Coinbase Ireland fined €3.25 million over customer fund safeguarding failures

Coinbase's Irish e-money subsidiary was fined €3,252,618 (about $3.6 million) and reprimanded by the Central Bank of Ireland for breaching rules on safeguarding customer funds over a period of four years and nine months. The central bank announced the sanction on Oct. 22, and the settlement notice published with it said the account meant to hold customer money had been short of funds for more than two years. It is the second penalty for a Coinbase entity in Ireland in about a year, after Coinbase Europe was fined €21.46 million for anti-money laundering monitoring failures.

A customer-funds account that ran short for over two years

The sanctioned firm is Coinbase Ireland Limited. It takes in euros, pounds and dollars from customers and issues e-money, which customers then use to buy crypto assets on the Coinbase platform. Ireland's e-money rules require such funds to be kept apart from the firm's own money and anyone else's, and placed in a separate safeguarding account at a bank by the end of the next business day, so customers can be repaid even if the firm fails.

According to the settlement notice released by the central bank, Coinbase Ireland changed the data tables used to calculate how much belonged in the safeguarding account in July 2022. The change left the calculation report with incomplete information, and the account was underfunded from July 2022 to October 2024. From Jan. 1, 2023, to June 27, 2024, it was short every single day. The largest daily shortfall was €3.4 million in 2023 and €5.2 million in 2024, against average safeguarding obligations of €323 million and €470 million, respectively. The central bank said that had the firm become insolvent during that time, the account would not have held enough to cover what customers were owed.

As Silvergate failed, 30 clients' dollars went to the wrong account

Customer money was also mixed with another entity's funds. On March 2, 2023, just before the collapse of Silvergate Bank in the U.S., Coinbase Ireland told 30 institutional clients to send dollars to Signature Bank instead of Silvergate. That account, however, belonged to U.S. parent Coinbase Inc., not the Irish entity. When Signature Bank also failed on March 12, deposits were redirected to another Coinbase Inc. account, at Cross River Bank.

1. Nov. 2020More than 6.3 million customers move from Coinbase UK to the Irish entity after Brexit; some keep depositing into the UK account
2. July 2022Data tables behind the safeguarding calculation are changed, and the shortfall begins
3. March 2, 202330 institutional clients are told to deposit into a Coinbase Inc. account
4. Jan. 2024The firm reports some of the issues to the central bank; on Jan. 19 it stops paying other entities' customers' euro withdrawals from the Irish safeguarding account
5. Oct. 2024Underlying calculation error fixed; settlement account opened in the Irish entity's own name
6. Aug. 19, 2025Deposits blocked for the last 33 users still paying into the UK account
7. Oct. 21, 2026Settlement reached with the central bank, announced Oct. 22

The institutional clients' money was mixed with Coinbase Inc. funds for about 19 months. Coinbase Ireland argued that deposits were recorded on individual customer ledgers and protected by U.S. deposit insurance, but the central bank rejected that, saying it did not change the fact that the funds were not held in a segregated account in the Irish entity's name. Separately, some customers who moved over from the UK after Brexit kept depositing into the old Coinbase UK account, a problem that lasted almost five years, from November 2020 to August 2025.

Oversight left to the U.S. parent, without local expertise

The central bank said failures in outsourcing oversight had seriously weakened the firm's safeguarding controls. Coinbase Ireland placed excessive reliance on the U.S.-based Coinbase Group to run the processes and controls needed to meet Irish and EU rules, and did not have sufficient local skill and expertise to oversee the core function of safeguarding customer funds. The regulator said the firm had not properly completed two risk mitigation programmes it was given in July 2022 and March 2023, and raised the base penalty of €4,425,330 by 5%. A 30% settlement discount was then applied to the resulting €4,646,597. The sanction takes effect only once confirmed by Ireland's High Court.

"We have no tolerance for weaknesses in safeguarding arrangements."

Karen O'Leary, Director of Enforcement, Central Bank of Ireland

According to The Block, Coinbase said the issues had been fully resolved and that no customer lost money or access to funds. The company said it self-reported several of the problems in January 2024 and has strengthened its safeguarding controls. The case is the central bank's 164th enforcement outcome, bringing total fines to more than €432 million. Coinbase moved its crypto trading business to a Luxembourg entity under the EU's Markets in Crypto-Assets Regulation (MiCA), and the central bank said the Coinbase Group does not operate any crypto-asset service providers (CASPs) in Ireland.

In South Korea, won deposits are held by banks

Exchanges in South Korea face a similar duty. Article 6 of the country's Virtual Asset User Protection Act requires exchanges to keep users' deposits separate from their own assets, place them with banks or other designated institutions, and state that the money belongs to users. If an exchange's registration is cancelled or it goes bankrupt, the bank must pay those deposits back to users first when they claim them. Article 7 requires exchanges to keep users' coins separate from their own and to actually hold the same type and quantity of coins entrusted to them. Coinbase does not operate a Korean won trading service in South Korea.