The Central Bank of Ireland has fined Coinbase Ireland EUR 3.25 million over safeguarding and outsourcing breaches under e-money rules.
The Central Bank of Ireland has imposed a reprimand and a monetary penalty of EUR 3,252,618 on Coinbase Ireland for breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011 (EMR 2011). The breaches occurred between 1 November 2020 and 19 August 2025. The regulator announced the decision on 22 October 2026, one day after it reached a settlement with the company. Coinbase Ireland has admitted the contraventions and accepted the sanctions.
Reliance on group outsourcing and an underfunded safeguarding account
Coinbase Ireland is an e-money institution within the Coinbase Group. The US-based group operates a global platform for buying, selling, transferring, and storing crypto assets. The Ireland-based entity issues and redeems e-money in exchange for fiat currency, and customers use that e-money to purchase crypto assets on the group’s trading platform. Because of this role, the firm is subject to the safeguarding and outsourcing requirements of the EMR 2011, as amended. The Central Bank considers these requirements fundamental to protecting customer funds.
The regulator identified failings in three areas. First, Coinbase Ireland lacked an adequate outsourcing governance framework, relying excessively on the US-based Coinbase Group, as its outsourced service provider, to implement the safeguarding processes and controls needed to meet Irish and EU compliance requirements. It also did not have enough local skill and expertise to oversee the management and safeguarding of customer funds.
Second, the firm did not adequately safeguard customer funds. Inadequate system design and insufficient control testing left its designated safeguarding account underfunded for lengthy periods. The third issue was that it lacked adequate internal control, escalation, and governance processes to identify material changes concerning safeguarding and report them to the Central Bank.
Authorisation commitments under scrutiny
Karen O’Leary, Director of Enforcement at the Central Bank of Ireland, said outsourcing is beneficial to the industry, but when it is not managed effectively, it can represent a risk for firms’ operational resilience. O’Leary added that the regulator has no tolerance for weaknesses in safeguarding arrangements.
O’Leary also highlighted the authorisation process. Authorisation in Ireland gives firms access to the wider EU market, and the details and commitments firms provide during authorisation are central to the Central Bank’s decision on whether to authorise them. The official considered the firm’s failure to adhere to those assurances and to report material changes utterly unacceptable.
Settlement terms and High Court confirmation
The Central Bank set the penalty at EUR 4,646,597 and then applied a 30% settlement discount, which reduced it to EUR 3,252,618. The case was concluded through the undisputed facts settlement process under the Administrative Sanctions Procedure (ASP).
The sanctions take effect once confirmed by the High Court, which may decline only if it finds them manifestly disproportionate, in which case the matter returns to the Central Bank and Coinbase Ireland for reconsideration.
This case follows an earlier enforcement action against another Coinbase entity. In November 2025, the Central Bank of Ireland fined Coinbase Europe EUR 21.5 million for breaching anti-money laundering and counter-terrorist financing transaction monitoring obligations.
