Cryptocurrency exchanges operate at a massive global scale, processing billions of dollars in digital asset transfers every single day. This velocity creates severe regulatory exposure, forcing digital asset platforms to implement rigorous anti-money-laundering controls that can keep pace with fast-moving blockchain networks.
Coinbase encountered major regulatory enforcement actions involving anti-money-laundering shortcomings, but these proceedings centered on distinct corporate entities, operational periods, and system failures.
The first major milestone occurred on January 4, 2023, when the New York State Department of Financial Services announced a settlement involving a $50 million monetary penalty and a separate $50 million commitment to compliance improvements. Industry analysts frequently describe this as a $100 million settlement, but the entire sum was not a financial fine.
Years later, on November 6, 2025, the Central Bank of Ireland announced a €21,464,734 fine against Coinbase Europe Limited for serious transaction-monitoring failures occurring between April 23, 2021, and March 19, 2025. The Irish High Court formally confirmed these sanctions on January 12, 2026.
Both regulatory actions highlight persistent questions about whether digital asset compliance programs can successfully identify suspicious activity, generate accurate alerts, and ensure human investigators review and resolve those warnings in time.
This analysis examines how these compliance breakdowns developed, what the official regulatory records documented, how suspicious transactions slipped through review, and what these enforcement actions reveal about the practical operation of automated screening systems.
What Is AML Screening in Cryptocurrency?
Preventing illicit finance on a digital asset platform requires a multi-layered compliance architecture designed to catch risks before, during, and after a transaction occurs.
Customer Identification and Due Diligence
Compliance programs begin by verifying customer identity during onboarding, a process known as Know Your Customer or KYC. Exchanges collect legal names, residential addresses, dates of birth, and government-issued identification documents, matching them against physical records to establish baseline identity.
Beyond checking identity papers, exchanges must gather information regarding the intended purpose of the account, expected transaction volumes, and expected sources of wealth.
Verifying an identification document is not the same as understanding a customer’s risk profile. A user who passes basic identity verification may still present high-risk characteristics depending on their employment, corporate affiliations, or geographical location, necessitating enhanced due diligence.
Sanctions and Watchlist Screening
Exchanges must continuously screen customers, wallet addresses, and relevant transaction parties against official government sanctions lists, including databases maintained by the Office of Foreign Assets Control.
Sanctions filtering and transaction monitoring serve completely different functions within a compliance framework.
Sanctions controls seek to identify and block prohibited parties, restricted jurisdictions, or blacklisted digital wallet addresses from accessing the platform. Transaction monitoring, by contrast, focuses on behavioral patterns to spot potentially suspicious financial activity among otherwise authorized users.
Transaction Monitoring and Suspicious Activity Alerts
Automated transaction-monitoring systems rely on algorithmic rules or detection scenarios to flag unusual transactional behavior. These rules might search for activity inconsistent with a customer’s verified profile, rapid layering of funds across multiple accounts, or sudden spikes in transaction volume.
The resulting alert is an initial signal for investigation rather than a definitive conclusion that criminal conduct has occurred.
Sophisticated crypto monitoring tools also incorporate blockchain analytics to trace digital assets across distributed ledgers, tracking fund movements across multiple wallet hops.
Investigation, Reporting, and Escalation
When an automated monitoring rule fires an alert, the case enters an operational workflow handled by human compliance analysts. Analysts review the customer profile, examine associated blockchain transactions, document their investigative decisions, and escalate complex cases to senior compliance management.
If an investigation establishes a reasonable suspicion of illicit finance, the compliance team files a Suspicious Activity Report with financial intelligence units.
An alert, an investigated case, and a suspicious activity report represent completely distinct stages in a compliance pipeline, and operational bottlenecks at any single stage can undermine the entire control structure.
Why Crypto Exchanges Face Particular Monitoring Demands
Cryptocurrency platforms face unique operational challenges due to the pseudonymous, borderless, and irreversible nature of blockchain transactions.
High transaction volumes, cross-border transfers, and the rapid deployment of decentralized finance protocols mean compliance software must process enormous streams of unstructured data.
While public blockchains offer complete transparency into ledger movements, blockchain visibility alone does not automatically reveal the real-world identity controlling a specific wallet address or prove whether a particular transfer serves a legitimate commercial purpose.
Why Coinbase’s AML Screening Cases Matter
Investigating why prominent digital asset enforcement actions occur provides vital perspective on the operational vulnerabilities inherent in automated compliance architectures.
An anti-money-laundering system can fail in several distinct ways:
- It may gather incomplete customer information during onboarding, leaving the institution unable to assign an accurate risk rating.
- Its detection rules may generate more operational alerts than compliance staff can investigate within regulatory timeframes.
- Its underlying software may fail to evaluate blockchain transactions correctly, even when monitoring rules appear active on paper.
- Its corporate governance and escalation procedures may fail to identify or communicate serious control failures to leadership promptly.
Examining the New York and Irish regulatory records as separate case studies illustrates these distinct failure modes.
The New York investigation evaluated a broad institutional compliance program, uncovering systemic weaknesses across customer due diligence, sanctions screening, and severe alert backlogs. The Irish enforcement action examined a technical failure where specific monitoring scenarios failed to evaluate millions of transactions properly due to coding errors.
Understanding these differences gives compliance professionals a practical framework: a system can fail because underlying controls are inadequate, because an organization lacks the staffing capacity to process warnings, or because technical faults prevent software from examining relevant activity.
Coinbase’s 2023 New York Settlement: How the Compliance Failures Developed
The 2023 New York regulatory settlement stemmed from multi-year supervisory examinations that uncovered widespread operational vulnerabilities across Coinbase’s compliance infrastructure.
The 2018–2019 Examination Found Problems Beyond Transaction Monitoring
Coinbase secured a virtual-currency license and money-transmission authority in New York in 2017, opening the door to rapid retail expansion. In May 2020, the New York State Department of Financial Services initiated a comprehensive supervisory examination covering the period from July 1, 2018, through December 31, 2019, eventually delivering its formal findings to corporate leadership in September 2020.
The resulting consent order documented structural deficiencies across multiple core compliance pillars:
- Inadequate know-your-customer and customer due diligence procedures.
- Deficiencies in automated transaction-monitoring systems.
- Vulnerabilities in OFAC sanctions screening protocols.
- Shortcomings in annual anti-money-laundering risk assessments.
- A lack of required technical validation for transaction-monitoring software.
The breadth of these findings highlights a fundamental compliance principle: transaction-monitoring systems depend entirely on accurate customer data. If onboarding procedures fail to capture complete risk profiles, monitoring software lacks the contextual inputs required to prioritize suspicious behavior accurately.
Furthermore, the regulator noted that many of these operational issues had been identified internally through self-assessments and external reviews since at least 2018, meaning the investigation addressed long-standing weaknesses rather than a sudden administrative oversight.
The 2020–2021 Remediation Effort Did Not Resolve the Underlying Problems
Following the delivery of the examination findings, Coinbase engaged an independent consultant to evaluate its Bank Secrecy Act, anti-money-laundering, and sanctions programs. The consultant delivered a critical report in February 2021, prompting Coinbase to adopt an extensive remediation plan.
Despite these corrective efforts, the regulator concluded that critical vulnerabilities persisted, prompting the launch of a formal enforcement investigation in 2021 to determine whether the compliance gaps constituted legal violations.
This phase of the case underscores the gap between adopting a theoretical remediation plan and demonstrating that compliance controls operate effectively in practice.
The regulator’s findings indicated that corporate remediation efforts failed to keep pace with the hyper-growth of the platform. The investigation encompassed customer onboarding, transaction tracking, sanctions controls, recordkeeping obligations, and overall governance structures.
Customer Growth Overwhelmed the Monitoring and Review Process in 2021
The operational breakdown became acute during the retail cryptocurrency surge of 2021, when surging trading volumes overwhelmed the company’s manual compliance review capacity.
The New York consent order documented staggering operational metrics from this period:
- Customer sign-ups in May 2021 reached levels 15 times higher than in January 2020.
- Monthly transaction volumes in November 2021 soared to 25 times higher than January 2020 baseline levels.
- Unreviewed transaction-monitoring alerts accumulated past 100,000 cases by the end of 2021.
- Customers awaiting enhanced due diligence exceeded 14,000 accounts by late 2021.
These figures illustrate a critical operational bottleneck. Automated software can generate millions of alerts, but those warnings remain useless unless compliance teams possess adequate staffing, modern case-management tools, clear risk priorities, and functioning escalation pathways.
The regulator attributed the growing backlog primarily to management’s inability to forecast surging alert volumes, a severe shortage of qualified compliance personnel, and an outdated case-management system utilized between 2019 and November 2021.
The accumulation of over 100,000 unreviewed alerts represented a massive operational failure, though it did not mean that every unreviewed alert involved confirmed criminal proceeds.
What the New York Investigation Revealed About Activity That Was Missed
To demonstrate the real-world impact of these compliance backlogs, the regulatory consent order highlighted specific investigative examples where onboarding failures allowed suspicious actors to operate undetected.
A Customer With a Publicly Documented Criminal History
The regulator described a former Coinbase customer who had been criminally charged in the 1990s in connection with child sexual abuse material.
During the onboarding process, Coinbase’s compliance systems failed to identify this publicly accessible criminal history. As a result, the user was never assigned a high-risk classification and escaped specialized transaction monitoring or account restrictions.
According to the findings, the customer engaged in suspicious transactions potentially linked to illicit activity for more than two years before compliance staff flagged the behavior, filed appropriate reports, and closed the accounts. Coinbase cooperated fully with law enforcement once the activity was detected.
This case highlights the danger of failing to capture foundational risk intelligence during initial customer onboarding.
The Corporate Account Fraud Involving More Than $150 Million
In a separate incident during the spring of 2021, an unauthorized individual claiming to represent a corporate entity opened an account without supplying the mandatory identification documentation required by internal compliance policy.
Despite having zero transactional history to justify higher limits, the unauthorized user successfully secured a 50-fold increase in daily withdrawal limits.
On a single business day, more than $150 million was transferred from the corporation’s external bank account into the Coinbase account, rapidly converted into cryptocurrency, and withdrawn to an external wallet address.
Coinbase remained unaware of the fraudulent activity for six days until contacted directly by the victim corporation’s bank. Coinbase assisted law enforcement, and the funds were eventually recovered.
This multi-million-dollar incident underscored the hazardous combination of bypassed verification protocols, arbitrary limit increases, rapid digital asset conversion, and delayed incident detection.
The February 2022 Monitoring Agreement and the Independent Review
As operational backlogs intensified, regulatory pressure reached a critical threshold. In February 2022, Coinbase and the New York regulator entered into a formal memorandum of understanding that required the appointment of an independent compliance monitor.
The independent monitor took up the role in April 2022 to oversee ongoing remediation.
While the monitor’s August 2022 report acknowledged measurable progress in upgrading compliance infrastructure, it concluded that significant deficiencies still remained across the program.
Coinbase subsequently drafted a targeted remediation plan, and corrective work continued right up until the final consent order was issued in January 2023.
The installation of an independent monitor demonstrated that regulatory oversight extends far beyond purchasing new compliance software, requiring deep structural validation of corporate governance and operational execution.
Why the January 2023 Settlement Was $100 Million
On January 4, 2023, the formal enforcement proceeding concluded with a comprehensive settlement agreement requiring Coinbase to:
- Pay a $50 million financial penalty to the state of New York.
- Commit an additional $50 million to compliance technology and operational improvements over a two-year performance window.
- Maintain ongoing corrective remediation under continued independent regulatory oversight.
Industry observers often mischaracterize this resolution as a straightforward $100 million regulatory fine. In reality, the financial penalty totaled $50 million, paired with a mandatory $50 million investment in internal compliance enhancement.
Furthermore, the settlement did not establish that every unreviewed alert involved active money laundering, nor did it prove that all cryptocurrency transactions processed by the platform were illicit. The legal action focused squarely on systemic compliance deficiencies and institutional failures in identifying, investigating, and resolving financial crime risks.
Coinbase Europe’s €21.46 Million Irish Fine: How Transaction Monitoring Failed
The regulatory enforcement action initiated by the Central Bank of Ireland shifted the investigative focus from broad institutional governance failures in New York to specific technical faults within automated transaction-monitoring software.
The Monitoring Failures Began in 2021 and 2022
The Irish enforcement proceeding targeted Coinbase Europe Limited, a corporate subsidiary operating under strict European Union anti-money-laundering and counter-terrorist-financing statutes.
The Central Bank’s formal findings documented systemic monitoring failures spanning an extended operational window between April 23, 2021, and March 19, 2025.
Internal reviews conducted by Coinbase revealed that three distinct coding errors directly impaired five out of its twenty-one operational transaction-monitoring scenarios throughout 2021 and 2022.
A monitoring scenario represents a configured set of algorithmic rules designed to flag specific patterns of potentially illicit financial behavior. However, simply configuring a scenario does not guarantee that it evaluates incoming blockchain transactions correctly.
In this instance, the coding flaws meant that specific transaction categories bypassed full evaluation. One notable technical failure involved cryptocurrency addresses separated by specialized character strings that the impaired scenarios completely overlooked.
The core vulnerability was not an absolute absence of monitoring software, but rather a technical defect that prevented specific rules from examining relevant transfer data.
What the Central Bank Found About the Transactions That Were Not Properly Monitored
The formal settlement notice quantified the massive scope of the unmonitored transaction streams.
Official figures released by the Central Bank of Ireland outline the scale of the failure:
- 30,442,437 transactions were not fully and properly monitored due to software coding flaws.
- More than €176 billion represented the aggregate financial value of those unmonitored transactions.
- Approximately 31% of all transactions processed by the platform during the active fault period were impacted.
- 184,790 transactions were identified as requiring secondary manual monitoring and intensive review.
- 2,708 suspicious transaction reports were ultimately generated following exhaustive retrospective investigations.
Interpreting these figures requires careful operational context. The staggering €176 billion valuation reflects the total financial throughput of the affected transactions, not an established sum of laundered criminal proceeds.
Similarly, the 30.4 million unmonitored transfers were not proven to be illegal; rather, they represented transactional volume that bypassed required automated screening controls.
The subset of 184,790 transactions required extensive secondary analysis, culminating in 2,708 formal suspicious transaction reports submitted to financial intelligence authorities.
A failure to monitor a transaction correctly constitutes a serious regulatory violation, but it does not automatically establish that every unmonitored transfer involved unlawful conduct.
How the Faults Were Discovered and Corrected
Coinbase reported that the technical coding errors were uncovered through internal quality assurance efforts and system testing protocols.
Once identified, engineering teams deployed software patches to correct the faulty detection rules within a two-to-three-week window.
However, fixing underlying code and reviewing millions of historically affected transactions represented two entirely different operational challenges.
Coinbase had to re-run the massive volume of unmonitored transactions through corrected monitoring scenarios and manually investigate the resulting analytical flags.
The Central Bank noted that it took Coinbase Europe nearly three years to complete this comprehensive retrospective review. This extended timeline underscores a vital compliance reality: fixing software code is only the first step, as retroactive reviews cannot fully replace real-time monitoring and immediate escalation when transactions occur.
The regulatory breach period extended from April 2021 through March 2025, while the technical coding errors originated in 2021 and 2022.
What the Retrospective Review and Suspicious Transaction Reports Established
The exhaustive retrospective analysis of approximately 185,000 flagged transactions yielded thousands of regulatory filings that shed light on underlying platform risks.
Coinbase’s internal review generated roughly 2,700 suspicious transaction reports associated with approximately €13 million in transaction value, closely mirroring the Central Bank’s formal count of 2,708 submitted reports.
A suspicious transaction report formally documents reasonable grounds for suspicion rather than serving as definitive proof of a criminal conviction.
The Central Bank emphasized that these reports captured serious illicit activities, including traditional money laundering, sophisticated fraud and online scams, international drug trafficking networks, cyberattacks, and child sexual exploitation material distribution.
The €13 million valuation associated with these specific reports stands distinct from the broader €176 billion in unmonitored transaction volume, illustrating how a small fraction of unmonitored transfer value can conceal high-severity criminal exposure.
The Central Bank’s Three Formal Findings
The formal settlement notice issued by Irish regulators established three specific legal contraventions against Coinbase Europe Limited:
- Failure to monitor transactions properly: The firm failed to fully and properly monitor over 30.4 million customer transactions.
- Failure to maintain effective policies and procedures: Internal compliance controls, operating procedures, and risk systems failed to operate effectively to detect financial crime.
- Failure to conduct required additional monitoring: The company did not execute mandatory secondary reviews across nearly 185,000 flagged transactions.
These findings highlight that regulatory responsibility extends far beyond deploying initial software configurations. Institutions must maintain continuously tested controls, investigate operational exceptions, and ensure reporting obligations are fulfilled without delay.
How the €21.46 Million Penalty Was Calculated
The enforcement proceeding concluded on November 5, 2025, when the Central Bank and Coinbase Europe agreed to a formal settlement structure.
Regulators determined that baseline sanctions totaling €30,663,906 were warranted for the admitted compliance contraventions.
Because Coinbase cooperated with the investigation and resolved the proceeding under administrative settlement guidelines, a 30% settlement discount was applied, reducing the monetary penalty to €21,464,734 alongside a formal public reprimand.
The Central Bank announced the sanctions on November 6, 2025, and the Irish High Court formally confirmed the enforcement action on January 12, 2026.
The 2024 UK Enforcement Action Against Coinbase’s Payments Business
Regulatory scrutiny surrounding Coinbase’s compliance infrastructure extended beyond American and Irish jurisdictions into the United Kingdom.
On July 25, 2024, the UK Financial Conduct Authority imposed a £3.5 million fine against CB Payments Limited for breaching formal restrictions placed on the onboarding of high-risk retail customers.
This enforcement action involved a distinct corporate entity and targeted legal breaches regarding customer onboarding limitations rather than transaction-monitoring coding errors or systemic New York alert backlogs.
Highlighting this UK proceeding demonstrates that digital asset compliance pressures span multiple international regulatory bodies. However, compliance professionals must maintain a clear distinction between these separate legal proceedings, avoiding the mistake of combining distinct regulatory fines into a single cumulative penalty figure.
How the New York and Irish Cases Differ
Comparing the New York and Irish enforcement actions provides a structured framework for understanding distinct institutional failure modes within digital asset compliance architectures.
| Compliance Dimension | New York Enforcement Case | Irish Enforcement Case |
| Primary Regulated Entity | Coinbase, Inc. | Coinbase Europe Limited |
| Main Enforcement Announcement | January 4, 2023 | November 6, 2025 |
| Primary Examination Period | Supervisory review from July 2018 to December 2019, with backlogs continuing through 2021–2022 | April 23, 2021, through March 19, 2025 |
| Core Compliance Deficiencies | Customer due diligence, transaction monitoring, sanctions controls, risk assessments, and severe alert backlogs | Software coding errors impairing specific transaction-monitoring scenarios and incomplete transaction screening |
| Primary Quantitative Evidence | Over 100,000 unreviewed alerts and more than 14,000 customers awaiting enhanced due diligence | 30,442,437 unmonitored transactions totaling over €176 billion |
| Financial Settlement Terms | $50 million monetary penalty paired with a $50 million compliance investment commitment | €30.66 million proposed sanction reduced via a 30% discount to €21.46 million |
| Core Operational Lesson | Rapid customer growth can overwhelm compliance staffing capacity and case-management workflows | Automated monitoring rules can exist in software while failing to evaluate underlying transaction data correctly |
While both enforcement actions reflect broader corporate challenges in scaling anti-money-laundering controls across an expanding digital asset exchange, their underlying legal findings, factual histories, and technical root causes remain entirely separate.
What the Coinbase Cases Reveal About AML Screening Controls
Analyzing these major enforcement actions yields practical lessons for compliance officers and risk management teams operating in the cryptocurrency sector.
A Monitoring System Must Be Tested After Every Material Change
The Irish enforcement action proves that configuration rules cannot be trusted blindly following deployment. Compliance teams must execute rigorous pre-implementation testing and continuous post-update validation.
Testing protocols must verify how software handles edge cases, specialized character formats, and unusual wallet address structures.
Confirming that a rule exists within a system configuration is insufficient; testing must validate actual operational coverage across live transaction data streams.
Alert Backlogs Are a Compliance Risk, Not Just a Staffing Problem
The New York settlement highlights the dangers of allowing operational alert backlogs to accumulate unchecked. Compliance leadership must actively monitor key performance indicators, including alert age, investigation volumes, risk-based prioritization queues, and staff workloads.
Successfully generating automated alerts offers zero regulatory defense if human investigators lack the time, software tools, or headcount required to examine those warnings promptly.
Customer Risk Ratings Must Affect Real Decisions
The findings from the New York examination underscore the vital link between initial customer due diligence and ongoing transaction monitoring.
Information gathered during onboarding must directly dictate customer risk scores, automated monitoring thresholds, and the frequency of periodic account reviews.
Relying on incomplete customer profiles or assigning inaccurate risk ratings invalidates every downstream control mechanism that depends on those baseline inputs.
Retrospective Reviews Need Clear Ownership and Escalation
The multi-year duration required to complete retrospective reviews in the Irish case demonstrates the complexity of remediating historical control failures.
Firms require formalized incident response protocols to identify affected transaction windows, isolate faulty rules, re-run historical data, submit required regulatory reports, and escalate findings to executive leadership immediately upon discovery.
What to Evaluate When Choosing an AML Screening Vendor
Selecting enterprise compliance technology requires rigorous vendor due diligence. External software providers do not assume regulatory liability; ultimate compliance responsibility rests squarely on the regulated financial institution.
Evaluating compliance vendors requires assessing several critical operational capabilities:
- Transaction Coverage: Can the vendor demonstrate precisely which digital assets, blockchain networks, wallet formats, and data fields are actively screened by their detection algorithms?
- Scenario Testing: Are detection rules subjected to rigorous pre-deployment testing and continuous validation after software updates?
- Alert Handling: Does the system maintain immutable audit trails recording when an alert was created, assigned, reviewed, escalated, and closed?
- Backlog Monitoring: Can compliance supervisors track aged cases, overdue investigative queues, and unassigned high-risk alerts in real time?
- Auditability: Are historical rule versions, configuration change logs, testing results, and investigator decision notes permanently recorded?
- Incident Response Tools: If a monitoring rule fails, does the platform allow compliance teams to isolate affected transactions and execute a structured retrospective review?
- Governance and Oversight: Does the regulated institution retain complete transparency and control over the vendor’s system performance and maintenance cycles?
Outsourcing anti-money-laundering technology never relieves an exchange of its legal obligation to maintain effective compliance controls. Vendor selection must focus on rigorous control testing and operational transparency rather than marketing claims.
Coinbase’s Remediation and Regulatory Outcomes
Both regulatory enforcement actions triggered extensive institutional remediation across Coinbase’s global operations.
Following the January 2023 New York settlement, Coinbase fulfilled its commitment to invest $50 million in compliance infrastructure, upgrading transaction-monitoring architectures, enhancing customer risk-scoring models, and expanding blockchain analytics capabilities. Independent monitoring provided structured oversight throughout the corrective process.
In Europe, following the Irish enforcement action, Coinbase Europe Limited confirmed that engineering teams patched the software coding errors within weeks of discovery, subsequently executing a multi-year retrospective review of affected transaction streams and strengthening ongoing oversight of automated monitoring systems.
These comprehensive remedial efforts emphasize a central truth of modern financial regulation: maintaining an effective anti-money-laundering compliance program requires continuous technological investment, rigorous internal auditing, adequate investigative staffing, and immediate corrective action whenever control vulnerabilities emerge.
