• The Central Bank of Ireland reprimanded Coinbase Ireland and fined it €3,252,618 after a 30% settlement discount from €4,646,597.
• The breaches concern safeguarding of customer funds and outsourcing under the Electronic Money Regulations 2011, covering 1 November 2020 to 19 August 2025.
• Reported findings include heavy reliance on the US-based parent, long periods of underfunding in the safeguarding account, and weak escalation of material changes.
• This is a separate case from the €21,464,734 anti-money-laundering fine imposed on Coinbase Europe Limited in November 2025.
• Firms that outsource core controls to a group entity should test whether their own oversight, funding checks and escalation paths work independently.

The Central Bank of Ireland has reprimanded Coinbase Ireland and fined it €3,252,618 for safeguarding and outsourcing failures, according to its 22 October 2026 press release. The penalty is a 30% settlement discount off an initial €4,646,597. Unlike the larger anti-money-laundering case of 2025, this one concerns how customer funds are protected and how much of a regulated entity's control environment can sit with its parent. The sanctions take effect only if the High Court confirms them.

What the regulator found

The breaches fall under the Electronic Money Regulations 2011 and cover 1 November 2020 to 19 August 2025, per the Central Bank of Ireland. The regulator's findings, as summarised in its release, include over-reliance on the US-based parent as an outsourced provider, long periods in which the designated safeguarding account was underfunded, and weak escalation and reporting of material changes. Coinbase told Finextra it self-reported several issues in January 2024 and has fixed most of the underlying control problems.

Why outsourcing is the real subject

The structural point is that an authorised local entity remains accountable for functions it hands to a group parent. The rule sets an incentive: a regulated subsidiary cannot treat group tooling as a substitute for its own oversight. The second-order effect for compliance teams is cost, because independent monitoring of safeguarding balances, and documented escalation when group systems change, duplicate work that group-level design was meant to avoid. This reading is analysis; the regulator's findings are limited to those it published.

How this differs from the 2025 action

This case is separate from the November 2025 action against Coinbase Europe Limited, which the Central Bank of Ireland fined €21,464,734 for anti-money-laundering transaction-monitoring failures. That earlier matter concerned detecting suspicious activity; this one concerns protecting customer money and controlling delegated functions. Together they show supervisors testing different layers of the same business, and a firm that passes one test can still fail another. Readers should not conflate the two figures or the two legal bases.

What to watch next

The immediate step is High Court confirmation, which the Central Bank of Ireland says is required before the sanctions take effect. Beyond that, the useful signal is whether other e-money and crypto firms authorised in Ireland review how they fund and reconcile safeguarding accounts and how much control sits with a parent. Nothing published indicates further proceedings against Coinbase Ireland, and no wider conclusions about customer losses should be drawn from this release.