Customer Funds Are Not an Outsourcing Project: Ireland Fines Coinbase EUR 3.25M as US and EU Tighten the Enforcement Red Line

On one side of the Atlantic, a central bank fine draws a hard line that “fund safety cannot be outsourced”; on the other, an American exchange is suing its own regulator over the legal identity of perpetual futures. A license is only the entry ticket; day-to-day execution is the real exam.

Ireland Fines Coinbase EUR 3.25M: Why the Safeguarding Red Line Cannot Be Outsourced

On October 22, the Central Bank of Ireland published an enforcement notice imposing a fine of EUR 3,252,618 on Coinbase Ireland (CBIE), plus a public reprimand. The penalty is based on the safeguarding and outsourcing provisions of the Electronic Money Regulations 2011 (EMR 2011), covering a breach period that ran from November 1, 2020 to August 19, 2025, nearly five years. The original penalty was EUR 4,646,597, reduced by 30% because Coinbase accepted an “undisputed facts” settlement, bringing the final amount to EUR 3.25 million, pending confirmation by the Irish High Court.

This is not the first time Coinbase has been fined in Ireland. In November 2025, the Central Bank fined a separate entity, Coinbase Europe, EUR 21.5 million for failing to monitor more than 30 million transactions for money-laundering and terrorist-financing risk over a year, resulting in 2,708 late suspicious transaction reports. With the two penalties combined, Coinbase has become one of the most prominent cases in European crypto enforcement history. This time, the regulator’s target is a layer more fundamental, and easier to overlook, than AML: whether customer money has actually been kept in segregated accounts.

The details in the settlement notice are striking. During the US banking crisis in March 2023, Coinbase directed about 30 institutional clients to deposit US dollars into bank accounts held by Coinbase Inc., rather than the Irish entity’s segregated accounts, citing the need to “protect customers from potential losses arising from bank failure.” The practice lasted about 19 months (March 2023 to October 2024), mixing customer funds with those of other Coinbase entities. Separately, funds migrated from Coinbase UK remained in the UK entity’s safeguarding account until August 19, 2025. Coinbase acknowledged that these measures were intended to protect customers during turbulence, but the outcome violated the segregation requirements of EMR 2011.

That statement is the soul of the entire penalty: outsourcing is allowed, but regulatory accountability cannot be outsourced. When CBIE applied for its license in 2019, it promised the Central Bank it would “establish robust and automated safeguards.” In practice, since 2020, operations relied on the US parent’s processes. The Central Bank flagged governance concerns in letters in July 2022 and March 2023, but the issues were not adequately resolved until Coinbase self-reported in January 2024, remediated the shortfall in June 2024, fixed the underlying data issue in October 2024, and finally appointed a dedicated safeguarding officer in December 2024. Regulators have limits to their patience: from warnings to a settlement fine, nearly two years elapsed.

The warning to the industry goes far beyond the EUR 3.25 million itself. Coinbase is the world’s largest crypto exchange and custodian of Bitcoin. Its Irish entity is a licensed e-money institution (EMI), and the Irish license grants access to the entire EU market. Yet when a function as central as customer-fund safeguarding is outsourced to a foreign parent, and the local team cannot even compute daily segregation accurately, the credibility of the entire licensing system is called into question. In her statement, Karen O’Leary stressed that commitments made during the authorisation process are critical to the Central Bank’s assessment: “Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable.” This is the regulatory logic of the MiCA era: a license is not the finish line, but the starting point of ongoing compliance.

CME Sues Its Own Regulator: Are Perpetuals Futures or Swaps

If the Irish fine represents a tightening of enforcement in Europe, the CME lawsuit across the Atlantic is a turf war over definitions in the US market. On October 22, CME Group CEO Terry Duffy, after reporting record third-quarter revenue, reiterated that crypto perpetual futures (perps) are legally swaps, not futures. CME is suing its own regulator, the Commodity Futures Trading Commission (CFTC), to make that case.

The dispute began on May 29, 2026, when the CFTC approved prediction-market platform Kalshi to list a Bitcoin perpetual contract, classifying it as a standard futures product. CME filed its complaint in US federal district court on June 18, challenging that classification. Duffy’s core argument: perpetuals have no expiry date, traders can hold leveraged positions indefinitely, and the mechanism that keeps the contract price anchored to spot, the funding rate, involves periodic payments between longs and shorts. That ongoing payment structure fits the definition of a swap under the Commodity Exchange Act, and under the Dodd-Frank post-2008 framework. In Duffy’s words:

CME’s position is full of tension. On a July earnings call, Duffy said 94% of CME’s first-half volume came from institutional traders, and these core clients “did not ask for perps.” In other words, CME is not suing to launch its own perpetuals; it is suing to stop competitors from capturing the retail perp market under a more lenient classification. The CFTC’s response is equally blunt: on September 2 it filed a motion to dismiss, arguing that CME, as a registered exchange, has the right to list the same contracts itself, and therefore lacks legal standing. The regulator’s subtext: if you think the classification is wrong, go list one yourself.

The stakes behind the classification fight are very concrete. If perpetuals are deemed swaps, a range of obligations under Dodd-Frank kick in: central clearing, margin segregation, trade reporting. Customer collateral protection and bankruptcy isolation rules differ fundamentally from futures; on tax, futures enjoy the Section 1256 60/40 long-term/short-term capital gains treatment, while the tax status of swaps remains unsettled. Duffy has also warned that offshore venues offer up to 250x leverage on perpetuals, versus roughly 6x for Kalshi’s contracts. The outcome of the lawsuit will determine which rules US retail investors trade perpetuals under, and whether the CFTC can police offshore venues serving US users without new legislation.

The CFTC’s motion to dismiss is still pending, with no ruling yet. If the motion is granted, the classification of perpetuals remains unresolved, and any registered exchange could list similar products under a classification that no court has validated; if CME prevails, the rules of the entire US crypto derivatives market would be rewritten. One signal market observers are watching: whether CME files its own perpetual contract listing before the judge rules, which would largely dilute the stakes of the lawsuit.

Key Takeaways for Practitioners