The Central Bank of Ireland announced a fine against Coinbase’s Irish unit for failing to meet customer fund safeguarding obligations. The approximately €3.25 million penalty also covers shortcomings in its oversight of outsourced services. Coinbase said customers suffered no financial losses or problems accessing their funds.
In its announcement on Thursday, October 22, the regulator said it reached a settlement a day earlier. The investigation covers breaches between November 1, 2020, and August 19, 2025. Coinbase Ireland admitted violating its obligations under electronic money regulations.
Under the settlement, the company accepted a reprimand alongside the financial penalty. However, the sanctions require confirmation from Ireland’s High Court before taking effect. The announcement therefore outlines the settlement, while court confirmation remains pending.
Customer fund safeguarding accounts faced shortfalls
Coinbase Ireland operates as one of the group’s electronic money service providers. The company issues electronic money in exchange for customers’ fiat currency. Customers can then use those balances to purchase crypto assets on Coinbase’s platform.
This activity carries specific obligations to protect customer funds. Outsourcing services does not remove the company’s responsibility for those processes. The Central Bank’s investigation examined both safeguarding arrangements and oversight of outsourced services.
According to the regulator’s findings, Coinbase Ireland relied excessively on US-based group companies for safeguarding processes. The local entity also lacked sufficient expertise to oversee the management of customer funds. Weak system design and insufficient control testing allowed prolonged shortfalls in the safeguarding account.
According to the settlement notice, daily safeguarding shortfalls reached €5.2 million in 2024. The investigation also found that some customer funds entered accounts belonging to other Coinbase entities. Those funds therefore went into accounts other than those held in Coinbase Ireland’s name.
The issue affected approximately 30 institutional customers between March 2023 and October 2024. These customers deposited dollars into accounts held by Coinbase Inc., rather than Coinbase Ireland. Some customers transferring from the UK entity also had funds entering its UK safeguarding account until August 2025.
Coinbase says customers suffered no losses
Coinbase said it resolved the issues under investigation and strengthened its customer fund safeguarding controls. The company also said it voluntarily reported some problems to the Central Bank in January 2024.
According to Coinbase, no customer suffered financial losses because of these issues. Customers also retained access to their funds. The company stressed that the shortcomings related to past operations.
A company spokesperson also addressed the circumstances behind the problems in comments to Reuters. The spokesperson said they largely arose while Coinbase took steps to protect customers during significant disruptions.
The Central Bank emphasized payment and electronic money firms’ responsibility to safeguard customer funds. Karen O’Leary, the regulator’s director of enforcement, said it had no tolerance for weaknesses in these arrangements.
Settlement reduced the penalty by 30%
The Central Bank initially determined a financial penalty of €4,646,597 for the breaches. It then applied a 30% reduction under its settlement framework. This brought the amount accepted by the company to €3,252,618.
Another Irish company within the Coinbase group faced a financial penalty last year. In November 2025, the Central Bank announced an approximately €21.46 million fine against Coinbase Europe. That case concerned transaction monitoring failures under anti-money laundering and counter-terrorist financing requirements.
In the earlier investigation, the regulator found that the company failed to properly monitor over 30 million transactions. The latest case focuses on Coinbase Ireland’s customer fund safeguarding and oversight of outsourced services. The two enforcement actions concern different companies within the same group and separate regulatory obligations.
