FCA fined Coinbase £3.5mn for providing payment services to more than 13,000 “high-risk” customers.

Crypto exchange Coinbase’s subsidiary, CB Payments Ltd has been fined £3.5mn by the UK’s financial watchdog [FCA] for

• Repeatedly breaching a requirement that prevented the firm from offering services to high-risk customers AND   
• Providing payment services to more than 13,000 “high-risk” customers.

The High-risk customers included:-

• Those on sanctions lists,
• Politically exposed people and
• Those who declared themselves unemployed.

The fine is the first the FCA has handed out to a firm handling payments used in crypto trading. This is in stark contrast to the US financial regulator, which has aggressively pursued digital asset companies in recent years.

In its most recent large penalty, the Securities and Exchange Commission fined collapsed crypto group TERRAFORM LABS and its founder more than $5bn earlier this year.

• https://www.sec.gov/newsroom/press-releases/2024-73#:~:text=The%20Securities%20and%20Exchange%20Commission%20today%20announced%20that,to%20massive%20investor%20losses%20when%20the%20scheme%20unraveled.

Therese Chambers, joint executive Director of Enforcement and Market Oversight at the FCA, said:

1. 'The money laundering risks associated with crypto are obvious and firms must take them seriously. Firms like CBPL that enable crypto trading need to have strong financial crime controls.
2. CBPL's controls had significant weaknesses and the FCA told it so, which is why the requirements were needed. CPBL, however, repeatedly breached those requirements.
3. 'This increased the risk that criminals could use CBPL to launder the proceeds of crime.
4. We will not tolerate such laxity, which jeopardises the integrity of our markets.'

The regulator said.

• Coinbase’s payments subsidiary entered into a so-called “voluntary requirement” with the FCA in October 2020 following “concerns about the effectiveness” of its financial crime control framework
• This agreement prevented the company from taking on risky clients.

However, the FCA said:

• That CBPL’s “lack of due skill, care and diligence” in sticking to the requirement meant it repeatedly allowed contentious customers to use its services in the three years following the agreement.
• CBPL onboarded and/or provided its services to 13,416 high-risk customers”.
• Of those, about 31 per cent deposited a total of about $24.9mn, which was used to make withdrawals and crypto trades through other Coinbase entities, totalling about $226mn.

Coinbase added that the number of high-risk individuals who used its services amounted to 0.34 per cent of the number of people “onboarded” by CBPL over the three-year period.

FULL FCA STATEMENT:-

1. CB Payments Limited (CBPL) has been fined £3,503,546 by the Financial Conduct Authority (FCA) for repeatedly breaching a requirement that prevented the firm from offering services to high-risk customers.
2. CBPL is part of the Coinbase Group, which operates a prominent cryptoasset trading platform that is accessible globally.
3. CBPL does not undertake cryptoasset transactions for customers but it acts as a gateway for customers to trade cryptoassets via other entities within the Coinbase Group.
4. CBPL is not currently registered to undertake cryptoasset activities in the UK.
5. The firm entered into a voluntary requirement (the VREQ) in October 2020, which followed significant engagement with the FCA relating to concerns about the effectiveness of CBPL’s financial crime control framework.
6. The VREQ prevented CBPL from taking on new high-risk customers while it addressed issues with its framework.
7. Despite the restrictions in place, CBPL onboarded and/or provided e-money services to 13,416 high-risk customers.
8. Approximately 31 per cent of these customers deposited around USD $24.9 million. These funds were used to make withdrawals and then execute multiple cryptoasset transactions via other Coinbase Group entities, totalling approximately USD $226 million.
9. The breaches were the result of CBPL’s lack of due skill, care and diligence in the design, testing, implementation and monitoring of the controls put in place to ensure that the VREQ was effective. This included failing to consider all of the various ways in which customers might be onboarded when designing the controls. B
10. because of inadequacies in the initial monitoring of compliance with the VREQ, repeated and material breaches went undiscovered for almost two years.
11. Today’s action was taken under the Electronic Money Regulations 2011; this is the first time the FCA has taken enforcement action using these powers.  The firm agreed to resolve the matter and qualified for a 30% discount on its fine.

SOURCES

• https://www.bloomberg.com/news/articles/2024-07-25/coinbase-unit-fined-for-enabling-cryptoasset-trading-by-uk
• https://www.coinbase.com/en-gb/blog/coinbase-and-fca-reach-agreement-to-resolve-investigation-into-voluntary-requirement-breaches