The Central Bank of Ireland (CBI) has fined Coinbase Ireland 3.25 million euros ($3.6 million) for alleged breaches of its obligations to safeguard customer funds and oversee outsourced services.

The penalty, announced Thursday, targets the Irish division of cryptocurrency exchange Coinbase Global (COIN), which the regulator said failed to establish an adequate outsourcing governance framework. The CBI set out the enforcement action in a press release published on its official website.

Safeguarding and outsourcing requirements underpin the protection of customer funds held by regulated firms. Companies are obliged to keep those funds adequately funded and monitored, and to set up procedures for reporting to the regulator when material changes occur. The rules also mean a regulated firm cannot simply hand that duty to another part of its corporate group: even where day-to-day tasks are outsourced, the locally licensed entity is expected to keep its own governance and controls.

"They placed excessive reliance on the U.S.-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls [and] failed to adequately safeguard customers' funds, both through inadequate system design and insufficient control testing," the CBI said. In the regulator's assessment, the Irish unit leaned too heavily on its U.S.-based parent and lacked adequate systems and controls of its own.

Silvergate Collapse Led to Commingled Funds

Among the issues disclosed, Coinbase said in a statement following the CBI's announcement that when crypto-friendly bank Silvergate was on the verge of collapse in 2023, the exchange instructed 30 customers to deposit funds into an alternate account held by Coinbase at another U.S. bank. The company laid out the episode in a blog post addressing its settlement with the regulator. As a result, those customers' funds were held alongside money belonging to customers of another Coinbase entity — a breach of safeguarding requirements. Segregation rules are designed to keep each regulated entity's customer money identifiable and separate so it can be traced and returned intact, and pooling different entities' customer funds in a single account undermines that separation.

Coinbase also disclosed that euro withdrawals from U.S. or U.K.-based customers were at times paid out of Coinbase's safeguarding account, and that coding errors left the account underfunded by an average of 0.54% in 2023 and the first half of 2024.

"No customer suffered any financial loss as a result of these matters, and no customer was ever unable to access their funds," the company said.

Follows Earlier AML Penalty

The fine arrives almost one year after the CBI fined Coinbase Europe 21.4 million euros for breaching its anti-money-laundering (AML) obligations between 2021 and 2025, as reported by CoinDesk. Taken together, the penalties bring the CBI's fines against Coinbase entities in Ireland to 24.65 million euros.

Source: CoinDesk