The Securities and Exchange Commission filed a complaint last week against the founder of venture-backed mobile payments startup Jumio, Inc., charging him with causing the company to prepare false and misleading financial statements that inflated the company’s earnings and gross margins and with defrauding secondary market purchasers of his shares. The founder, Daniel Mattes, agreed to pay more than $16 million in disgorgement and prejudgment interest plus a $640,000 penalty and to be barred from being an officer or director of a publicly traded company in the United States.

Jumio, Inc. was founded to make mobile phone purchases easier and more secure through its customer identity and credit card verification technology.  The company had two lines of business: a processing business which connected merchants to payment processors in exchange for a commission paid by the processors equal to 10% of their processing fee, and a product business which licensed its ID and credit card verification technology to merchants.

Mattes appears to have engaged in separate fraudulent schemes for each of the two lines of business. As to the processing business fraud, the complaint alleges that Mattes prepared Jumio’s financials for 2013 and 2014 which overstated revenue and profitability by recording as revenue the entire amount of processing fees collected by payment processors, rather than the 10% actually paid to Jumio.

The product business fraud involved a roundtrip contract with no economic substance and improper recognition of subscription revenue. The roundtrip transaction consisted of an agreement Mattes entered into on Jumio’s behalf with a software developer under which the software developer would ostensibly pay Jumio $710,000 per quarter for credit card verification scans that the developer could resell to third parties, and Jumio would ostensibly pay the developer $800,000 per quarter for software development services. The complaint alleges that Mattes caused Jumio to recognize as revenue the $710,000 from that contract in the first quarter of 2013. Mattes apparently wasn’t careful enough in concealing this deception; the complaint asserts that he wrote to an employee not to get excited over the transaction because “it’s more a deal to get our numbers straight for the upcoming round”, evidently a reference to Jumio’s Series C offering. Although both parties ceased making payments to each other after the first quarter of 2013, Mattes had Jumio continue to record the stated revenue from that contract throughout 2013 and 2014.

The second type of product business related fraud involved recognizing as revenue at the commencement of certain subscription agreements the entire amount of subscription fees due under such agreements before services were performed, and even when it became obvious a subscriber wouldn’t pay, in clear violation of revenue recognition rules. Under Generally Accepted Accounting Principles, Jumio should have only recognized the revenue over the period of the subscription as the revenue was earned, and should not have recognized revenue from deals where collectability was not reasonably assured. Mattes’ accounting also violating SEC staff policy on revenue recognition. SEC Staff Accounting Bulletin No. 101 – Revenue Recognition in Financial Statements provides that revenue generally is realized or realizable and earned only when all of the following criteria are met: (i) persuasive evidence of an arrangement exists, (ii) delivery has occurred or services have been rendered, (iii) the seller’s price to the buyer is fixed or determinable, and (iv) collectability is reasonably assured.

The misstatements Mattes made in Jumio’s financial statements were material. The complaint states that Jumio’s 2013 financials represented that Jumio’s gross revenue was $101 million, when it was actually only $9.5 million; that its gross margin was $23 million, when it was actually only $9.2 million; and that its net profit was $1.3 million, when in fact it had a net loss of $10 million.

Mattes also deceived the board regarding his intentions, according to the complaint. In early 2014, Mattes set up a program to allow employees to sell shares through a broker in the secondary markets. Mattes himself had previously sold large blocks of shares to institutional investors and was under a contractual obligation to provide notice to the board (and presumably receive board consent) before selling any of his own shares. Mattes was evidently informed by a director that the board would not authorize further sales by him, apparently out of concern that he have sufficient skin in the game and be properly incentivized. When the board authorized the employee share selling program, Mattes represented to the board that he would be excluded. Nevertheless, Mattes in fact did sell his own shares through the program without notifying the board. The complaint further asserts that Mattes had been warned by company counsel that he needed board approval for the sales, and that he falsely represented to counsel that he received informal approval with ratification to follow.

Mattes’ profit from the alleged fraud was considerable, securing a profit of over $14 million from the sale of his own shares to secondary market investors through the employee selling program. His involvement in the fraud, according to the complaint, was direct. He prepared the false financials, caused them to be provided to the broker and personally discussed them with investors. He also misrepresented to at least one investor that he was not selling his own shares. When the investor noticed that funds were being wired to Mattes, Mattes falsely claimed that he was only acting as an intermediary for legal reasons on behalf of employee sellers. He was even quoted as saying to the investor that he didn’t want to sell a single share because of “lots of great stuff coming up” and that “[he]’d be stupid to sell at this point.”

In late 2014, Jumio hired a CFO, who quit after just a few days on the job. He told Jumio’s board that revenue numbers were inaccurate, referencing the roundtrip transaction in particular. The board then hired outside accountants to assess Jumio’s books, leading to a restatement of its 2013 and 2014 financial statements. But even after Mattes knew that the financial statements would need to be restated, he continued selling his stock in the secondary market.

Mattes resigned from Jumio in mid-2015 after an internal investigation. Jumio filed for Chapter 11 bankruptcy in 2016 and the shares that Mattes had sold to the secondary market purchasers became worthless. Ironically, Mattes founded Jumio in 2010 to decrease fraud (in mobile purchases). Certainly, primary culpability for the wrongdoing here lies with Mattes. But to minimize the risk of internal management fraud and avoid Jumio’s fate, companies should exercise good corporate governance and sound internal controls which appeared to be somewhat lacking at Jumio before it was too late. Among other safeguards, there should be some independent review of financial statements such as an audit committee composed of non-management directors and/or an independent accounting firm. Counsel also has an important gatekeeper role to play and should exercise diligence in protecting the interests of the company when uncovering evidence of possible fraud.