Coinbase Ireland agreed to a proposed €3, 252, 618 penalty and a reprimand for failing to safeguard customer funds and oversee outsourced controls. Reported daily shortfalls reached €5.2 million in 2024, though Coinbase says customers lost no money. The sanctions still need High Court confirmation.
- The Central Bank said the breaches ran from Nov. 1, 2020, to Aug. 19, 2025.
- Reported shortfalls point to compliance failures, not proof of customer losses.
- A separate penalty against Coinbase Europe concerned transaction monitoring, not safeguarding.
Proposed penalty covers five years of breaches
The Central Bank of Ireland said Coinbase Ireland admitted breaches of the Electronic Money Regulations 2011 and agreed to a reprimand and a €3, 252, 618 penalty. The breaches covered Nov. 1, 2020, to Aug. 19, 2025.
The agreement was reached on Oct. 21, 2026, and announced the next day. The original €4, 646, 597 penalty was reduced by 30% to €3, 252, 618. The sanctions are not yet in force and require High Court confirmation.
The regulator’s reported findings went beyond individual payment errors. They included heavy reliance on the US-based Coinbase Group, insufficient expertise in Ireland to oversee safeguarding, weaknesses in system design and control testing, and failures to report material changes.
Outsourcing does not absolve a regulated firm of responsibility for its controls. Coinbase Ireland remained responsible for ensuring that the group functions it relied on adequately protected customer funds.
Central Bank enforcement director Karen O’Leary said: “Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds, ”
Reported shortfalls reached €5.2 million
FinanceFeeds, citing settlement documents, reported that errors in systems used to calculate daily safeguarding requirements and rebalance funds began in July 2022. The safeguarded amount reportedly fell short of requirements every day for at least 18 months.
FinanceFeeds reported the largest daily shortfalls as €3.4 million in 2023 and €5.2 million in 2024. It also reported average safeguarding obligations of €323 million in 2023 and €470 million in 2024. Those averages show how much should have been safeguarded, not how much was missing on a typical day.
The reported shortfalls were part of a wider set of breaches covering Nov. 1, 2020, to Aug. 19, 2025. The available information does not explain how the period of daily shortfalls relates to that full span or why the regulator’s period ends on Aug. 19, 2025.
A safeguarding shortfall means the required amount was not fully held in the relevant safeguarding arrangement on a given day. That is a serious control failure, but it does not by itself show that customer money disappeared or that customers suffered a loss.
Coinbase told Reuters that no customers lost money or access to their funds. That is the company’s account. The reported shortfalls alone prove neither that customers lost money nor that they did not.
Coinbase describes several fund-flow problems
Coinbase says some issues arose as it tried to protect customers during periods of disruption. The company describes several distinct ways funds moved between accounts or customer groups:
- During the 2023 US banking crisis, Coinbase says it moved funds associated with 30 customers from its Silvergate account to an account held by Coinbase Inc. at another US bank. This mixed Irish customers’ funds with those of other customers. Coinbase says daily transfers to the Irish safeguarding arrangement did not prevent the initial mixing.
- After Brexit, some European customers continued sending deposits to old UK accounts, despite receiving new Irish deposit details. Coinbase says it later blocked those misdirected deposits.
- For some euro withdrawals, Coinbase says it paid US and UK customers from the Irish safeguarding account. The company acknowledged that this arrangement did not meet regulatory requirements.
Coinbase says it reported several issues in January 2024 and fixed most of the underlying controls that year. In an Oct. 22 statement, the company said the historical problems were fully resolved, pointing to changes in technical controls and safeguarding calculations.
The regulator’s reported findings run through Aug. 19, 2025, while Coinbase’s statements describe remediation. The available information does not say which controls changed after 2024 or provide a published audit or regulator confirmation that the fixes worked.
Separate entities handle e-money and crypto services
Coinbase’s customer guidance says Coinbase Ireland handles e-money services and Coinbase Luxembourg handles crypto-asset services. E-money refers to electronic money services. Safeguarding rules require firms to protect the relevant customer funds under the applicable regulations.
Coinbase received a Luxembourg MiCA license in June 2025. MiCA is the EU framework for regulating crypto-asset markets and service providers. Coinbase said the authorization lets it serve customers across all 27 EU member states, with its Luxembourg entity providing crypto-asset services across the European Economic Area through passporting.
This division clarifies which entity handles each service, but it does not remove Coinbase Ireland’s obligations for its e-money business. Nor does it address the regulator’s reported concerns about the Irish entity’s oversight of group-level functions.
A separate penalty concerned transaction monitoring
Coinbase faced a separate Irish enforcement case involving a different entity and different controls. In November 2025, Coinbase Europe accepted a €21.5 million settlement over failures in anti-money laundering and counter-terrorist financing monitoring.
According to reporting on that settlement, more than 30 million transactions worth over €176 billion were not properly screened during a 12-month period. Retrospective checks took nearly three years and led to 2, 708 suspicious transaction reports to Ireland’s Financial Intelligence Unit. The findings also involved failures to apply required additional monitoring to nearly 185, 000 transactions.
The penalty was reduced by 30%, from roughly €30.6 million to €21.5 million. That case concerned transaction monitoring, not the safeguarding failures attributed to Coinbase Ireland.
Key questions and answers
-
Has Coinbase Ireland’s penalty taken effect?
No. Coinbase agreed to a proposed €3, 252, 618 penalty and a reprimand, but the sanctions still need High Court confirmation.
-
How large were the reported safeguarding shortfalls?
FinanceFeeds, citing settlement documents, reported peak daily shortfalls of €3.4 million in 2023 and €5.2 million in 2024.
-
Do the shortfalls prove customers lost money?
No. They indicate that required funds were reportedly not fully safeguarded on certain days. Coinbase says customers did not lose money or access to their funds.
-
Which Coinbase entity was responsible for the safeguarding case?
The case concerned Coinbase Ireland’s e-money services. According to the company’s customer guidance, Coinbase Luxembourg handles crypto-asset services.
-
Was the €21.5 million penalty part of the same case?
No. It was a separate settlement against Coinbase Europe over anti-money laundering and counter-terrorist financing monitoring.
Coinbase says the historical safeguarding issues have been resolved and customers suffered no financial loss. But safeguarding is supposed to protect funds before disruption strikes, not just reassure customers afterward. High Court confirmation is still pending, and the available information does not show how the company’s fixes were independently tested. The Central Bank’s annual report provides further context on the regulator’s work.
