On 22 October 2026 the Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 for breaching its e-money safeguarding and outsourcing obligations, closing an enforcement case that had been open for years. The most striking part of the penalty is what it does not describe: the regulator found no evidence that any customer actually lost money.
The failure was structural. Coinbase Ireland is the electronic money institution that issues and redeems the euro balances customers use to move in and out of crypto, and it let its designated safeguarding account run short. Between 1 January 2023 and 27 June 2024 the account was underfunded on a daily basis for at least eighteen months. The maximum daily shortfall was €3.4 million in 2023 and €5.2 million in 2024 — small against the roughly €323 million and €470 million the firm held on average in those years, but real in absolute terms. Across the period the average gap was 0.54% of its safeguarding obligations.
What the regulator found
The Central Bank grouped the contraventions into three areas. First, Coinbase Ireland leaned too heavily on its US parent. It outsourced the implementation and operation of its safeguarding processes, the daily reconciliation of the safeguarding account, and the calculation of its obligations to Coinbase Inc. in the United States, without keeping enough local skill and expertise to oversee that work. Second, it failed to adequately safeguard customer funds, because of inadequate system design and insufficient control testing. Third, it lacked the internal controls and escalation procedures that would have flagged material changes to the regulator; several changes to its safeguarding arrangements were not notified promptly.
Why the headline number is not final
The fine is built from a €4,646,597 base penalty, reduced by the maximum 30% settlement discount to €3,252,618. Coinbase Ireland has accepted the sanction, but it still requires confirmation by the High Court before it takes effect, as Irish administrative sanctions do. It is the Central Bank’s 164th enforcement outcome, taking its total fines past €432 million.
The settlement notice is careful about what did and did not happen. The failure of Signature Bank in March 2023 “did not result in the loss of CBIE Users’ Funds,” and the regulator found “no evidence of actual consumer detriment being realised.” The risk was contingent: had the firm become insolvent during that period, customer funds would not have been as isolated as the rules require. That is the point of safeguarding — money must be kept separate before anything goes wrong, not after.
What it signals
There is a strategic layer too. When the EU’s MiCA framework took effect, Coinbase moved its virtual-asset-service-provider business to a Luxembourg entity authorised as a crypto-asset service provider, and the group no longer operates any such providers from Ireland. Coinbase Ireland remains the cash and e-money layer. The Central Bank’s message is that the Dublin entity will be held to the full letter of European safeguarding law no matter how much of its support sits inside a US parent. Director of Enforcement Karen O’Leary put it plainly: outsourcing “can threaten the operational resilience of firms” when it is not effectively managed, and failing to honour assurances made during authorisation is “completely unacceptable.”
Adapted from Coinbase Ireland Fined €3.25 Million Over E-Money Safeguarding Failures.