Irish Central Bank Fines Coinbase Ireland $3.6 Million Over Customer Fund Safeguarding

Table of Contents

• You might want to know
• Main Topic
• Key Insights Table
• Afterwards...

You might want to know

• Why did Ireland’s central bank impose a 3.25 million-euro ($3.6 million) penalty on Coinbase Ireland?
• What did Coinbase say about the impact of the safeguarding issues on customers?

Main Topic

Ireland’s central bank fined Coinbase Ireland 3.25 million euros ($3.6 million) over alleged failures to meet obligations for safeguarding customer funds and overseeing outsourced services. The Central Bank of Ireland (CBI) said the cryptocurrency exchange’s Irish division had not established an adequate framework to govern outsourcing. Its findings also addressed the systems and controls used to protect funds held for customers.

Safeguarding requirements are intended to keep customer money properly protected and distinct from funds that may belong to a company or other customers. Firms are expected to maintain sufficient funding in safeguarding accounts, monitor those accounts, and have procedures for reporting material changes to regulators. Outsourcing rules, meanwhile, require companies to retain effective oversight of services performed by third parties, including related entities within a corporate group.

According to the CBI, Coinbase Ireland relied excessively on its U.S.-based parent group to implement safeguarding processes and controls. The regulator said the Irish business failed to safeguard customers’ funds adequately because of weaknesses in system design and insufficient testing of controls. The central issue was not simply whether a shortfall ultimately caused customer losses; regulators also assess whether systems are designed and monitored to meet obligations consistently.

Coinbase disclosed that coding errors contributed to an account being underfunded by an average of 0.54% in 2023 and the first half of 2024. The company also described situations in which euro withdrawals by customers based in the U.S. or the U.K. were paid from Coinbase Ireland’s safeguarding account. These arrangements raised concerns about whether funds were held and administered in accordance with the rules applicable to the Irish entity.

One example cited by Coinbase involved the period when crypto-friendly bank Silvergate was on the verge of collapse in 2023. Coinbase said it instructed 30 customers to deposit funds into an alternate account held by Coinbase at another U.S. bank. The funds were consequently held alongside funds belonging to customers of another Coinbase entity. The company acknowledged that this arrangement breached safeguarding requirements.

The episode illustrates how operational decisions made during periods of financial uncertainty can create regulatory risks. Moving funds to an alternate account may be intended as a practical response to a banking disruption, but the arrangement still needs to comply with rules governing whose money is held, where it is held, and how it is segregated. A company’s internal procedures must also make it possible to identify and correct account or coding problems in a timely way.

The CBI’s criticism focused both on the specific safeguarding outcomes and on the governance behind them. Reliance on a parent company or another service provider does not remove a regulated firm’s responsibility to oversee the services it uses. A robust framework generally requires clearly assigned responsibilities, ongoing monitoring, effective testing, and escalation procedures when a material issue is identified. The regulator’s statement emphasized that Coinbase Ireland’s framework and controls did not adequately meet these expectations.

Coinbase said that the shortcomings did not cause customers to lose money or prevent them from accessing their funds. In its statement following the CBI announcement, the company said: “No customer suffered any financial loss as a result of these matters, and no customer was ever unable to access their funds.” This statement describes the company’s account of the customer impact. The fine, however, reflects the regulator’s view that safeguarding and outsourcing obligations must be met regardless of whether a customer loss is ultimately reported.

The penalty follows a separate Irish regulatory action against another Coinbase entity. Almost one year earlier, the CBI fined Coinbase Europe 21.4 million euros for breaches of anti-money laundering (AML) obligations between 2021 and 2025. That earlier case concerned AML compliance, while the fine against Coinbase Ireland concerns safeguarding customer funds and the governance of outsourced services. The two actions involve different regulatory responsibilities and entities within the Coinbase group.

Coinbase Global, whose stock ticker is COIN, was identified in the report with a price of $169.86. The fine itself was imposed on Coinbase Ireland, not on every company or division associated with the wider group. The distinction matters because regulated entities can have separate legal obligations, even when they share services, systems, or group-level resources. The CBI’s findings highlight that local regulatory accountability remains relevant when operations are supported by a parent company based in another country.

For customers, the company’s statement that no one lost money or was unable to access funds is an important part of the account. For regulators, however, preventing a loss is only one element of consumer protection. Safeguarding rules are designed to reduce the possibility of harm before it occurs, while governance and control requirements help ensure that customer assets can be identified, monitored, and protected under different operating conditions.

The case also underscores the practical importance of accurate account reconciliation and software controls. Coding errors can affect the calculation or movement of funds, while poorly designed processes may make it harder to detect a shortfall. Regular testing, clear ownership of reconciliations, and prompt escalation can help a firm spot discrepancies and respond appropriately. Where services are outsourced, the regulated company still needs a reliable way to verify that those services are being delivered in line with its legal responsibilities.

Coinbase’s case therefore brings together several connected issues: the separation of customer funds, the design and testing of internal systems, oversight of group and outsourced services, and procedures for dealing with exceptional events. The CBI’s fine sends a clear regulatory message that financial firms operating in Ireland are expected to maintain effective safeguards even when key systems or processes depend on providers elsewhere in the corporate group.

Key Insights Table

Afterwards...

The case points to continuing regulatory attention on how financial and cryptocurrency firms protect customer assets, supervise outsourced operations, and respond to system weaknesses. Firms that rely on group-level services will need to demonstrate that local entities maintain meaningful oversight, testing, and reporting procedures. For Coinbase Ireland, the fine closes a regulatory enforcement process but also highlights the need for sustained improvements in safeguarding governance. More broadly, the outcome reinforces that customer protection depends not only on avoiding losses, but also on maintaining controls designed to prevent them.

The source publication also disclosed that CoinDesk is part of Bullish (NYSE:BLSH), a global digital asset platform focused on institutional markets that provides market infrastructure and information services. Bullish owns and invests in digital asset businesses and digital assets, and CoinDesk employees, including journalists, may receive Bullish equity-based compensation. CoinDesk stated that its journalists follow editorial policies and that the organization has adopted principles intended to support integrity, editorial independence, and freedom from bias.