Coinbase Ireland's €3.25m Fine: Safeguarding Lessons for EMIs

On 22 October 2026 the Central Bank of Ireland fined Coinbase Ireland Limited, an Irish e-money institution, €3,252,618 and reprimanded it for breaking the safeguarding and outsourcing rules of the Electronic Money Regulations 2011 between November 2020 and August 2025. No customer lost money. The fine is still worth reading line by line, because the settlement notice is a rare, detailed record of how a well-funded EMI ended up with an underfunded safeguarding account for at least 18 months, and almost every failure in it can happen at a much smaller firm.

The short version: a data change broke the report that calculated how much had to be safeguarded, unmatched receipts never entered the calculation, customer money passed through accounts in other group companies' names, and the people who should have spotted all of this worked for other group companies in another country. This guide walks through what happened, how the regulator priced it, and the controls an EMI or payment institution should test this quarter, in Ireland, elsewhere in the EU and in the UK.

What the Central Bank of Ireland found

The press release and the 30-page settlement notice dated 21 October 2026 set out four admitted contraventions of the Irish EMR 2011, the regulations that transpose the E-Money Directive's safeguarding rules.

The Central Bank classed the outsourcing contravention as reckless, because it had told the firm directly, in July 2022 and again in March 2023, that its governance and outsourcing fell short. The other three were classed as negligent. The sanctions take effect only once the High Court confirms them.

The firm was authorised in October 2019 and started trading on 1 November 2020, when more than 6.3 million customers moved to it from the group's UK EMI after Brexit. It issues and redeems e-money in fiat; customers use that e-money to buy crypto-assets through other group companies. Coinbase says it self-reported several of the issues in January 2024 and has fixed them. The same regulator fined another Irish group entity, Coinbase Europe, €21.46 million in November 2025 for transaction-monitoring failures.

How the safeguarding account ended up short

Under the EU rules, an EMI must keep users' funds apart from everyone else's money at all times and, if it still holds them at the end of the business day after receipt, place them in a separate account at a credit institution or invest them in secure, low-risk assets; alternatively, they can be covered by an insurance policy or comparable guarantee (Article 7 of the E-Money Directive, applying Article 10 of PSD2). In practice most firms run a daily cycle: calculate what they owe customers, compare it with what sits in the safeguarding account, and move money in or out to close the gap. Coinbase Ireland called that last step its Treasury Rebalancing Procedure.

The settlement notice shows that cycle failing in five places.

Where the money went: five breaks in one safeguarding cycle

1. The design approved at authorisation: customers pay straight into one segregated account, and a daily, automated calculation tells treasury how much must sit there.
2. Break 1: from March 2023, about 30 institutional customers were told to pay USD into accounts held by Coinbase Inc., a US group company, not the EMI. This lasted about 19 months.
3. Break 2: some customers who migrated from the UK entity kept paying into the UK EMI's safeguarding account, until deposits were fully blocked on 19 August 2025.
4. Break 3: until 19 January 2024, euro withdrawals by other group companies' customers were paid from this EMI's safeguarding account.
5. Breaks 4 and 5: a July 2022 data-table change left the obligation report incomplete, and unallocated receipts were missing from it, so every rebalance moved too little money in.

Simplified from the Central Bank of Ireland settlement notice of 21 October 2026. Dashed lines are routes the regulator found non-compliant.

The calculation bug: 0.54% short, every day

The most instructive failure is the quietest one. In July 2022 the firm changed how it maintained the data tables behind its safeguarding obligation report, a business-intelligence dashboard that pulled customer transactions from the group ledger and matched each customer to the legal entity they contracted with. The change left the report's inputs incomplete. The firm did not identify the problem until January 2024, and in the meantime the rebalancing process moved money to match the report's figure.

The result, according to the settlement notice:

• The safeguarding account was underfunded every day from 1 January 2023 to 27 June 2024, and consistently from July 2022 until the root cause was fixed in October 2024.
• The average daily shortfall was 0.54% of the safeguarding obligation, which averaged €323 million in 2023 and €470 million in 2024.
• The largest daily shortfall was €3.4 million in 2023 and €5.2 million in 2024.
• When the firm spotted the issue in January 2024 it believed it affected only currencies its customers did not use. The Central Bank's inspection later found it affected all currencies, retail and institutional.

At those balances 0.54% works out at roughly €1.7 million to €2.5 million missing on an average day. That is small next to the balance sheet and large next to any customer's claim in an insolvency. It also shows why a reconciliation that compares the bank balance with a calculated requirement is only as good as the calculation: if the requirement is wrong, the reconciliation passes every day.

Unallocated receipts fell out of the sum

A second gap ran from September 2023 to June 2024. Incoming payments that could not yet be matched to a customer, because of incomplete payer data, refunds or rejected withdrawals, did not appear in the obligation report, so they were never safeguarded. The notice traces this to missing control checks when the firm onboarded a new banking provider, and to the absence of periodic testing of the unallocated-funds files.

This is a common blind spot. An unmatched receipt is still someone's money. The UK's new rules say so explicitly: the safeguarding requirement is the sum of every client's balance, ignoring negative balances, plus any amounts received but not yet allocated to a client (CASS 15.8.30R in PS25/12).

Mixing: ledgering and insurance did not count

In March 2023, as Silvergate and Signature Bank failed, the firm told about 30 institutional customers to send USD to a "for benefit of" account held by Coinbase Inc., a US group company, first at Signature Bank and then at Cross River Bank. That continued until it opened its own settlement account at Customers Bank in October 2024. Separately, its EEA safeguarding bank would not accept USD directly, so USD deposits had always landed in the firm's own US accounts first and were swept across by the end of the next business day.

The firm argued the money was protected: each deposit was credited to the right customer ledger, the US accounts had FBO status and FDIC cover, and the amounts were included in its obligation calculation. The Central Bank rejected all three points. The rule that users' funds "shall not be mixed at any time with the funds of any person other than" the e-money holders is, in its words, "absolute and does not permit exceptions based on ledgering, insurance, or custodial calculations".

Coinbase has said the rerouting was meant to protect customers during the US bank failures. That may be true, and the regulator records no loss. The lesson is that a crisis decision taken to protect customers still has to stay inside the safeguarding rules, and still has to be notified.

Material changes nobody told the regulator about

Three changes made the firm's arrangements different from the ones the Central Bank assessed at authorisation: USD arriving outside the EEA safeguarding account, customer money routed through accounts in other entities' names, and significant manual work in a process described as automated. Regulation 18 of the EMR 2011 requires notice "without undue delay" of changes that affect the accuracy of the authorisation file; Regulation 31 requires notice in advance of material changes to safeguarding measures. The notice treats these as substantive, not procedural, breaches: the regulator cannot do its gatekeeping job if the firm it licensed is not the firm that operates.

Why outsourcing was the reckless part

Coinbase Ireland outsourced the core of safeguarding to Coinbase Inc., a US group company: running the processes and controls, the daily reconciliation, the obligation report and its data, the calculation itself and the rebalancing. The Central Bank found that the people overseeing this work were employed by other group companies outside Ireland, and that even the second- and third-line testing of the outsourced controls was done by outsourced functions. The firm had no safeguarding directly responsible individual until 16 December 2024, seven months after the on-site inspection began.

That ran against the EBA Guidelines on outsourcing and the Central Bank's own outsourcing guidance, which say a regulated firm must not become an "empty shell" and that boards cannot outsource responsibility. Two Dear CEO letters (9 December 2021 and 20 January 2023) and two risk mitigation programmes had made the point. A third-party safeguarding audit commissioned after the 2023 letter produced 20 findings.

For any EMI inside a larger group, or relying on a technology vendor for its ledger and reconciliation, this is the central lesson. Outsourcing the work is allowed. Outsourcing the understanding is not.

How the €3.25 million was calculated

The settlement notice shows the Central Bank's Administrative Sanctions Procedure arithmetic step by step, which makes it possible to see what moves a penalty.

1. Starting point: average annual gross turnover over the breach period, rounded to €63,219,000.
2. Severity: level 7 on a 1–10 scale, applied as 7% of the starting point: €4,425,330.
3. Aggravation: +5% because the firm did not complete two risk mitigation programmes: €4,646,597.
4. Cap: the maximum for this firm was €10 million (the greater of €10 million or 10% of last year's turnover), so no reduction.
5. Settlement discount: 30% under the undisputed facts process: €3,252,618.

How an Irish ASP penalty is built

Average annual turnover in the breach period(€000)

Turnover in the last complete financial year(€000)

Severity level (1–10, applied as %)(level)

Aggravating (+) or mitigating (−) adjustment(%)

Settlement discount(%)

Base penalty after severity

€4,425,330.00

Penalty after adjustment and cap

€4,646,597.00

Penalty after settlement discount

€3,252,618.00

Statutory maximum for this firm

€10,000,000.00

The firm's last-year turnover is not published; the notice says only that the applicable maximum was €10 million.

Follows the steps in the Coinbase Ireland settlement notice. Defaults reproduce that case; other cases can use different starting points. Not a prediction of any real penalty.

Two things stand out. First, turnover drives the number, not the size of the shortfall. The same failings at a firm with a tenth of the revenue would have started from a tenth of the figure, while the €10 million floor means the cap does not limit a small firm's penalty to 10% of its turnover. Second, the single aggravating factor was failing to complete two risk mitigation programmes the regulator had set. The cheapest way to keep a penalty down is to close supervisory actions properly the first time.

What has changed in Ireland since the breaches

The Central Bank has already turned the lessons of this case and its wider work into requirements:

• Head of Safeguarding (PCF-56). Since 10 February 2026, the Head of Safeguarding role has been a pre-approval controlled function at Irish payment and e-money institutions, with existing role-holders confirmed through an in-situ process. Coinbase Ireland's lack of a local safeguarding owner until December 2024 is exactly what the role addresses.
• Thematic findings. The Central Bank's December 2025 Payment and E-Money Newsletter lists what its thematic inspection found: reconciliation processes not written down, second-line teams doing first-line safeguarding work, no documented escalation thresholds, incomplete incident logs, heavy concentration in single banks without counterparty limits, and local teams that did not understand their own safeguarding insurance.
• Priority stated again this week. At the Central Bank's payments and e-money seminar on 21 October 2026, Director Domhnall Cullinan said firms must prioritise safeguarding customer monies and called it "a non-negotiable for us".

The same failures under the UK's CASS 15

UK firms have operated under a stricter, more prescriptive safeguarding regime since 7 May 2026, set out in the FCA's PS25/12. Several of the Coinbase Ireland failures map directly onto specific UK rules:

• Daily reconciliations. An internal safeguarding reconciliation at least once every reconciliation day (CASS 15.8.19R), plus external reconciliations against bank statements.
• Same-day top-up. A shortfall must be paid in "as soon as possible and, in any case, by the end of the day on which the reconciliation is performed" (CASS 15.8.50R), from the firm's own funds if relevant funds are not available (CASS 15.8.51R).
• Unallocated funds count. The requirement includes receipts not yet allocated to a client (CASS 15.8.30R), the gap that left the Irish account short for nine months.
• Non-standard methods need an auditor. A firm using a non-standard reconciliation method needs an independent auditor's report before using it and before changing it materially (CASS 15.8.37R). Firms on the standard method still need change control over the data feeding their calculation.
• Monthly returns, annual audit, resolution pack. A monthly safeguarding return, an annual safeguarding audit under SUP 3A unless the firm has not been required to safeguard more than £100,000 at any time over at least 53 weeks, and a resolution pack retrievable within 48 hours (CASS 10A).

The FCA's reason for all this is in the policy statement: for payment firms that became insolvent between Q1 2018 and Q2 2023, the average shortfall was 65% of the funds owed to clients. We explained what happens to customers when that gap is discovered in our guide to UK special administration for EMIs.

What PSD3 will add in the EU

The agreed text of PSD3 keeps the two safeguarding methods but adds the option of a separate account at a central bank, at the central bank's discretion, asks firms to avoid concentrating safeguarded funds in one credit institution, requires them to tell users how their funds are protected and mandates the EBA to draft technical standards on safeguarding within a year of entry into force (summary of Article 9). PSD3 is not yet adopted or published, so none of this applies today; our PSD3 and PSR guide covers the timeline. The EBA standards will show how far the EU follows the UK into the detail of how the daily number is produced.

Concentration matters for the same reason the USD workaround did. A single safeguarding bank that will not take a currency, or that exits the relationship, forces improvisation. Our banking partner exit plan covers how to keep a second route open before you need it.

A safeguarding control test for this quarter

Safeguarding controls to test this quarter

• Every customer-funds receiving account is in the regulated entity's own name

  List each IBAN and currency account customers can pay into, including legacy and affiliate details still shown in apps, invoices or old onboarding flows.

• Old payment details are blocked, not just discouraged

  Reject or return payments to retired accounts automatically; emails and in-app notices were not enough in the Irish case.

• The safeguarding account pays out only for your own customers

  Check group treasury flows so no affiliate's redemptions or withdrawals can be funded from your safeguarded pool.

• Unallocated receipts are in the daily requirement

  Unmatched payments, refunds and rejected withdrawals must be safeguarded until they are returned or allocated.

• The obligation calculation has independent completeness checks

  Reconcile the customer count and total e-money liability in the report back to the core ledger every day, and alert on drift.

• Data and schema changes to safeguarding inputs go through change control

  Treat any change to tables, feeds or entity mappings used by the calculation as a safeguarding change with testing and sign-off.

• A named local owner signs off each daily reconciliation

  In Ireland the accountable owner is the PCF-56 Head of Safeguarding; in the UK, the person given safeguarding oversight responsibility.

• Second-line testing is independent of whoever runs the process

  If the reconciliation is outsourced to a group company or vendor, avoid having it tested by the same provider; the Central Bank criticised exactly this.

• Escalation thresholds for safeguarding incidents are written down

  Define what size and duration of shortfall goes to the board and to the regulator, and keep a complete incident log.

• Material changes are notified before they go live

  New safeguarding banks, currencies routed through other accounts, and manual workarounds all change what the regulator approved.

Drawn from the failures in the settlement notice and the Central Bank's December 2025 thematic findings. Your progress is saved on this device when browser storage is available.

This article explains regulatory requirements and a public enforcement decision. It is not legal advice; confirm how the rules apply to your firm with your counsel or regulator.

Our view

The Coinbase Ireland case turns less on crypto or on a single bug than on oversight. Every firm has data errors. What turned one into an 18-month daily shortfall was a calculation nobody local understood well enough to question, a reconciliation that checked the bank balance against that calculation and nothing else, and testing performed by the same group that ran the process.

The fix is mostly architectural. The safeguarding requirement should be derived from the same ledger that holds customer balances, with unallocated receipts as a first-class category, every receiving account tied to the regulated entity, and an independent completeness check between the two that a local owner reads every day. That reasoning is behind the double-entry Accounting Ledger in the Fyora platform: client-funds accounts are kept per legal entity and currency, balances are real-time and every posting has an audit trail, so the safeguarding requirement can come from the books rather than from a separate dashboard. Where a firm's ledger sits in a group system or a vendor's product, the custom development work is usually in the data feed and the controls around it, not in the reconciliation screen.

If you are reviewing your safeguarding set-up after this decision, tell us what you're building.

FAQ

Why was Coinbase Ireland fined?

For four admitted breaches of the Irish E-Money Regulations 2011: outsourcing safeguarding to a US group company without local oversight, mixing users' funds with other group entities' funds, failing to keep users' funds fully in its designated safeguarding account, and not notifying the Central Bank of material changes to its safeguarding arrangements.

Did Coinbase Ireland customers lose money?

No. The Central Bank found no evidence of actual customer detriment, but said customers might not have been able to recover their funds promptly and in full had the firm become insolvent while the account was underfunded.

How was the €3.25 million penalty calculated?

The Central Bank took average annual turnover over the breach period (€63.2 million) as its starting point, applied severity level 7 (7%), added 5% for failing to complete earlier risk mitigation programmes and then applied the 30% settlement discount, giving €3,252,618.

Do unallocated payments need to be safeguarded?

Yes. Funds received for e-money or payment services remain users' funds even before they are matched to a customer. The UK's CASS 15.8.30R expressly includes unallocated receipts in the safeguarding requirement, and their omission caused part of the Irish shortfall.

Can an EMI receive customer funds into a group company's account?

In this case the Central Bank said no: users' funds must not be mixed at any time with the funds of anyone other than the users they are held for, and the Central Bank said this applies even where the money is ledgered to the right customer or covered by deposit insurance.

Sources

1. Central Bank of Ireland — The Central Bank takes enforcement action against Coinbase Ireland (22 October 2026)
2. Central Bank of Ireland — Settlement Notice: Coinbase Ireland Limited (21 October 2026)
3. Central Bank of Ireland — Enforcement action against Coinbase Europe Limited (6 November 2025)
4. Central Bank of Ireland — Fitness & Probity: new Head of Safeguarding PCF roles (February 2026)
5. Central Bank of Ireland — Payment and E-Money Newsletter, Issue 1 (December 2025)
6. Central Bank of Ireland — Speech by Domhnall Cullinan, Payments and E-Money Industry Seminar (21 October 2026)
7. FCA — PS25/12: Changes to the safeguarding regime for payments and e-money firms
8. EUR-Lex — Directive 2009/110/EC (E-Money Directive)
9. EUR-Lex — Directive (EU) 2015/2366 (PSD2)
10. EBA — Guidelines on outsourcing arrangements
11. Irish Legal News — Central Bank of Ireland fines Coinbase €3,252,618
12. Irish Examiner — Central Bank imposes €3.25m fine on Coinbase's Irish arm over safeguarding breaches
13. Safeheld — PSD3 timeline: dates and safeguarding changes for EU firms