The Central Bank of Ireland has imposed a €3.25 million fine on Coinbase Ireland Limited for failing to safeguard customer funds and relying excessively on its US parent company for compliance controls. The penalty, announced on Thursday following a settlement, addresses breaches that occurred between November 2020 and August 2025 under Ireland’s Electronic Money Regulations. As an e-money institution, Coinbase Ireland manages euro and dollar balances used by European customers to purchase crypto assets, which legally must be held in dedicated accounts separate from corporate funds and other entities.
Regulators identified three primary failures: excessive reliance on US-based group structures without adequate local oversight, prolonged underfunding of the safeguarding account due to poor system design, and a lack of processes to notify the regulator of material changes in practices. Karen O’Leary, the Central Bank’s director of enforcement, stated that the firm’s drift from the "robust and automated safeguards" promised during its 2019 authorization was unacceptable. The base penalty was set at €4.65 million but reduced by 30% due to the settlement; the final sanction awaits High Court confirmation.
Coinbase acknowledged self-reporting many issues in January 2024 and claimed most control problems were resolved that same year, emphasizing that no customers lost money or access to funds. Specific incidents included directing customers to deposit dollars into a US entity’s account during the March 2023 banking crisis and paying withdrawals for non-Irish customers from the Irish safeguarding account for liquidity reasons. Coding errors also led to an average underfunding of roughly 0.54% of the total obligation through mid-2024. Since then, Coinbase has redesigned its calculation methods, passed third-party validations, posted a €25 million guaranty bond, and hired a dedicated head of safeguarding.
This enforcement action underscores the critical importance of operational autonomy for subsidiaries within global financial institutions. By penalizing Coinbase Ireland for leaning on its US parent, the Central Bank signals that local regulatory frameworks require substantive, independent oversight rather than mere administrative delegation. The failure to flag material changes highlights a significant gap in communication protocols, suggesting that internal governance structures were insufficiently responsive to evolving regulatory expectations despite initial authorization commitments.
From a market structure perspective, this case illustrates the complexities of managing cross-border liquidity and fund segregation in multi-entity crypto exchanges. While Coinbase argued that certain commingling instances arose during periods of disruption, such as the US banking crisis, regulators maintained that safeguarding obligations are fundamental and cannot be waived for operational convenience. This distinction reinforces the strict liability nature of e-money regulations, where the integrity of customer funds takes precedence over business continuity measures that might compromise segregation standards.
