Ireland Fines Coinbase Unit €3,252,618 Over Safeguarding Failures
Key Facts
The Central Bank of Ireland announced on October 22 a fine of €3,252,618 against Coinbase Ireland Limited for breaching obligations on safeguarding customer funds and outsourcing. The regulator said the breaches occurred between November 1, 2020 and August 19, 2025, under the Electronic Money Regulations 2011. The sanctions are subject to High Court confirmation before taking effect, making the announcement a stated enforcement step rather than a fine that is effective immediately. The case centers on arrangements for safeguarding customer funds and oversight of outsourced operations. The Central Bank said payment and electronic money firms have a fundamental duty to safeguard customer funds in full, adding that it “has no tolerance for weaknesses in safeguarding arrangements.”
The proposed penalty was €4,646,597 before a 30% settlement discount was applied, bringing the final announced amount to €3,252,618. The Central Bank said the discount was granted under its settlement scheme, and Coinbase Ireland agreed to the sanctions, according to the announcement. They will take effect only after High Court confirmation, with the Central Bank to apply for confirmation as soon as practicable. The decision therefore combines a settlement that reduced the penalty with a judicial step still required to complete its enforcement. The breaches span nearly five years, from late 2020 through August 2025.
The regulator said Coinbase Ireland relied excessively on the U.S.-based Coinbase Group to provide safeguarding services, while the Irish unit lacked sufficient local expertise to oversee customer funds. The Central Bank said the outsourcing model was not accompanied by an appropriate level of local governance and oversight. It also cited shortcomings in the design of systems and testing of controls that allowed the designated safeguarding account to remain underfunded for extended periods. The findings indicate that the case is not limited to a temporary shortfall in the account balance, but also covers how oversight was designed and monitored. The regulator also said internal controls and escalation procedures were insufficient to detect material changes to safeguarding arrangements and report them to the Central Bank.
Coinbase said it identified a number of historical safeguarding issues itself and reported them to the Central Bank in January 2024. The company added that no customers suffered financial losses or lost access to their funds because of the past practices. The company’s account offers one view of how the issues reached the regulator, while the Central Bank’s decision was based on failures in governance, oversight and control design. The fine relates to safeguarding and outsourcing obligations, not the customer data theft incident the company disclosed in May 2025. In a separate Irish case, Coinbase Europe was fined €21,464,734 in November 2025 after transaction monitoring failures led to more than 30 million transactions not being properly monitored over a 12-month period.
In a separate incident in May 2025, Coinbase said attackers paid contractors or employees in support roles outside the United States to obtain customer information. The stolen data included names, addresses, phone numbers and email addresses; masked Social Security and bank account numbers; images of government-issued identity documents; and account snapshots and transaction histories. The company said passwords, private keys and funds were not exposed. In its initial regulatory filing, Coinbase estimated related remediation and voluntary reimbursement expenses at between $180 million and $400 million, noting that the estimate was preliminary and subject to change. It later said in a subsequent filing that it paid $311.2 million during 2025 in connection with the incident, including voluntary customer reimbursements and direct legal costs.
Coinbase said it would reimburse customers who were tricked into sending funds to the attackers and added extra identity checks for large withdrawals from designated accounts. The company had recorded $308 million in other operating expenses in the second quarter of 2025 and said most of that amount was related to costs from the data theft incident it disclosed in May. When the breach was disclosed, Coinbase shares fell 6% near midday trading on May 15, 2025, although they remained up about 22% since the start of that month, supported by gains in Bitcoin and other cryptocurrencies. In the latest trading data cited, the stock closed at $162.32 on October 28, 2026. The company calendar also listed the release of third-quarter results for October 29, while Coinbase set October 30 as a deadline related to stablecoin compliance with MiCA rules; the transition period for issuers of these coins had ended on July 1, 2026, without an extension.