Coinbase Ireland Fined €3.25 Million Over E-Money Safeguarding Failures

Eleven months after Dublin’s regulator first reached into the Coinbase group, it reached in again. On 22 October the Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 — roughly €3.25 million — for letting its customer-fund safeguarding account run underfunded day after day while the job of watching that money sat with a US parent thousands of miles away, per the Central Bank’s settlement notice .

The fine is the second Irish penalty on the Coinbase group in under a year, and it lands on a different part of the business. The first, in November 2025, hit Coinbase Europe for anti-money-laundering failures. This one targets the e-money arm — the entity that holds euro balances while customers move in and out of crypto — and the charge is simpler and more unsettling: customer money was not kept as safely apart as Coinbase had promised it would be.

A Second Irish Penalty in Eleven Months

Coinbase Ireland, an electronic money institution authorised in October 2019 and operating since November 2020, is the piece of Coinbase that issues and redeems e-money. Customers convert fiat into e-money, buy crypto on the group’s trading platform, then convert back and store the balance with Coinbase Ireland. That makes it the custodian of the everyday cash layer for Coinbase’s European users.

In November 2025 the Central Bank fined Coinbase Europe €21,464,734 after more than 30 million transactions went improperly monitored over twelve months. That case was about watching for money laundering. This case is about the money itself — whether customer funds were ring-fenced the way European rules demand. Combined, the two penalties come to €24,717,352 across roughly eleven months.

The older fine still dwarfs the new one: at €21.46 million versus €3.25 million, the anti-money-laundering penalty was about 6.6 times larger. But size is the wrong way to read this. The safeguarding case cuts closer to the customer relationship, because it concerns the funds a user expects to get back the moment they ask.

The Fine, Broken Down

The Central Bank set the monetary penalty at €4,646,597 and then reduced it by the maximum 30% settlement discount, producing the €3,252,618 figure. The arithmetic is straightforward: €4,646,597 multiplied by 0.70 equals €3,252,618, a discount worth €1,393,979.

That headline number was itself built from a base penalty of €4,425,330 plus a 5% aggravating factor of €221,267. The aggravator reflects the regulator’s frustration that the problems dragged on: the Central Bank first told Coinbase Ireland about governance deficiencies in a July 2022 letter, reissued its demands in March 2023, and watched the issues persist through a May 2024 on-site inspection before a dedicated safeguarding officer was finally appointed in December 2024.

This is the Central Bank’s 164th enforcement outcome, pushing its total fines past €432 million. The maximum penalty in this case was €10 million, so the €3.25 million fine sits well under the ceiling — a reminder that Irish e-money fines are measured, not confiscatory, and that the regulator’s point here is corrective rather than punitive.

What the Central Bank Found

The settlement notice reads as a catalogue of a subsidiary that leaned too hard on its parent. Coinbase Ireland outsourced the implementation and operation of its safeguarding processes, the daily reconciliation of its safeguarding account, the maintenance of the data systems that track customer funds, the calculation of its safeguarding obligations, and the execution of its daily treasury rebalancing — all of it to Coinbase Inc. in the United States.

The people supervising that outsourced work were employees of other Coinbase group entities, not of Coinbase Ireland, and they sat outside Ireland. The second and third lines of defence that tested the outsourcing controls were themselves outsourced. Karen O’Leary, the Central Bank’s director of enforcement, put the objection plainly: “While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms.”

There was also a transparency failure. After authorisation, Coinbase Ireland made material changes to its safeguarding arrangements without telling the regulator promptly, or at all. Three stand out. First, its US banking partner would not accept dollar deposits directly, so customer dollars were routed through US bank accounts before reaching the safeguarding account — contradicting the automated, segregated flow Coinbase described at authorisation. Second, around 30 institutional customers were moved from Silvergate, Signature and Cross River banks into a Coinbase Inc. account. Third, processes that had been promised as automated were in places run manually.

O’Leary framed the issue as a broken promise: “Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable.”

Eighteen Months of a Short Account

The most concrete failure was an account that did not hold enough money. From July 2022 the systems Coinbase Ireland used to work out its daily safeguarding obligations contained material errors, so the firm could not say how much it was supposed to hold. Its designated safeguarding account was underfunded on a daily basis for at least eighteen months.

The shortfalls were small in percentage terms but real in absolute terms. The maximum daily shortfall was €3.4 million in 2023 and €5.2 million in 2024. The average daily shortfall was 0.54% of obligations that averaged €323 million in 2023 and €470 million in 2024 — meaning the 2024 peak of €5.2 million represented roughly 1.1% of the average balance, against a long-run average gap of about half a percent.

Customer funds were also mixed with other money. After the March 2023 collapse of Silvergate and Signature, some institutional customers deposited into a Coinbase Inc. account for about nineteen months, until Coinbase Ireland opened its own settlement account in October 2024. Separately, after Brexit, more than 6.3 million customers were migrated from Coinbase UK, and some kept depositing into the Coinbase UK account for almost five years — a breach the regulator dates from November 2020 to August 2025, when a final 33 users were found and cut off.

To be fair to Coinbase, none of this is alleged to have lost anyone money. The settlement notice records that the Signature Bank failure “did not result in the loss of CBIE Users’ Funds,” and Coinbase has said no customer was unable to access funds. The failure was structural, not a theft — a failure to keep customer money as isolated as the rules require, in case a wind-down ever had to happen.

Why the Sanction Is Not Yet Final

The €3.25 million fine is not yet in force. Under Ireland’s administrative sanctions regime, a settled penalty must be confirmed by the High Court, which will approve it unless it considers the sanction manifestly disproportionate. That step has not happened.

Coinbase Ireland has also been cleaning up. It self-identified several of the safeguarding weaknesses and reported them to the Central Bank in January 2024, appointed a safeguarding responsible individual in December 2024, completed third-party assurance on its risk-mitigation programme in early 2026, and closed that programme in June 2026. The regulator’s own notice confirms the remedial work was completed before this announcement, which is part of why the firm earned the full settlement discount.

The counter-reading of this story, then, is that it is old news made public — a settlement for conduct that ran from 2020 to 2025 and has largely been remediated. The fine reads as the closing chapter of a supervision that began with a May 2024 inspection, not as evidence that Coinbase’s European safeguarding is broken today.

The Luxembourg Question

The longer-term context is MiCA, the EU’s crypto-assets framework. When MiCAR took effect, Coinbase moved the business of its Irish virtual-asset-service provider to a new Luxembourg entity authorised as a crypto-asset service provider, and the settlement notice confirms the group “does not operate any CASPs from Ireland.” Coinbase Ireland, the e-money institution, remains the cash-and-fiat layer rather than the crypto layer.

That split is the real strategic question this fine raises. If the crypto-facing business now runs from Luxembourg while the payments and e-money function stays in Dublin, the Central Bank of Ireland’s message is that the Dublin entity will be held to the full letter of European safeguarding law no matter how much of its support sits inside a US parent. O’Leary’s closing line makes the expectation explicit: “This action against Coinbase Ireland underlines the Central Bank’s focus on ensuring that customers are at all times protected and that the integrity of the financial system is maintained.”

The next observable step is the High Court confirmation, which will convert the agreed penalty into a binding one. Beyond that, the test is whether Coinbase Ireland’s redesigned reconciliation and its new safeguarding officer keep the account funded every single day — a standard the regulator has now publicly said it will not relax, and one that will matter for the custody of client assets across the EU as the proposed custody rules for investment advisers on the other side of the Atlantic push the same theme, even as Kraken’s parent acquires a European banking licence to deepen its own EU footprint.