Central Bank of Ireland Fines Coinbase Ireland €3.25M Over Customer Fund Safeguarding

€3.25M Settlement Pending Court Approval

Coinbase Ireland has agreed to pay a €3.25 million fine (about $3.6 million) after the Central Bank of Ireland found it breached obligations to safeguard customer funds and oversee outsourced controls. The settlement, announced on Thursday, October 22, covers contraventions of the Electronic Money Regulations 2011 between November 1, 2020 and August 19, 2025. The regulator's enforcement announcement states that the exchange's Irish unit accepted a reprimand and admitted the contraventions. Under an agreement reached on October 21, a penalty initially set at €4,646,597 was reduced by 30% to €3,252,618, and the sanctions take effect only once the High Court confirms them.

The findings concern governance, not market conduct. The Central Bank concluded that Coinbase Ireland placed excessive reliance on the US-based Coinbase Group as an outsourced service provider for safeguarding processes and controls, while lacking the local expertise to supervise the function. Weak system design and insufficient control testing left the customer safeguarding account underfunded for long stretches: errors in the systems that calculate daily safeguarding requirements began in July 2022, and the account ran daily funding gaps for at least 18 months, peaking at €3.4 million in 2023 and €5.2 million in 2024 against average obligations of €323 million and €470 million respectively. The regulator also cited failures to report material changes. “Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds,” said Karen O’Leary, the Central Bank's director of enforcement. Coinbase Global, for its part, says no customer lost money or access to funds at any point, and that many of the problems arose while the company was taking steps to protect customers during periods of disruption.

Silvergate, Mixed Deposits and Coding Errors

The exchange's own settlement statement, published on October 22, sets out how Irish customer money crossed between group entities. In 2023, as crypto-friendly bank Silvergate moved toward collapse, Coinbase instructed 30 customers to send deposits to an account held by Coinbase Inc. at another US bank. That mixed Irish customers' funds with money belonging to customers of another Coinbase entity, a direct breach of safeguarding requirements, and daily transfers to the Irish safeguarding account did not undo the initial mixing. After Brexit, some European customers continued paying into old UK accounts despite receiving new Irish deposit details, a flow the company later blocked. Certain euro withdrawals for US and UK customers were also paid from the Irish safeguarding account, an arrangement the company acknowledges fell short of regulatory requirements.

The company's statement confirms coding errors left the account underfunded by an average of 0.54% across 2023 and the first half of 2024. Coinbase reported several of the issues to the regulator in January 2024, remediated most underlying controls that year and says the historical problems are now fully resolved. The company notes no customer was ever unable to access their money, and that the standard process for withdrawing money on Coinbase was unaffected.

Structure matters here too. E-money services remain with Coinbase Ireland under Irish law, while crypto-asset services sit with Coinbase Luxembourg, which received its MiCA license in June 2025 and opened its European hub office in June 2026. Irish customers are assigned an October 23 effective date for updated terms; customers who reject the changes have 30 days to withdraw assets and close accounts, and the new terms require consent to Luxembourg executing trades outside EU venues, including on Coinbase Exchange. The settlement is also the second with the Irish regulator in twelve months: in November 2025, Coinbase Europe accepted a €21.5 million penalty, reduced from roughly €30.6 million under the same 30% discount, over anti-money laundering failures in which more than 30 million transactions worth over €176 billion went unscreened for 12 months. Delayed retrospective checks took nearly three years and produced 2,708 suspicious transaction reports to Ireland's Financial Intelligence Unit, with admissions covering missing additional monitoring on nearly 185,000 transactions, obligations at the core of KYC compliance.

A Second Irish Settlement in Twelve Months

Our reading of the two dockets: the Central Bank is policing Coinbase's European operating architecture rather than its trading business, and it treats group-level control design as the root cause in both cases. The safeguarding findings tie the breaches to excessive reliance on the US parent, the same governance pattern behind the AML settlement. For the Nasdaq-listed parent, COIN, the financial hit is modest and the cooperation discount consistent, but a second admission within a year builds a documented enforcement record if the Luxembourg migration, effective for Irish customers on October 23, opens new supervision gaps.