GRC

Coinbase Ireland’s €3.25m fine: the cost of trusting group controls

Ireland fined Coinbase Ireland €3.25m for relying on its US parent’s safeguarding controls. What it means for UK outsourcing and resilience.

Balance scales graphic with the headline Coinbase Ireland fined €3.25m over outsourcing

Ireland’s central bank has fined Coinbase Ireland €3.25m because it relied on its US parent to run safeguarding controls it could not oversee itself. UK payment and e-money firms that lean on group IT and operations should read the findings closely, because UK rules make the same demand.

What happened

On 22 October 2026 the Central Bank of Ireland reprimanded Coinbase Ireland Limited and fined it €3,252,618. The firm breached its safeguarding and outsourcing obligations under Ireland’s Electronic Money Regulations 2011 over almost five years, from November 2020 to August 2025. Under the regulator’s undisputed facts process, the firm admitted the breaches and settled on 21 October, earning a 30 per cent discount on a base penalty of €4,646,597. The sanction does not take effect until the High Court confirms it.

The findings fall into three groups. On outsourcing, the Irish entity left the US-based Coinbase Group to design safeguarding processes and controls that met Irish and EU law, and lacked the local skill to supervise that work. On safeguarding, system design was inadequate, controls were not tested enough, and the designated safeguarding account was underfunded for long periods. On governance, escalation procedures were weak, and material changes to safeguarding were neither spotted nor reported to the regulator.

It follows a fine of more than €21m on another group entity, Coinbase Europe, in November 2025 for anti-money laundering failures. Coinbase said in a statement that no customer lost money because of these matters. According to the Irish Times, the company told the regulator about several of the problems itself in January 2024 and fixed most of them that year.

The detail

The causes were ordinary. CoinDesk reports that coding errors left the safeguarding account short of funds by an average of 0.54 per cent through 2023 and the first half of 2024. That is a fault in reconciliation logic, not a cyber attack, and it is exactly what proper control testing exists to catch.

CoinDesk describes two further breaches. When Silvergate Bank was close to collapse in 2023, about 30 customers were told to pay into an alternative Coinbase account at another US bank, where their money was held alongside that of another Coinbase entity’s customers. Safeguarding rules forbid that kind of commingling. CoinDesk also reports that euro withdrawals requested by customers based in the US or UK were paid out of Coinbase Ireland’s safeguarding account.

The UK appears directly in the case. The Irish Times reports that after Brexit, some customers kept sending money to old UK accounts that fell short of safeguarding requirements, even though they had been told to use the Irish account. Old payment routes outlived the restructure.

The Irish Times says Coinbase promised robust, automated safeguards when it was authorised in 2019, and that the regulator found outsourcing to the parent had “materially impaired” internal controls. Enforcement director Karen O’Leary called the failure to honour authorisation assurances “completely unacceptable”.

Timeline of the Coinbase Ireland case from 2019 authorisation to the October 2026 fine

Why it matters for UK organisations

None of this is specific to Ireland. The FCA’s operational resilience rules apply to firms authorised or registered under the UK Payment Services Regulations 2017 and Electronic Money Regulations 2011, as well as to banks, insurers and qualifying cryptoasset firms. Those firms must identify their important business services, set impact tolerances, and map and test the people, processes and technology behind them. The FCA is explicit that firms stay accountable when they rely on third parties, and a group company is a third party.

The deadline for operating within impact tolerances passed on 31 March 2025. For an e-money issuer, safeguarding is almost certainly an important business service, so a UK version of this case would turn on whether the firm can evidence control of a service its parent built.

Reporting rules are also about to tighten. Under FCA PS26/2 and the PRA’s PS7/26, which take effect on 18 March 2027, firms must notify regulators of new or significantly changed material third-party arrangements and submit an annual register. The PRA has also updated SS2/21 on outsourcing and third-party risk management. One detail matters for groups like Coinbase: the FCA requires material intra-group arrangements to be reported only when they in turn depend on an outside supplier. That narrows what reaches the regulator, not what the board must oversee.

Expert view

In my experience, intra-group services get the least scrutiny of any supplier relationship. Contracts with outside vendors come with due diligence questionnaires, right-to-audit clauses and exit plans. The parent’s shared platform comes with an assumption that “group has it covered”. When we test UK subsidiaries of overseas groups, the regulated entity often cannot see change logs or test controls on the systems running its own regulated processes without raising a ticket with a team in another time zone.

The underfunding caused by coding errors is the part I would put in front of a board. Safeguarding reconciliation is software. Software changes, and every release can quietly break a control. If the regulated firm does not own the test cases for that logic, or at least see the results independently, it cannot say the control works. Under FCA rules, a UK firm cannot hand that accountability to a parent overseas.

The emergency workarounds deserve equal attention. Steps Coinbase says it took to protect customers during a banking crisis created the commingling breach. Resilience plans need pre-approved fallback banking arrangements that already meet safeguarding requirements, or the people handling the crisis will improvise.

To be fair, Coinbase says it self-reported and that no customer lost money. But good outcomes do not excuse controls that could not be shown to work.

What to do now

  1. List every intra-group dependency behind an important business service. Treat the parent like any other supplier: a written agreement, service levels, audit and information rights, and a named owner in the UK entity.
  2. Build local competence. Make sure someone in the regulated firm understands each outsourced control well enough to challenge it. The lack of local expertise was a finding in its own right.
  3. Test critical controls independently. For safeguarding, run your own daily reconciliation checks and get sight of test results for every release that touches reconciliation code.
  4. Govern changes as changes. Restructures, new bank accounts, legacy accounts left open after a migration and payment routing changes all need risk assessment, and some must be notified to the regulator. Close or monitor legacy collection accounts.
  5. Pre-approve your fallbacks. Agree compliant alternative safeguarding arrangements before a bank failure forces a decision.
  6. Get ready for March 2027. Start your material third-party register now, including intra-group providers, even where the FCA will not require them to be reported.
  7. Extend the basics across group boundaries. Cyber Essentials access control and secure configuration should cover shared group systems touching regulated data.

Bottom line

Coinbase Ireland was not fined for a data breach or an outage. It was fined because it could not show that controls built by its parent did what it had promised its regulator. UK firms that rely on group platforms face the same accountability test under FCA operational resilience rules. Before 2027 brings tighter reporting, check you can explain, test and evidence every control you have handed to someone else, parent company included.

Sources

Related Posts