Coinbase Ireland Fined €3.25 Million Over Customer Fund Safeguarding Failures

Ireland’s Central Bank cited weak safeguarding controls, excessive reliance on its US group, and gaps in local oversight. Coinbase says the issues have been resolved and no customers lost access to funds.

Coinbase Ireland has agreed to a €3.25 million penalty after Ireland’s Central Bank identified failures in how the crypto platform’s Irish e-money business safeguarded customer funds and managed outsourced responsibilities.

The enforcement action, announced on October 22, 2026, concerns breaches of Ireland’s Electronic Money Regulations 2011 between November 2020 and August 2025. It follows a separate €21.5 million penalty imposed in November 2025 on another Coinbase entity for anti-money-laundering and transaction-monitoring failures.

The latest case focuses on a different regulatory obligation: ensuring that customer money is properly protected and that the locally authorized firm retains adequate oversight of critical functions.

According to the Central Bank, Coinbase Ireland relied too heavily on its US-based group for safeguarding processes. It also lacked sufficient local expertise, had weaknesses in internal controls, and allowed its designated safeguarding account to remain underfunded for extended periods.

Coinbase says it has strengthened its controls, redesigned safeguarding calculations, and added dedicated expertise. It also says no customer suffered financial loss or was unable to access funds because of the historical issues.

The case highlights a central question for international financial services firms: when a business operates across borders, how much responsibility can it delegate to a group company without weakening local regulatory accountability?

What the Central Bank Found

The Central Bank’s enforcement action identifies three broad areas of concern.

1. Weak oversight of outsourced functions

The regulator said Coinbase Ireland did not have an adequate outsourcing governance framework. In particular, it placed excessive reliance on the US-based Coinbase Group to implement processes and controls intended to meet Irish and EU safeguarding requirements.

The Irish entity also lacked sufficient local skills and expertise to oversee the management and protection of customer funds at all times.

Outsourcing can help financial firms access technology, specialist staff, and shared infrastructure. However, regulatory responsibility does not disappear when a critical function is performed by another group company.

A locally authorized firm must still understand the service it receives, assess its risks, and maintain effective oversight. The Central Bank said Coinbase Ireland fell short of those expectations.

2. Safeguarding accounts were underfunded.

The regulator also found that weaknesses in system design and control testing meant Coinbase Ireland did not adequately safeguard customer funds.

As a result, its designated safeguarding account was underfunded for lengthy periods.

Safeguarding is a core requirement for e-money institutions. It is intended to protect customer money by ensuring that the required funds are held and managed in accordance with applicable rules.

Coinbase’s own explanation provides further context. The company said technical errors affected its daily safeguarding calculations. It reported that the account was underfunded on average by approximately 0.54% of its total safeguarding obligation during 2023 and the first half of 2024.

That percentage is Coinbase’s disclosure about the historical calculation issue, not a measure of customer losses. The company says it corrected the error and enhanced its technical controls.

3. Internal escalation and regulatory reporting were inadequate.

The Central Bank also identified weaknesses in internal controls, escalation procedures, and governance processes for identifying and reporting material changes to safeguarding arrangements.

This matters because regulators need firms to communicate significant changes that could affect their compliance. It is not enough for a company to have procedures on paper; those procedures must also work when operating models change or unexpected events arise.

The regulator stressed that commitments made during authorization are important to its assessment of whether a firm should be permitted to operate in Ireland and gain access to the wider European market.

Why the Fine Is €3.25 Million

The Central Bank said the sanctions warranted in the settlement comprised a reprimand and a monetary penalty of €4,646,597.

A 30% settlement discount reduced the monetary penalty to €3,252,618, or approximately €3.25 million.

Coinbase Ireland admitted the prescribed contraventions and agreed to the undisputed facts set out in the settlement notice. The sanctions have been accepted by the company.

There is an important legal qualification: the Central Bank said the sanctions are subject to High Court confirmation and will take effect once confirmed. The settlement announcement should therefore not be described as an already finalized court-confirmed penalty.

The regulator’s message was direct. Karen O’Leary, its Director of Enforcement, said firms must maintain the culture, expertise, and controls needed to meet their obligations and protect customers. She also warned that poorly managed outsourcing can threaten operational resilience.

For the Central Bank, the case is not simply about a technical accounting problem. It concerns governance, oversight, and the ability of an authorized institution to demonstrate that customer funds are protected.

Coinbase’s Response: No Customer Losses Reported

Coinbase says the issues arose in the context of operational decisions made during periods of disruption. It argues that the steps were taken to protect customers, although some arrangements did not meet safeguarding requirements.

The company highlighted two examples.

The 2023 US banking crisis

During the banking crisis in 2023, Coinbase said it directed 30 customers to deposit US dollars into an account held by Coinbase Inc. at another US bank. The aim was to protect customers from potential losses arising from a bank failure and maintain access to banking services.

However, the arrangement meant Coinbase Ireland customers’ funds were held alongside funds associated with customers of another Coinbase entity. That was inconsistent with the applicable safeguarding requirements.

Coinbase said its daily treasury rebalancing process moved the funds into a Coinbase Ireland safeguarding account each day. However, the process did not prevent the initial mixing of funds.

Deposits following Brexit

Coinbase also cited the migration of European Economic Area customers from a UK affiliate to the Irish entity following Brexit.

The company said it gave affected customers new Irish bank account details and instructed them to use those details for future deposits. Some customers nevertheless continued sending funds to legacy UK bank accounts.

Coinbase said these deposits did not comply with safeguarding requirements. It later introduced system-level blocks to reject further misdirected deposits.

The company also disclosed other historical issues, including certain withdrawals for customers of other Coinbase entities being paid from Coinbase Ireland’s safeguarding account and technical errors in daily safeguarding calculations.

Coinbase says it self-identified and reported several issues to the Central Bank in January 2024. It says the vast majority of underlying control issues were addressed that year and that all the issues covered by the settlement have since been resolved.

The company also reported additional technical controls, a redesigned safeguarding calculation process, dedicated safeguarding expertise, and third-party validations. These are Coinbase’s statements about remediation; the fine itself reflects the regulator’s findings about the historical breaches.

How This Differs From Coinbase’s 2025 Fine

The latest action is Coinbase’s second major Central Bank penalty involving its Irish operations, but the two cases concern distinct regulatory failures.

In November 2025, the Central Bank fined Coinbase Europe €21.5 million over anti-money-laundering and counter-terrorist financing transaction-monitoring failures. The earlier case concerned coding errors that affected the screening of certain transactions.

The October 2026 case instead concerns Coinbase Ireland’s safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

The distinction is important. Transaction monitoring is designed to identify suspicious activity and support financial crime controls. Safeguarding is concerned with the proper protection and handling of customer funds held by an e-money institution.

Together, the cases underline the range of controls regulators expect from crypto-related financial businesses. Compliance involves more than monitoring transactions or maintaining a license. It also requires robust financial controls, clear accountability, reliable systems, and effective oversight of third parties.

Why Outsourcing Is a Wider Regulatory Issue

Many financial firms rely on group companies or external providers for technology, operations, compliance support, and other critical services. This can improve efficiency and allow businesses to scale across markets.

However, outsourcing also creates risks when responsibility becomes fragmented.

A local entity may depend on a central technology team for calculations, another group company for payment processing, and separate teams for risk management. If responsibilities are unclear, errors can go undetected or material changes may not reach the regulator promptly.

The Central Bank’s findings illustrate why firms need clear ownership of critical functions. They must know who is responsible for safeguarding calculations, who tests the controls, who investigates discrepancies, and who reports significant changes.

For crypto and fintech companies operating across Europe, these issues are particularly relevant. A group-wide operating model must still meet the requirements of each regulated entity and jurisdiction.

The lesson is not that outsourcing is inherently inappropriate. It is that outsourcing requires governance, expertise and monitoring proportionate to the importance of the function.

What the Case Means for Crypto and Fintech Firms

The Coinbase Ireland settlement offers several practical lessons for businesses providing payments, e-money or crypto-related services.

First, safeguarding calculations need reliable technical controls. Firms should test systems, reconcile account balances and investigate discrepancies promptly. Even small calculation errors can become regulatory issues when they affect required safeguarding balances over time.

Second, local accountability must be real. A regulated entity needs sufficient expertise to oversee critical activities, even when group companies provide much of the operational infrastructure.

Third, material changes require clear escalation. New banking arrangements, customer migration, revised payment flows and emergency operational measures should be assessed for regulatory implications before they become established practices.

Fourth, customer protection and regulatory compliance must work together. A decision intended to protect customers during a crisis may still breach safeguarding rules if it mixes funds or changes how they are held. Firms need procedures that address both immediate operational risks and legal obligations.

Finally, remediation should be demonstrable. Updated policies alone may not be enough. Firms need evidence that controls work consistently, calculations are accurate and governance arrangements identify problems before they persist.

The Bigger Picture: Trust Depends on the Controls Behind the Platform

Crypto platforms compete on access, speed and the range of services they offer. Yet customer trust also depends on less visible systems: safeguarding accounts, reconciliation processes, oversight arrangements and regulatory reporting.

The Central Bank’s action against Coinbase Ireland shows that these systems remain a priority for supervisors. The issue was not a reported loss of customer funds. It was the failure to meet safeguarding and outsourcing requirements over an extended period.

Coinbase says it has corrected the historical issues and strengthened its controls. The regulator, meanwhile, has used the settlement to reinforce its expectations for firms operating under Irish authorisation.

For the wider fintech industry, the message is clear: global scale does not remove local accountability. Companies can share technology and outsource operations, but regulated entities must still be able to demonstrate that customer funds are protected and that critical risks are properly managed.

Sources: Central Bank of Ireland enforcement announcement; Coinbase’s statement on the settlement; RTÉ News report; Coinbase’s statement on its 2025 transaction-monitoring settlement.

AML complianceCentral Bank of IrelandCoinbaseCoinbase fineCoinbase Irelandcrypto exchangecrypto regulationcustomer protectiondigital assetselectronic money regulationsfinancial regulationFinTech complianceoperational riskoutsourcing compliancesafeguarding customer fundsTheFinRatetransaction monitoring