Coinbase Ireland has agreed a €3.25 million settlement over failures to safeguard customer funds and oversee outsourced operations, with the sanctions still requiring confirmation by Ireland’s High Court.
The Central Bank of Ireland announced the action on October 22. It covers breaches of electronic-money rules between November 2020 and August 2025, including inadequate systems that left the entity’s designated safeguarding account underfunded for extended periods.
Coinbase says the historical issues have been resolved and no customers suffered financial loss or lost access to their funds. The regulator’s findings concern weaknesses in the protections that should have been in place, rather than an announced theft from customer wallets.
An Irish entity remained responsible for customer money
Coinbase Ireland is an electronic-money institution providing fiat services within the wider group. Customers exchange conventional money for electronic money that can be used to purchase crypto assets through the group’s platform.
The central bank found excessive reliance on a US group company and insufficient local expertise to oversee safeguarding. It also identified inadequate internal controls and escalation processes for reporting material changes.
Outsourcing the work does not remove the regulated entity’s responsibility. A firm can use another group company’s technology while remaining accountable for knowing how much customer money it must protect and whether that amount is held correctly.
Segregation matters if a business fails
Safeguarding separates money owed to customers from funds used for other purposes. Accurate calculations and correctly designated accounts are therefore more than an accounting preference: they support the ability to identify and return customer money if the institution stops operating.
A customer may be able to use a service normally while its internal arrangements fall short of those requirements. The absence of an immediate loss does not demonstrate that the protections would have worked as intended during an insolvency.
Conversely, a finding that protections were inadequate does not justify claiming that customers have already lost the amounts involved. The distinction between a control failure and an actual realised loss is central to this case.
The discounted penalty needs court confirmation
The regulator assessed a penalty of €4,646,597 and applied a 30% settlement discount, reducing it to €3,252,618. Coinbase Ireland admitted the contraventions and accepted the sanctions, according to the central bank.
The High Court must confirm them before they take effect. This is an agreed enforcement settlement awaiting that procedural step, rather than a claim that the court has already issued its confirmation.
In its own statement, Coinbase said it had strengthened the calculation process, introduced additional technical controls and added safeguarding expertise. Those are the company’s descriptions of remediation.
For customers comparing crypto services, the case underlines the importance of identifying the legal entity responsible for each part of an account. Fiat balances, crypto custody and transactions may involve different obligations even when they appear inside the same application.