- Trending
- Comments
- Latest
The enforcement action centres on weaknesses in the systems used to calculate daily safeguarding requirements and transfer the necessary funds into protected accounts. According to reporting by FinanceFeeds, citing settlement documents, calculation errors began in July 2022 and contributed to daily funding shortfalls that persisted for at least 18 months.
The reported shortfalls reached €3.4 million on the largest affected day in 2023 and €5.2 million in 2024. Average safeguarding obligations were approximately €323 million in 2023 and €470 million in 2024, according to the same report.
Safeguarding requirements are designed to protect money held on behalf of customers by ensuring that the appropriate funds are maintained separately from a firm’s own money and other assets. When a financial institution fails to meet these requirements, customers may face additional risks if the firm experiences financial distress or operational disruption.
The reported funding gaps do not, by themselves, establish that customers lost money. Coinbase has maintained that all customers retained access to their funds and that the deficiencies did not result in customer financial losses.
The Central Bank of Ireland identified inadequate local oversight of safeguarding activities delegated to Coinbase’s US-based group. It also pointed to insufficient Irish expertise, weaknesses in system design and testing, and failures to report material changes appropriately.
The regulator emphasised the importance of meeting these obligations, particularly for firms responsible for handling customer money.
“Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds,” said Karen O’Leary, the central bank’s enforcement director.
The settlement underscores the distinction between a company’s overall financial position and its day-to-day compliance with customer protection requirements. Even where a business reports no customer losses, failures to maintain the required safeguards can still constitute regulatory breaches.
In its explanation of the settlement, Coinbase described several historical practices that contributed to the safeguarding problems. These included the movement of customer deposits between group entities, payments involving accounts outside Ireland and weaknesses in the processes used to calculate safeguarding requirements.
One significant episode occurred during the US banking crisis in 2023. According to Coinbase’s published account, the company redirected 30 customers from its Silvergate account to an account held by Coinbase Inc. at another US bank.
The exchange acknowledged that the arrangement resulted in Irish customers’ money being mixed with funds belonging to other customers. Although the company continued making daily transfers into the Irish safeguarding account, it said those transfers did not prevent the initial mixing of funds.
A separate problem arose after Brexit, when some European customers continued sending deposits to old UK accounts despite having received updated Irish banking details. Coinbase said it subsequently blocked deposits sent to the incorrect accounts.
The company also acknowledged that certain euro withdrawals for customers in the United States and the United Kingdom were paid from the Irish safeguarding account. It recognised that this arrangement did not comply with the applicable regulatory requirements.
These practices illustrate the operational challenges that can arise when a financial services company serves customers across multiple jurisdictions while relying on shared banking infrastructure and centralised group systems.
However, the Central Bank of Ireland’s findings indicate that the issue extended beyond individual payment arrangements. The regulator identified weaknesses in the governance and oversight of outsourced safeguarding functions, as well as shortcomings in the controls designed to identify and prevent errors.
Coinbase said it reported several issues to the regulator in January 2024 and corrected most of the underlying control weaknesses during that year. The company subsequently introduced changes to its technical controls and safeguarding calculations.
In its October 22 statement, Coinbase said the historical problems had been fully resolved. The settlement nevertheless establishes that the company’s earlier arrangements did not consistently meet the standards required under Irish electronic money regulations.
The enforcement action comes as Coinbase continues to reorganise its European operations under the European Union’s evolving cryptocurrency regulatory framework.
Under its customer guidance, Coinbase Ireland remains responsible for electronic money services, which are governed by Irish law. Cryptocurrency services are handled by Coinbase Luxembourg, operating under the relevant Luxembourg regulatory framework.
The distinction is important because electronic money and crypto-asset services are subject to different regulatory arrangements. The Irish enforcement action concerns safeguarding obligations associated with electronic money, rather than directly addressing the licensing of Coinbase’s broader cryptocurrency business.
Coinbase secured a licence under the EU’s Markets in Crypto-Assets Regulation, commonly known as MiCA, in Luxembourg in June 2025. The authorisation provided a regulatory basis for the company to offer eligible crypto-asset services across the European Union.
On June 25, 2026, Coinbase announced the opening of an office in Luxembourg, reinforcing the country’s role as its European cryptocurrency hub. The company said its Luxembourg entity would provide crypto-asset services across the European Economic Area through the EU passporting framework.
The company has also introduced phased changes to customer agreements as part of its European restructuring. Its published guidance identifies August 18, 2025, as the effective date for certain customers in Hungary, Iceland, Liechtenstein and Malta. Italy and the Netherlands followed on September 15, while Ireland was among the countries assigned an October 23 effective date.
According to Coinbase, customers are notified before changes to their agreements take effect. Those who do not accept the updated terms have 30 days from the applicable effective date to withdraw their assets and close their accounts.
The revised terms also require affected customers to consent to the Luxembourg entity executing trades outside EU trading venues, including on Coinbase Exchange. Coinbase instructs customers to confirm their consent when signing in after the relevant changes become effective.
The restructuring places the company’s European cryptocurrency services under a central regulatory framework while leaving its Irish entity responsible for electronic money activities. The €3.25 million settlement highlights why the latter responsibilities remain significant even as the company consolidates other services elsewhere in Europe.
The safeguarding settlement is not the first major enforcement action involving Coinbase’s Irish operations. In November 2025, Coinbase Europe accepted a separate €21.5 million settlement concerning deficiencies in anti-money laundering and counter-terrorist financing transaction monitoring.
That earlier case involved more than 30 million transactions valued at over €176 billion that were not properly screened during a 12-month period. According to reporting on the enforcement findings, retrospective reviews took almost three years to complete.
The delayed monitoring resulted in 2,708 suspicious transaction reports being submitted to Ireland’s Financial Intelligence Unit, according to the account of the earlier case. Coinbase Europe also admitted failures involving its policies and controls, including the additional monitoring required for nearly 185,000 transactions.
The penalty was reduced by 30% from approximately €30.6 million to €21.5 million through the settlement process. The findings concerned transaction-monitoring systems and internal procedures intended to prevent and detect money laundering and terrorist financing.
The two cases address different regulatory responsibilities. The earlier enforcement action focused on financial crime controls, while the latest settlement concerns the protection of customer money and the oversight of safeguarding arrangements.
Taken together, the cases demonstrate the breadth of compliance obligations facing cryptocurrency businesses operating within regulated financial systems. Firms must maintain effective safeguards for customer assets while also ensuring that their transaction-monitoring systems, internal procedures and reporting arrangements meet regulatory standards.
For Coinbase, the latest agreement also reinforces the need to maintain effective oversight when critical functions are managed across international group structures. Outsourcing operational responsibilities does not remove the regulated entity’s obligation to ensure that those functions comply with local law.
The €3.25 million penalty will take effect once the High Court confirms the sanctions. Until then, the settlement remains subject to judicial approval, while Coinbase maintains that the historical safeguarding deficiencies have been addressed and that customers did not experience financial losses.
Copyright © 2025 - The Bit Gazette.
