Ireland Fines Coinbase €3.25m Over Customer Funds

The Central Bank of Ireland has fined Coinbase Ireland €3,252,618 and reprimanded it for failing to protect customers’ money properly for almost five years. The e-money arm of the crypto exchange breached its safeguarding and outsourcing duties under the Electronic Money Regulations 2011 between 1 November 2020 and 19 August 2025, the regulator said in a press release on 22 October. Coinbase Ireland has admitted the breaches.

The fine is not yet final. The sanctions “are subject to confirmation by the High Court and will take effect once confirmed”, the Central Bank says. Under the settlement process, the court confirms a sanction unless it finds it “manifestly disproportionate”. The penalty started at €4,646,597 before a 30% discount for settling.

Customer money was mixed with other Coinbase funds

Coinbase Ireland issues e-money in exchange for ordinary (fiat) currency, which customers then use to buy crypto on the wider Coinbase platform. Under Irish rules, the money it holds for those customers must be kept apart from everyone else’s. The Settlement Notice, dated 21 October, sets out several ways in which that did not happen.

There is a direct UK link. When more than 6.3 million customers moved from Coinbase UK to Coinbase Ireland after Brexit in 2020, some kept paying into the safeguarding account of the UK business, CB Payments Limited, which is authorised by the Financial Conduct Authority. The notice says Coinbase Ireland started rejecting those deposits in March 2024, but found in August 2025 that 33 users could still make them. Only from 19 August 2025 were all such deposits blocked. The Central Bank counts this as a breach lasting almost five years.

The collapse of US banks in 2023 created a second problem. On 2 March 2023, Coinbase Ireland told 30 institutional customers to send dollar deposits to an account of its US sister company, Coinbase Inc., first at Signature Bank and then at Cross River Bank, rather than to an account in its own name. That lasted until October 2024, about 19 months. Separately, until 19 January 2024, euro withdrawals by customers of Coinbase UK and Coinbase Inc. were paid out of Coinbase Ireland’s safeguarding account.

A data change left the account short every day for 18 months

A change to data tables in July 2022 broke the report Coinbase Ireland used to work out how much it had to safeguard each day, the notice says. As a result, its safeguarding account was underfunded every day from 1 January 2023 to 27 June 2024. The average daily shortfall was 0.54% of its safeguarding obligation, which averaged €323m in 2023 and €470m in 2024. The fault was fixed in October 2024. The Central Bank found “no evidence of actual consumer detriment”, but says customers might not have got all their money back promptly had the firm become insolvent.

The regulator judged the outsourcing breach “reckless” and the other three negligent. Coinbase Ireland relied on Coinbase Inc. in the US to run its safeguarding, and the people overseeing that work were employed by other group companies outside Ireland. It had no dedicated safeguarding lead until 16 December 2024, after an on-site inspection began in May 2024. “Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable,” said Karen O’Leary, the Central Bank’s director of enforcement.

The fine is about passporting as much as safeguarding

For compliance teams, the most pointed part of the notice is not the shortfall but the warnings. The Central Bank wrote to Coinbase Ireland in July 2022 and again in March 2023 about weak governance and outsourcing, and added 5% to the penalty because those risk mitigation programmes were not adequately completed. A firm that had two direct letters and still waited until late 2024 to appoint someone locally responsible for safeguarding gave the regulator little room for leniency.

The notice also shows how the Central Bank sees its role as a gateway. An Irish e-money licence gives access to the wider European market, and O’Leary tied this case directly to “the rigour with which we expect firms to approach authorisation”. Coinbase Ireland’s application promised a single segregated account, automated processes and daily reconciliation. The notice describes US accounts, manual steps and a broken report instead. That makes the case a test of how closely Dublin checks group firms after licensing them.

The Central Bank’s calculation explains the size of the sum. It started from Coinbase Ireland’s own average annual turnover of about €63.2m, applied a severity level of 7 out of 10, and could not have gone above €10m in this case. The reputational cost may matter more as Coinbase pushes deeper into regulated finance, from its conditional US trust charter to opening Deribit to US institutions. Regulators are converging on the same message about controls, whether in FinCEN’s $1.2bn Bank of America penalty, the OCC’s GENIUS Act rule for stablecoin issuers or the FCA’s DeFi consultation in the UK. The next step here is the High Court, which will decide whether the €3,252,618 penalty stands.