Coinbase Ireland Fined $3.6M by Central Bank of Ireland
The Central Bank of Ireland has reached an enforcement settlement with Coinbase Ireland, imposing a $3.6 million fine for failures to safeguard customer funds and provide adequate oversight of its operations between 2020 and 2025. Coinbase Ireland has admitted the prescribed contraventions and agreed the undisputed facts, though the sanctions require approval from Ireland's High Court before they take legal effect. For accounting firms, auditors, and CFOs advising crypto businesses operating in the EU, this action is a clear marker of where the Central Bank's supervisory attention is now directed — and it has direct implications for how firms using crypto accounting software should document their own safeguarding and outsourcing controls.
What the Central Bank of Ireland Found
The regulator's enforcement notice, published on Thursday 22 October 2026, centres on two categories of failure: the safeguarding of customer funds and the exercise of proper oversight over a sustained five-year period.
Safeguarding breaches
Under Irish and EU regulatory requirements, firms holding client funds in connection with payment or virtual asset services are obliged to keep those funds ring-fenced from their own assets and to put in place arrangements that protect clients in the event of insolvency. The Central Bank found that Coinbase Ireland fell short of these requirements during the period under review. The specific mechanics of the breach have not been set out in full detail in the public notice, but the regulator's framing makes clear that the firm's operational arrangements did not give the Irish entity adequate, independent control over the funds it was responsible for protecting.
Outsourcing and group reliance
The second strand of the enforcement action concerns how Coinbase Ireland structured its reliance on Coinbase's US parent entity. The regulator found that the Irish arm improperly outsourced certain services to the US group company without maintaining the level of oversight that Irish authorisation requires. This is a particularly significant finding in the context of crypto regulation. Many VASP-licensed or e-money-licensed crypto entities in Ireland are subsidiaries or branches of larger US or global groups, and they frequently rely on group-level technology, compliance, and operations teams. The Central Bank is signalling that regulatory authorisation cannot be treated as a brass-plate arrangement: the locally authorised entity must genuinely govern and oversee the services delivered on its behalf.
Coinbase Ireland's own user documentation at the time of the enforcement notice stated that the firm uses "a variety of service providers (some belonging to the Coinbase Group and some not) in the context of outsourcing arrangements." That disclosure, while commercially unremarkable, underlines the structural dynamic the regulator has now scrutinised formally.
The Regulator's Position
Karen O'Leary, the Central Bank's enforcement director, was direct in her public statement. She said firms operating in Ireland "must have the appropriate culture and expertise to comply with the rules, respond to risks and to protect customer interests." She added that the action against Coinbase Ireland "underlines the Central Bank's focus on ensuring that customers are at all times protected and that the integrity of the financial system is maintained."
That language is deliberate. Culture and expertise are not technical compliance concepts — they refer to the quality of the people, governance structures, and risk frameworks that sit behind a licence. A firm can tick the boxes on a regulatory return and still fail this test if its leadership and operational teams do not genuinely own their compliance obligations. The Central Bank is telling the market that it will look past the paperwork.
Timeline: Coinbase Ireland's Regulatory History
Understanding the timeline helps contextualise why this enforcement action covers such a long window.
Key milestones
Coinbase launched its Irish operations in 2018. It received an e-money institution (EMI) licence from the Central Bank in 2019, giving it the ability to issue e-money and provide payment services across the EU under passporting arrangements. In 2022, it secured registration as a virtual asset service provider (VASP) under Irish AML legislation transposing the EU's Fifth and Sixth Anti-Money Laundering Directives. The contraventions identified by the regulator span 2020 to 2025, meaning they began within the first year of the EMI licence being live and persisted for half a decade before the settlement was reached.
That duration matters. It suggests the failings were not isolated incidents but structural features of how the Irish entity operated relative to its US parent — a pattern rather than a one-off lapse.
Accounting and Reporting Implications for Firms
For accounting practices and CFOs advising crypto businesses, this enforcement action generates several concrete considerations, both in terms of audit and reporting obligations and in terms of the internal controls their clients need to have in place.
Client money and safeguarding disclosures
Any firm holding client crypto or fiat assets under an EMI or VASP licence in Ireland should review its safeguarding arrangements as a matter of urgency. Auditors signing off on financial statements or internal control reports for such entities will need to consider whether the safeguarding disclosures in those statements accurately reflect the operational reality, not just the written policy. The gap between what a policy document says and what actually happens operationally is precisely the gap the Central Bank has now formalised in an enforcement notice.
For firms using digital asset accounting software to track client holdings, the software output is only as reliable as the underlying governance that determines which assets are segregated, where they are held, and how they are reconciled. A spreadsheet or software ledger showing correctly segregated balances is not evidence of compliant safeguarding if the operational controls do not match.
Outsourcing registers and third-party governance
The outsourcing dimension of this case is particularly relevant for firms whose crypto clients rely on group or third-party service providers for technology, custody, or compliance functions. Under both the EU's DORA framework (which applies to financial entities from January 2025) and the Central Bank's existing outsourcing guidance, firms must maintain detailed registers of material outsourcing arrangements and evidence that they are actively managing and overseeing those providers. A finding that a locally authorised entity "improperly relied" on a group company is, in accounting terms, a governance and internal controls failure, not just a regulatory one.
Auditors and compliance advisers reviewing crypto clients' control environments should be asking: does the Irish (or EU) entity have genuine visibility into the services delivered by its group or third-party providers? Does it have the ability to intervene, redirect, or terminate those arrangements? Is that evidenced in board minutes, risk committee papers, and vendor management records? Robust crypto bookkeeping software and accounting workflows need to connect to these governance artefacts, not sit in a silo.
High Court approval and timing
One procedural point worth noting for advisers is that the $3.6 million fine does not take effect automatically. Under the Central Bank's enforcement framework, sanctions of this nature require approval from Ireland's High Court. Until that approval is granted, the settlement is not legally final. This means that for firms preparing financial statements for Coinbase Ireland, the liability may need to be treated as a contingent or committed obligation depending on the stage of the court process at the relevant balance sheet date — a judgement that requires careful review of IAS 37 provisions and contingencies standards.
What This Means for the Broader Irish Crypto Market
Ireland has become a significant hub for crypto firms seeking EU market access, in part because of its established financial services ecosystem and its position as a gateway for US and global groups entering the single market. The Central Bank has now demonstrated that it is prepared to take formal enforcement action against a high-profile, globally recognised firm, and that the action can cover a multi-year period rather than a single incident.
For the dozens of other firms that hold Irish EMI licences or VASP registrations and operate through group structures, this is not a background news item. It is a direct signal that the regulator's supervisory methodology includes scrutiny of whether the locally authorised entity is genuinely in control of its operations and its clients' assets. Firms that have historically treated their Irish licence as an administrative gateway while managing operations centrally from London, New York, or elsewhere should treat this enforcement action as a prompt to reassess that model.
The pattern of regulators in AML-intensive jurisdictions challenging group-level outsourcing arrangements is not confined to Ireland. For broader context on how similar scrutiny is playing out across European AML frameworks, see our analysis of Irish Mafia crypto laundering and AML red flags and the linked commentary on how UK bank blocking patterns affect crypto firms operating across borders.
Practical Steps for Accounting Firms and CFOs
Immediate review priorities
Firms advising Irish-licensed crypto entities, or acting as their CFO or finance function, should consider the following actions in light of this enforcement settlement.
First, pull the current outsourcing register and map every material service delivered by a group company or third party. For each one, identify whether the Irish entity has a written agreement, active oversight records, and the contractual right to terminate. If any of those three elements are missing, that is a gap the Central Bank could identify on inspection.
Second, review the safeguarding methodology. This means tracing client funds from receipt through to the designated safeguarding account or custody arrangement and confirming that reconciliations are performed on the frequency required by the licence conditions. The reconciliation records should be maintained in a way that is auditable independently of the group's central systems.
Third, check the board and senior management structure. The Central Bank's reference to "culture and expertise" is a pointer to Senior Executive Accountability Regime (SEAR) obligations. Named individuals need to own these risks formally, not just nominally.
Finally, ensure your crypto accounting software or digital asset accounting software generates audit trails that support — rather than merely summarise — the safeguarding and reconciliation process. A system that produces a clean balance but cannot show the movement history of each client's funds is unlikely to satisfy a regulator that is looking for genuine operational controls.
Frequently Asked Questions
What did Coinbase Ireland admit to in the Central Bank settlement?
Coinbase Ireland admitted the prescribed contraventions and agreed the undisputed facts set out by the Central Bank of Ireland. The admitted failures cover inadequate safeguarding of customer funds and insufficient oversight of its operations, including an improper reliance on its US parent company to deliver certain services, during the period from 2020 to 2025.
Is the $3.6 million fine already in force?
Not yet. Under the Central Bank of Ireland's enforcement framework, sanctions of this type require approval from Ireland's High Court before they take legal effect. The settlement has been reached and the facts agreed, but the fine is not yet legally imposed. Firms preparing financial statements for the affected entity should consider the appropriate accounting treatment under IAS 37 until the court process concludes.
What does "improper reliance" on a group company mean in practice?
When a locally authorised firm outsources material functions to a parent or affiliate, it remains fully responsible for the regulatory quality of those services. "Improper reliance" in this context means the Irish entity did not maintain the governance, oversight, and contractual controls needed to demonstrate that it — rather than the US group — was genuinely managing those services. The Central Bank expects the licensed entity to have the capability and the authority to oversee and, if necessary, replace any group provider.
How should auditors treat the safeguarding failures identified in this action?
Auditors reviewing similar crypto entities should consider whether safeguarding disclosures in financial statements reflect operational reality. The existence of a written safeguarding policy is not sufficient; auditors should seek evidence that client funds are actually segregated, reconciled regularly, and held in a way that would protect clients in an insolvency. The enforcement notice suggests that operational arrangements can diverge significantly from stated policies, and that divergence is an audit risk.
Does this enforcement action have implications beyond Ireland?
Yes. Any crypto firm operating through an EU-licensed subsidiary while managing operations from a non-EU group entity faces the same structural risk. The Central Bank of Ireland's action reflects a broader regulatory expectation, present across EU competent authorities, that the locally authorised entity must be substantively in control of its own operations and client protections. Firms in other EU jurisdictions with similar group structures should review their arrangements in light of this precedent.
Source: Cointelegraph