The Central Bank of Ireland has fined Coinbase Ireland Limited 3,252,618 euros. The reason: between November 1, 2020 and August 19, 2025 the company breached its duties to safeguard client fu
The Central Bank of Ireland has fined Coinbase Ireland Limited 3,252,618 euros. The reason: between November 1, 2020 and August 19, 2025 the company breached its duties to safeguard client funds and to govern its outsourcing. The decision was announced on October 22, 2026, a day after the regulator and the company settled.
For customers in Europe this is not a distant notice from Dublin. Euros held in a Coinbase account are not a bank deposit but electronic money issued by this Irish entity, and the firm serves the rest of the European Union from its Irish licence. The regulator's findings therefore describe the protection that applies to those balances.
Coinbase Ireland is an e-money institution. An e-money institution is a financial company that converts cash into electronic money and redeems it on demand without being a bank. On the regulator's description, the entity issues e-money against state currency and redeems it again; customers then use that e-money to buy crypto assets on the Coinbase group's trading platform.
The relevant rules are the Irish Electronic Money Regulations 2011. They require two things that serve the same purpose at heart: client funds must be segregated and safeguarded in full, and a firm that outsources tasks must remain in control of them. The Central Bank calls these requirements fundamental to the protection of client funds and to confidence in the financial system.
Safeguarding is the duty to separate client money from the institution's own assets and to hold it in full in a designated account. The point shows up in a crisis: if the institution fails, client money should not fall into the estate, because it was never the institution's property.
That separation is where things went wrong. The regulator finds that Coinbase Ireland failed to safeguard client funds adequately, and names two causes: inadequate systems design and insufficient testing of its own controls. The consequence is stated briefly and unmistakably: the designated safeguarding account was underfunded for extended periods.
Underfunded means that at times the safeguarding account held less than customers held in balances. A shortfall does not mean money has gone missing, and the regulator makes no such allegation. It means that the protective mechanism would not have worked in full during that time.
The third finding concerns missing internal control and escalation procedures. The company lacked the processes to identify material changes in the safeguarding of client funds at all, let alone report them to the regulator. A supervisor who never hears about a change cannot assess it.
The first finding goes to the group structure. On the Central Bank's findings, Coinbase Ireland relied to an excessive degree on the US Coinbase group as an outsourced service provider to implement the processes and controls for safeguarding client funds, so that Irish and European requirements would be met.
There is a staffing finding alongside it: the Irish company, as the regulator describes it, did not have enough in-house expertise to oversee the administration and safeguarding of client funds adequately at all times. The Central Bank calls this a core function and a core responsibility of the Irish entity, not of the parent.
The point is more than a formality. A European subsidiary can pool technology and processes within the group, but responsibility does not travel with them. Whoever holds the licence must be able to judge the outsourced work, and that takes people who understand it professionally.
The sanction takes effect only once the Irish High Court confirms it.
The headline figure is already a reduced amount. The Central Bank determined that a reprimand and a fine of 4,646,597 euros were appropriate. A 30 percent discount under the settlement procedure was then applied, bringing the sum down to 3,252,618 euros. Coinbase Ireland has admitted the findings, accepted the undisputed facts and accepted the sanctions.
The discount is not a concession in an individual case but part of the procedure. The Central Bank can grant up to 30 percent where a firm does not contest the facts and thereby spares a lengthy investigation. This is the fifth settlement under the procedure introduced by the Central Bank (Individual Accountability Framework) Act 2023.
For scale the authority cites its own record: this is its 164th enforcement outcome, and the total of all fines it has imposed now stands at more than 432 million euros. Against that record the Coinbase case is a mid-sized item, not a record.
One detail is easily missed in short reports: the sanctions are subject to confirmation by the Irish High Court and take effect only once the court has confirmed them. The Central Bank applies for that confirmation as soon as the settlement procedure is complete.
The court confirms the decision unless it considers the sanction manifestly disproportionate. If confirmation is withheld, the matter goes back to the Central Bank and the company for fresh consideration, with a recommendation from the court where appropriate. The amount is therefore settled, but the procedure has not yet run its course.
This is the practical core for customers. A euro balance at an e-money institution is not a bank deposit. The statutory deposit guarantee, which in the European Union covers bank balances up to 100,000 euros per customer and institution, does not apply to e-money. In its place stands exactly the duty at issue in this case: the segregated, full safeguarding of client funds.
Both routes pursue the same goal and work differently. A deposit guarantee pays out of a fund when losses occur. Safeguarding prevents the loss by making sure the money never legally belongs to the institution. How robust the second route is depends entirely on the safeguarding account being funded at all times, and that is what the Irish decision is about.
We set out at length how euro balances on trading venues are classified in law after the answer from the European securities regulator ESMA: euro balances on a crypto exchange.
An Irish decision reaches customers across Europe because of the single market. A company authorised in one member state may offer its services throughout the Union; the procedure is called passporting, or the EU passport. Ongoing supervision stays with the home state authority, here the Irish central bank.
The Central Bank's Director of Enforcement, Karen O'Leary, puts precisely that link at the centre of her statement. O'Leary points to the importance of the authorisation process and the care firms must take with it when authorisation gives them access to the wider EU market. Representations and commitments made during authorisation are decisive for the assessment, she says, and failing to adhere to them or to notify material changes is wholly unacceptable.
On safeguarding duties she says: «Payment and e-money firms have a fundamental obligation to fully safeguard customers' funds. The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements.» The full statement is in the Central Bank of Ireland notice of October 22, 2026.
Crypto assets in self-custody depend on no institution's safeguarding account.
The Coinbase group has two Irish entities with different jobs, and that matters for placing this case. Coinbase Ireland Limited is the e-money institution and therefore responsible for euro balances. Coinbase Europe Limited, on the Central Bank's description, provides crypto asset and wallet services to customers worldwide so that they can use the group's trading platform.
Different duties attach to each. E-money falls under the Electronic Money Regulations and their safeguarding rules. The crypto asset service falls under anti-money-laundering law and, since the European regulation on markets in crypto assets, under its requirements for authorisation and custody as well. What a MiCA licence brings with it is set out in our overview of the MiCA obligations.
The October 2026 decision is not the first against an Irish Coinbase entity. On November 6, 2025 the same authority fined Coinbase Europe Limited 21,464,734 euros because the company had breached its transaction monitoring duties under Irish anti-money-laundering law between April 23, 2021 and March 19, 2025.
The figures in that earlier case are considerably larger. Because of errors in the configuration of the monitoring system, more than 30 million transactions went without proper monitoring over a twelve-month period, according to the central bank. Their value exceeded 176 billion euros and accounted for around 31 percent of all Coinbase Europe transactions in the period concerned. Reviewing the affected transactions in full took almost three years. The details are in the central bank notice of November 6, 2025.
The two cases concern different entities, different rulebooks and different periods. What they share is that the regulator faulted the control systems in each, not a loss of client funds.
Safeguarding covers euro balances, not the coins themselves. Crypto assets held on a trading venue are subject to its custody duties. Transferring them to your own address leaves that arrangement entirely: self-custody means the private keys to your holdings sit with you alone, with no company in between.
That choice costs convenience and shifts responsibility. Self-custody leaves no company obliged to run a safeguarding account, but also nobody to restore lost access. Which devices are suitable is shown in our hardware wallet comparison.
For balances needed as payment for the next purchase, self-custody is no answer. Euros stay euros and sit where the trading happens. That is exactly why how well a venue segregates and safeguards that money is a selection criterion alongside fees or trading pairs.
The amount is fixed, the period is closed, the breaches are admitted. Open is the court's confirmation, and open for customers is the question of how much of a euro balance should sit on a trading venue permanently. Three steps sort that out.
(As of October 23, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
