Coinbase Ireland agrees €3.25 million sanction over safeguarding gaps

Coinbase Ireland has accepted a €3,252,618 sanction after Ireland’s central bank found prolonged failures in how the company calculated, segregated and supervised customer funds used for fiat services on Coinbase’s cryptocurrency platform.

The Central Bank of Ireland’s settlement record says calculation errors left Coinbase Ireland’s designated safeguarding account underfunded every day from January 1, 2023, through June 27, 2024. The sanction is not yet effective: Ireland’s High Court must confirm it unless the court finds it manifestly disproportionate.

That unfinished legal step gives the October 22 disclosure continuing significance. The case concerns customer fiat money held by a regulated electronic-money institution, not cryptocurrency stored in Coinbase wallets, and the regulator found no evidence that customers ultimately suffered financial loss.

Shortfalls persisted across an 18-month window

Electronic-money institutions must reconcile customer liabilities against money held in designated safeguarding accounts. The segregation is intended to improve customers’ ability to recover funds if the institution becomes insolvent.

The settlement notice says a timing problem entered Coinbase Ireland’s reporting system after data-table changes in July 2022. Incomplete information then flowed into the report used to calculate the company’s daily safeguarding obligation.

The resulting account shortfalls reached a maximum of €3.4 million during 2023 and €5.2 million during 2024. Across the regulator’s measurement period, the average daily shortfall equaled 0.54% of the safeguarding obligation. That obligation averaged €323 million in 2023 and €470 million in 2024.

Those figures are not customer losses. They measure the difference between the regulated entity’s calculated obligation and the money present in its designated account on the relevant days. The regulator said customers faced potential harm if Coinbase Ireland had become insolvent while the account lacked sufficient funds.

The timing mismatch persisted from July 2022 until an underlying fix was installed in October 2024, a 27-month period in the regulator’s chronology. A separate failure to include certain unmatched incoming funds affected reconciliation calculations for approximately nine months, from September 2023 through June 2024.

Outsourcing did not transfer responsibility

The central bank also found that Coinbase Ireland relied excessively on its United States-based parent group to perform safeguarding functions without maintaining enough local expertise or oversight. It classified that outsourcing contravention as reckless and three related safeguarding and notification contraventions as negligent.

The settlement covers conduct between November 1, 2020, and August 19, 2025. The notice says customer funds were mixed with money associated with other Coinbase entities in several circumstances, including deposits sent through legacy accounts and withdrawals for customers contracted with non-Irish affiliates.

Daily treasury rebalancing later moved money between accounts, according to Coinbase, but that did not cure the initial segregation breaches. The company also failed to notify the central bank promptly about material changes to arrangements described during its authorization process.

Court confirmation remains outstanding

The regulator initially calculated a €4,646,597 penalty, including an aggravating adjustment for Coinbase Ireland’s failure to address earlier regulatory requirements adequately. A 30% settlement discount reduced the accepted amount to €3,252,618. Both figures come from the regulator’s sanction methodology and are not estimates of customer exposure.

Coinbase says it self-reported several issues in January 2024, corrected the calculation errors and found no instance in which a customer lost money or could not access funds. It also says two third-party reviews conducted since January 2025 found no remaining issues and that it added a €25 million guarantee bond. The company did not identify those reviewers in its public statement, limiting independent assessment of that assurance.

The Central Bank of Ireland and Coinbase Ireland reached the settlement on October 21 and announced it on October 22. Coinburn is reporting it on October 26. The next legally meaningful event will be the High Court’s confirmation decision; until then, the reprimand and monetary sanction have been accepted but have not taken effect.