The Central Bank of Ireland has fined Coinbase Ireland Limited €3,252,618 over safeguarding and outsourcing breaches under the Electronic Money Regulations 2011. The announcement followed a settlement reached between the Central Bank and the firm on 21 October 2026. Coinbase Ireland admitted the prescribed contraventions and agreed the undisputed facts set out in the settlement notice. The fine is small; the finding is not. For any e-money institution or payment institution that is the EU subsidiary of a non-EU group, this is the reference case on where safeguarding must be owned.
What the Central Bank found
The press release describes three failures. On outsourcing, the firm placed excessive reliance on the US-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls, and lacked sufficient local skill and expertise to oversee the management and safeguarding of customer funds. On safeguarding, inadequate system design and insufficient control testing allowed the designated safeguarding account to be underfunded for lengthy periods, and the firm lacked the internal control and escalation procedures needed to identify and report material changes concerning safeguarding to the Central Bank.
The settlement notice gives the detail. The people responsible for overseeing both safeguarding and the outsourced services were employees of other Coinbase Group entities, not of Coinbase Ireland, and were based outside Ireland. Second and third line testing of the outsourced processes and controls was performed by functions that were themselves outsourced to Coinbase Inc. In plain terms, it appears the Irish entity neither calculated, reconciled nor independently tested its own safeguarding position.
The underfunding came from a data problem. The systems the firm relied on to calculate its daily safeguarding obligation contained material errors from July 2022 onwards. The firm identified underfunding of safeguarded balances every day from 1 January 2023 to 27 June 2024. The maximum daily shortfall was €3.4 million in 2023 and €5.2 million in 2024, and the average daily shortfall was 0.54% of a safeguarding obligation that averaged €323 million in 2023 and €470 million in 2024. Half a percent sounds like rounding. In an insolvency it is the difference between every customer being paid in full and some not being paid at all.
There were also mixing failures. Until March 2023, the firm’s institutional users made USD deposits directly into a Coinbase Ireland account at Silvergate Bank, one of three US banks that failed that month. For approximately 19 months after that, the funds of 30 institutional users were mixed with the funds of Coinbase Inc., because they were received into accounts in Coinbase Inc.‘s name. The Central Bank’s position was that these funds were not held in Coinbase Ireland’s own account or in a segregated account in its name, and so were not safeguarded as required. Separately, a small number of 33 customers still had access to the Coinbase UK account and made deposits into it, until all customers’ ability to deposit there was blocked from 19 August 2025.
What it signals
Central Bank Director of Enforcement Karen O’Leary said: “Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds. The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements.” She also said that failing to adhere to assurances made during the authorisation process, or to inform the Central Bank of material changes, “is completely unacceptable”.
The Central Bank set the sanction at a reprimand and a monetary penalty of €4,646,597, reduced to €3,252,618 by a 30% settlement discount, and the sanctions are subject to confirmation by the High Court. This is the fifth settlement under the Administrative Sanctions Procedure since the changes introduced by the Central Bank (Individual Accountability Framework) Act 2023.
In our reading, the case makes three points to group subsidiaries. First, substance is measured in people. The Central Bank’s cross-industry guidance on outsourcing, as summarised in the notice, states that while the performance of functions can be outsourced, boards and senior management cannot outsource their responsibilities. Coinbase Ireland appointed a safeguarding directly responsible individual only in December 2024, after an on-site inspection that began in May 2024. A named local owner for the daily reconciliation appears to be the control the Central Bank expected from the start.
Second, supervisory letters are not background reading. The Central Bank had communicated its expectations to all EMIs in Dear CEO letters of 9 December 2021 and 20 January 2023, and directly to Coinbase Ireland in letters dated 14 July 2022 and 27 March 2023 that included risk mitigation programmes. That is a long arc from first letter to settlement, and it suggests the outcome was shaped as much by the response to supervision as by the underlying breach.
The fine is small; the finding is not.
Third, the authorisation file is a standing commitment. At authorisation the firm set out a business model and was thereafter obliged to seek approval from the Central Bank for any material change to it. The notice records material changes to the firm’s safeguarding arrangements after authorisation that were not notified to the Central Bank at the earliest opportunity, or at all. One example was significant manual intervention in safeguarding arrangements, which contradicted the automated systems described in the authorisation application. We read this as the point most likely to catch other group firms: operational decisions taken by a treasury team abroad, such as where a currency lands or which group account receives it, can be regulatory notifications in the regulated entity.
What still applies
Nothing in this case changes the rules. Regulation 29(2)(a)(i) of the EMR 2011 requires that “users’ funds shall not be mixed at any time with the funds of any person other than the electronic money holder’s on whose behalf the funds are held”. Daily segregation, a designated account in the institution’s own name at a credit institution, and a daily reconciliation that matches the account balance to the obligation remain the baseline for every EMI using the segregation method. The outsourcing framework is unchanged too: group shared services remain permissible, provided the regulated entity keeps the oversight, the expertise and the decision rights. The case is an application of existing rules to a group operating model, not a new rule.
What firms should do
Name the owner of the daily reconciliation. One person employed by the EU entity, based in the jurisdiction, should approve the daily safeguarding reconciliation and be able to explain the calculation behind it. If that person works for the parent, the firm has the Coinbase Ireland fact pattern.
Separate the lines of defence from the service provider. Second line testing and internal audit of outsourced safeguarding should not sit in the group function that performs it. Where they do, document why, and put an independent check in place this quarter rather than next year.
Rebuild the safeguarding calculation from source. Trace every data table and system the obligations report depends on, put those tables under change control, and test the report against a deliberately introduced shortfall. The Coinbase Ireland errors ran for years because the firm could not see them.
Map every bank account that touches customer money against the authorisation file. Any account not in the entity’s name, any currency routed through a group account, any manual step where the application promised automation: treat each as a potential Regulation 18 notification and take legal advice on whether approval or notification is required.
Re-read the Dear CEO letters and any risk mitigation programme as a checklist, and have the board attest to each item on evidence, not assurance from the parent. Our guide on audit readiness best practices for financial firms sets out how to assemble that evidence before a supervisor asks for it.
Where the local entity lacks the people to do this, Taft supplies a fractional compliance team: compliance staff who sit inside the regulated entity, own the safeguarding and outsourcing oversight day to day, and give the board something to attest to. Taft does not give legal advice; where a question turns on the legal reading of the EMR 2011, the firm should take it.
Sources
- The Central Bank takes enforcement action against Coinbase Ireland, Central Bank of Ireland
- Central Bank of Ireland Administrative Sanctions Procedure (ASP), Primary document
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.