- The Central Bank of Ireland has fined Coinbase Ireland Limited €3,252,618, roughly $3.6m, for breaching safeguarding and outsourcing obligations under the Electronic Money Regulations 2011. The penalty is not final: it needs High Court confirmation before it takes effect.
- The breaches ran from 1 November 2020 to 19 August 2025, a window of nearly five years.
- The regulator found no evidence of actual consumer harm, and Coinbase says no customer lost money or access. The shortfall in the Irish safeguarding account reached €5.2m in 2024 before the firm corrected it.
Safeguarding is the dull part of financial regulation, and it is also the part that decides whether your money is still there when a bank fails. Ireland’s central bank has fined Coinbase‘s Irish arm €3.25m for getting it wrong for most of five years.
If you keep cash or coins with an exchange, safeguarding rules are the thing standing between your balance and whatever else the firm is dealing with. They require customer money to be held apart from the company’s own, in an account at a bank, and checked often enough that a shortfall shows up fast. A regulator has now decided one of the largest exchanges in the world was not doing that properly in Europe for years. Nobody has alleged the money went missing. The point of the rules is that the question should never need asking.
What safeguarding actually requires
When you put euros or pounds into an exchange account, that balance is usually electronic money rather than a bank deposit. There is no deposit protection behind it. What protects it instead is a set of obligations on the firm: hold an equivalent amount in a designated account at a credit institution, keep it separate from company money, reconcile it regularly so the total always matches what customers are owed, and never use it as working capital.
The test is not whether the business is healthy. It is whether the money can be identified as yours and returned to you if the business stops being healthy.
What the Central Bank said
In its press release announcing the enforcement action, the Central Bank of Ireland said Coinbase Ireland “placed excessive reliance on the U.S.-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls”. It also said the firm “failed to adequately safeguard customers’ funds, both through inadequate system design and insufficient control testing”.
Outsourcing is permitted. A regulated Irish subsidiary can run on systems built by its American parent. What it cannot do is treat that as a substitute for its own oversight, because the licence, and the liability, sit in Dublin.
The substantive text of the Central Bank’s release did not load when we checked it. Later reporting from CryptoSlate and The Defiant has since filled in part of what the regulator found, and the rest of the detail below comes from Coinbase’s own statement as reported by CoinDesk.
The account that comes from Coinbase
Silvergate was one of the two American banks that crypto firms leaned on for dollar payments, and in early 2023 it ran into trouble and wound down. Companies banking there had very little time to find somewhere else.
According to Coinbase, during that period it instructed 30 customers to deposit funds into an alternate account it held at another US bank, which mixed those funds with the customers of a different Coinbase entity. The company also says coding errors left the Irish safeguarding account underfunded by an average of 0.54% across 2023 and the first half of 2024. The Defiant, reporting on the regulator’s findings, puts the shortfall at €5.2m in 2024 before Coinbase corrected it.
Coinbase’s statement says: “No customer suffered any financial loss as a result of these matters, and no customer was ever unable to access their funds.” Its blog post is headed “Resolving past safeguarding issues: our settlement with the Central Bank of Ireland”.
The regulator reached the same conclusion on harm, which it had not done in the material we could see when this was first published: CryptoSlate reports the Central Bank found no evidence of actual consumer detriment. That settles the question of outcomes without touching the one the fine is actually for, which is whether the controls were designed and tested properly in the first place. CoinDesk, citing its own earlier reporting, notes this follows a separate €21.4m penalty against Coinbase Europe in November 2025 over anti-money-laundering failures.
What it means for UK customers
UK users contract with Coinbase’s UK entity, registered with the Financial Conduct Authority, so this is not a penalty against the company holding British balances. The obligations are closely comparable, though, and the timing is awkward: the FCA is bringing crypto firms into full authorisation for the first time, and safeguarding is precisely the sort of requirement applicants will be held to once they are through the gate.
For anyone weighing how much to leave sitting on an exchange at all, the practical options have not changed. We cover the trade-offs in our guide to self-custody, and the company’s fees and protections in our Coinbase review.
What to watch
The High Court step. Sanctions under the Central Bank’s Administrative Sanctions Procedure do not take effect until the court confirms them, and both CryptoSlate and The Defiant report that confirmation is still outstanding even though Coinbase has accepted the penalty. Until it happens, the €3.25m is agreed rather than enforceable, which is a distinction most coverage of the fine has skipped over.
Watch also for the full settlement notice, which would set out the specific contraventions and whether the figure includes the discount the Central Bank normally applies when a firm settles rather than contests. We could not establish the discount point from the material available.
Beyond that, whether European and UK regulators start treating safeguarding reviews as routine for crypto firms rather than exceptional. Two Irish fines against Coinbase entities inside a year suggests the enforcement side of these regimes has stopped being theoretical.