Blast from the past: BBVA and KPMG
When I saw that BBVA wants to buy Banco de Sabadell, the first thing I did was check who the auditor is. There are only so many to go around!
It’s mid-summer and it’s time to say a bit about what I have been up to and my upcoming schedule. I have tried to keep my schedule free this summer to be able to follow the muse, work with my friend and frequent collaborator Olga Usvyatsky of Deep Quarry, and maybe read some of my books.
I buy everyone’s first novel!
While I was reading and reflecting in July I recorded two podcasts.
On July 1 I did the Deeponomics podcast with Johan van Geffen,
Incoming PhD Student, Stockholm School of Economics.
Michael Levin and Professor Ann Lipton are hosts of the Shareholder Primacy podcast.
I was on the podcast on July 9th.
Lindsey A. Gallo, Assistant Professor of Accounting at the Stephen M. Ross School of Business at the University of Michigan has asked me to come and guest lecture her MAcc students in mid August when they are in Washington, D.C. I will be presenting my usual ripped from the headlines update on audits and auditors, and audit regulators as well as teaching our KPMG-PCAOB scandal Teaching Case.
I have been invited back to Cambridge University to co-teach the Audit residency for the Executive Master in Accounting Program in mid September.
I will be teaching my hybrid fraud case course for the Montclair State University MAccs in the late fall term. I am now also teaching the required asynchronous Accounting Ethics course every spring for Montclair State University.
In late November I will also be guest lecturing to the MAccs at Ohio State again at the invitation of Program Leader Prof. Patrick Kielty. As always OSU has some of the sharpest students around and several of them always connect with me to follow-up for future guidance on ways to use their tools outside of the Big 4.
I’ll be back at the University of Miami in early winter teaching the hybrid fraud case course there, for the third time.
*************************************************************************************************
Coming up today: A blast from the past with BBVA.
On May 5, David Paolella’s "The Special Situation Report #109: 5/5 Roundup" noted that "Banco Bilbao Vizcaya Argentaria (BBVA)" confirmed negotiations to merge with Banco de Sabadell and has hired advisers for a potential all-stock merger (Filing).
By June 24, The Wall Street Journal was reporting that the bank had run into some trouble with its plans.
Spain Blocks Legal Merger of BBVA and Sabadell for Up to Five Years
After first three years Spanish cabinet will assess whether to hold the merger for another two Elena Vardon June 24, 2025
The Spanish government said it would clear Banco Bilbao Vizcaya Argentaria’s hostile bid for smaller peer Banco de Sabadell on the condition that the banks don’t legally merge for up to five years.
Spain’s Ministry of Economy, Commerce and Business said on Tuesday that both entities and their assets will have to be kept separate and manage their activities independently for at least three years.
Reuters had a report on the 30th with a bit more detail:
MADRID, June 30 (Reuters) - Spain's BBVA said on Monday it would move ahead with its hostile takeover bid for Sabadell despite the government effectively blocking it from fully merging with its smaller rival for at least three years.
In a further twist to a deal's process that began in April 2024, BBVA's arch-rival Santander has put in a binding offer for Sabadell's British unit, TSB, sources told Reuters on Monday.
BBVA gets minimal coverage in US press, despite being listed on the New York Stock Exchange and being the #2 bank in Spain — after its arch rival Santander — and despite having a global presence. In June 2021 it closed its sale announced in November 2020 of its U.S. subsidiary to PNC Financial Services Group, Inc.. BBVA continues to operate in the U.S. through its broker-dealer BBVA Securities and a New York branch where it provides wholesale banking services as well as the fintech investment fund Propel Venture Partners.
As a Spanish bank, BBVA is subject to EU audit firm rotation rules.
We talked a bit about audit partner rotation in my last newsletter. We do not have mandatory audit firm rotation in the U.S., but they have strict rules throughout the EU and in the UK.
The 2014 EU Audit Regulation, which applies to statutory audits (hereafter ‘audits’) of Public Interest Entities (PIEs), introduced measures limiting the statutory auditor’s (hereafter ‘auditor’) tenure. Their aim is to address the familiarity threat and reinforce auditors and audit firms’ independence.
The Regulation established a maximum duration of the audit engagement of an auditor or an audit firm in a particular audited company at 10 years. The minimum duration is 1 year.
BBVA is on its third auditor since I last wrote about it.
When the new EU rules came into play BBVA had been audited by Deloitte since 1990. The Accountancy Europe publication linked to above explains it took a while for countries to implement the new EU rules:
This publication presents our latest update (November 2021) on how countries have decided to deal with the options on implementing the mandatory auditor rotation rules, almost 6 years after the transposition deadline of the 2014 EU audit legislation.
BBVA went out for tender to replace Deloitte and it was a very competitive situation since all of the Spanish banks were now also choosing new firms. So they played musical chairs.
All of the remaining Big 4 — EY, PwC, and KPMG — were in the running to replace Deloitte at BBVA.
But one of them had an edge.
KPMG won BBVA audit with stolen data about rival’s inspections
Francine Mckenna, MarketWatch, June 21, 2018 at 3:40 p.m. ET
Former regulatory executive used access to Deloitte inspection information to successfully pitch BBVA
An auditor was able to use access to confidential regulatory inspection data to get advance knowledge of its own inspections and also poach a client.
The revelation, coming in court documents supporting the government’s case against former KPMG partners, shows the confidential information was also used against the auditor’s rivals.
The story dates back to 2016, when a Spanish bank, BBVA, was forced to solicit bids from other audit firms and switch from an audit relationship with Deloitte’s Spanish firm due to European Union’s mandatory audit rotation rules. Confidential information around those bids gave KPMG a secret advantage over rivals PwC and Ernst & Young, who were also eligible to bid on the BBVA audit.
The episode was described in the Securities and Exchange Commission’s complaints against four former KPMG partners, a KPMG employee and a former Public Accounting Oversight Board employee. The KPMG Spain partner involved was not named and the Spanish banks were not named. Use of another audit firm’s confidential inspection data to pursue the BBVA audit was not outlined in the original criminal indictment.
Brian Sweet, a former partner at KPMG, used his contacts at the audit regulator PCAOB, which was his former employer, to obtain highly confidential data about the audits of BBVA and Banco Santander, according to a new document filed in the case.
Sweet and his PCAOB contacts had access to information about all the largest audit firms, not just KPMG. Sweet pleaded guilty on January 5 to conspiracy and wire fraud and is cooperating with the authorities.
Emails obtained during KPMG’s internal investigation of the scandal were turned over to the prosecutors in the case against the former KPMG officials. The correspondence spells out how KPMG gained an advantage over its rivals.
While I was reporting on the KPMG PCAOB data theft scandal at MarketWatch between 2017 and 2019, two attorneys unexpectedly, and undoubtedly mistakenly, filed two un-redacted documents in the criminal case in the Southern District of New York against the KPMG partners and the PCAOB executive. These documents — Exhibit N and Exhibit O — provided significant details about KPMG clients affected by the scandal, the un-indicted partners and KPMG officials who had been involved in these engagements and in KPMG's National Office activities, and about related entities such as Palantir, which was hired to develop a model using the stolen regulatory data that could predict the PCAOB's inspection selections.
For more on the KPMG scandal see these stories and our working paper.
Exhibit N describes what happened between US Assurance Leader Scott Marcello, former PCAOB inspector turned KPMG partner Brian Sweet and KPMG Spain partner Dabie Tsai:
Case 1:18-cr-00036-JPO Document 100-14 Filed 06/08/18 Page 31 of 39
96. On or about November 27, 2015, Dabie Tsai emailed [Scott] Marcello updating him on the status of BBVA's efforts to choose a new auditor. Tsai told Marcello that it appeared BBVA would launch its request for proposal ("RFP") on January 16, 2016 and would name a new auditor on February 16, 2016.
97. On or about April 6, 2016, Dabie Tsai emailed [Brian] Sweet to thank him in advance for his help and to say she would send a meeting invite for them to discuss the "two Spanish banks we discussed just now." Tsai also provided Sweet with her personal email account and fax number "in case you want to use either."
98. On or about April 8, 2016, Sweet emailed Tsai on her KPMG email account providing a publicly available PCAOB report.
99. Shortly thereafter, Sweet used his personal account to email Tsai' s personal account and said, "Dabie, it was great chatting with you today! Attached are some examples of the types of issues that have been raised in the past." Attached to the email was an internal and confidential PCAOB comment form for Banco Santander.
100. That same day, Tsai used her personal email account to respond to Sweet's personal email account saying "Thank YOU so much!!!! I have printed each out so it will only be on the hard copy that I read . . . I promise to take appropriate care of this. Appreciate all of your help - and I am sure you've heard it many times, but I am going to add it to all the other accolades - I am so glad you came to KPMG you've been a huge help to the firm . . . since you joined!. . . I'll be in touch re: our current proposal effort."
101. On or about May 10, 2016, Tsai emailed Sweet asking him if he would be interested/willing in serving in a newly created "quality partner" role if KPMG was successful in winning BBVA's business. In the same email chain, Tsai also asked whether Sweet had "any updates on the BBVA Inspection front per our last conversation? Would really appreciate being able to get some details for consideration into highlighting (what not to dos or what to do to prevent such) as appropriate in our written document if possible? Promise will be very sensitive and only discussing the technicals."
102. On or about May 1 3, 20 1 6, Tsai emailed Sweet re: "Follow up re: Deloitte BBVA audit," and asked Sweet if he had a few minutes to speak later that day. Sweet and Tsai agreed to speak later that day.
More information about the confidential competitive information that Brian Sweet provided to KPMG Spain’s Dabie Tsai was revealed when two of the defendants — David Middendorf and Jeffrey Wada — later went to trial in Spring of 2019.
From the complete trial transcript
Pages 1421-1423/3468
Sweet - Cross
Case 1:18-cr-00036-JPO Document 301 Filed 03/13/19
Daily Transcript Pages 4-6/128
Q. (Amy Lester, Middendorf Attorney) Moving ahead to 2016, could you recall meeting an audit partner named Dabie Tsai?
A. (Brian Sweet) I do.
Q. She was another partner at KPMG who worked on banking clients, right?
A. Yes.
Q. You met her at a conference in New Jersey?
A. Yes.
Q. She mentioned to you that she was pitching a new account for KPMG, right?
A. Yes.
Q. This was for a client that was currently being serviced by Deloitte, I believe?
A. Yes.
Q. It was a Spanish bank known as BBVA?
A. Yes.
Q. You had just met Ms. Tsai, right?
A. I had met her I think back in December of 2015. But yes, it was fairly recent. I didn't know her prior to that.
Q. This was perhaps only the second time you were speaking to
her?
A. We had spoken on the phone a few times. She had originally been signed to one of the monitoring programs I was working on, so we had participated in phone several times as a result of that. But the conference you are referring to I think may have been the first time in person or maybe the second time.
Q. Fair to say you didn't know her well at that time?
A. No, I didn't.
Q. When she told you that she was pitching for this new account, this Spanish bank, you told her that you knew that Deloitte had received 13 comments on its inspection of that bank's audit, right?
A. Yes.
Q. That wasn't public information at the time, was it?
A. No.
Q. You knew that because when you were at the PCAOB you had access to that information, right?
A. No. That was something that Jung Lee had told me.
Q. So you learned it from a former colleague at the PCAOB?
A. Yes.
Q. That was confidential information, right?
A. Yes.
Q. You told that to Ms. Sai because you thought it could be helpful to her in making that pitch, right?
A. Yes.
Q. You thought it could be helpful to you because you wanted her to include you in that pitch, right?
A. Not at that time, but she did include me in the pitch later on.
Q. She created a special role for you as part of her pitch for business to that firm, didn't she?
A. Yes. It was much later than that, that event day when that happened, but yes, ma'am.
Q. You asked for her personal email address so you could share documents relating to Deloitte's audit of a different Spanish bank that you thought would be helpful to her, right?
A. Yes.
Q. You sent her those documents that you had saved to your desktop, right?
A. Yes.
Q. Mr. Middendorf never asked you to do that, right?
A. No.
The two defendants were found guilty at trial. All of the other defendants pled guilty. One of the defendants even served time in jail! But, alas, a Supreme Court decision regarding how wire fraud is typically used in insider trading cases resulted in all of the verdicts and decisions being voided.
KPMG eventually paid a fine for its responsibility as a firm. But, as I told someone on LinkedIn recently, I don’t think they would have been fined if not for the investigation turning up a perhaps worse and longer duration scandal. KPMG was the original exam cheating firm.
So, as I wrote when KPMG was finally fined, the KPMG-PCAOB data theft scandal was not just about cheating on inspections and subverting the PCAOB regulatory mandate. It was also about cheating for competitive purposes, and the other Big 4 firms were cheated out of a fair shot at the BBVA audit.
KPMG also used the data to its competitive advantage to win a new audit of a Spanish bank, the Department of Justice and SEC alleged in their complaints. “KPMG won BBVA audit with stolen data about rival’s inspections,” published June 21, 2018, describes how Brian Sweet, a former PCAOB executive who joined KPMG as a partner, used his contacts at the PCAOB to obtain highly confidential data about the audits of BBVA and Banco Santander, which were audited by rival firms. A local partner in Spain used the information to prepare a successful bid for KPMG Spain to take over the BBVA audit.
BBVA chose KPMG for its audit on March 3, 2017. That was slightly more than a month before KPMG fired six employees over the PCAOB data theft scandal, including Scott Marcello and Brian Sweet. From the New York Times:
The accounting firm KPMG has fired six employees, including the head of its audit practice in the United States, after it learned they were given improper warnings ahead of planned audit inspections by its regulator, the Public Company Accounting Oversight Board.
KPMG said that an individual who had joined the firm from the Public Company Accounting Oversight Board had received confidential information from an employee of the oversight board and shared it with others at KPMG.
“That information potentially undermined the integrity of the regulatory process,” KPMG said in a news release on Tuesday. The accounting firm said it had learned of the matter from a whistle-blower in February.
A year later I was writing about the contents of Exhibit N and Exhibit O as well as the SEC and criminal charges that had been filed against everyone but Scott Marcello.
I was told by a Spanish journalist that my June 2018 story about BBVA — no one else matched or expanded on my reporting of this aspect of the scandal — resulted in Dabie Tsai leaving KPMG Spain in September of 2018. KPMG Spain's Javier Muñoz, who was leading the process to win the BBVA audit, also left his role as lead Audit Partner for financial institutions in July 2018, a month after my story about Tsai came out.
KPMG did not keep BBVA as its audit for ten years, but instead left after five.
It may be that another KPMG partner, in Argentina, drew negative attention from the PCAOB in November 2023 for not following the audit standards regarding communications with BBVA Argentina's Audit Committee. (Issuer names are rarely disclosed in PCAOB enforcement actions against firms and professionals.)
BBVA has used EY Spain since March of 2022.
Maybe BBVA feels so confident in acquiring Banco de Sabadell, despite the competition from Santander — PwC won that audit from Deloitte beginning in 2016 — because Banco de Sabadell's auditor is its old friend KPMG Spain.
© Francine McKenna, The Digging Company LLC, 2025