Compliance Insights from FCA's £3.5M Penalty on Coinbase Payments

On 23rd July 2024, the FCA fined Coinbase Payments Limited (CBPL) £3.5 million due to concerns over their business conduct, highlighting a lack of due skill, care, and diligence in ensuring compliance with CBPL’s VREQ to mitigate the financial crime risks posed by high-risk customers.

Here are our learnings from our deep dive into the FCA notice.

Overall Impact

1. Over 3 years CBPL breached VREQ requirements by onboarding and providing payment or e-money services to 13K high-risk customers, prohibited deposits, totalling $24.9m.
2. Customers used funds to withdraw and execute multiple cryptoasset transactions via Coinbase Group entities, totalling ~$226m.
3. CBPL submitted SARs for 62 customers, transactions worth ~$1.75m (several exceeding $50K).

Key Learnings

✅ Establish a comprehensive compliance framework with clearly defined roles and responsibilities

An internal review identified documented VREQ compliance framework was not formalised and no formal document laid the roles of teams specifically for VREQs.

✅ Ensure rigorous SDLC process, collaboration and accurate translation of regulatory requirements

There were gaps in the initial implementation of CBPL’s VREQ potentially due to the use of different versions of the finalised FCA requirements. Ensuring end-to-end traceability of requirements and open communication across domains and teams is paramount to ensuring compliance.

✅ Implement rigorous testing and monitoring

There was a consistent lack of evidence surrounding the testing of the implementations and monitoring of the built system until a few years post-implementation.

✅ Carefully manage, review and monitor migrations

1,034 high-risk customers were migrated from another Coinbase Group entity. The required assessment was not conducted to determine whether the VREQ Flag should be applied to these accounts, resulting in the flag not applied correctly.

✅ Ensure thorough audit trails & records

CPBL was required to keep records relating to compliance with VREQ prior and post-implementation and sufficient evidence wasn’t available to support. Traceability of requirements through the entire process, audit trails and record keeping are crucial to a compliance solution.

✅ Configurable policies that enable Human in the loop

CBPL had no way to restrict the automated onboarding of high-risk retail customers requiring bespoke system changes. It is important to build systems that enable configurable policies to require conditional human-centred reviews.

Stay ahead of compliance challenges by integrating robust KYC and AML solutions that keep your organisation secure and compliant.