The Coinbase Ireland fine: 3.25 million euros for leaving safeguarding to a US parent

The Coinbase Ireland fine is a 3,252,618 euro penalty and reprimand from the Central Bank of Ireland for four breaches of e-money safeguarding, outsourcing and notification rules, centred on leaving safeguarding to a US group company. Announced on 22 October 2026, it covers November 2020 to August 2025 and still needs High Court confirmation.

• Coinbase Ireland Limited, an e-money institution, admitted four contraventions of the European Communities (Electronic Money) Regulations 2011: outsourcing, mixing of funds, failure to safeguard and failure to notify.
• Its safeguarding account was underfunded every day from 1 January 2023 to 27 June 2024, with a maximum daily shortfall of 5.2 million euros in 2024.
• The Central Bank rated the outsourcing breach reckless because its position was public and it had told the firm on 14 July 2022 to follow the EBA outsourcing guidelines.
• Two unfinished risk mitigation programmes, from July 2022 and March 2023, added 5% to the penalty before the discount.
• The penalty fell from 4,646,597 euros to 3,252,618 euros after the maximum 30% settlement discount.

What did the Central Bank of Ireland find at Coinbase Ireland?

The Coinbase Ireland fine rests on a finding that the firm let a US group company run its safeguarding of customer funds without the local skill and expertise in Ireland to oversee it. The result, set out in a 30-page settlement notice, was mixed funds, an underfunded safeguarding account and changes the regulator was never told about.

The press release was published on 22 October 2026, the day after the settlement was agreed. Coinbase Ireland Limited (CBIE) was authorised as an e-money institution in October 2019 and began operating on 1 November 2020. It issues and redeems e-money in exchange for fiat currency, which customers then use to buy crypto assets on the group's trading platform through other Coinbase companies. It does not handle crypto transactions itself.

The settlement notice, dated 21 October 2026, lists four admitted contraventions. CBIE outsourced its safeguarding calculations, daily reconciliation, reporting data and treasury rebalancing to Coinbase Inc. in the United States. The people overseeing that work were employees of other group entities based outside Ireland, and the second and third line testing of the arrangement was itself outsourced to Coinbase Inc.

The rule text behind each row is in S.I. No. 183 of 2011. The Central Bank found no evidence of actual consumer detriment, but said users might not have been repaid promptly and in full had the firm become insolvent. Karen O'Leary, its Director of Enforcement, said: "Payment and e-money firms have a fundamental obligation to fully safeguard customers' funds."

How did the safeguarding failures happen?

The failures behind the settlement came from data and account plumbing, not from a single bad decision. Deposits landed in accounts owned by other group entities, the safeguarding account paid out for other group companies' customers, a reporting change understated what had to be safeguarded, and some deposits never entered the calculation.

Five mechanisms stand out in the notice. First, after Brexit, more than 6.3 million customers migrated from Coinbase UK to CBIE in 2020, but some kept paying into the Coinbase UK safeguarding account. Deposits there were rejected from 15 March 2024. In August 2025, internal audit found that 33 customers could still use the UK account because of how they had originally been onboarded. Every customer was blocked from it on 19 August 2025 and asked to accept an updated CBIE user agreement.

Second, when Silvergate Bank and Signature Bank failed in March 2023, about 30 institutional customers were told to deposit dollars into Coinbase Inc. accounts at Signature Bank and then Cross River Bank. Those were not CBIE accounts, and the practice lasted until CBIE opened its own settlement account in October 2024. The Central Bank rejected the argument that ledgering, for-benefit-of status and FDIC insurance protected the funds, calling the no-mixing rule "absolute".

Third, Coinbase UK and Coinbase Inc. arranged for CBIE, which held most of the group's euros, to pay euro redemptions to their own customers out of CBIE's designated safeguarding account. That practice stopped on 19 January 2024.

Fourth, a July 2022 change to the data tables behind the Looker report, which calculated the daily safeguarding obligation, left records incomplete. The account was underfunded from July 2022 to October 2024. Between January 2023 and June 2024 the average daily shortfall was 0.54% of obligations, which averaged 323 million euros in 2023 and 470 million euros in 2024.

Fifth, between September 2023 and June 2024, unallocated deposits were left out of the reconciliation. They included payments that could not be matched to a customer because of incomplete data. Control checks had not been completed when a new banking provider was brought in.

How does the Coinbase Ireland fine compare with earlier cases?

The Coinbase Ireland fine sits between a small safeguarding case and a large AML case at the same regulator. It is about ten times the BlueSnap penalty of 2024, but well below the 21.46 million euros imposed on its sister company Coinbase Europe in 2025 for transaction monitoring failures.

The BlueSnap case is the closest match: customer funds kept outside the designated account, mixed with other funds, and safeguarding run by the wider group with weak local oversight. The Coinbase Europe case left more than 30 million transactions unmonitored for 12 months and its later review of them led to 2,708 suspicious transaction reports. The DNB decision on Modulr is the Dutch parallel, where an e-money institution left ongoing monitoring to its crypto partners; we analysed it in the Modulr fine.

BlueSnap, Modulr and Coinbase Ireland share a pattern. In each, a licensed entity relied on a group company or partner for a control the law places on the licence holder, and the regulator held the licence holder responsible. The press release counts this as the Central Bank's 164th enforcement outcome, taking its total fines past 432 million euros.

What does this mean for your compliance obligations?

The Coinbase Ireland fine shows what the Central Bank expects as evidence when a group company runs a regulated control. Safeguarding is the breach here, but the outsourcing test the Central Bank applied mirrors the one the EU AML Regulation will apply to customer due diligence, monitoring and reporting from 10 July 2027.

On safeguarding, Regulation 29 treats segregation as absolute, and the Central Bank expects a daily reconciliation that can be tested by the first and second lines. The notice shows that reconciliation depends on knowing which legal entity each customer is contracted with. Firms that move customers between entities, as Coinbase did after Brexit, need to re-paper them and block the old payment routes, not rely on emails and in-app notices.

On outsourcing, the settlement notice cites the Central Bank's Cross-Industry Guidance on Outsourcing (December 2021), which says boards "cannot outsource their responsibilities", and the EBA Guidelines on Outsourcing Arrangements, which warn against "empty shells". The notice suggests a supervisor will look for a named local owner, a role CBIE filled with a Safeguarding DRI only on 16 December 2024. The notice also points to second line testing independent of the service provider.

For AML, Article 18 of the AML Regulation lets obliged entities outsource tasks but requires them to notify the supervisor first and keeps them "fully liable" for the provider's acts and omissions. It uses the same test as the e-money rule: outsourcing must not "impair materially" the quality of controls. Among the tasks it bars from outsourcing are the customer risk rating and the decision to onboard. Suspicious activity reporting is also barred, with one exception: another obliged entity in the same group and the same Member State. A US shared-services hub does not meet that exception. Firms that run customer due diligence or transaction monitoring through a group platform should map each task against Article 18 now.

On notification, Regulations 18 and 31 require advance or prompt notice of changes to arrangements described at authorisation. Moving deposits to group accounts in a banking crisis, or replacing automated reconciliation with manual steps, counted as material changes.

What is still uncertain, and what are the risks?

The largest open question the Coinbase Ireland fine leaves is how far group shared-services models can go before a regulated subsidiary becomes an empty shell. The Central Bank has drawn the line for safeguarding, but it has not published a threshold, and the cost of building local expertise falls hardest on small subsidiaries of large groups.

The Coinbase Ireland fine and reprimand do not yet have legal effect. Under the undisputed facts settlement process, the High Court must confirm the sanctions, and it will do so unless it finds them manifestly disproportionate. Coinbase Europe's 2025 sanctions were confirmed by the High Court on 12 January 2026, so refusal would be unusual, but it remains possible.

The case also shows how long data defects can run unseen. The reporting fault began in July 2022, was identified in January 2024 as affecting only currencies CBIE customers did not use, and was found by the inspection to affect all currencies. A control that its owner cannot test independently is only as good as the first wrong assumption.

Next, the obligations are converging but not yet aligned. The group moved its Irish crypto-asset business to a Luxembourg entity authorised under MiCA, while the e-money entity stayed in Ireland, and the AML Regulation will add its own outsourcing rules from July 2027. A firm with one platform and several licences faces several supervisors asking the same question in different legal terms.

Finally, the authorisation file has become an enforcement document. The Central Bank compared what CBIE promised at authorisation with what it did, line by line, and O'Leary called the failure to keep authorisation commitments or report material changes "completely unacceptable". Firms authorised in Ireland should expect the same audit.

How should compliance teams respond?

After the Coinbase Ireland fine, compliance teams should start by listing every regulated control performed by a group company or vendor and naming the local person who owns each one. Then they should test those controls independently of the provider and compare current arrangements with what the authorisation file promised.

Build a register of outsourced safeguarding, CDD, screening and monitoring tasks, marked against Regulation 22(2) and AMLR Article 18. Check that every customer record carries the contracting legal entity and that old payment routes are closed after any migration. Reconcile the authorisation file against today's process and notify the regulator of any gap. Finally, make sure unmatched deposits and incomplete payment data feed an exception queue, so they are never left out of a calculation.

For firms mapping outsourced CDD against AMLR Article 18, Zyphe returns verification results and proofs with an exportable audit trail, so the licence holder can evidence each check itself. After verification, documents and biometrics are encrypted into the user's own vault, split across a network of thousands of nodes, with per-region data residency. You can see how it works, compare our KYC software and AML software, or book a demo.

The bottom line

The Coinbase Ireland fine is a safeguarding case with a wider message: a licence holder cannot hand a regulated control to its group and keep only the licence. The Central Bank now reads authorisation files as promises, tests whether local people can explain outsourced work, and treats data errors in group systems as the licence holder's own. Teams running CDD, screening or monitoring through shared platforms should apply that scrutiny now.

Cited sources

• Central Bank of Ireland press release on Coinbase Ireland, 22 October 2026
• Settlement Notice to Coinbase Ireland Limited, 21 October 2026 (PDF)
• European Communities (Electronic Money) Regulations 2011, S.I. No. 183 of 2011
• Regulation (EU) 2024/1624, the AML Regulation, Article 18 on outsourcing
• Central Bank of Ireland press release on Coinbase Europe Limited, 6 November 2025
• De Nederlandsche Bank decision on Modulr Finance B.V., October 2026
• Central Bank of Ireland press release on BlueSnap Payment Services Ireland, 21 November 2024