Coinbase Ireland Fined €3.25 Million After Years of Failures to Safeguard Customer Funds

Key Takeaways

• €3.25 Million Penalty: The Central Bank of Ireland imposed a €3,252,618 settlement penalty on Coinbase Ireland Limited for breaches of electronic money regulations between November 2020 and August 2025, subject to High Court confirmation.
• Customer Fund Shortfalls: Errors in safeguarding calculations left CBIE's designated safeguarding account underfunded daily for at least 18 months, with maximum daily shortfalls of €3.4 million in 2023 and €5.2 million in 2024.
• Inadequate Outsourcing Oversight: CBIE outsourced its critical safeguarding function to a US Coinbase Group company for more than four years without sufficient local expertise, governance, or oversight.
• Undisclosed Operational Changes: The company failed to adequately notify the regulator of material changes to its safeguarding arrangements, including routing customer funds through US accounts and relying on manual processes.

Deep Dive

At its worst in 2024, the shortfall in Coinbase Ireland's customer safeguarding account reached €5.2 million. The company was required to keep enough money in the account to cover its obligations to customers. For at least 18 months, it fell short every day.

The errors behind those failings had been present since July 2022, according to the Central Bank of Ireland. They affected the calculations Coinbase Ireland Limited (CBIE) used to determine how much customer money it needed to protect, and the procedures used to move funds into and out of its designated safeguarding account. In 2023, the maximum daily shortfall had reached €3.4 million.

The problems persisted while the regulator was pressing the company to strengthen its governance. Coinbase Ireland had placed responsibility for safeguarding customer funds with another company in its US-based corporate group, but lacked the local expertise and oversight needed to supervise the arrangement properly.

The Central Bank announced a €3.25 million settlement penalty against CBIE, the Irish electronic money subsidiary of Coinbase, for regulatory breaches spanning November 2020 to August 2025. The company admitted the contraventions and agreed to a reprimand and a financial penalty of €3,252,618, reduced from €4,646,597 under the regulator's settlement scheme. Both sanctions require confirmation by Ireland's High Court before taking effect.

Money received from customers in exchange for electronic money must be protected and available for redemption, including if the institution becomes insolvent. The Central Bank found that Coinbase Ireland's failures could have prevented customers from recovering their funds promptly or in full in such circumstances. Its settlement notice does not establish that customers actually suffered losses.

What the regulator documented was a company unable to demonstrate reliably that it was protecting the money entrusted to it, even after years of supervisory intervention. The failures began with the records on which that protection depended.

Under Ireland's electronic money regulations, institutions using the bank-account segregation method must keep customer funds separate from other money and maintain accurate records of their safeguarding obligations. Daily reconciliations are intended to establish whether the amount held in designated accounts is sufficient to meet what the institution owes its customers.

Coinbase Ireland's systems did not produce accurate calculations. Material errors affected both its determination of daily safeguarding obligations and the treasury rebalancing process used to adjust the balance of its designated account.

The failures were persistent rather than isolated. The Central Bank found that the account was underfunded daily for at least 18 months. Across the period examined, the average daily shortfall represented 0.54% of CBIE's safeguarding obligations, which averaged €323 million in 2023 and €470 million in 2024. The regulator also found that CBIE had failed to maintain proper segregation of customer money for more than four years, allowing funds belonging to its customers to be mixed with funds belonging to customers of other Coinbase entities.

Segregation is especially important when a financial institution fails. It is intended to keep customer money identifiable and separate from assets that could otherwise become entangled in insolvency proceedings. In Coinbase Ireland's case, inaccurate records and inadequate segregation created uncertainty over whether the company could return the money it owed.

The Central Bank concluded that CBIE could not demonstrate adequate internal controls to verify that customer funds were properly protected because it could not accurately calculate its safeguarding obligations.

There was another problem. Much of the responsibility for protecting those funds rested outside Ireland.

The Limits of Group Oversight

Coinbase Ireland had outsourced its critical safeguarding function to a US company within the Coinbase Group. Such arrangements are permitted, but they do not transfer regulatory responsibility away from the licensed institution.

The Central Bank found that CBIE had failed to maintain the local capabilities necessary to supervise the outsourced function effectively. It lacked sufficient expertise to understand the risks within its regulated business, identify and correct safeguarding failures, and exercise meaningful oversight of the company performing the work. These deficiencies persisted for more than four years.

The regulator had been explicit about its expectations. In December 2021 and January 2023, it issued industry-wide letters addressing governance and safeguarding requirements for electronic money institutions. It wrote directly to CBIE in July 2022 and March 2023, identifying weaknesses in the company's arrangements and imposing risk mitigation programs intended to bring them into line with supervisory expectations.

The Central Bank considered CBIE's governance inadequate for the nature, scale and complexity of its business. Its reliance on the Coinbase Group required stronger oversight of the policies, procedures and internal controls governing the Irish operation. Yet the company did not adequately resolve those concerns.

According to the settlement notice, oversight of the outsourced safeguarding arrangements remained substantially unchanged until December 2024, when CBIE appointed an individual directly responsible for safeguarding. That appointment followed an on-site inspection beginning in May 2024, during which the Central Bank identified continuing weaknesses in the company's outsourcing arrangements.

By then, the regulator had been raising concerns directly with Coinbase Ireland for more than two years. The errors in its safeguarding calculations had also been present since July 2022.

The Central Bank's findings describe a prolonged failure of supervision within the company. Responsibility for a critical function had been assigned to another group entity, while the Irish subsidiary lacked the means to establish whether that function was being performed correctly. The regulator concluded that the shortcomings materially affected CBIE's ability to meet its safeguarding obligations.

The settlement also exposed discrepancies between the safeguarding arrangements Coinbase Ireland had described when seeking authorization and those it subsequently operated.

What the Regulator Had Been Told

When Coinbase Ireland applied for authorization as an electronic money institution, it assured the Central Bank that customer funds would be deposited directly into segregated accounts at credit institutions. It also described robust, automated safeguarding arrangements. The actual movement of customer money proved more complicated.

CBIE's safeguarding banking partner would not accept US dollar deposits directly into the company's designated safeguarding account in the European Economic Area. Dollar-denominated funds were therefore deposited into CBIE bank accounts in the United States and subsequently transferred to the designated safeguarding account through its treasury rebalancing process. The Central Bank found that this arrangement differed from the direct-deposit safeguarding structure presented during authorization.

A separate change affected approximately 30 institutional customers. They were instructed to stop depositing funds into accounts at Silvergate Bank, Signature Bank and Cross River Bank and instead send money to a US bank account belonging to Coinbase Inc., another group company. Those funds were then transferred to CBIE's designated safeguarding account.

Customer money was passing through accounts owned and controlled by another Coinbase entity rather than being deposited directly into the safeguarding arrangements the Central Bank had assessed. The regulator also established that some safeguarding processes required significant manual intervention, despite CBIE having described automated systems in its authorization application. These changes were not disclosed to the Central Bank at the earliest opportunity, or in some cases at all.

The omissions meant the regulator was not given timely notice that arrangements central to its original authorization decision had changed. The Central Bank said the changes left CBIE's safeguarding arrangements inconsistent with those it had assessed when granting authorization.

That assessment forms part of the regulator's responsibility to determine whether an institution seeking access to the wider European market has adequate governance, financial resources and systems to protect its customers.

Coinbase Ireland's failure to communicate material changes therefore extended beyond shortcomings in regulatory correspondence. The Central Bank had authorized one set of safeguarding arrangements, while the company subsequently operated arrangements that differed in important respects.

The failures were connected. Customer funds moved through a structure involving multiple group entities and, in some cases, manual processes. The Irish subsidiary lacked sufficient oversight of its outsourced safeguarding function. Its records could not reliably establish how much money needed to be protected each day. The resulting shortfalls continued despite the regulator's repeated efforts to secure improvements.

For an international financial group, centralized operations can provide access to expertise and infrastructure that individual subsidiaries would struggle to maintain independently. The Central Bank did not dispute those benefits. Its finding was that Coinbase Ireland had relied on the wider group without retaining the local control required of an Irish-regulated institution.

The settlement establishes failures in governance, outsourcing, recordkeeping, safeguarding and regulatory communication. CBIE has accepted the facts and admitted the contraventions, allowing the Central Bank to conclude the matter without a further investigation or inquiry.

The Central Bank's findings also carry a consequence beyond the penalty. Coinbase Ireland's safeguarding failures, the regulator concluded, could have created significant difficulties if the company had needed to wind down its operations. The funds at issue were customer money that should have remained protected and readily available for redemption.

The company's obligations did not end with maintaining an account balance. It needed records accurate enough to establish what belonged in that account, controls capable of detecting errors, and management able to intervene when those controls failed.

For years, those safeguards did not operate as required. The Central Bank's account of the case leaves a further measure of the delay. Although the errors in CBIE's safeguarding calculations dated to July 2022, and the regulator had directly challenged its governance that same month, the company did not appoint its safeguarding lead until December 2024, after inspectors had examined the operation. By that point, the maximum daily shortfall had already reached €5.2 million.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey