Who checks safeguarding when a licensed crypto firm outsources it to the group?
On Thursday 22 October 2026, the Central Bank of Ireland fined Coinbase Ireland €3,252,618 for breaching its safeguarding and outsourcing obligations. The licence was in Dublin. The regulator found the safeguarding ran on the US-based Coinbase Group, with too little expertise in Ireland to oversee it. Read by a marketer rather than a lawyer.
€3,252,618
€4,646,597 less a 30% settlement discount, plus a reprimand.
Nov 2020 – Aug 2025
Breaches of the Electronic Money Regulations 2011, per the Central Bank.
~30 institutional clients
Dollars deposited into accounts held by Coinbase Inc., March 2023 to October 2024, per The Block.
€21.5m
Coinbase Europe, November 2025, over transaction monitoring, per The Block.
What the regulator found.
The Central Bank lists three failures. Coinbase Ireland placed excessive reliance on the US-based Coinbase Group as an outsourced service provider to run safeguarding for Irish and EU rules, without enough local skill to oversee it. It allowed its designated safeguarding account to be underfunded for lengthy periods, through inadequate system design and control testing. And it lacked the escalation and governance processes to report material changes to the regulator.
The Block’s reading of the settlement notice adds the detail most coverage skipped: for about 19 months, roughly 30 institutional clients deposited dollars into bank accounts held by Coinbase Inc., not the Irish e-money firm. Funds of some customers who migrated from Coinbase UK sat in the UK entity’s safeguarding account until 19 August 2025. The regulator had raised governance concerns in letters in July 2022 and March 2023.
Coinbase said no customers lost money or were unable to access their funds, that it self-reported several of the issues in January 2024, and that the issues are fully resolved.
The timeline.
Per the Central Bank of Ireland and The Block.
What this means for any crypto firm running an EU licence.
The licence is granted on the application. The Central Bank’s Director of Enforcement, Karen O’Leary, said the details and commitments a firm gives during authorisation are critical to the decision, and that an Irish authorisation is what gives access to the wider EU market.
Outsourcing the work doesn’t outsource the duty. Running safeguarding on group systems is allowed. The finding here is that the licensed entity couldn’t oversee it or calculate, day by day, how much it owed customers.
“Your funds are protected” is a marketing claim too. Any page that tells customers their money is safeguarded is making a promise about whose name is on the bank account.
Questions.
What did the Central Bank of Ireland fine Coinbase Ireland for?
On 22 October 2026 the Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 for breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011 between 1 November 2020 and 19 August 2025. Coinbase Ireland admitted the breaches in a settlement reached on 21 October 2026.
How was the fine calculated?
The Central Bank set the penalty at €4,646,597 and applied a 30% settlement discount, bringing it to €3,252,618. The sanctions, which also include a reprimand, take effect once the High Court confirms them.
What went wrong with customer funds?
The regulator found that Coinbase Ireland placed excessive reliance on the US-based Coinbase Group to run its safeguarding processes and lacked sufficient local skill and expertise to oversee them. Its designated safeguarding account was underfunded for lengthy periods. According to The Block’s reading of the settlement notice, about 30 institutional clients deposited dollars into bank accounts held by Coinbase Inc., rather than the Irish entity, from March 2023 to October 2024.
Did customers lose money?
Coinbase said no customers lost money or were unable to access their funds, and that it self-reported several of the issues to the Central Bank in January 2024. The regulator said that, had the firm become insolvent while the breaches were ongoing, users may not have been able to promptly and fully regain their funds, according to The Block.
Why does the Central Bank stress authorisation?
An Irish authorisation gives a firm access to the wider EU market. The Central Bank’s Director of Enforcement, Karen O’Leary, said details and commitments given during authorisation are critical to the decision, and that failing to adhere to those assurances or to report material changes, as happened in this case, is completely unacceptable.
Is this Coinbase’s first fine in Ireland?
No. In November 2025 the Central Bank fined Coinbase Europe €21.5 million over transaction-monitoring failures, according to The Block.
What is safeguarding?
E-money and payment firms must keep customers’ money separate from their own and protected, usually in a designated safeguarding account, so it can be returned in full if the firm fails. The firm must be able to calculate every day how much it owes customers and show that amount is covered.
Is this legal advice?
No. It is a marketer’s summary of a regulator’s announcement and published reporting, for founders building or marketing these products.
Sources.
Central Bank of Ireland, “The Central Bank takes enforcement action against Coinbase Ireland” (22 October 2026)
The Block, “Coinbase Ireland fined $3.6 million over customer fund segregation, oversight failures” (Brian Danga, 22 October 2026)
Related: Who is on the other side of a prediction-market bet? · Crypto marketing compliance · Crypto ad policy
Making promises about customer funds in your marketing?
Twenty minutes, direct with the founder.