#
Enforcement is led by the CBI's Administrative Sanctions Procedure (ASP), under which it can fine firms up to EUR 10 million or 10% of turnover and individuals up to EUR 1 million. The landmark recent payments-context action is the November 2025 fine of Coinbase Europe Limited (EUR 21,464,734 after a 30% settlement discount, from EUR 30.66m) for AML/CTF transaction-monitoring failures under the CJA 2010 — subject to Irish High Court confirmation. Historic large fines include Bank of Ireland (EUR 24.5m, 2021) for IT service-continuity/control failings. The CBI is also the competent authority for EU financial sanctions and issued its first Financial Crime Bulletin in late 2025.
The enforcement firepower behind that action is substantial. The CBI's Administrative Sanctions Procedure empowers fines up to EUR 10 million or 10% of turnover for firms and EUR 1 million for individuals; notable historic fines include Bank of Ireland's EUR 24.5 million in November 2021 for IT service-continuity and internal-control breaches. The CBI issued its first Financial Crime Bulletin in late 2025, flagging weak sanctions-screening — just under half of 40 assessed firms lacked transaction-screening — and sanctioned non-EU bank cards at EU ATMs. This quantifies the supervisory firepower and the sanctions-screening focus relevant to payments firms across both bank and non-bank populations.
Outlook
The litigation and enforcement trajectory is escalating. The Coinbase Europe fine, pending High Court confirmation, sets a precedent for CASP AML enforcement and signals the CBI's willingness to deploy its full ASP firepower. The first Financial Crime Bulletin's findings on sanctions-screening weakness suggest further supervisory attention on transaction-screening adequacy. Payments firms should anticipate continued, well-resourced enforcement activity and treat the EUR 10m / 10%-of-turnover ceiling as a live exposure.
Legal & Litigation
The Central Bank of Ireland's enforcement action against BlueSnap Payment Services Ireland Limited, confirmed by the High Court on 2 April 2025, stands as the concrete enforcement record behind the safeguarding expectations now being formalised through the new Head of Safeguarding controlled function elsewhere in this brief. The settlement resulted in a reprimand and a fine of two hundred ninety-eight thousand, two hundred and forty euro, reflecting a thirty per cent settlement discount against a headline sanction of four hundred sixty-three thousand, two hundred euro. The underlying findings were that the firm did not deposit its customers' funds into BlueSnap's own designated safeguarding account, and that it mixed its customers' funds with other funds, alongside delayed notification to the Central Bank of the issue and inadequate oversight of safeguarding operations that were provided at group level rather than within the local entity.
The case is instructive precisely because it maps directly onto the standing supervisory expectations discussed in the conduct and safeguarding context: the requirement that second- and third-line oversight of safeguarding reside within the local legal entity rather than with group or outsourced providers, the expectation of immediate notification of any safeguarding issue identified, and the expectation of daily reconciliation that would be expected to catch a fund-mixing failure of this kind before it became entrenched. The Central Bank's December 2025 Payment and E-Money Newsletter and its 2026 Regulatory and Supervisory Outlook both record that sector-wide deficiencies of a similar character, specifically concentration risk in safeguarded-fund placement and inadequate credit-risk management frameworks, persist across the Irish payment and e-money sector even after this enforcement action, with the Outlook noting that fifty-eight payment and e-money firms held a combined eleven point eight billion euro in safeguarded funds at the end of 2025, an increase of seventeen per cent on the prior year-end.
The scale noted in that Outlook figure underscores why the Central Bank has moved toward the governance-based supervisory model built around the new Head of Safeguarding function: the BlueSnap enforcement outcome demonstrates that thematic guidance and notices alone did not fully prevent a serious safeguarding failure, and the growing pool of safeguarded funds across the sector increases the consequence of any similar failure recurring.
Outlook
The BlueSnap enforcement record is likely to remain the reference case the Central Bank and the sector point to when assessing whether the new governance structure, specifically the Head of Safeguarding function, is functioning as intended, and any further enforcement action on safeguarding grounds in coming cycles should be read against the same pattern of findings, namely fund-mixing, delayed notification, and oversight gaps between group-level and local-entity-level functions.
Sources and findings (4)
- T3https://wp.nyu.edu/compliance_enforcement/2025/11/24/central-bank-of-ireland-fines-coinbase-more-than-e21-million-for-breaching-anti-money-laundering-and-counter-terrorist-financing-transaction-monitoring-obligations/retrieved
- T3https://www.dilloneustace.com/insights/legal-insights/central-bank-ramps-up-enforcement-actions-as-record-fines-imposed/retrieved
- T1https://www.centralbank.ie/regulation/how-we-regulate/enforcement/administrative-sanctions-procedureretrieved
- T3https://globalsanctions.com/2025/12/irish-central-bank-issues-first-financial-crime-bulletin-including-sanctions/retrieved