Coinbase Ireland admitted breaches involving customer fund protection and oversight of services outsourced to its US group. The sanctions it accepted will be submitted to Ireland’s High Court for confirmation.
The Central Bank of Ireland has reached a settlement with Coinbase Ireland Limited over failures to safeguard customer money and oversee outsourced services. In its 22 October announcement, the regulator said the firm accepted a reprimand and a discounted monetary penalty of €3,252,618. The sanctions will take effect once Ireland’s High Court confirms them.
The penalty concerns Coinbase Ireland, an electronic money institution within the Coinbase crypto exchange group. It issues e-money in exchange for customers’ fiat currency and redeems e-money back into fiat. Customers can use their e-money to buy crypto assets on the group’s trading platform. The regulator’s findings concern safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.
Reliance on the US group outpaced local oversight
The bank found that Coinbase Ireland relied excessively on the US-based Coinbase group to put safeguarding processes and controls in place. The Irish entity lacked the local expertise needed to keep overseeing how customer money was managed and protected. Its rules for governing and overseeing outsourced services were also inadequate, according to the regulator.
Poor system design and insufficient testing of controls left the designated safeguarding account underfunded for lengthy periods. The bank identified breaches between 1 November 2020 and 19 August 2025. The size of the account shortfall and the start and end dates of each underfunding episode were not disclosed.
Coinbase Ireland’s managers had not put adequate controls in place to spot material changes in how customer funds were protected and report them to the Central Bank. Procedures for raising problems with the people responsible were also inadequate. Coinbase Ireland admitted the breaches and agreed to the facts underlying the settlement.
“we have no tolerance for weaknesses in safeguarding arrangements.”
O’Leary stressed that firms must honour the assurances they give when applying for authorisation in Ireland. The bank relies on those details and commitments when assessing whether to permit a firm to operate. She described failures to keep such assurances, or to notify the regulator of material changes, as unacceptable.
Coinbase says customers suffered no financial loss
A Coinbase spokesperson told Reuters that the company had reported the problems to the bank itself. According to the spokesperson, no customers suffered financial loss or were unable to access their funds. The company said the issues largely arose while it was taking steps to protect customers during periods of significant disruption.
Sanctions will take effect after High Court confirmation
The parties settled on 21 October, and the bank announced the outcome the following day. It determined that a reprimand and a €4,646,597 monetary penalty were warranted. A 30% settlement discount reduced the penalty to €3,252,618. Court confirmation remains pending, and no payment date was announced.
| Item | Details in the official announcement |
|---|---|
| Period covered by the breaches | 1 November 2020–19 August 2025 |
| Settlement / public announcement | 21 October / 22 October 2026 |
| Monetary penalty before discount | €4,646,597 |
| Settlement discount / final amount | 30% / €3,252,618 |
| Condition for taking effect | Confirmation by Ireland’s High Court |
The bank will apply to the court as soon as practicable after settlement. The court will confirm the decision unless it considers a sanction manifestly disproportionate. If it declines confirmation, it will send the matter back to the bank and the firm for reconsideration, together with any recommendations.
Under its Administrative Sanctions Procedure, the bank can settle when agreed facts remove the need to begin or continue an investigation. A discount of up to 30% is not automatic: the bank decides whether to offer one, taking the timing of settlement into account. Coinbase Ireland’s case is the fifth settlement under the procedure revised in 2023 and the bank’s 164th enforcement outcome overall.
A separate case from the 2025 transaction-monitoring fine
On 6 November 2025, the bank announced a €21,464,734 fine against Coinbase Europe Limited. That case concerned anti-money laundering and counter-terrorist financing transaction monitoring obligations between 23 April 2021 and 19 March 2025. The High Court confirmed those sanctions on 12 January 2026. The new case concerns how a different legal entity, Coinbase Ireland, protected customer funds in its e-money business.
In a 14 October industry speech, Deputy Governor Mary-Elizabeth McMunn said firms needed to be able to return customer money in full and without delay, even during disruption or firm failure. She said control failures in outsourced work had featured in recent safeguarding incidents. The bank’s 14 October post below links to that speech; it predates the 22 October Coinbase announcement.
The Central Bank of Ireland’s 14 October statement on payment security
The post loads from X when you open it.
The safeguarding account belongs to the e-money business. The bank identified underfunding of the account set aside to protect customer money. It did not report a crypto wallet theft or a Bitcoin reserve shortfall.
