Coinbase Ireland Fined €3.25 Million Over Fund Segregation Failures
The Central Bank of Ireland has issued a €3.25 million fine against Coinbase Europe Limited's Irish operation (referred to in the regulatory notice as CBIE) for serious breaches of customer fund safeguarding and outsourcing requirements under the Electronic Money Regulations. The regulator concluded that the failures could have prevented customers from promptly recovering their funds had the firm become insolvent, a finding that carries direct implications for any accounting firm or CFO advising clients who rely on regulated crypto intermediaries to hold or process digital assets.
What the Central Bank Found
The regulator's enforcement notice, published on 22 October 2026, sets out two broad categories of breach: failures in customer fund safeguarding, and failures in outsourcing governance.
Fund Safeguarding Shortfalls
At its peak in 2024, the daily safeguarding shortfall reached €5.2 million (approximately $5.8 million). The root cause was structural: the Irish entity could not accurately calculate how much it was obligated to safeguard on a daily basis, because of an underlying data issue that was not fully remediated until October 2024.
The most operationally significant finding relates to approximately 30 institutional clients who, for roughly 19 months between March 2023 and October 2024, deposited US dollars into bank accounts held in the name of Coinbase Inc., the US parent, rather than accounts in Coinbase Ireland's own name. Client funds were therefore commingled with money held by other group entities rather than being ring-fenced at the Irish entity level. Separately, funds belonging to customers who migrated from Coinbase UK continued to sit in the UK entity's safeguarding account until August 2025.
The Central Bank stated explicitly that this arrangement was incompatible with the firm's wind-down strategy obligations. In a worst-case insolvency scenario, the absence of proper segregation at the entity level would have made it materially harder for a liquidator to identify and return client money quickly.
Outsourcing and Governance Failures
The second category of breach concerns how Coinbase Ireland managed its reliance on group infrastructure. The regulator found that the Irish entity lacked the internal skills and experience needed to provide effective oversight of the outsourced safeguarding provider (OSP), and that this gap compounded the safeguarding failures. The Central Bank had raised governance concerns in letters issued in July 2022 and March 2023, but the notice records that those concerns were not adequately resolved.
Coinbase Ireland appointed a dedicated safeguarding officer only in December 2024, well after the period of non-compliance. The regulator's language on this point is pointed: the firm "committed serious outsourcing breaches" that had "a material impact on its ability to safeguard."
Timeline and Penalty Structure
Key Dates
Coinbase incorporated its Irish subsidiary in Dublin in July 2018. The firm received an e-money licence from the Central Bank in 2019 and obtained virtual asset service provider (VASP) registration from the same regulator in 2022. The safeguarding issues covered in this notice span primarily from March 2023 to late 2024, with some remediation steps taken in mid-2024 and the data fix completed in October 2024. Coinbase self-reported several of the issues to the Central Bank in January 2024.
Fine and Discount
The gross penalty stood at €4,646,597 (approximately $5.2 million). Under the Central Bank's settlement framework, Coinbase Ireland accepted a 30% discount, bringing the final figure to €3.25 million. The firm also accepted a formal reprimand. Both the fine and the reprimand require confirmation by the High Court before they take legal effect.
Coinbase has stated publicly that no customers lost money and none were unable to access their funds. The firm says it has since strengthened its safeguarding controls and considers the matter resolved.
Context: A Second Major CBI Action Against the Coinbase Group
This penalty follows a separate €21.5 million fine issued against Coinbase Europe in November 2025, which related to transaction-monitoring failures. In that case, more than 30 million transactions went unmonitored, producing 2,708 late suspicious transaction reports. Together, the two enforcement actions suggest the Central Bank had longstanding concerns about the depth of compliance infrastructure supporting Coinbase's European operations relative to the scale and complexity of the business.
The sequencing matters for accounting and compliance advisers. The 2025 action targeted AML controls; the 2026 action targets safeguarding and governance. These are distinct regulatory pillars, and regulators treating them as separate enforcement tracks is consistent with how MiCA enforcement is evolving across EU member states, where conduct obligations, prudential safeguarding, and AML requirements are being assessed and enforced individually rather than bundled together.
Accounting and Regulatory Implications for Firms
Client Money Classification and Balance Sheet Risk
For accounting firms preparing financial statements for clients that hold digital assets on a regulated platform, this case raises a material question: are the assets genuinely off-balance-sheet from the platform's perspective, and are they properly segregated at the entity level that your client actually contracted with? The Central Bank's finding that institutional client deposits sat in a US parent entity's accounts for nearly 19 months illustrates that group-level safeguarding arrangements can create unexpected legal and accounting risk for the end client.
Under both IFRS and Irish GAAP, the substance of the arrangement determines whether client money qualifies as a liability of the platform or is genuinely held in trust. Where segregation breaks down, the accounting treatment may be more complicated than a straightforward off-balance-sheet position. Firms acting as auditors or reporting accountants for platforms or their clients should document the legal entity structure underpinning any safeguarding arrangement as part of standard working papers.
Outsourcing Risk and the OSP Model
The regulatory finding that Coinbase Ireland lacked local expertise to oversee its outsourced safeguarding provider has a direct read-across to any firm advising a crypto business that relies on group shared-service infrastructure. Regulators across the EU, and particularly the Central Bank of Ireland, are now clearly willing to treat inadequate OSP oversight as a standalone breach, not simply as evidence of a broader systemic failure. For CFOs structuring their operations through an Irish VASP or e-money entity, this means the governance over outsourced functions, including the qualifications and seniority of the personnel doing the oversight, needs to be demonstrable and auditable.
Digital Asset Accounting Software and Daily Reconciliation
A recurring thread in the regulatory notice is the inability to calculate daily safeguarding obligations accurately. In practice, this is a data and systems problem as much as a governance problem. Robust crypto compliance reporting requires that the underlying digital asset accounting software or crypto bookkeeping software can generate entity-specific, daily positions that reconcile to custodian records at the individual legal-entity level, not at the group level. Where a firm is relying on consolidated group reporting to satisfy entity-level obligations, the Coinbase Ireland case is a concrete illustration of where that approach can fail.
Firms advising regulated crypto entities should review whether client-facing systems can produce the granularity needed: entity-level balances, daily safeguarding calculations, and automated alerts when a shortfall occurs. The appointment of Coinbase Ireland's safeguarding officer in December 2024 came only after the data fix was in place; best practice would reverse that sequence.
Client Onboarding and Fund-Flow Documentation
The institutional client segment affected here is notable. Roughly 30 institutional clients had funds in the wrong entity's accounts for an extended period. For accounting firms onboarding new clients who are institutional users of crypto platforms, standard due diligence should now include confirming the specific legal entity holding the client's funds, the jurisdiction in which that entity is licenced, and the segregation model applied. This is consistent with the broader pattern flagged in our coverage of UK banks blocking crypto transfers and what it signals for client fund flows, where the gap between a platform's public-facing branding and its underlying legal entity structure continues to create friction and risk for institutional users.
What Firms Should Do Now
Immediate Review Points
The CBI's findings translate into a concrete checklist for accounting firms and CFOs:
- Identify which specific legal entity holds your client's digital assets, and confirm that entity is the one that holds the licence or VASP registration.
- Request confirmation from the platform that client funds are held in accounts in the name of the licensed entity, not a parent or affiliate.
- Where outsourced safeguarding is used, ask for evidence that the regulated entity has qualified personnel conducting oversight, not simply receiving consolidated group reports.
- Review any platform agreements signed before October 2024 for Coinbase Ireland specifically, to confirm that the entity-level remediation described in the notice applies to your client's account structure.
- Ensure that digital asset accounting software used internally or recommended to clients can produce entity-level, daily safeguarding positions rather than group-consolidated views.
Longer-Term Governance Considerations
The Central Bank's references to wind-down strategy obligations are a reminder that VASP and e-money licence holders are expected to maintain a credible plan for returning client funds in an insolvency scenario. For accounting firms acting as auditors or compliance advisers to such entities, testing the wind-down plan against the actual fund-flow and segregation architecture should be part of the annual governance review cycle, not a one-time licensing exercise.
The High Court confirmation process for this penalty means the formal order is not yet in effect, but the findings in the regulatory notice are already public and binding in practical terms. Firms should treat the notice itself as the operative document for advisory purposes.
Frequently Asked Questions
What does the Central Bank of Ireland fine cover?
The €3.25 million penalty, reduced from a gross figure of approximately €4.65 million under a 30% settlement discount, covers breaches of customer fund safeguarding rules and outsourcing governance requirements under the Electronic Money Regulations. The Central Bank found that Coinbase Ireland could not accurately calculate its daily safeguarding obligations and allowed client funds to be held in group entity accounts rather than entity-specific segregated accounts.
Did any customers actually lose money?
Coinbase has stated that no customers lost money and none were prevented from accessing their funds. However, the Central Bank's position is that the structural failures created a material risk: had the firm become insolvent during the breach period, customers may not have been able to promptly and fully recover their assets. The regulatory concern is prospective risk, not historical loss.
What is the relevance for accounting firms using digital asset accounting software?
The case highlights that entity-level, daily safeguarding reconciliation is a regulatory expectation, not a best practice. Any digital asset accounting software or crypto bookkeeping software deployed by a regulated entity must be capable of producing accurate, entity-specific daily positions. Group-consolidated reporting is insufficient for this purpose and, as this case shows, can itself constitute a compliance breach.
How does this interact with MiCA requirements?
This enforcement action was brought under the Electronic Money Regulations, which pre-date MiCA. Under MiCA, crypto-asset service providers (CASPs) are subject to comparable safeguarding obligations, and the European Securities and Markets Authority is actively building out supervisory convergence across member states. Firms should expect that the standards applied in this CBI action, entity-level segregation, local oversight competence, and daily reconciliation, will be reflected in MiCA supervisory expectations going forward.
Is the fine final?
Not yet. Both the €3.25 million fine and the formal reprimand require confirmation by the High Court before they take legal effect. The regulatory notice and Coinbase's admission of the violations are already public, but the sanction becomes formally binding only on High Court confirmation.
Source: The Block