Coinbase Ireland Fined €3.25M as Safeguarding Failures Draw Second Irish Penalty

The Central Bank of Ireland has fined Coinbase Ireland €3.25 million for failures in safeguarding customer funds, outsourcing oversight and internal controls, marking a second major enforcement action against a Coinbase entity in Ireland within a year.

Announced on October 22, the penalty relates to breaches of Ireland’s Electronic Money Regulations between November 2020 and August 2025. Coinbase Ireland admitted the violations and agreed to a reprimand and monetary penalty. The sanction remains subject to confirmation by Ireland’s High Court.

The fine was reduced from €4.65 million under the Central Bank’s 30% settlement discount. The regulator said the failures could have delayed or prevented customers from recovering their funds if the Irish entity had become insolvent.

Customer Funds Were Not Properly Segregated

The Central Bank identified weaknesses in how Coinbase Ireland calculated and safeguarded funds owed to customers. These included instances in which customer deposits were received into bank accounts belonging to other Coinbase entities rather than accounts held in the Irish entity’s name.

For approximately 19 months between March 2023 and October 2024, around 30 institutional clients deposited US dollars into accounts held by Coinbase Inc., Coinbase’s US entity. Some customers who had migrated from Coinbase UK also continued depositing funds into the UK entity’s safeguarding account until August 2025.

The regulator also identified technical errors in the daily calculations used to determine how much customer money Coinbase Ireland was required to safeguard. These shortcomings weakened the company’s ability to demonstrate that customer funds were adequately protected at all times.

Coinbase Ireland also relied heavily on its US parent group for safeguarding operations without sufficient local expertise and oversight. The Central Bank said earlier governance concerns had not been adequately addressed.

Coinbase said it had resolved the identified issues and strengthened its safeguarding processes. The company said no customer suffered financial loss or was unable to access funds as a result of the historical practices.

Second Irish Penalty Targets a Different Control Failure

The latest penalty follows a separate €21.46 million fine against Coinbase Europe, another entity within the Coinbase Group, over anti-money laundering and counter-terrorist financing transaction-monitoring failures.

In November 2025, the Central Bank said configuration errors had left more than 30 million transactions, worth over €176 billion, improperly monitored during a 12-month period. The subsequent review resulted in 2,708 late suspicious transaction reports. The High Court confirmed that sanction in January 2026.

The two cases concern different regulatory obligations and separate Coinbase entities. The earlier case involved transaction monitoring and the reporting of suspicious activity; the latest concerns the safeguarding of customer money and the governance of outsourced functions.

Taken together, however, the enforcement actions highlight the breadth of controls regulators expect from financial firms serving crypto customers, from monitoring transactions for financial crime to maintaining accurate records and keeping customer funds appropriately segregated.

Coinbase’s European Structure Has Also Changed

Coinbase has shifted its European crypto-asset services to Luxembourg under the EU’s Markets in Crypto-Assets Regulation (MiCA), while Coinbase Ireland continues to provide e-money services. The distinction means the latest Irish penalty concerns the Irish entity’s fiat-related services and safeguarding obligations, rather than the crypto-asset services transferred to Luxembourg.

Coinbase obtained its MiCA authorization through Luxembourg in June 2025, allowing its authorized Luxembourg entity to provide covered crypto-asset services across the European Union. The change in its European structure does not remove the Irish entity’s responsibility for its own regulated activities.

The latest case also underscores a central challenge for international financial groups: outsourcing core operations to a parent company does not eliminate the locally regulated entity’s responsibility for effective oversight, controls and compliance.

For Coinbase, the immediate issue is the latest Irish sanction and the need to demonstrate that the shortcomings have been fully addressed. For regulators, the case reinforces the importance of ensuring that customer-fund protections operate effectively in practice, rather than existing only as formal policies.