Coinbase Ireland fined €3.25m by CBI
Coinbase Ireland Limited will pay €3,252,618 after the Central Bank of Ireland (CBI) found it left customer money underfunded and did not properly oversee the safeguarding work it handed to its US-based group. The CBI announced the reprimand and monetary penalty on 22 October 2026, after settling with the firm on 21 October 2026. The breaches ran from 1 November 2020 to 19 August 2025. The sanctions are subject to High Court confirmation and take effect only once confirmed.
Coinbase Ireland is an e-money institution, a firm licensed to issue electronic money, and part of the Coinbase Group. The CBI found breaches of the safeguarding and outsourcing obligations in the Electronic Money Regulations 2011, as amended. Safeguarding means keeping customer money ring-fenced and fully funded. The CBI found that weak system design and insufficient control testing allowed the designated safeguarding account to be underfunded for lengthy periods. The CBI also found an inadequate outsourcing governance framework, meaning the arrangement under which another party performs a function for the firm. Coinbase Ireland relied excessively on the US-based Coinbase Group as its outsourced service provider and lacked the local skill and expertise to oversee the safeguarding of customer funds. Its internal controls, escalation procedures and governance processes were also inadequate to identify and report material changes concerning safeguarding to the CBI.
The CBI set the sanction at €4,646,597 and applied a 30% settlement discount, bringing the penalty to €3,252,618. Coinbase Ireland admitted the contraventions and agreed the facts under an undisputed facts settlement, in which a firm accepts the facts in return for a discount. The CBI said it was the fifth such settlement since changes made by the Central Bank (Individual Accountability Framework) Act 2023. The High Court confirms a sanction unless it is satisfied the sanction is manifestly disproportionate, in which case it remits the matter to the CBI. Confirmation was pending on 22 October 2026. The outcome is the CBI’s 164th enforcement action, taking its total fines above €432 million. It follows the CBI’s fine of Coinbase Europe Limited, a different group entity, of €21,464,734 on 6 November 2025 for anti-money laundering failures.
Karen O’Leary, the CBI’s Director of Enforcement, said: “Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds. The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements.” She added: “Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable.” On outsourcing, she said: “While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms.”
The CBI penalised three separate gaps, so e-money and payments firms that run safeguarding through a group entity or outsourced provider can test each. Does the local entity have the expertise to oversee the function itself? Is the designated safeguarding account tested and reconciled so it cannot sit underfunded? Is any change in safeguarding arrangements escalated to the regulator?
