Coinbase Ireland Fined €3.25M Over Customer Fund Safeguarding

The Central Bank of Ireland has fined Coinbase Ireland €3,252,618 for failing to properly protect customer money for almost five years, between 1 November 2020 and 19 August 2025. The breaches fall under Ireland's Electronic Money Regulations 2011 and cover two duties: safeguarding customer funds and overseeing outsourced work.

Coinbase Ireland admitted the breaches and agreed to the facts. The settlement was reached on 21 October and announced today. It is not final yet, because the High Court must confirm the sanctions before they take effect, and no hearing date has been set.

Customer Money Leaned on a US Parent

Safeguarding sounds dry, but the idea is simple. A firm holding your euros has to keep them in a designated account, set aside for you, so the money is there whatever happens to the company.

The regulator found that Coinbase Ireland fell short of that in several ways:

• It placed excessive reliance on the US-based Coinbase Group to run the safeguarding processes and controls that Irish and EU rules require.
• It did not have enough local skill and expertise to oversee the safeguarding of customer funds at all times.
• Poor system design and too little control testing left its safeguarding account underfunded "for lengthy periods of time."
• It lacked the controls and governance to spot material safeguarding changes and report them to the regulator.

The central bank's language was blunt. It said it has "no tolerance for weaknesses in safeguarding arrangements," and that failing to keep the promises made during authorisation, or to report material changes "as happened in this case is completely unacceptable."

The sanctions are a reprimand and a penalty of €4,646,597. A 30% discount for settling brings the fine down to €3,252,618. The bank says this is its 164th enforcement outcome, taking its total fines to more than €432 million.

Coinbase Explains the Silvergate Moment

Coinbase answered with a blog post titled around resolving past safeguarding issues, and it fills in details the regulator's press release does not mention.

The most human of them dates to 2023. When Silvergate Bank was at risk of failing, Coinbase says its Irish arm directed 30 customers to deposit into a Coinbase, Inc. account at another US bank, so they could keep banking access and avoid exposure to a bank collapse. The catch was that their money then sat alongside funds belonging to customers of another Coinbase entity, which Coinbase itself says was contrary to safeguarding requirements.

It's an understandable crisis decision with an uncomfortable side effect. Coinbase describes a few more of the same kind:

• After the post-Brexit move of European customers, some kept sending money to the old UK deposit accounts, so it mixed with UK customer deposits.
• For liquidity reasons, some euro withdrawals by US and UK customers of other Coinbase entities were paid from the Irish safeguarding account.
• Coding errors left the safeguarding account underfunded by about 0.54% of the total obligation, on average, in 2023 and the first half of 2024. Coinbase says it fixed this within days of finding it in 2024.

That percentage is Coinbase's figure. The regulator's press release gives no number, only that the account was underfunded for long stretches. The Silvergate details also come from Coinbase; the bank's full settlement notice has not been checked against them.

A Careful Apology and a New European Home

Coinbase's framing is calm and fix-it focused. It says its Irish entity self-reported many of these items to the central bank in January 2024 and has since fully fixed them. It says no customer lost money and no customer was ever unable to reach their funds.

It also points to concrete changes: a €25 million guaranty bond as an extra safeguarding layer, a dedicated Head of Safeguarding, and two third-party reviews since January 2025 that it says found no remaining issues. These are Coinbase's own claims, and the regulator's release does not address them.

That combination is a reasonable way to rebuild trust: admit the breach, name the specifics, show the spending. The test is whether the fixes hold, and that is harder to see from outside than a well-written post.

Coinbase has also since moved its European headquarters to Luxembourg. The next step in Ireland is the High Court, which must confirm the reprimand and fine before either takes effect.