Coinbase Ireland fined €3.25M by Central Bank over safeguarding failures

What happened

The Central Bank of Ireland has fined Coinbase Ireland Limited €3,252,618, roughly $3.6 million, and issued a reprimand after the firm admitted breaking rules on protecting customer money and on overseeing work handed to other companies. The regulator announced the outcome on Thursday, a day after reaching a settlement with the Coinbase subsidiary. The sanctions only take effect once Ireland's High Court confirms them.

The contraventions of the Electronic Money Regulations 2011 ran from Nov. 1, 2020 to Aug. 19, 2025. Coinbase Ireland is an e-money institution that issues the euro and dollar balances European customers use to buy crypto on the Coinbase platform. Under Irish rules those balances must sit in dedicated safeguarding accounts, kept apart from the company's own money and from funds belonging to customers of other Coinbase entities.

The Central Bank identified three failures. Coinbase Ireland leaned excessively on its US-based group to design and operate its safeguarding controls and lacked the local expertise to supervise that work. Its safeguarding account was underfunded for lengthy stretches because of weak system design and insufficient control testing. And it had no adequate process for alerting the regulator to material changes in how it safeguarded funds.

Karen O'Leary, the Central Bank's director of enforcement, said payment and e-money firms have a fundamental duty to safeguard customer funds and that the regulator has no tolerance for weaknesses in those arrangements. She said that failing to honour assurances given during authorisation, or to report material changes, was completely unacceptable. Coinbase Ireland admitted the contraventions and agreed to the undisputed facts.

Why it matters

Safeguarding rules exist so that customer money remains available and identifiable if a firm gets into difficulty. The settlement notice noted that had Coinbase Ireland become insolvent while its account was short, users may not have been able to regain their funds promptly and in full. That risk exists independently of whether anyone actually lost money, and Coinbase maintains that no customer did.

The action is the second enforcement outcome against Coinbase's European operations in less than a year and reinforces how closely Irish authorities are scrutinising the group's regional footprint. Ireland was Coinbase's route into the EU after Brexit, and the case turns on commitments the company made to win authorisation in 2019. It also illustrates a distinction regulators stress: safeguarding duties for an e-money business are not the same as the rules covering an exchange, a wallet or a bank deposit, even where one brand sits behind all of them.

What the data shows

The Central Bank set the starting penalty at €4,646,597 and applied the maximum 30% settlement discount, producing the final figure of €3,252,618. The regulator said the outcome is its 164th enforcement action and pushed its lifetime fines past €432 million.

According to the settlement notice as reported by outlets including Unchained and crypto.news, 30 institutional clients were directed during the March 2023 US banking turmoil to send dollars to accounts held by Coinbase, Inc. at other US banks rather than to an account in the Irish unit's name, and their money stayed mixed with that entity's funds for about 19 months. Some customers who moved from Coinbase UK after Brexit kept depositing into old UK accounts for almost five years. Calculation errors left the safeguarding account short every day for at least 18 months, with the gap peaking at €5.2 million in 2024 and €3.4 million in 2023, according to figures cited from the settlement documents. Coinbase has said the shortfall averaged about 0.54% of its total obligation through 2023 and the first half of 2024, and that a daily rebalancing process moved funds back each day.

Background

Coinbase began operating in Ireland in 2018, obtained an e-money licence from the Central Bank in 2019 and registered as a virtual asset service provider in 2022. In a blog post the company said it flagged many of the issues described in the settlement to the regulator in January 2024 and resolved most of the underlying control problems that year. It said it has since redesigned its safeguarding calculation, completed two third-party validations without open findings, posted a €25 million guaranty bond and appointed a dedicated head of safeguarding. A spokesperson told Reuters the problems largely arose while the company was trying to protect customers during periods of significant disruption.

The penalty follows a separate €21.5 million settlement with Coinbase Europe over anti-money-laundering and terrorist-financing monitoring failures covering more than 30 million transactions. Coinbase has since shifted its European headquarters to Luxembourg, where it holds a MiCA licence granted in June 2025; crypto services are provided by Coinbase Luxembourg, while e-money services remain with the Irish entity. The company's migration guidance set staged effective dates for updated terms across EU markets through late 2025.

What is still unclear

Reports differ on when the earlier Coinbase Europe penalty was imposed, with several outlets placing it in November 2025 and one describing it as May. The detailed shortfall and obligation figures, including average safeguarding obligations of €323 million in 2023 and €470 million in 2024, come from settlement documents as summarised by other publications rather than from the regulator's public statement. The timing of High Court confirmation has not been disclosed.

What to watch

The immediate test is High Court confirmation, without which the fine and reprimand do not take effect. Beyond that, the case will be read as a signal of how strictly the Central Bank polices authorisation commitments from payment and e-money firms. Coinbase's split between Irish e-money services and Luxembourg crypto services under MiCA will also be watched, as will whether the regulator pursues further action against other entities in the group.

Questions readers ask