The Central Bank takes enforcement action against Coinbase Ireland

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes. The Central Bank determined that a reprimand and €4,646,597 monetary penalty were warranted, reduced to €3,252,618 through the 30% settlement discount under the undisputed-facts settlement process in the Admini

Who is affected

• Irish-authorised electronic money institutions
• Irish-authorised payment institutions that safeguard customer funds
• Crypto businesses operating through an Irish e-money institution
• Groups outsourcing safeguarding, treasury, reconciliation, systems or other critical functions to affiliates or third-party service providers
• Firms relying on commitments or operating-model descriptions made during the Irish authorisation process

Related regulations

• Electronic Money Regulations 2011, as amended
• Central Bank (Individual Accountability Framework) Act 2023
• Central Bank Administrative Sanctions Procedure Guidelines, December 2023