The UK Financial Conduct Authority (FCA) has fined Coinbase’s payments subsidiary, CB Payments Limited (CBPL), £3,503,546, or roughly $4.5 million, for repeatedly breaching compliance restrictions tied to high-risk customers. According to the regulator, the case represents the FCA’s first enforcement action against a firm enabling cryptoasset trading, underscoring the agency’s tougher posture toward controls in the digital asset sector.
FCA says restrictions were ignored
The regulator said CBPL had previously agreed to a voluntary requirement with the FCA in October 2020. Under that arrangement, the company was barred from onboarding new high-risk customers until it had resolved weaknesses in its compliance framework. Despite that restriction, the FCA found that CBPL went on to onboard and/or provide e-money services to 13,416 high-risk customers.
While CBPL does not directly execute cryptoasset transactions for retail users, it acts as a gateway that enables customers to access crypto trading services through other entities within the Coinbase group. The FCA also noted that CBPL is not currently registered to carry out cryptoasset activities in the UK, making the compliance shortcomings especially significant in the regulator’s view.
Millions in deposits and larger crypto transaction flows
The FCA said that around 31% of the high-risk customers identified in the case deposited about $24.9 million. Those funds were then used for withdrawals and to facilitate multiple cryptoasset transactions through other Coinbase group entities, amounting to approximately $226 million in total transaction value.
In the regulator’s assessment, the failures stemmed from inadequate control measures. The breaches were not detected for nearly two years, raising concerns about oversight, monitoring, and the practical enforcement of internal restrictions once they had been put in place.
A signal on crypto compliance expectations
Therese Chambers, joint executive director of enforcement and market oversight at the FCA, stressed that firms operating around cryptoassets face elevated financial crime risks and are expected to maintain robust systems to identify and manage those risks. The enforcement outcome sends a broader message to crypto-linked businesses serving the UK market: commitments made to regulators must be backed by effective controls, not merely formal policies.
The case is notable not only because of the fine itself, but also because it highlights how payment and onboarding functions can sit at the center of regulatory scrutiny in crypto markets. Even where a firm does not directly process crypto trades, regulators may still view it as a critical compliance gatekeeper if its services provide customer access to digital asset platforms.
For the wider industry, the FCA’s action reinforces a familiar theme in crypto regulation: risk classification, customer onboarding, and anti-financial-crime controls remain among the most sensitive areas for enforcement. Firms operating in the UK, or routing users into crypto products through affiliated entities, are likely to face increasing pressure to demonstrate that restricted customer categories are properly screened, blocked, and monitored over time.
As regulators continue refining their approach to crypto oversight, this case may be remembered as an important marker of the FCA’s enforcement direction. The agency has made clear that when compliance weaknesses allow high-risk users to access services despite explicit restrictions, firms should expect meaningful penalties and closer supervisory attention.