Coinbase Ireland is an e-money institution and is part of the global Coinbase Group, which operates one of the world’s largest crypto asset-trading platforms which allows for the buying, selling, transferring, and storing of crypto assets. As an e-money institution Coinbase Ireland issues and redeems e-money in exchange for fiat currency. Customers use the e-money Coinbase Ireland has issued to buy crypto assets on Coinbase Group’s online trading platform.

Coinbase Ireland is subject to the safeguarding and outsourcing requirements set out in the EMR 2011 (as amended). These requirements are fundamental to the protection of customer funds and to maintaining public confidence in the financial system. Coinbase Ireland did not meet these requirements in the following respects:

1. Coinbase Ireland failed to have in place an adequate outsourcing governance framework, in particular:

• They placed excessive reliance on the US-based Coinbase Group as an outsourced service provider to implement safeguarding processes and controls to meet Irish / EU regulatory compliance requirements; and
• failed to have sufficient local skill and expertise available within Coinbase Ireland to appropriately oversee the core function and responsibility of managing and safeguarding customer funds at all times

2. Coinbase Ireland failed to adequately safeguard customers’ funds, both through inadequate system design and insufficient control testing.  As a result, they allowed its designated safeguarding account to be underfunded for lengthy periods of time.
3. Coinbase Ireland failed to have adequate internal control and escalation procedures and sufficient governance processes to identify and report material changes concerning safeguarding to the Central Bank.

Coinbase Ireland has admitted the prescribed contraventions and has agreed to the undisputed facts as set out in the Settlement Notice. As part of the settlement agreement reached between the Central Bank and Coinbase Ireland, the Central Bank has determined that sanctions comprising a reprimand and monetary penalty in the amount of €4,646,597 are warranted. The application of a 30 per cent settlement scheme discount brings the amount to €3,252,618. The sanctions have been accepted by Coinbase Ireland. The sanctions are subject to confirmation by the High Court and will take effect once confirmed.  

Central Bank director of enforcement, Karen O’Leary said: “Firms in Ireland must have the appropriate culture and expertise to comply with the rules, respond to risks and to protect customer interests. While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms.

Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds. The Central Bank has made its supervisory expectations in this regard clear: we have no tolerance for weaknesses in safeguarding arrangements.

This case also highlights the importance of the authorisation process and the rigour with which we expect firms to approach authorisation to do business here thereby gaining- through authorisation - access to the wider EU market. Details and commitments given by firms during the authorisation process are critical to the Central Bank’s assessment of whether or not to authorise a firm. Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable.

This action against Coinbase Ireland underlines the Central Bank’s focus on ensuring that customers are at all times protected and that the integrity of the financial system is maintained.”

A spokesperson for Coinbase Ireland said: “Today, Coinbase Ireland Limited (CBIE) and the Central Bank of Ireland announced a settlement concerning historic safeguarding practices, under which CBIE will pay a €3.25 million fine.

“These issues largely arose in the context of Coinbase taking steps to protect customers during periods of significant disruption. For example, during the 2023 US banking crisis CBIE directed customers to deposit their funds into alternative bank accounts held by Coinbase, Inc to protect them from potential losses arising from bank failure. While this helped protect customers from financial loss and disruption, it involved CBIE customers’ funds being mixed with funds held for other Coinbase entities, which was not in line with regulatory safeguarding requirements. Similarly, following Brexit, although CBIE repeatedly instructed customers to use its Irish bank account for future deposits, some customers continued to deposit into legacy UK bank accounts, which did not comply with regulatory safeguarding requirements. No customers suffered financial loss or were unable to access their funds as a result of these issues.

“CBIE self-identified and reported several of these issues to the CBI in January 2024, addressed the vast majority of the underlying control issues that year, and have since fully resolved them. We have strengthened our safeguarding controls, redesigned our calculation processes, and added dedicated expertise to prevent similar issues from recurring.”