Central Bank of Ireland fines Coinbase Europe $25 million for breaching anti-money laundering monitoring obligations

The Central Bank of Ireland has fined Coinbase Europe Limited, part of the Coinbase Group, €21,464,734 ($24.7 million) for breaching its anti-money laundering and counter-terrorist financing transaction monitoring obligations between April 2021 and March 2025.

As a virtual asset service provider (VASP), Coinbase Europe must continuously monitor customer transactions, the central bank explained in a statement on Thursday. If it suspects that any activity may involve money laundering or terrorist financing, it is required to promptly file a suspicious transaction report with Ireland's Financial Intelligence Unit and the Revenue Commissioners, as required under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010.

Specifically, Coinbase Europe was fined after faults in the configuration of their monitoring system left more than 30 million transactions — worth over €176 billion ($202.8 billion), or about 31% of Coinbase Europe's total activity during the period — unmonitored for 12 months, according to the bank. The firm took nearly three years to review the backlog, ultimately filing 2,708 late suspicious transaction reports flagging potential money laundering, fraud, drug trafficking, cyberattacks, and child sexual exploitation, it added.

Coinbase Europe admits breaches

Coinbase Europe admitted breaching Ireland's anti-money laundering rules by failing to monitor the transactions, lacking adequate internal controls, and neglecting extra checks on a further 184,790 transactions, the bank continued. In a settlement agreement with Coinbase Europe on Nov. 5, the Central Bank of Ireland imposed a reprimand and a €30.7 million ($35.4 million) penalty, reduced to €21.5 million after a 30% settlement scheme discount. The sanction has been accepted by Coinbase Europe and now awaits High Court confirmation, the bank said.

"To be effective in combating financial crime, law enforcement agencies rely on regulated financial institutions to have systems in place to monitor transactions and report suspicions. The failure of such a system within any financial institution creates an opportunity for criminals to evade detection — and criminals will take that opportunity," Central Bank of Ireland Deputy Governor for Consumer and Investor Protection Colm Kincaid said. 

"Crypto has particular technological features which, together with its anonymity-enhancing capabilities and cross-border nature, makes it especially attractive to criminals looking to move their funds. This is why it is especially important that firms engaged in crypto services have robust controls in place to identify and report suspicious transactions," he continued. "Where system failures do occur, it is imperative that they are reported to the Central Bank without delay so that appropriate actions can be taken to manage and mitigate the risk."

Responding to the news in a blog post on Thursday, Coinbase said the issue stemmed from three coding errors that caused five of its 21 transaction-monitoring scenarios to only partially screen customer activity in 2021 and 2022. The company said that once discovered, it fixed the errors within two to three weeks, then re-reviewed all affected transactions and ultimately filed about 2,700 suspicious transaction reports.

The firm stressed that it cooperated fully with the Central Bank of Ireland, accepted the settlement and €21.5 million fine, and has since strengthened its testing, oversight, and monitoring processes.

"Coinbase recognizes the importance of effective AML procedures and takes our obligations under AML legislation and regulatory guidance very seriously," it said. "Our goal has always been and will always be to build the most trusted, compliant, and secure platform in the world."