The Central Bank of Ireland (CBI) fined Coinbase Ireland Limited €3,252,618 on October 22, 2026, for breaching safeguarding and outsourcing obligations under the Electronic Money Regulations 2011. The penalty, reduced from €4,646,597 via a 30% settlement discount, covers violations spanning Novem...
"Payment and e-money firms have a fundamental obligation to fully safeguard customers' funds. The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements." — Karen O'Leary, Director of Enforcement, Central Bank of Ireland
The Central Bank of Ireland (CBI) fined Coinbase Ireland Limited €3,252,618 on October 22, 2026, for breaching safeguarding and outsourcing obligations under the Electronic Money Regulations 2011. The penalty, reduced from €4,646,597 via a 30% settlement discount, covers violations spanning November 1, 2020 through August 19, 2025 — a period of nearly five years.
This marks the second enforcement action against a Coinbase entity in Ireland within 12 months. In November 2025, the CBI fined Coinbase Europe Limited €21,464,734 for anti-money laundering monitoring failures that left more than 30 million transactions worth over €176 billion unscreened. Combined, the two penalties total approximately €24.7 million ($27.7 million) from a single regulator against one company's Irish operations.
The latest fine brings the CBI's lifetime enforcement tally to its 164th action, with cumulative penalties exceeding €432 million across all sectors.
The core finding: Coinbase Ireland's designated safeguarding account — the ring-fenced pool where customer funds must sit, separated from corporate money — was underfunded every day for at least 18 consecutive months.
The numbers are specific. Average daily shortfalls reached €3.4 million in 2023, rising to €5.2 million in 2024. As a percentage of total safeguarding obligations, the gap averaged 0.54%. In absolute terms, Coinbase Ireland held average safeguarding obligations of €323 million in 2023 and €470 million in 2024.
The root cause was technical: material errors in the systems used to calculate daily safeguarding obligations and rebalance customer funds, originating in July 2022. Coding errors in internal calculation dashboards meant the firm was systematically miscounting what it owed customers. The CBI found that Coinbase Ireland had failed to design adequate systems and had not conducted sufficient control testing to catch the discrepancy.
Coinbase stated that no customers suffered financial loss or were unable to access their funds during the shortfall period. The CBI acknowledged this but emphasized that the deficiencies created potential insolvency risk — meaning that if Coinbase Ireland had failed during those 18 months, customers would have faced a shortfall in the pool intended to make them whole.
The safeguarding shortfall was not the only segregation failure. The CBI identified that approximately 30 institutional customers had their dollar deposits routed into accounts controlled by Coinbase Inc. — the US parent — rather than into Coinbase Ireland's dedicated safeguarding accounts. This mixing persisted for 19 months.
The fund-mixing problem intensified during the US banking crisis of March 2023. When Signature Bank collapsed, Coinbase Ireland rerouted customers to alternative Coinbase-held bank accounts at Cross River Bank. This emergency response, while intended to maintain service continuity, resulted in customer funds being commingled with money held by other Coinbase entities — a direct violation of safeguarding rules that require strict separation.
A separate issue involved UK-based customers. Following Brexit, certain clients transferred from Coinbase UK continued to have funds deposited into the British entity's safeguarding account rather than the Irish entity's accounts. This misrouting persisted until August 2025 — nearly five years after the Brexit transition period ended.
The CBI's findings highlighted a structural governance issue: Coinbase Ireland placed "excessive reliance" on its US-based parent, Coinbase Group, as an outsourced service provider for implementing safeguarding processes.
The Irish entity lacked sufficient local expertise to independently oversee customer fund management. Its outsourcing governance framework was inadequate, and it failed to establish proper escalation procedures. When the CBI issued supervisory warnings in 2022 and 2023 about these deficiencies, remediation was slow. A remedial appointment was not made until December 2024 — roughly two years after the first warning.
This pattern — a locally licensed entity that functions primarily as a regulatory wrapper around operations managed from a US headquarters — is not unique to Coinbase. It reflects a structural tension in how global crypto firms approach European compliance. The Irish entity held the electronic money institution (EMI) license and bore the regulatory obligations, but the operational capacity and decision-making authority resided in San Francisco.
| Date | Event | |------|-------| | Nov 2020 | Breach period begins; outsourcing governance deficiencies present from license inception | | Jul 2022 | Coding errors introduced in safeguarding calculation systems | | 2022 | CBI issues first supervisory warning regarding outsourcing and safeguarding | | Mar 2023 | US banking crisis; Signature Bank collapses; Coinbase Ireland reroutes customer funds to alternative accounts, mixing customer money with other Coinbase entities | | 2023 | CBI issues second supervisory warning; average daily shortfall at €3.4M | | Jan 2024 | Coinbase self-reports several calculation and operational errors to CBI | | 2024 | Daily safeguarding shortfall rises to €5.2M; safeguarding obligations average €470M | | Dec 2024 | Coinbase makes remedial appointment | | Aug 2025 | Breach period ends; UK customer fund misrouting resolved | | Nov 2025 | CBI fines Coinbase Europe Limited €21.5M for AML monitoring failures (separate entity, separate case) | | Oct 22, 2026 | CBI announces €3.25M settlement with Coinbase Ireland |
The Irish penalties add to a growing compliance-cost line item for Coinbase Global Inc. According to enforcement tracker data, the company's cumulative regulatory fines have reached approximately $181 million worldwide.
Key penalties include:
Separately, Coinbase disclosed in 2026 that it anticipates spending $180 million to $400 million to remediate and reimburse customers affected by data breach incidents — a liability distinct from regulatory fines but compounding the total compliance and remediation burden.
For context, Coinbase Global reported total revenue of $7.18 billion for the year ended December 31, 2025. The cumulative fine total of approximately $181 million represents roughly 2.5% of one year's revenue — material but not existential for a firm of Coinbase's scale.
The enforcement actions arrive against the backdrop of Coinbase's decision to relocate its primary European hub from Ireland to Luxembourg. In Q2 2025, Coinbase secured the first MiCA (Markets in Crypto-Assets Regulation) license granted to a US crypto exchange, choosing Luxembourg over Ireland as the licensing jurisdiction.
The move reversed an earlier plan to center EU operations in Dublin. However, Coinbase stated it would continue investing in its Irish presence, with plans to add approximately 50 jobs locally.
The timing raises a question for the Irish regulatory ecosystem: whether the CBI's enforcement posture influenced the hub decision, or whether Luxembourg's MiCA regime simply offered a cleaner operational structure. Neither Coinbase nor the CBI has drawn a direct connection between the enforcement actions and the relocation.
Coinbase Ireland retains its EMI license and continues to issue the euro and dollar balances that European customers use to purchase crypto assets. The entity remains operationally relevant even as strategic primacy shifts to Luxembourg.
The Coinbase Ireland case fits into a wider enforcement pattern as European regulators prepare for the full MiCA regime, scheduled to take effect on October 25, 2027, under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 in the UK, with the EU framework already partially in force.
The European Banking Authority (EBA) published a consultation in June 2026 proposing a penalty framework under MiCA that could expose issuers of significant digital assets to fines of up to 12.5% of annual turnover — or twice the profits generated by a violation, whichever is greater. For significant e-money token issuers, the proposed cap is 10% of turnover.
Binance provides a contrasting data point. Greece's Hellenic Capital Market Commission reportedly moved to reject Binance's MiCA license application in June 2026, and the exchange notified EU users it would cease services effective July 1, 2026. The divergence — Coinbase absorbing fines and maintaining operations versus Binance exiting the market — illustrates two models for handling European regulatory escalation.
The MiCA framework's penalty regime, once fully operational, will make the €3.25 million Coinbase Ireland fine look modest. Applied to Coinbase's 2025 global revenue of $7.18 billion, a 12.5% MiCA penalty ceiling would theoretically reach approximately $897 million — though European revenue represents a fraction of the global figure.
The €3.25 million penalty is small relative to Coinbase's revenue. The underlying findings are not. An electronic money institution that could not correctly calculate what it owed customers for 18 months, that mixed institutional client funds with parent company accounts during a banking crisis, and that took two years to act on regulatory warnings, operated below the standard expected of a licensed financial services firm.
Coinbase's response — self-reporting errors, cooperating with the settlement process, and confirming no customer losses — mitigated the outcome. The 30% settlement discount and the absence of customer harm kept the headline number manageable. But the pattern of issues — systemic calculation errors, outsourcing dependency, slow remediation — points to a structural compliance gap between the pace of Coinbase's global expansion and the capacity of its local regulatory entities to independently meet their obligations.
As MiCA penalty ceilings rise and European regulators gain sharper enforcement tools, the cost of that gap will increase. The CBI's message, as stated by Director O'Leary, is unambiguous: no tolerance for safeguarding weaknesses. For Coinbase, the €3.25 million fine is a line item. The question is whether the operational reforms match the regulatory expectation before the next enforcement action carries a larger number.