Coinbase Ireland fined €3.25 million after its client-money account ran short for 18 months

The Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 on Thursday 22 October 2026 for breaking the safeguarding and outsourcing rules that protect customers’ money at e-money firms. The breaches ran from 1 November 2020 to 19 August 2025, according to the Central Bank’s press release, and the settlement was agreed on 21 October. The Coinbase Ireland fine, about $3.6 million at CoinDesk’s conversion, comes with a reprimand.

No customer lost money, Coinbase says, and the regulator found no evidence that any customer was harmed. Its complaint is different. For long stretches the firm could not show that client funds were fully set aside and ready to be paid back if the company failed. On the worst day of 2024 the safeguarding account was €5.2 million short.

The entity matters here. Coinbase Ireland Limited is an electronic money institution, authorised by the Central Bank in October 2019 and operating since 1 November 2020. It issues and redeems the e-money that customers use to move euros and other fiat currencies in and out of Coinbase trading, and it passports that service across the European Economic Area. The rules it broke are the Electronic Money Regulations 2011, as amended. This is not a MiCA case, and Coinbase Ireland is not the company that holds the group’s European crypto licence.

Coinbase Ireland fine: the settlement in figures

The settlement notice published with the release shows how the Central Bank reached its number. It started from Coinbase Ireland’s average annual gross turnover over the breach period, rounded to €63,219,000, rated the case 7 on its 1 to 10 severity scale and took 7% of that figure. It then added 5% because the firm had not completed two risk mitigation programmes the regulator sent it in 2022 and 2023, and cut the total by the maximum 30% for settling.

The 0.54% figure covers the period when the account was short every single day, from 1 January 2023 to 27 June 2024, which is why Coinbase describes it as “2023 and H1 of 2024”. Applied to the average obligations, it works out at roughly €1.7 million to €2.5 million missing on a typical day, on Coindaro’s arithmetic. The rule asks for 100%, every day.

The sanctions only take effect once the High Court confirms them. The case is the Central Bank’s 164th enforcement outcome, taking its total fines past €432 million, and the fifth settled through the “undisputed facts” route of its Administrative Sanctions Procedure, introduced by the Central Bank (Individual Accountability Framework) Act 2023.

Three failings the Central Bank found at Coinbase Ireland

The press release sums the case up in three findings. Coinbase Ireland leaned too heavily on the US side of the Coinbase group to run its safeguarding processes and controls, without enough skilled staff of its own to oversee them. Poor system design and too little control testing left the safeguarding account underfunded for long periods. And weak escalation meant material changes to its safeguarding set-up were never reported to the Central Bank.

Payment and e-money firms must fully safeguard customers’ funds, Karen O’Leary, the Central Bank’s Director of Enforcement, said in the release: “we have no tolerance for weaknesses in safeguarding arrangements.” She also said that failing to keep the assurances a firm gives when it is authorised, or to report material changes, “is completely unacceptable”.

Of the four breaches, the outsourcing one is rated reckless in the settlement notice, because the regulator had told the firm in writing in July 2022 to follow the EBA outsourcing guidelines. The three safeguarding breaches are rated negligent. Until December 2024, the people overseeing safeguarding were employees of other Coinbase companies based outside Ireland, and even the second- and third-line testing of the outsourced work was itself outsourced to Coinbase Inc.

Where the money actually sat

The shortfall came from data, not from a missing transfer. In July 2022 Coinbase Ireland changed how it maintained the data tables behind the “Looker” report that calculated each day how much it had to safeguard. The report then worked from incomplete records. The firm spotted the problem in January 2024 and thought it only touched currencies its customers did not use. The Central Bank’s inspection found it affected every currency, retail and institutional customers alike. A second gap, deposits that could not be matched to a customer, left more money out of the calculation between September 2023 and June 2024.

Customer money was also mixed with money that belonged to other Coinbase companies. Until March 2023, institutional customers paid dollars into a Coinbase Ireland account at Silvergate Bank. On 2 March 2023, as Silvergate faltered, the firm told 30 of them to pay into a Coinbase Inc. account at Signature Bank instead. Signature failed on 12 March, and the deposits moved to a Coinbase Inc. account at Cross River Bank. That lasted until October 2024, when Coinbase Ireland opened its own account at Customers Bank. Coinbase argued the money was ledgered per customer and held “for the benefit of” clients. The Central Bank answered that the ban on mixing funds is absolute.

Brexit created the longest breach. In 2020 more than 6.3 million customers moved from Coinbase UK, the FCA-authorised CB Payments Limited, to Coinbase Ireland. Some kept sending money to the old UK safeguarding account. The firm told the Central Bank on 17 January 2024 and started bouncing those payments on 15 March 2024, but in August 2025 its internal audit found 33 customers who could still use the UK route. Deposits there were blocked for everyone from 19 August 2025, the last day of the breach period.

One more flow ran the other way. Until 19 January 2024, euro withdrawals by customers of Coinbase UK and Coinbase Inc. were paid out of Coinbase Ireland’s safeguarding account, which usually holds most of the group’s euros.

Why safeguarding matters when no customer lost money

E-money firms are not banks. They cannot lend out customer money, and they must keep it apart from their own, usually in a dedicated account at a bank. Coinbase Ireland’s designated account is at AS LHV Pank, an Estonian bank. The point of that separation shows on a bad day: if the firm goes bust, the safeguarded blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool goes back to customers instead of being shared out among creditors.

So the regulator treats a missing euro as a problem even while withdrawals keep working. Had Coinbase Ireland become insolvent while the breaches were running, customers might not have got all their money back quickly, the settlement notice says. It calls this “a fundamental failure to meet the Central Bank’s expectations regarding wind-down strategy”.

For a Coinbase user, the e-money side is the cash part of the account: euros sent by bank transfer and waiting to buy crypto, or the proceeds of a sale waiting to be withdrawn. Coinbase Ireland does not handle crypto transactions itself. The crypto sits with other Coinbase companies, under other rules.

Warnings in 2022 and 2023, fixes from 2024

In March 2022 Coinbase Ireland’s board told the Central Bank, in a required attestation, that the firm complied with its safeguarding obligations. The regulator wrote to it on 14 July 2022 about “significant deficiencies” in its governance and again on 27 March 2023, noting the first set of required fixes had not worked. An external safeguarding audit then produced 20 findings. Coinbase Ireland reported three safeguarding issues itself in January 2024, and the Central Bank began an on-site inspection in May 2024. The repairs came in stages:

• 27 June 2024: the daily underfunding stopped once the error was identified.
• October 2024: the data fault and the unmatched-deposits gap were fixed, and the firm opened its own US dollar account.
• 16 December 2024: a manager directly responsible for safeguarding was appointed.
• January 2025: a new risk mitigation programme, closed by the Central Bank in June 2026 after outside assurance.
• July 2025: the formal investigation opened.
• 19 August 2025: the UK deposit route was shut for all customers.

Coinbase’s answer: a €25 million bond and a Head of Safeguarding

Coinbase answered in a post titled “Resolving past safeguarding issues”. The blog page refused Coindaro’s requests, so the statement is quoted here from the full text published by FX News Group. “There was no customer impact: no client suffered any financial loss or was unable to access their funds as a result of these historic practices,” the company said.

Coinbase sorts the issues into five areas: dollar deposits during the 2023 US banking crisis, deposits by migrated UK customers, euro withdrawals for customers of other Coinbase entities, coding errors in the daily calculation, and changes it did not report. For the first three it says its daily treasury rebalancing put the money back into the safeguarding account each day, while accepting that this did not prevent the initial mixing.

The fixes it lists are a €25 million guaranty bond, a dedicated Head of Safeguarding appointed before the Central Bank made such a role standard across the industry this year, and two outside validations since January 2025 that found no remaining issues. Coinbase adds that its European headquarters is now in Luxembourg and that EEA customers keep their service without interruption.

The second Irish fine in a year, on a different Coinbase company

This is not Coinbase’s first penalty in Dublin. In November 2025 the Central Bank fined Coinbase Europe Limited €21.46 million for anti-money-laundering transaction monitoring failures: more than 30 million transactions worth over €176 billion were not properly monitored, FinanceFeeds recalls. The High Court confirmed that fine in January 2026, about two months after it was announced.

The two cases should not be merged. The 2025 fine hit Coinbase Europe Limited, then registered in Ireland as a virtual asset service provider, under anti-money-laundering law. The 2026 fine hits Coinbase Ireland Limited, the e-money institution, under the Electronic Money Regulations. Together they add up to about €24.7 million, imposed by the same regulator on two companies of the same group less than a year apart.

MiCA is a different licence, issued in Luxembourg

Coinbase’s authorisation under the EU’s Markets in Crypto-Assets regulation does not come from Ireland. ESMA’s register of crypto-asset service providers lists Coinbase Luxembourg S.A., authorised by Luxembourg’s CSSF on 20 June 2025 for seven services, custody and exchange among them, and passported to 30 EEA countries including France, Italy and Ireland. The settlement notice adds that Coinbase moved Coinbase Europe’s business to that Luxembourg company and no longer runs any crypto-asset service provider from Ireland. Irish VASP registrations stopped having effect at the end of 2025.

So the Irish fine is not a sanction under MiCA and does not touch the Luxembourg licence. MiCA sets its own custody and segregation rules for crypto-assets, separate from the e-money safeguarding rules in this case. Our guide to what the MiCA regulation means for users explains how the licence and the EU passport work, and the short version is in our glossary entry on MiCA.

How MiCA firms should be supervised is itself under debate in Brussels. France wants ESMA to supervise more crypto firms directly, as we reported in our piece on France’s MiCA review proposals.

What it means for Coinbase users in France, Italy and the EEA

The Irish company is still the group’s e-money institution for Europe: Coinbase describes it as the entity “which provides fiat services to European customers”. On that description, euro balances held on Coinbase by French or Italian users sit with the Irish firm, while their crypto services run under the Luxembourg MiCA licence. It previously also took on all the customers of Coinbase Germany GmbH, according to the settlement notice.

Neither the Central Bank nor Coinbase has said how many retail customers had money in the account on the days it ran short, or in which countries they live. Nothing published so far says French or Italian customers were affected in particular.

For readers comparing platforms, the case shows that one exchange brand is often several regulated companies, each with its own licence and supervisor. Our Coinbase review covers the platform as a whole, and our checklist for choosing a crypto exchange explains which entity to look for in the terms of service.

High Court confirmation is the next step

Both sides are bound by the settlement, but it is not yet in force. The Central Bank applies to the High Court “as soon as practicable”, and the court confirms the sanction unless it finds it manifestly disproportionate. The Coinbase Europe fine took about two months to go through. No hearing date has been given for this one.