Ireland fines Coinbase unit 3.25 million euros over customer fund safeguarding failures

Ireland has for more than a decade served as the European Union base for some of the world's largest technology and financial firms, and the Central Bank of Ireland has correspondingly become one of the bloc's busiest supervisors of electronic money and crypto asset businesses. E-money institutions authorised in Dublin can issue stored value across the EU single market, which means the Irish regulator's rulebook on safeguarding customer funds carries consequences well beyond the state's borders.

Coinbase Ireland Limited (CBIE) is one such firm. It is a licensed electronic money institution inside the global Coinbase Group, and it issues and redeems e-money in exchange for fiat currency that customers then use to buy crypto assets on the group's trading platform. It is a wholly owned subsidiary of Coinbase Global Inc., the US-listed exchange operator described as the largest crypto exchange in the United States.

On 22 October 2026 the Central Bank of Ireland published the outcome of an enforcement investigation into how that Irish entity handled customer money between November 2020 and August 2025. The regulator fined the company 3,252,618 euros for breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011, and issued a reprimand alongside the monetary penalty.

The case lands at a delicate moment for Coinbase in Europe. The group has been moving its EU activity from national registrations toward harmonised authorisation under MiCA, the markets in cryptoassets regulation, and it has already absorbed a separate eight-figure Irish penalty against a different subsidiary. The Coinbase Ireland decision is therefore being read less as an isolated compliance slip than as a marker of how the Irish supervisor intends to treat outsourcing and customer-fund controls across the sector.

Key Facts

The Central Bank of Ireland announced on 22 October 2026 that it had reached a settlement with Coinbase Ireland on 21 October 2026. The penalty of 3,252,618 euros resolved three findings: an inadequate outsourcing governance framework, a failure to adequately safeguard customers' funds, and inadequate internal controls and escalation procedures for reporting material changes to the regulator. Coinbase Ireland admitted the prescribed contraventions and agreed the undisputed facts.

According to the settlement notice dated 21 October 2026, the breaches ran for 57.5 months. Coinbase Ireland mixed its users' funds with funds belonging to Coinbase UK for the entire period from 1 November 2020 to 19 August 2025, and with funds belonging to Coinbase Inc. for 19 months between March 2023 and October 2024. Outsourcing failures ran 49 months and the failure to notify the Central Bank of material changes ran 38 months.

The safeguarding shortfall was quantified in detail. Systems and controls used to calculate daily safeguarding obligations contained material errors from July 2022 onwards, and the designated safeguarding account was underfunded on a daily basis for at least 18 months, between 1 January 2023 and 27 June 2024. The maximum daily shortfall reached 3.4 million euros in 2023 and 5.2 million euros in 2024, against average safeguarding obligations of 323 million euros in 2023 and 470 million euros in 2024. The average daily shortfall equated to 0.54% of obligations.

The penalty was built from a starting point of 63,219,000 euros, a severity rating of 7 on a scale of 1 to 10, equal to 7% of that figure, giving a base penalty of 4,425,330 euros and a final penalty of 4,646,597 euros before settlement. A 30% settlement scheme discount brought the final figure to 3,252,618 euros, or roughly $3.6 million. The notice states there was no evidence of actual consumer detriment, but that customers could have been exposed had the firm become insolvent. Coinbase Ireland appointed a safeguarding directly responsible individual only on 16 December 2024, after an on-site inspection that began in May 2024.

CoinDesk reported on October 22, 2026, that the fund mixing was triggered in part by the near collapse of crypto-friendly bank Silvergate in 2023, when Coinbase instructed 30 customers to deposit money into an alternative account held by Coinbase at another US bank, so that the money sat alongside funds belonging to customers of a different Coinbase entity. The Irish Times reported on October 22, 2026, that the Central Bank found Coinbase Ireland had let user funds be mixed with funds held elsewhere for four years despite an explicit promise at authorisation in 2019 that it would maintain robust, automated safeguards.

Analysis

The most revealing part of the decision is the regulator's language. Karen O'Leary, the Central Bank's director of enforcement, said payment and e-money firms have a fundamental obligation to fully safeguard customers' funds and that the authority has no tolerance for weaknesses in safeguarding arrangements. She added that failing to adhere to assurances given during authorisation, or to report material changes, is completely unacceptable. The reference to authorisation-stage assurances is pointed, because the settlement notice records that CBIE had promised robust automated safeguards back in 2019.

Irish Legal News reported on October 22, 2026, that Coinbase attributed the problems to steps taken to protect customers during periods of significant disruption. During the 2023 US banking crisis, the company directed customers to deposit funds into alternative bank accounts held by Coinbase Inc. to shield them from potential losses from bank failure, which protected customers but mixed CBIE funds with money held for other Coinbase entities. Coinbase said no customers suffered financial loss or were unable to access funds, that CBIE self-identified and reported several issues in January 2024, and that it has since fully resolved them.

Both accounts can be true at once, and that is the interesting part. The bigger picture here is that crypto firms running global platforms routinely make risk decisions in a crisis faster than their legal entity structure can absorb, and European supervisors are now pricing that gap. Coinbase's protective intent during the Silvergate episode did not change the legal fact that customer money sat in the wrong account. The Central Bank's framing, that outsourcing which is not effectively managed can threaten the operational resilience of firms, applies to the whole fintech sector rather than to crypto alone.

The proportionality signal also deserves attention. Severity of 7 out of 10, no evidence of consumer detriment, a 30% settlement discount, and a firm that admitted the facts: the outcome is a reprimand plus a penalty that is modest against the sums sitting in the underfunded account. The 5.2 million euro maximum daily shortfall in 2024 is small relative to the 470 million euro average daily obligation, yet the 18 month duration of daily underfunding is what drove the severity rating upward.

Why It Matters

The direct financial cost is manageable for Coinbase Global, whose share price stood around $170.15, down 3.91%, when CoinDesk published on October 22, 2026. The supervisory cost is less easily dismissed. This is the second Irish-regulated Coinbase unit to be sanctioned: The Irish Times reported on October 22, 2026, that the sanction follows a 21.5 million euro fine last November against Coinbase Europe, a virtual asset service provider, for failing to properly monitor more than 30 million transactions for money laundering or terrorist financing over the course of a year. Coinbase Europe's Irish VASP registration lapsed at the end of last year as the group moved activities to Luxembourg while the EU shifted to MiCA authorisation.

For the wider e-money sector, the case establishes that safeguarding is treated as an operational discipline rather than a paperwork exercise. The findings attack system design, control testing, local expertise and escalation lines, which are the parts of a safeguarding regime that are hardest to evidence and easiest to under-resource when an institution leans on a parent company abroad. Firms that outsource critical functions to group entities should expect examiners to ask who locally understands, and can challenge, the numbers.

The settlement is the Central Bank's 164th enforcement outcome, bringing total fines imposed to over 432 million euros. That institutional record matters for how the Irish regime is perceived as MiCA supervision beds in: Dublin is signalling that promises made at authorisation will still be enforced years later.

Next Up

The sanctions remain subject to High Court confirmation before taking effect, a procedural step that follows settlements reached under the Central Bank's administrative sanctions procedure. Until that confirmation, neither the reprimand nor the 3,252,618 euro penalty is final.

Beyond the courtroom, attention turns to whether the Central Bank extends its safeguarding scrutiny to other e-money and crypto firms holding customer funds in Ireland, and to how Coinbase structures oversight of its remaining Irish-regulated entities. Coinbase says the underlying control issues were addressed in 2024 and fully resolved, with calculation processes redesigned and dedicated expertise added.