Marking its own homework

A fine for the shape of a firm, not a single bad trade

On 21 October 2026 the Central Bank of Ireland settled an enforcement action against Coinbase Ireland Limited, the group's authorised electronic money institution and the legal home of its European customers' money. The headline penalty was €4,646,597, reduced to €3,252,618 after a 30% settlement discount, with the sanctions still to be confirmed by the High Court.¹ Coinbase Ireland admitted the facts.

What makes the case worth reading is not the number. It is the nature of the failing. There was no rogue trader, no customer loss crystallised, no fraud. Instead the Central Bank described a regulated entity that, for most of five years, did not look like the firm its own authorisation described. Safeguarding of customer funds, the single most important thing an e-money institution does, was outsourced to a United States affiliate with no meaningful local expertise to oversee it. Customer money was held and moved through accounts in the names of other Coinbase companies. And the daily calculation that was supposed to prove the money was fully protected had been quietly producing the wrong answer since a routine data change in July 2022.

The firm admitted contraventions of the European Communities (Electronic Money) Regulations 2011 spanning 1 November 2020 to 19 August 2025: failure to segregate users' funds, failure to maintain local oversight of an outsourced core function, and failure to tell the regulator when the real operating model drifted away from the one it had been authorised on.¹

The money was never stolen. It was simply never quite as safe as the paperwork said it was, and for eighteen months no one in Ireland was positioned to know.

An Irish licence, operated from abroad

An electronic money institution exists to do one thing above all others: keep its customers' money safe and separate, so that if the firm fails, the money can be handed back promptly and in full. Coinbase Ireland held an Irish authorisation for exactly this purpose. It was the EU-facing entity, the one the Central Bank supervised, the one whose board signed the attestations.

But the Central Bank found that the substance of the safeguarding function did not live in Ireland. For more than four years the firm outsourced the critical work of safeguarding users' funds to a US Coinbase group company, and did so without the local skill, expertise or governance to understand the risk, supervise the provider, or catch failures when they happened. The notice is blunt about the consequence: this arrangement "materially impaired the quality of CBIE's internal safeguarding controls."¹

The gap was not filled until the firm appointed a dedicated Safeguarding Designated Responsible Individual, in Ireland, on 16 December 2024. Until that date, the person whose job was to own the safety of European customer money, locally and with authority, did not exist.¹ This is what regulators mean when they talk about "substance". A licence is a promise that the regulated activity is genuinely carried on, and genuinely controlled, where it is authorised. When the real decisions, data and controls sit in another jurisdiction inside another legal entity, the supervised firm becomes a nameplate, and supervision becomes an argument about who was actually responsible.

Outsourcing a function is permitted. Outsourcing the ability to understand and control it is not.

Money that travelled under other names

Segregation is the mechanism that makes safeguarding real. Users' funds must be held in an account in the institution's own name, kept apart from the firm's money and from anyone else's, so there is never a question about whose money is whose. Coinbase Ireland breached that requirement, in more than one way, for almost the entire period under review.

When United States banking partners would not accept certain deposits directly into the Irish safeguarding account, the firm routed them elsewhere. In March 2023, ahead of the failure of Silvergate Bank, it instructed 30 institutional users to deposit into a Coinbase Inc. "for benefit of" account held at Signature Bank, rather than an account in Coinbase Ireland's own name. When Signature Bank failed days later, on 12 March 2023, the funds were moved to another Coinbase Inc. account at Cross River Bank. This continued until the firm finally opened its own settlement account in October 2024, roughly nineteen months of institutional customer money sitting in an affiliate's name.¹

A second leak ran even longer. Customers who had migrated from the UK entity kept depositing into a Coinbase UK safeguarding account, mixing Irish users' funds with UK funds, from November 2020 all the way to 19 August 2025. The firm did not fully close that door until it discovered 33 users still had access to the old account, at which point it blocked deposits and forced an updated user agreement. In a separate episode, the Irish safeguarding account was itself used to fund euro withdrawals for non-Coinbase-Ireland customers, a practice that only ceased in January 2024.¹

The report that quietly broke

The most instructive part of this case is also the most mundane. The firm's daily safeguarding obligation, the figure that answers "how much customer money must be protected today", was produced by an internal business-intelligence report. In July 2022 someone made a routine change to the data tables that fed it. An unintended consequence was that the report began to present incomplete information.¹

This was the "timing mismatch". Transactions straddling the calculation cut-off were dropped, so the obligation came out too low, so the designated account was topped up to a number that was too small. From July 2022 until October 2024 the account was consistently underfunded as a direct result. Nobody caught it for more than two years, because the report had no independent check sitting beside it, and because the people who might have questioned it were not in the room.¹

A second, overlapping defect made it worse. Between September 2023 and June 2024, certain unallocated users' funds simply stopped appearing in the report, and so were left out of the reconciliation entirely. The root cause was almost comically ordinary: the firm had changed banking provider and had not run the control checks at implementation, nor set up periodic testing of the unallocated-funds files to confirm every transaction was captured.¹ For about nine months, a slice of customer money was invisible to the one calculation whose job was to see all of it.

A reconciliation that no one reconciles is not a control. It is a number that happens to be printed every day.

Neither defect was exotic. There was no breach, no attacker, no clever evasion. A spreadsheet-grade pipeline silently changed its output after a schema tweak, and a second pipeline silently dropped a category of records after a vendor migration. The failure was not that these things happened; failures of this kind happen in every firm. The failure was that nothing was designed to notice.

Small as a ratio, millions in cash

It would be easy to read "0.54%" and move on. That was the average daily shortfall as a proportion of the safeguarding obligation, and as a ratio it sounds like rounding error. The absolute figures tell a different story, because the obligation itself was enormous: it averaged €323 million in 2023 and €470 million in 2024.¹

Against those bases, the shortfall was not rounding error. The maximum single-day gap was €3.4 million in 2023 and €5.2 million in 2024. Every day, for at least eighteen months, the pool of money standing behind European customers was millions of euro lighter than the firm's own rules required, and lighter than its customers believed.¹

The Central Bank was careful about what this did and did not mean. No customer lost money, and the collapse of Silvergate and Signature did not crystallise a loss. But the regulator's concern is structural, not dependent on an outcome. Its point was that if the firm had failed while underfunded and commingled, users "may not have been able to promptly and fully regain their funds."¹ Safeguarding is insurance against a bad day. The whole value of it is that it holds on the day the firm is least able to improvise, and on that day a daily shortfall and a pile of money in someone else's name are exactly the wrong things to discover.

Automated on the application, manual in the building

When Coinbase Ireland was authorised, it described an operating model to the Central Bank. Part of what it described was automation: systems that would calculate and safeguard funds without the fragility of hand operation. The reality drifted, and the firm did not tell the regulator that it had.

Two changes mattered. First, the safeguarding banking partner would not accept US-dollar deposits directly into the EEA designated account, so dollars were first routed through US Coinbase Ireland accounts and only then swept across. Second, the arrangements came to rely on "significant manual intervention in some cases", contradicting the automated systems set out in the authorisation application.¹ Under Regulations 18 and 31, a firm must notify the Central Bank, without undue delay, of changes that affect the accuracy of the information it was authorised on. Coinbase Ireland did not.

The notice is pointed that these were "more than procedural breaches."¹ A supervisor's whole model of a firm is built from what the firm tells it. When the operating reality quietly diverges, limited banking infrastructure here, a manual workaround there, the supervisor is left overseeing a firm that no longer exists while the real one runs unwatched. Notification failures rarely cause the harm. They are what allows the harm to run for years.

Two risk programmes, one board attestation, and the time in between

This was not a firm the Central Bank had failed to warn. The timeline shows a regulator pressing, and a firm that kept answering before it had actually fixed anything.

The March 2022 board attestation is the detail that lingers. The board certified compliance while, beneath it, the firm lacked local safeguarding expertise, was commingling funds across affiliates, and was four months from a data change that would underfund the safeguarding account for two years. The attestation was not dishonest. It was something more common and more dangerous: a board confirming what it had been told, by a function it could not independently see, because the substance that would have let it see was in another country.

Why nothing caught it

Each individual failure here has a tidy technical fix. Add a cut-off control to the report. Reconcile unallocated funds. Open an account in your own name. Notify the regulator. But a list of fixes mistakes the symptoms for the disease. The reason all of these went wrong at once, and stayed wrong for years, is a single structural choice with three consequences.

No local owner

With no Safeguarding DRI in Ireland until December 2024, there was no one whose job, authority and daily attention were pointed at the safety of customer funds in the supervised entity. Problems that would have been obvious to an accountable owner, a report that changed shape, a bank that could not hold the account, a workaround that became permanent, had no owner to be obvious to.

No independent check

The safeguarding obligation was produced by one report and believed. There was no second, independently maintained calculation to disagree with it, no zero-tolerance reconciliation to confront the daily balance against a trusted number. A control that cannot be contradicted is not a control; it is a readout.

A line of defence that marked its own homework

Most tellingly, the Central Bank found that the second- and third-line testing of the outsourcing was itself performed by functions outsourced to the same US affiliate.¹ The arrangement that needed challenging was being assured by the people who ran it. The three lines of defence had collapsed into one. When the operator, the monitor and the assurer are the same organisation, independence is a diagram, not a fact.

Outsource the work if you must. The moment you also outsource the people who check the work, you have no idea whether it is being done.

Every firm now runs a report it has stopped reading

Strip away the crypto and the cross-border structure, and the Coinbase Ireland case is about something almost every regulated firm now has: an automated pipeline that produces a number people trust without re-deriving. The safeguarding report here was a plain BI job. The next one will be a model, a vendor feed, or an AI agent reconciling positions, and the failure mode will be identical and harder to see.

The mechanism that caused eighteen months of underfunding was silent drift. A schema change in July 2022 altered what the pipeline captured, and the output stayed plausible while becoming wrong. This is the single most important property of automated controls to internalise: they rarely fail loudly. They fail by continuing to produce confident, well-formatted answers that no longer correspond to reality. A human who makes this error eventually feels the friction. A pipeline feels nothing, and will repeat the mistake several hundred times before anyone asks.

AI systems sharpen every edge of this. An agent that calculates a safeguarding obligation, flags exceptions, or decides which transactions are "unallocated" is subject to the same calibration problems that sank the Looker report, and adds its own. It will drift when its inputs drift. It will drop a category of records after an upstream change and give no sign. It will produce an answer with the same fluent confidence whether the data behind it is complete or missing a bank feed. And because its output reads as considered, it is even easier to accept without the independent re-derivation that would have caught the error. Automation does not remove the need for a second opinion. It raises the premium on having one.

The governance lesson is just as transferable. Coinbase Ireland did not fail because it used an affiliate or an automated report. It failed because it placed the thing that mattered beyond the reach of anyone who could challenge it: the calculation had no independent twin, the outsourced function had no independent assurer, the supervised entity had no local owner. An AI control deployed the same way, operated and "validated" by the same team, scored against its own outputs, reproduces this case exactly, only faster and with a better user interface. The discipline that protects you is unchanged whether the engine is a spreadsheet or a model: someone independent must own it, something independent must check it, and the firm must be able to prove both.

The same shape, in other jurisdictions

Segregation and substance failures are not a crypto peculiarity. They recur wherever a firm holds other people's money and lets the controls around it drift from the entity on the licence.

Across all three, the regulator's underlying objection is the same. An authorisation is a statement about where and how an activity is genuinely controlled. When client money is commingled, when oversight is thin, when the controls sit outside the regulated entity, the licence and the firm have come apart, and enforcement is how they are forced back together.

What a safeguarding function should be able to prove

The Central Bank's own remediation points to the controls that were missing. The test for any firm holding customer money, whether under the EMRs, CASS, or a local client-asset regime, is not whether it has a safeguarding policy. It is whether it can demonstrate, on any given day, these things at once.

• An independent daily obligation calculation. The safeguarding obligation should be computed a second way, from the customer-liability ledger, and compared to the production report with a zero-euro difference tolerance before the day's position is certified.
• A zero-tolerance reconciliation. The certified obligation is reconciled to bank-confirmed balances by currency and account; any deficit triggers immediate funding and escalation, not a note for next quarter.
• Completeness checks on every feed. Record counts, totals and expected source files are verified each run. Missing an unallocated-funds file should block certification, not pass silently for nine months.
• Accounts only in the firm's own name. A controlled allowlist of approved safeguarding accounts, with routing that rejects or quarantines any deposit heading for an affiliate's or legacy account.
• Independent assurance of outsourcing. The function that operates an outsourced control cannot be the function that assures it. Second and third lines must be genuinely separate from the provider.
• A local owner with authority. A named, resident, suitably expert individual accountable for safeguarding, with direct access to the board and the standing to stop a change.
• Notification as a reflex. A change-assessment gate that treats a new bank, a manual workaround, or a model change as a potential regulatory notification by default.

Substance is the control that enables all the others

The temptation with a case like this is to file it under "crypto" and assume it does not apply. That reading misses the point entirely. Nothing here depended on digital assets. The exact same case could be written about a payments firm, a broker holding client money, or a fund administrator running reconciliations, and in the age of outsourced platforms and shared services, most of them are one bad schema change away from it.

The spine of the case is substance. A regulated entity that outsources its core function to an affiliate, staffs no local owner, lets one report stand unchecked, and tells the regulator none of it, has not reduced its risk by leaning on a larger group. It has concentrated its risk and hidden the evidence from the one party, itself, that could have acted. Every downstream failure, the commingling, the underfunding, the missed notifications, flows from the same source: there was no one, in the right place, with the authority and the information to say stop.

That is why "substance" is not a box-ticking concept. It is the control that makes every other control possible. A firm can buy the best reconciliation engine on the market and still underfund its customers for eighteen months if no one who understands it is sitting where the regulator thinks they are. The Coinbase Ireland settlement is, in the end, a €3.25 million reminder that you can delegate the work, but you cannot delegate being the firm.