What the regulators actually say.

The most common objection to confidential transfers is that the travel rule forbids them.

This is the collision that does not dissolve on closer reading.

Supervisory access, external audit and suspicious activity reporting are all bilateral disclosures to a named party under a legal duty.

The 2023 Privacy Pools paper made a design argument that has held up: instead of hiding everything, let a depositor prove in zero knowledge that their withdrawal belongs to a chosen set of deposits, o…

The strongest evidence that public authorities do not equate confidentiality with wrongdoing is that they keep building it.

The compliance debate usually asks whether institutions are permitted to use confidentiality.

Worth stating plainly rather than glossing: this is the weakest part of the case for confidential ledgers.

Regulators keep drawing a line that the debate tends to flatten.

Nothing else in this section has as much reach. FATF sets standards rather than law, but the mutual evaluation process and the grey list make adoption close to compulsory, which is why the same travel…

The quiet instrument that will do the most to end pseudonymity at the intermediary layer, and it arrives before the AML rules do.

The single most privacy-restrictive sentence in global financial regulation is probably here.

Included here mainly to correct a common misattribution. The FSB coordinates national authorities on financial stability, and its 2023 framework is frequently cited in arguments about on-chain surveil…

IOSCO pulls in both directions, which makes it more interesting than most.

If you want evidence that the institutions writing the rules do not equate confidentiality with crime, this is where to look.

The counterweight instrument, and the one that has not arrived.

Rarely discussed in privacy debates about crypto, and structurally one of the more significant bodies in this section.

Set this against the financial standard-setters and the contrast is sharp.

A national agency rather than a global one, included because its output gets adopted internationally as reference material and because it does something no financial regulator has.

MiCA carries exactly one operative anonymity rule, and it is narrower than its reputation.

This, not the privacy-coin headline, is what actually ends unattributed transfers at the EU perimeter.

Reported almost everywhere as an EU ban on privacy coins from 1 July 2027.

The law most often described as a problem for blockchain is also the strongest European argument for building with privacy technology.

The reference text on how European data protection law lands on a ledger, final since 7 July 2026.

A central bank designing confidentiality into money on purpose is the most direct evidence that European regulators do not equate privacy with illegality.

The clearest counterexample to the idea that regulators are uniformly against cryptographic privacy: here EU law names the technology and requires it.

Whether a blockchain address is personal data is not a settled question, and the two European institutions answering it are drifting apart.

A useful case of a rule written for one context landing awkwardly on another.

The UK has built a full regulatory perimeter without reaching for a single prohibition on privacy technology.

A useful corrective to the assumption that a crypto-friendly jurisdiction is permissive about anonymity.

Turkey reaches the same destination as an anonymity ban without ever writing one.

Norway took the EU rulebook through the EEA route and enforced it promptly, closing its transition window in July 2026 with providers told to wind down.

An unusual case: the virtual assets law passed in February 2022 is recorded in the official register as never having entered into force.

Across every jurisdiction surveyed for this section, institutional privacy oversight was either strengthening or holding steady.

Russia has the most direct on-chain deanonymisation mandate found anywhere in this section.

France pulls harder in both directions than any other member state.

Germany's divergence runs in two directions and neither is about coins.

Liechtenstein made a structural choice worth understanding: rather than requiring every participant to identify counterparties, it turned identification into its own licensed role.

Iceland is worth a card mainly for what it reveals about the EEA route into EU financial law.

The Netherlands ran the most aggressive self-hosted wallet identification demand in Europe and then gave it up, which makes it the most instructive European case in this section.

Poland is the exception that shows how the EU framework behaves when a member state cannot implement it.

Ireland adds nothing of its own to the EU rules on crypto confidentiality, and that is worth saying plainly rather than inventing local colour.

Spain's national contribution sits on the marketing side rather than the confidentiality side, and it got there first.

Italy's national addition was a reporting channel rather than a prohibition, and it went further than the European baseline in an unusual direction.

Portugal's distinctive contribution came from its data protection authority rather than its financial regulators, and it addresses a question the financial rules do not reach.

Estonia mattered to this market out of proportion to its size, because for a few years it issued more crypto authorisations than anywhere else in Europe.

Lithuania took the same route as Estonia and reached a similar destination by a different instrument.

Belgium adds no national layer on confidentiality, and that is worth stating plainly rather than manufacturing local colour.

Austria's only real distinguishing feature in this area is timing.

Luxembourg carries weight here because of what is domiciled in it rather than because of any national rule on confidentiality.

Sweden has a reputation for hostility to crypto that is worth separating into its parts.

Denmark is a useful reminder that the financial supervisor is not always the body that matters most for privacy.

Czechia is one of the member states that put crypto supervision inside the central bank rather than with a separate markets authority, which matters more for how firms experience the process than for…

The most restrictive thing in current US law on this subject, and it is architectural rather than procedural.

The most severe action ever taken by a government against privacy tooling, followed by the most significant legal retreat from one.

Registration, identity verification and suspicious activity reporting for anyone acting as a money transmitter in crypto all originate here, and none of that has loosened.

Where federal policy has softened around non-custodial software, New York has not moved at all.

The clearest illustration of the US perimeter split. Custodial reporting arrived exactly as planned and is now in its first year of cost-basis reporting, which means identity, proceeds and acquisition…

The most significant shift in this section, and the one most easily overstated.

Any account of US financial privacy that stops at statutes misses the layer that actually decides things.

The US moved in both directions at once between 2024 and 2026, and the dividing line is custody rather than politics.

Canada is the clearest case in this section of an outcome that looks like a ban and is not one.

Brazil holds the two halves of this section's argument in one place.

Mexico states the reasoning that most regulators leave implicit.

Argentina drew its perimeter in the place this section keeps arguing is the right one.

The Bahamas holds the sharpest contradiction in this section, and both halves are deliberate.

Bermuda restricts no asset by name and still runs the most comprehensive transaction surveillance requirement found in the Americas.

Cayman matters because so many funds and token issuers are structured through it, and the finding is a set of absences rather than rules.

The British Virgin Islands is a useful illustration that confidentiality is not one thing.

Wyoming is the clearest example in the United States of a legislature building around self-custody rather than treating it as a gap.

California is the counterweight to Wyoming within the same country, and the contrast is instructive because neither state legislates about anonymity at all.

Texas belongs in this section for what it does not do. Non-stablecoin cryptocurrency does not require a money transmitter licence there, which leaves a large share of activity outside the perimeter th…

Worth reading closely because it is the road not taken elsewhere.

A useful case study in how a market gets closed without a rule that mentions the thing being closed out.

Japan is the clearest example of a rule written against untraceability rather than against named assets, and of that rule being applied by an industry body rather than a regulator.

Standards do not travel by themselves, and this is the machinery that moves them across Asia.

Australia constrains confidentiality through anti-money-laundering law and not through any coin-specific rule.

Thailand is the jurisdiction most often cited as having banned privacy coins, and the claim does not survive reading the instrument.

India has no bespoke crypto statute and regulates the sector through anti-money-laundering law and tax instead.

The one jurisdiction in this section that declined to exclude anonymity-enhancing assets and chose to price the risk instead.

A good illustration of exclusion happening without a rule that mentions the thing being excluded.

Two things commonly reported about Taiwan are wrong. The VASP Act is not pending; it passed its third reading on 30 June 2026, though commencement still has to be designated and licensing runs on a 21…

The most identity-maximalist regime covered here, and the only one actively trying to export it.

Japan shows the pattern in this section at its clearest: the rule is written against untraceability, never against named assets.

Two things are true here at once, and most coverage reports only the first.

Worth correcting a claim that circulates about Kazakhstan: the law does not establish a state system watching digital asset transactions.

The most explicit categorical ban in the Asia-Pacific set, and notable for how it is drafted.

Read in full, the circular contains no provision on privacy coins, mixers or tumblers, and no express treatment of self-hosted wallets.

Bangladesh is a useful reminder that a country does not need a crypto statute to prohibit crypto.

Sri Lanka occupies the position a lot of countries were in five years ago and few still are: crypto is neither licensed nor forbidden.

Most regimes reach anonymity-enhanced assets sideways, through listing criteria, liquidity gates or traceability tests.

The two financial free zones inside the UAE regulate separately from Dubai's virtual assets authority, and they went a step further than it did.

The regional counterpart to the Asian body, and the reason the Gulf entries in this section rhyme with one another.

Israel splits cleanly along the axis this whole section turns on.

If you want the counterexample to the pattern running through this section, it is here.

Most prohibitions in this section live in rulebooks that a regulator can amend without going back to a legislature.

Worth citing well beyond Ghana, because a central bank stated plainly in writing what most regimes leave to inference.

The most precisely drafted travel rule in this section, and the one that leaves least room.

Bahrain never names a coin, and its rule is broader for it. Licensees may not list assets that facilitate, or may facilitate, obfuscation or concealment of a client or counterparty's identity, and the…

Qatar reaches exclusion without ever writing a prohibition on anonymity, because its perimeter is drawn as a positive list.

Nigeria took the securities route rather than building a bespoke crypto statute, bringing digital assets under the securities regulator through the 2025 Act while the 2022 rules continue to carry the…

Seychelles matters here because of how many crypto entities are domiciled in it rather than because of anything it says about confidentiality, and it says nothing.

Most rules in this section reach assets, and a few reach tools.

Rwanda uses a technique worth understanding because it is different from a ban.

Mauritius matters here out of proportion to its size, because a great many crypto entities are domiciled in it.

Kuwait is worth including precisely because its regulators said the quiet part out loud.

Egypt inverts the usual shape of an entry in this section. There is no crypto privacy regime to describe because there is no lawful crypto activity: the banking law requires central bank approval to i…

Morocco is moving from prohibition toward a framework, and the direction is genuinely liberalising after years in which crypto activity sat outside the exchange control rules.