The Central Bank of Ireland has fined Coinbase Ireland €3.25 million for breaching the rules that require customer funds to be kept safely separate — a penalty that reads less like a story of missing money than a warning about who is actually watching the money. Announced on 22 October 2026 and settled the previous day, the fine covers conduct between November 2020 and August 2025.
The central finding is about outsourcing. Coinbase Ireland, the group’s e-money arm, leaned on its US parent to run almost every part of its safeguarding function: the daily reconciliation of the designated safeguarding account, the systems that track customer balances, and the calculation of how much it was obliged to hold. The people overseeing that work sat outside Ireland, and the Central Bank concluded the firm lacked sufficient local expertise to supervise the core job of protecting customer funds.
The consequence was measurable. The designated safeguarding account was underfunded on a daily basis for at least eighteen months. The gaps were small as a share of the whole — an average daily shortfall of 0.54% against obligations that averaged €323 million in 2023 and €470 million in 2024 — but the peaks were real: €3.4 million in 2023 and €5.2 million in 2024. Customer money was also mixed with other funds. Around thirty institutional customers’ balances sat in a Coinbase Inc. account for roughly nineteen months, and after Brexit more than 6.3 million customers migrated from Coinbase UK, some of whom kept depositing into the wrong account for years.
None of this is alleged to have lost anyone money. The settlement notice records that the failure of Signature Bank in March 2023 did not result in the loss of customer funds, and the problem was structural rather than a theft: customer money was not isolated as thoroughly as the rules demand, in case a wind-down ever became necessary.
The fine’s arithmetic is also worth reading. The Central Bank set the penalty at €4,646,597 before applying a 30% settlement discount, which brought it down to €3,252,618. That headline figure sits far below the €10 million ceiling available in this case — a reminder that the regulator’s point here is corrective rather than confiscatory.
Two details temper the headline. The fine is not yet in force, because under Ireland’s regime it must be confirmed by the High Court. The remediation also largely predates the announcement: Coinbase Ireland flagged safeguarding issues to the regulator in January 2024, appointed a dedicated safeguarding individual in December 2024, and closed its risk-mitigation programme in June 2026 after third-party assurance.
The strategic context is MiCA. Coinbase has moved its EU crypto-facing business to a Luxembourg entity authorised as a crypto-asset service provider, leaving Coinbase Ireland as the cash-and-fiat layer. The regulator’s message is that the Dublin entity will be held to the full letter of European safeguarding law no matter how much of its support sits inside a US parent. For readers, the durable lesson is simpler: keeping customer funds safe is a governance discipline, not a one-time compliance exercise.
Source: BlockchainReporter.