The Central Bank has fined cryptocurrency exchange Coinbase Ireland more than €3.25m for breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011 between November 2020 and August 2025.
Coinbase Ireland, which is part of the Coinbase Group, provides crypto asset and wallet services to customers to facilitate their use of its trading platform to buy and sell crypto assets.
This is the second time the Central Bank has fined Coinbase after it imposed a €21.5m fine in November 2025 for breaching anti-money laundering and counter-terrorist financing transaction monitoring obligations. Those breaches occured between April 2021 and March 2025.
The Central Bank said its latest fine relates to Coinbase Ireland failing to have in place an adequate outsourcing governance framework.
It said that Coinbase placed excessive reliance on the US-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls to meet Irish and EU regulatory compliance requirements.
The company also failed to have sufficient local skill and expertise available within Coinbase Ireland to appropriately oversee the core function and responsibility of managing and safeguarding customer funds at all times.
The Central Bank said the company did not adequately safeguard customers’ funds, both through inadequate system design and insufficient control testing. As a result, they allowed its designated safeguarding account to be underfunded for lengthy periods of time.
It added that Coinbase Ireland failed to have adequate internal control and escalation procedures and sufficient governance processes to identify and report material changes concerning safeguarding to the regulator.
In a statement today, Coinbase Ireland said it had strengthened its safeguarding controls, redesigned its calculation processes, and added dedicated expertise to prevent similar issues from recurring.
It said the breaches largely arose in the context of Coinbase taking steps to protect customers during periods of significant disruption.
“For example, during the 2023 US banking crisis CBIE directed customers to deposit their funds into alternative bank accounts held by Coinbase Inc to protect them from potential losses arising from bank failure,” the company said.
It said that while this helped protect customers from financial loss and disruption, it involved customers’ funds being mixed with funds held for other Coinbase entities, which was not in line with regulatory safeguarding requirements.
“Similarly, following Brexit, although CBIE repeatedly instructed customers to use its Irish bank account for future deposits, some customers continued to deposit into legacy UK bank accounts, which did not comply with regulatory safeguarding requirements,” it added.
It said that no customers suffered financial loss or were unable to access their funds as a result of these issues.
Coinbase Ireland said it self-identified and reported several of these issues to the Central Bank in January 2024, addressed the vast majority of the underlying control issues that year, and have since fully resolved them.
The Central Bank said that as part of the settlement deal, it has determined that sanctions comprising a reprimand and monetary penalty in the amount of €4,646,597 are warranted. The application of a 30% settlement scheme discount brings the amount to €3,252,618.
Karen O’Leary, the Central Bank’s Director of Enforcement, said that firms in Ireland must have the appropriate culture and expertise to comply with the rules, respond to risks and to protect customer interests.
“While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms,” Ms O’Leary said.
She stressed that payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds.
“The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements,” she added.
She also said the case highlights the importance of the authorisation process and the rigour with which the Central Bank expects firms to approach authorisation to do business here thereby gaining- through authorisation – access to the wider EU market.
“Details and commitments given by firms during the authorisation process are critical to the Central Bank’s assessment of whether or not to authorise a firm. Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable,” she stated.
“This action against Coinbase Ireland underlines the Central Bank’s focus on ensuring that customers are at all times protected and that the integrity of the financial system is maintained,” she added.
