Coinbase Ireland Fined €3.25M for Safeguarding and Oversight Failures

The Central Bank of Ireland has sanctioned the Irish entity of cryptocurrency exchange Coinbase with a €3.25 million fine for violating safeguarding and outsourcing requirements. The infractions occurred over a four-and-a-half-year period from 1 November 2020 to 19 August 2025.

The penalties require confirmation by the High Court before taking legal effect, the regulator announced. Coinbase Ireland operates as an e-money institution that issues and redeems electronic money in return for traditional currency, which customers then use to purchase crypto assets through the group's trading platform.

Investigators determined that Coinbase Ireland failed to establish proper frameworks for supervising services it had outsourced. The Irish subsidiary depended too heavily on its US-based parent company to implement the safeguarding procedures and controls mandated by Irish and European Union regulations.

The regulator further identified a shortage of local skills and knowledge within Coinbase Ireland to properly monitor the management and protection of customer funds. This gap in capabilities meant critical oversight functions were not performed at the subsidiary level as required.

Deficiencies in system architecture and inadequate testing of controls resulted in a designated safeguarding account remaining underfunded for extended periods, according to the Central Bank's findings.

The institution also lacked robust internal controls, escalation protocols, and governance mechanisms to detect and report material changes to its safeguarding arrangements. These shortcomings allowed compliance issues to persist without timely identification or remediation.

Karen O'Leary, the Central Bank's enforcement director, stressed the importance of firms maintaining appropriate culture and expertise to meet regulatory obligations and safeguard customer interests.

While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms.

She emphasised that payment and e-money institutions have a fundamental duty to fully protect customer funds, adding that the regulator has clearly communicated its supervisory expectations and maintains zero tolerance for weaknesses in safeguarding arrangements.

The regulator initially calculated the monetary penalty at €4.65 million before applying a 30% settlement discount to reach the final figure.

In its own statement, Coinbase Ireland said it cooperated with the Central Bank throughout the process to reach the settlement agreement.

We have fully addressed the concerns that led to this settlement and there was no customer impact: no client suffered any financial loss or was unable to access their funds as a result of these historic practices.

The company characterised the practices as historic, indicating that corrective measures have since been implemented to prevent recurrence.