Coinbase Ireland has agreed to a €3,252,618 penalty in a safeguarding settlement announced by Ireland’s central bank on October 22, 2026. The sanctions require High Court confirmation before taking effect.
TL;DR
- Court confirmation remains outstanding.
- Coinbase says customers suffered no losses or loss of access.
- The case illustrates why reconciliation and local oversight matter.
Failures in safeguarding and oversight
The regulator identified breaches between November 1, 2020, and August 19, 2025. It cited excessive reliance on U.S. group operations, insufficient local expertise and inadequate controls that left safeguarding accounts underfunded. Coinbase Ireland admitted the contraventions.
In its October 22 response, Coinbase said it had reported many issues in January 2024 and had resolved the underlying problems. The company attributed some failures to coding errors and to arrangements that initially mixed funds belonging to customers of different group entities.
Coinbase said calculation errors produced average underfunding of approximately 0.54% of the Irish entity’s safeguarding obligation during 2023 and the first half of 2024. It also reported two external validations of its replacement process since January 2025 and the introduction of a €25 million guaranty bond. These are the company’s account of its remediation.
A calculation error can matter even when customers continue to withdraw normally. The balance displayed in an application and the money held in designated accounts are separate records. Reconciliation is the process that checks whether those records agree and makes discrepancies visible to the people responsible for correcting them.
Why the local entity matters
The broader supervisory context predates this settlement. In a December 2025 payments newsletter, the Central Bank described good safeguarding practices including daily reconciliation, local sign-off and oversight of outsourced teams. It also highlighted sector-wide weaknesses in incident escalation, segregation of duties and local understanding of insurance arrangements.
That background helps explain the difference between having a group-wide process and being able to demonstrate that it works for a particular regulated business. A shared technology team may build the calculation, but someone must understand its inputs, challenge unexpected results and follow a defined escalation path when a discrepancy appears.
Effective oversight also requires a record of what happened between checks. Correcting a balance later does not explain why it differed earlier or whether the same error can recur. Those are questions about the control process itself. The practical lesson for payment infrastructure is that data accuracy, account ownership and responsibility for exceptions need to line up throughout the movement of customer money.
Written by the News Desk and edited by Samuel Rae.
Leave a Reply