New York ordered Coinbase to pay $50 million and invest $50 million in compliance

On January 4, 2023, the New York State Department of Financial Services and Coinbase, Inc. entered a consent order requiring the cryptocurrency exchange to pay a $50 million civil penalty and spend at least another $50 million improving its compliance program. The order also extended an independent monitor's work for 12 months, subject to further extension by the regulator.

The agreement resolved the New York department's investigation without further proceedings. Its headline value was $100 million, but that sum had two distinct parts: $50 million payable to New York within 10 days of the order's effective date, and no less than $50 million in approved compliance investments over 24 months. It was not a $100 million payment to customers or the state.

What New York found

The consent order traced the case to a supervisory examination begun in May 2020 and covering July 1, 2018, through December 31, 2019. The department said it found serious deficiencies in know-your-customer and customer-due-diligence procedures, transaction monitoring, anti-money-laundering risk assessments and sanctions screening. An enforcement investigation began in 2021.

The most visible measure of the problem was a backlog. By the end of 2021, according to the order, Coinbase had more than 100,000 unreviewed transaction-monitoring alerts, many months old, while more than 14,000 customers required enhanced due diligence. The order attributed the strain partly to rapid growth: customer sign-ups in May 2021 were 15 times January 2020 levels, and monthly transactions in November 2021 were 25 times January 2020 levels. Those multiples are regulatory findings tied to Coinbase's internal activity; they are not industry-wide market statistics.

The department found violations involving unsafe and unsound conduct, an ineffective Bank Secrecy Act and anti-money-laundering program, inadequate transaction monitoring and failure to report a cybersecurity incident properly. It also said some suspicious-activity reports were filed months late. The order recorded mitigating factors, including Coinbase's cooperation and remediation spending, while describing the compliance failures as an aggravating factor.

The remedy was operational, not only financial

The independent monitor had been engaged since April 2022 under an earlier memorandum. The January 4 order continued that monitorship for another year. Coinbase also had to submit, within 60 days, a detailed plan for the $50 million compliance investment and provide quarterly progress and spending updates after approval.

Coinbase's same-day account acknowledged historical shortcomings and framed the concerns around its 2018–2019 program and backlogs that expanded with growth in 2021. The company said it had built new anti-money-laundering and sanctions tools, enhanced transaction monitoring, introduced dynamic customer-risk scoring and expanded enhanced due diligence. Those were Coinbase's contemporaneous descriptions of its remediation; the January 4 record did not independently establish that every measure was fully effective. Indeed, the consent order said further improvement remained necessary.

Why the order mattered

The action showed how New York was applying bank-like supervision to a licensed digital-asset intermediary. Coinbase had held New York virtual-currency and money-transmitter licenses since 2017, so the case did not turn on whether a token was a security. It turned on whether a regulated exchange could scale customer checks, alert review, recordkeeping and incident reporting alongside trading activity.

That distinction matters for the event-day record. The settlement was evidence of serious compliance failures and a costly supervisory response, not evidence that Coinbase was insolvent, that customer assets were missing, or that a blockchain protocol had failed. No cryptocurrency price or on-chain measurement is used here, and no causal market-move claim is made. This reconstruction stops with information documented on January 4, 2023; later regulatory or compliance outcomes are outside its event-day frame.