s CEO, Markus Braun
denied any links or association with Asia Pacific E-Serv Corporation.

Summary

5. Markus Braun, through a call or series of calls to investment analysts, was reported to have
denied Wirecard having any association or links to1:

a. Asia Pacific E-Serv Corporation, a Philippine entity, also known as Aspaconline.

b. An individual named Arnold Marcellana, reported by ZRI to be the Risk and

Compliance Director for Wirecard Asia Pacific.

c. An individual named Ronald Magleo, reported by ZRI to have sold Asia Pacific E-Serv
Corporation/Aspaconline, to Wirecard in or around 2007.

6. The official company documentation and accounts for Wirecard Asia Pacific Inc and Asia
Pacific E-Serv Corporation were obtained from the Philippine Securities and Exchange
Commission. This documentation and accounts detail that contrary to the disclosures
reportedly made by Markus Braun to the market, that Wirecard:

a. Had a direct relationship with the entity, Asia Pacific E-Serv Corporation.

b. The individual named Arnold Marcellana was the Risk and Compliance Director for
Wirecard Asia Pacific, and a shareholder in Wirecard Asia Pacific.

c. The individual named Ronald Magleo, worked for Wirecard Asia Pacific as its Chief
Operating Officer.

d. Wirecard Asia Pacific Inc and Asia Pacific E-Serv Corporation were concurrently
controlled and managed by the same individuals: Rafael Legaspi, Esther Magelo,
Ronald Magleo and Arnold Marcellana.

1 http://www.zatarra-research.com/FINALMainreportZatarra.pdf
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
e. Official company filings returned to the Philippine SEC detail that Wirecard Asia
Pacific was registered to the same address as Asia Pacific E-Serv Corporation: 25th
Floor Yuchengo Tower 1, RCBC Plaza, Ayala Avenue, Makati City, Philippines.

f. In 2011, Wirecard Asia Pacific Inc annual returns are filed on Asia Pacific E-Serv
Corporation/Aspaconline headed paper.

g. Wirecard Asia Pacific Inc and Asia Pacific E-Serv Corporation were each audited by
the same auditor: Datiles Casero and Associates.

Conclusions

1. Prima facie, Markus Braun and Wirecard have made materially false and misleading
statements to investment analysts and into the wider market.

2. The blurred ownership structure of Wirecard Asia Pacific and Asia Pacific E-Serv Corporation
raises significant concern as to the audit for each company.

7. The service offering provided by Asia Pacific E-Serv Corporation and subsequently, Uni-
Channel, indicates that Wirecard utilizes these entities as part of a scheme to assist online
businesses outside Europe to set up European merchant accounts (specifically in the United
Kingdom) to accept major credit cards. This would permit high risk merchants, operating in
emerging markets, to pay lower transaction fees and charge backs, than they would ordinarily
do when operating from their true location. This would breach a significant number of
MasterCard and Visa compliance standards, notably MasterCard Rules 2:

 5.2 Merchant and Submerchant Compliance with Standards.

 5.4 Merchant Location.

 5.4.1 Disclosure of Merchant Location.

 5.6.5 Merchant Location.

 5.7 Transaction Message Data.

 7.6.6 High-Risk Payment Facilitators.

 Area of Use of License

Further Action/Recommendations

8. Recommend further in-depth investigation into the following:

Michael Brinkmann (HUMINT), Rafael Legaspi, Esther Magleo, Arnold Marcellana and
the Uni-Channel and RisingSunPayments entities.

2 https://www.mastercard.com/ca/merchant/en/getstarted/BM_Manual.pdf
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
Wirecard AG

9. Wirecard AG is a global financial services and technology company headquartered in

Aschheim, Munich, Germany. Its internet payment service competes with PayPal and Western
Union. Wirecard AG is listed on the Frankfurt Securities Exchange. 3

Comments Made by Wirecard’s CEO, Markus Braun

10. Subsequent to a research note, produced by Zatarra Research & Investigations (ZRI), on
February 24, 2016, Markus Braun, via a call or series of calls to investment analysts, was
reported to have denied Wirecard having any association or links to 4:

a. Asia Pacific E-Serv Corporation, a Philippine entity, also known as Aspaconline.

b. An individual named Arnold Marcellana, reported by ZRI to be the Risk and

Compliance Director for Wirecard Asia Pacific.

c. An individual named Ronald Magleo, reported by ZRI to have sold Asia Pacific E-Serv
Corporation/Aspaconline, to Wirecard in or around 2007.

11. On March 2, 2016, investment analysts, Adithya Metuku, Kal Korschelt, and Sean Johnstone,
released a research note from Bank of America Merrill Lynch (BoAML):

Addressing key investor concerns part II; reiterate Buy.

12. The note details that Metuku, Korschelt and Johnstone claim to have spoken to Markus
Braun, where in a call with Braun:

All allegations in the third party report [ZRI’s research note] were denied.

13. One of Markus Braun’s denials related to a company, Asia Pacific E-Serv
Corporation/Aspaconline, which ZRI indicated to be either an undisclosed subsidiary or
affiliate under the control of Wirecard. Metuku, Korschelt and Johnstone detailed:

Our checks with the CEO, Marcus (sic) Braun, confirmed that Wirecard does not/did
not have any links to this entity [Asia Pacific E-Serv Corporation/Aspaconline] or the
individual [Ronald Magleo] purported to have sold this company [Asia Pacific E-Serv
Corporation/Aspaconline] to Wirecard.
In addition, concerns also appear to be focused on alleged association with one specific
individual [Arnold Marcellana] who, according to the third party [ZRI] report,
apparently claims to have been the Risk and Compliance Officer for Wirecard Asia
Pacific. Our checks with Wirecard suggest that this individual does not/did not have
any connections with the company.

3 https://www.wirecard.com/company/our-story/
4 http://www.zatarra-research.com/FINALMainreportZatarra.pdf
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE

14. The official company documentation and accounts for Wirecard Asia Pacific Inc (SEC
Registration Number: CS200719114) and Asia Pacific E-Serv Corporation (SEC Registration
Number: CS200507846) were obtained from the Philippine Securities and Exchange
Commission. This documentation and accounts detail that contrary to the disclosures
reportedly made by Markus Braun to BoAML investment analysts and into the wider market,
that Wirecard:

a. Had a direct relationship with the entity, Asia Pacific E-Serv Corporation.
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
b. The individual named Arnold Marcellana was the Risk and Compliance Director for
Wirecard Asia Pacific, and a shareholder in Wirecard Asia Pacific.

c. The individual named Ronald Magleo, worked for Wirecard Asia Pacific as its Chief
Operating Officer.
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
Wirecard Asia Pacific and Asia Pacific E-Serv Joint Management

15. From 2009 until at least 2011, Arnold Marcellana is detailed in the Wirecard Asia Pacific Inc
filings as the Company Secretary, Compliance Officer, and a shareholder.

16. From 2007 until at least 2011, Rafael Legaspi is detailed as the CEO/President of Wirecard
Asia Pacific Inc.

17. From 2007 until at least 2013, Rafael Legaspi is detailed as the CEO/President of Asia Pacific
E-Serv Corporation.

Note: Arnold Marcellana is believed to be related to Rafael Legaspi, possibly Rafael Legaspi’s
son. Note ends.

18. From 2007 until at least 2009, Esther Magleo is detailed as CFO/Treasurer to Wirecard Asia
Pacific Inc.

19. From 2007 until at least 2009, Esther Magleo is detailed as CFO to Asia Pacific E-Serv
Corporation.

Note. Esther Magleo is believed to be Ronald Magleo’s mother. Note ends.

20. From at least 2009 until 2011, Michael Brinkmann (Passport Number: 500-259-3646) is
detailed as a Director and Shareholder of Wirecard Asia Pacific Inc.

21. Wirecard Asia Pacific Inc and Asia Pacific E-Serv Corporation were controlled and managed
by the same individuals: Rafael Legaspi, Esther Magelo, Ronald Magleo and Arnold
Marcellana.

22. Official company filings returned to the Philippine SEC detail that Wirecard Asia Pacific was
registered to the same address as Asia Pacific E-Serv Corporation: 25th Floor Yuchengo Tower
1, RCBC Plaza, Ayala Avenue, Makati City, Philippines.

23. In 2011, Wirecard Asia Pacific Inc annual returns are filed on Asia Pacific E-Serv
Corporation/Aspaconline headed paper.

24. Wirecard Asia Pacific Inc and Asia Pacific E-Serv Corporation were each audited by the same
auditor: Datiles Casero and Associates.

25. In 2010, the auditor to Wirecard Asia Pacific Inc. qualified its opinion, expressing doubt
regarding the company’s ability to continue to trade as a going concern:

We draw attention to Note 1 to the financial statements which indicate that the
Company will continue operating as a going concern. As shown in the financial
statements, the Company incurred net loss amounting to P11.81 million for the year
ended December 31, 2010 and is in capital deficiency position of P7.17 million as of
December 31, 2010. These conditions, among others, raise substantial doubt about
the Company's ability to continue as a going concern.

26. In 2010, Wirecard’s Group Annual Report (page 112) details:

Wirecard AG could reach the upper limit of this forecast. If the anticipated positive
influences from the Asian business and the issuing business exceed their targets.
REPORT V: WIRECARD AG. Nov 28, 2016.
STRICTLY CONFIDENTIAL. PROFESSIONAL LEGAL PRIVILEGE
Note: Wirecard Asia Pacific Inc was subsequently transferred to Wirecard Asia Pte. Ltd.
Singapore (previously known as E-Credit Plus Pte. Ltd). Wirecard Asia Pte. was another loss
making business where the auditor was unable to determine validity of revenues and fees and
expressed doubt over that company’s ability to continue as a going concern. 5 Note ends.

27. Wirecard Asia Pacific filings detail that Asia Pacific E-Serv Corporation is an affiliate to
Wirecard Asia Pacific.

28. Redipayonline, an e-wallet product of Asia Pacific E-Serv Corporation/Aspaconline is detailed

to have an exclusive relationship with Wirecard.6

29. Asia Pacific E-Serv Corporation/Aspaconline was an exclusive partner of Wirecard AG, using
Click2Pay as its payment system provider. 7,8

REPORT ENDS

5 https://ftalphaville-cdn.ft.com/wp-content/uploads/2015/05/E-Credit-Plus-AR-11-FP.pdf
6 http://web.archive.org/web/20080517070644/http:/www.redipayonline.com/
7 http://web.archive.org/web/20060405184309/http:/www.aspac-eserv.com/
8 http://web.archive.org/web/20080403221558/http:/www.wirecardap.com/