Central Bank of Ireland v Coinbase Europe: €21.5m AML Fine Explained

On 6 November 2025 the Central Bank of Ireland announced a settlement with Coinbase Europe Limited over failures in transaction monitoring. The fine was €21,464,734 after a 30 percent settlement discount, with a reprimand on top. It is one of the clearest recent Irish examples of what a transaction monitoring failure looks like in practice, and the lessons apply well beyond crypto. This guide walks through the Central Bank's press release and the settlement notice it published. For earlier Irish cases, see our guide to Central Bank of Ireland AML enforcement case studies.

Everything below comes from two Central Bank documents: the press release of 6 November 2025 and the settlement notice dated 5 November 2025. The firm admitted the facts as part of a settlement, so these are agreed findings, not allegations.

The headline numbers

• Fine: €21,464,734 after a 30 percent discount.
• Pre-discount penalty: €30,663,906.
• Other sanction: a reprimand.
• Period of the breaches: 23 April 2021 to 19 March 2025.
• Transactions not fully and properly monitored: 30,442,437.
• Share of activity affected: about 31 percent of Coinbase Europe's transactions between 23 April 2021 and 29 April 2022, valued at about €176 billion.

What went wrong

Coinbase Europe is a wholly owned subsidiary of Coinbase Global, Inc. The transaction monitoring system was operated on an outsourced basis by a US sister company, Coinbase Inc. According to the settlement notice, five of 21 high-risk screening rules in that system did not work as intended, so certain transactions were not fully monitored against high-risk blockchain addresses.

The notice attributes this to three configuration issues in the system, which date back to 28 October 2020. The first was identified on 24 August 2021 and fixed by 8 September 2021. Two more were identified on 8 April 2022 and fixed by 29 April 2022. The notice also records that Coinbase Europe was not informed of these issues at the time. The point for any regulated firm is that outsourcing the tool does not outsource the obligation, and the firm still needs to know when its monitoring stops working.

The three contraventions

1. Section 36A(1) of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010: failure to fully and properly monitor transactions, affecting 30,442,437 transactions.
2. Section 54(1) of the 2010 Act: failure to adopt effective internal policies, controls and procedures to prevent and detect money laundering and terrorist financing.
3. Section 39(1) of the 2010 Act: failure to conduct additional monitoring, affecting 184,790 transactions.

The notice cites sections 39(1) and 39(2), alongside section 33BC(2) of the Central Bank Act 1942 on publishing the statement and section 33AWA on High Court confirmation. For Irish enhanced due diligence rules, see our guide to enhanced due diligence under sections 38A and 39.

The clean-up

The notice says 255,125 transactions were flagged for further analysis, of which 184,790 needed review, valued at €3.6 billion. According to the press release, completing the monitoring of the affected transactions took almost three years and led to 2,708 suspicious transaction reports being filed with the Financial Intelligence Unit. The notice puts the value of those reports at over €13 million. Put plainly, a late look-back found real suspicious activity.

What the Central Bank said

Colm Kincaid, Deputy Governor for Consumer and Investor Protection, is the spokesperson quoted in the press release. The release calls monitoring transactions and reporting suspicions without delay a cornerstone of the anti-money laundering and counter terrorist financing regime. It says crypto firms need robust controls to identify and report suspicious transactions, and that system failures must be reported to the Central Bank without delay. The sanctions were accepted by Coinbase Europe and were subject to High Court confirmation, which the Central Bank's update records as given on 12 January 2026.

Lessons for other firms

These are our observations from the documents, not findings by the Central Bank.

• Test that every monitoring rule actually triggers, not only that it exists. The failure here was rules that did not work as intended.
• Monitor the monitoring. Set up checks that would reveal a sudden drop in alerts or an unexpected silence from a rule.
• If a group company runs your tools, make sure you receive notice of configuration problems and have a way to escalate them quickly.
• Plan for look-backs. Rectifying a monitoring gap can mean reviewing years of transactions.
• Report system failures to your regulator without delay.

For a view of where monitoring is heading, see our guide to the Wolfsberg statement on effective monitoring. For training in this area, see the Learnsignal CPD courses.

What we could not confirm

We did not read the High Court order itself and rely on the Central Bank's update for the confirmation date. The press release and notice describe the timing of the faults slightly differently, and we have followed the notice for dates. We have not checked any statements by Coinbase.

Frequently asked questions

How much was the fine?

€21,464,734 after a 30 percent settlement discount, from a pre-discount penalty of €30,663,906, plus a reprimand.

What did Coinbase Europe fail to do?

It failed to fully and properly monitor 30,442,437 transactions, to adopt effective internal controls, and to carry out additional monitoring on 184,790 transactions.

Was the penalty final on announcement?

The sanctions needed High Court confirmation, which the Central Bank's update records as given on 12 January 2026.

Does this apply only to crypto firms?

No. The legal provisions are in the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 and apply to designated persons generally, though the Central Bank made specific points about crypto firms.

Learnsignal publishes this guide for general education only. It is not legal advice.