# Crypto privacy regulation, by jurisdiction > What the rulebook actually says about confidentiality on public blockchains, > read from the instruments themselves rather than from summaries of them. Confidentiality and compliance are usually described as opposites. Read the instruments and they mostly are not: nearly every rule that looks like a demand for transparency binds a regulated institution to know and disclose specific facts to specific parties, not to publish those facts to the world. Part of the Soda Labs Privacy Hub: https://www.sodalabs.xyz/privacy-hub Human-readable version of this page: https://www.sodalabs.xyz/privacy-hub/regulation Every entry below also exists as markdown at .md ## 107 entries ### Global (18) - [The travel rule binds institutions, not ledgers](https://www.sodalabs.xyz/privacy-hub/regulation/why-travel-rule): The most common objection to confidential transfers is that the travel rule forbids them. - [Erasure against an append-only ledger](https://www.sodalabs.xyz/privacy-hub/regulation/why-erasure): This is the collision that does not dissolve on closer reading. - [Selective disclosure as a compliance primitive](https://www.sodalabs.xyz/privacy-hub/regulation/why-viewing-keys): Supervisory access, external audit and suspicious activity reporting are all bilateral disclosures to a named party under a legal duty. - [Proving where funds did not come from](https://www.sodalabs.xyz/privacy-hub/regulation/why-privacy-pools): The 2023 Privacy Pools paper made a design argument that has held up: instead of hiding everything, let a depositor prove in zero knowledge that their withdrawal belongs to a chose… - [Central banks are building confidentiality themselves](https://www.sodalabs.xyz/privacy-hub/regulation/why-central-banks-build-privacy): The strongest evidence that public authorities do not equate confidentiality with wrongdoing is that they keep building it. - [Why regulated institutions cannot use a transparent ledger](https://www.sodalabs.xyz/privacy-hub/regulation/why-institutions-need-it): The compliance debate usually asks whether institutions are permitted to use confidentiality. - [Sanctions screening on a confidential ledger](https://www.sodalabs.xyz/privacy-hub/regulation/why-sanctions-screening): Worth stating plainly rather than glossing: this is the weakest part of the case for confidential ledgers. - [Anonymity is not the same thing as confidentiality](https://www.sodalabs.xyz/privacy-hub/regulation/why-programmable-confidentiality): Regulators keep drawing a line that the debate tends to flatten. - [FATF](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fatf) [Attribution required]: Nothing else in this section has as much reach. FATF sets standards rather than law, but the mutual evaluation process and the grey list make adoption close to compulsory, which is… - [OECD CARF](https://www.sodalabs.xyz/privacy-hub/regulation/reg-oecd-carf) [Attribution required]: The quiet instrument that will do the most to end pseudonymity at the intermediary layer, and it arrives before the AML rules do. - [Basel Committee, SCO60](https://www.sodalabs.xyz/privacy-hub/regulation/reg-basel-sco60) [Attribution required]: The single most privacy-restrictive sentence in global financial regulation is probably here. - [Financial Stability Board](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fsb) [Confidential with disclosure]: Included here mainly to correct a common misattribution. The FSB coordinates national authorities on financial stability, and its 2023 framework is frequently cited in arguments ab… - [IOSCO](https://www.sodalabs.xyz/privacy-hub/regulation/reg-iosco) [Confidential with disclosure]: IOSCO pulls in both directions, which makes it more interesting than most. - [BIS Innovation Hub](https://www.sodalabs.xyz/privacy-hub/regulation/reg-bis-innovation-hub) [Builds with privacy tech]: If you want evidence that the institutions writing the rules do not equate confidentiality with crime, this is where to look. - [Convention 108+](https://www.sodalabs.xyz/privacy-hub/regulation/reg-convention-108) [Builds with privacy tech]: The counterweight instrument, and the one that has not arrived. - [Egmont Group](https://www.sodalabs.xyz/privacy-hub/regulation/reg-egmont) [Attribution required]: Rarely discussed in privacy debates about crypto, and structurally one of the more significant bodies in this section. - [ISO and IEC standards](https://www.sodalabs.xyz/privacy-hub/regulation/reg-iso) [Builds with privacy tech]: Set this against the financial standard-setters and the contrast is sharp. - [NIST](https://www.sodalabs.xyz/privacy-hub/regulation/reg-nist) [Builds with privacy tech]: A national agency rather than a global one, included because its output gets adopted internationally as reference material and because it does something no financial regulator has. ### Europe (34) - [MiCA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-mica) [Confidential with disclosure]: MiCA carries exactly one operative anonymity rule, and it is narrower than its reputation. - [EU Transfer of Funds Regulation](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-travel-rule) [Attribution required]: This, not the privacy-coin headline, is what actually ends unattributed transfers at the EU perimeter. - [EU AMLR Article 79](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-amlr) [Attribution required]: Reported almost everywhere as an EU ban on privacy coins from 1 July 2027. - [GDPR](https://www.sodalabs.xyz/privacy-hub/regulation/reg-gdpr) [Builds with privacy tech]: The law most often described as a problem for blockchain is also the strongest European argument for building with privacy technology. - [EDPB blockchain guidelines](https://www.sodalabs.xyz/privacy-hub/regulation/reg-edpb-blockchain) [Confidential with disclosure]: The reference text on how European data protection law lands on a ledger, final since 7 July 2026. - [Digital euro](https://www.sodalabs.xyz/privacy-hub/regulation/reg-digital-euro) [Builds with privacy tech]: A central bank designing confidentiality into money on purpose is the most direct evidence that European regulators do not equate privacy with illegality. - [eIDAS 2 and the EU Digital Identity Wallet](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eidas2) [Builds with privacy tech]: The clearest counterexample to the idea that regulators are uniformly against cryptographic privacy: here EU law names the technology and requires it. - [CJEU on identifiability](https://www.sodalabs.xyz/privacy-hub/regulation/reg-cjeu-identifiability) [Confidential with disclosure]: Whether a blockchain address is personal data is not a settled question, and the two European institutions answering it are drifting apart. - [EU Data Act, Article 36](https://www.sodalabs.xyz/privacy-hub/regulation/reg-eu-data-act) [Confidential with disclosure]: A useful case of a rule written for one context landing awkwardly on another. - [United Kingdom](https://www.sodalabs.xyz/privacy-hub/regulation/jur-united-kingdom) [Confidential with disclosure]: The UK has built a full regulatory perimeter without reaching for a single prohibition on privacy technology. - [Switzerland](https://www.sodalabs.xyz/privacy-hub/regulation/jur-switzerland) [Attribution required]: A useful corrective to the assumption that a crypto-friendly jurisdiction is permissive about anonymity. - [Turkey](https://www.sodalabs.xyz/privacy-hub/regulation/jur-turkey) [Attribution required]: Turkey reaches the same destination as an anonymity ban without ever writing one. - [Norway](https://www.sodalabs.xyz/privacy-hub/regulation/jur-norway) [Confidential with disclosure]: Norway took the EU rulebook through the EEA route and enforced it promptly, closing its transition window in July 2026 with providers told to wind down. - [Ukraine](https://www.sodalabs.xyz/privacy-hub/regulation/jur-ukraine) [Regime still forming]: An unusual case: the virtual assets law passed in February 2022 is recorded in the official register as never having entered into force. - [Georgia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-georgia) [Attribution required]: Across every jurisdiction surveyed for this section, institutional privacy oversight was either strengthening or holding steady. - [Russia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-russia) [Attribution required]: Russia has the most direct on-chain deanonymisation mandate found anywhere in this section. - [France](https://www.sodalabs.xyz/privacy-hub/regulation/jur-france) [Confidential with disclosure]: France pulls harder in both directions than any other member state. - [Germany](https://www.sodalabs.xyz/privacy-hub/regulation/jur-germany) [Confidential with disclosure]: Germany's divergence runs in two directions and neither is about coins. - [Liechtenstein](https://www.sodalabs.xyz/privacy-hub/regulation/jur-liechtenstein) [Confidential with disclosure]: Liechtenstein made a structural choice worth understanding: rather than requiring every participant to identify counterparties, it turned identification into its own licensed role. - [Iceland](https://www.sodalabs.xyz/privacy-hub/regulation/jur-iceland) [Confidential with disclosure]: Iceland is worth a card mainly for what it reveals about the EEA route into EU financial law. - [Netherlands](https://www.sodalabs.xyz/privacy-hub/regulation/jur-netherlands) [Confidential with disclosure]: The Netherlands ran the most aggressive self-hosted wallet identification demand in Europe and then gave it up, which makes it the most instructive European case in this section. - [Poland](https://www.sodalabs.xyz/privacy-hub/regulation/jur-poland) [Regime still forming]: Poland is the exception that shows how the EU framework behaves when a member state cannot implement it. - [Ireland](https://www.sodalabs.xyz/privacy-hub/regulation/jur-ireland) [Builds with privacy tech]: Ireland adds nothing of its own to the EU rules on crypto confidentiality, and that is worth saying plainly rather than inventing local colour. - [Spain](https://www.sodalabs.xyz/privacy-hub/regulation/jur-spain) [Confidential with disclosure]: Spain's national contribution sits on the marketing side rather than the confidentiality side, and it got there first. - [Italy](https://www.sodalabs.xyz/privacy-hub/regulation/jur-italy) [Confidential with disclosure]: Italy's national addition was a reporting channel rather than a prohibition, and it went further than the European baseline in an unusual direction. - [Portugal](https://www.sodalabs.xyz/privacy-hub/regulation/jur-portugal) [Confidential with disclosure]: Portugal's distinctive contribution came from its data protection authority rather than its financial regulators, and it addresses a question the financial rules do not reach. - [Estonia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-estonia) [Confidential with disclosure]: Estonia mattered to this market out of proportion to its size, because for a few years it issued more crypto authorisations than anywhere else in Europe. - [Lithuania](https://www.sodalabs.xyz/privacy-hub/regulation/jur-lithuania) [Confidential with disclosure]: Lithuania took the same route as Estonia and reached a similar destination by a different instrument. - [Belgium](https://www.sodalabs.xyz/privacy-hub/regulation/jur-belgium) [Confidential with disclosure]: Belgium adds no national layer on confidentiality, and that is worth stating plainly rather than manufacturing local colour. - [Austria](https://www.sodalabs.xyz/privacy-hub/regulation/jur-austria) [Confidential with disclosure]: Austria's only real distinguishing feature in this area is timing. - [Luxembourg](https://www.sodalabs.xyz/privacy-hub/regulation/jur-luxembourg) [Confidential with disclosure]: Luxembourg carries weight here because of what is domiciled in it rather than because of any national rule on confidentiality. - [Sweden](https://www.sodalabs.xyz/privacy-hub/regulation/jur-sweden) [Confidential with disclosure]: Sweden has a reputation for hostility to crypto that is worth separating into its parts. - [Denmark](https://www.sodalabs.xyz/privacy-hub/regulation/jur-denmark) [Confidential with disclosure]: Denmark is a useful reminder that the financial supervisor is not always the body that matters most for privacy. - [Czechia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-czechia) [Confidential with disclosure]: Czechia is one of the member states that put crypto supervision inside the central bank rather than with a separate markets authority, which matters more for how firms experience t… ### Americas (19) - [GENIUS Act](https://www.sodalabs.xyz/privacy-hub/regulation/reg-genius-act) [Attribution required]: The most restrictive thing in current US law on this subject, and it is architectural rather than procedural. - [OFAC and Van Loon](https://www.sodalabs.xyz/privacy-hub/regulation/reg-ofac) [Confidential with disclosure]: The most severe action ever taken by a government against privacy tooling, followed by the most significant legal retreat from one. - [FinCEN](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fincen) [Attribution required]: Registration, identity verification and suspicious activity reporting for anyone acting as a money transmitter in crypto all originate here, and none of that has loosened. - [NYDFS](https://www.sodalabs.xyz/privacy-hub/regulation/reg-nydfs) [Attribution required]: Where federal policy has softened around non-custodial software, New York has not moved at all. - [IRS broker reporting](https://www.sodalabs.xyz/privacy-hub/regulation/reg-irs-broker-reporting) [Attribution required]: The clearest illustration of the US perimeter split. Custodial reporting arrived exactly as planned and is now in its first year of cost-basis reporting, which means identity, proc… - [US Treasury and the Working Group](https://www.sodalabs.xyz/privacy-hub/regulation/reg-us-treasury-pwg) [Builds with privacy tech]: The most significant shift in this section, and the one most easily overstated. - [The third-party doctrine](https://www.sodalabs.xyz/privacy-hub/regulation/reg-third-party-doctrine) [Attribution required]: Any account of US financial privacy that stops at statutes misses the layer that actually decides things. - [United States](https://www.sodalabs.xyz/privacy-hub/regulation/jur-united-states) [Confidential with disclosure]: The US moved in both directions at once between 2024 and 2026, and the dividing line is custody rather than politics. - [Canada](https://www.sodalabs.xyz/privacy-hub/regulation/jur-canada) [Confidential with disclosure]: Canada is the clearest case in this section of an outcome that looks like a ban and is not one. - [Brazil](https://www.sodalabs.xyz/privacy-hub/regulation/jur-brazil) [Attribution required]: Brazil holds the two halves of this section's argument in one place. - [Mexico](https://www.sodalabs.xyz/privacy-hub/regulation/jur-mexico) [Attribution required]: Mexico states the reasoning that most regulators leave implicit. - [Argentina](https://www.sodalabs.xyz/privacy-hub/regulation/jur-argentina) [Confidential with disclosure]: Argentina drew its perimeter in the place this section keeps arguing is the right one. - [Bahamas](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bahamas) [Attribution required]: The Bahamas holds the sharpest contradiction in this section, and both halves are deliberate. - [Bermuda](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bermuda) [Attribution required]: Bermuda restricts no asset by name and still runs the most comprehensive transaction surveillance requirement found in the Americas. - [Cayman Islands](https://www.sodalabs.xyz/privacy-hub/regulation/jur-cayman-islands) [Confidential with disclosure]: Cayman matters because so many funds and token issuers are structured through it, and the finding is a set of absences rather than rules. - [British Virgin Islands](https://www.sodalabs.xyz/privacy-hub/regulation/jur-british-virgin-islands) [Confidential with disclosure]: The British Virgin Islands is a useful illustration that confidentiality is not one thing. - [Wyoming](https://www.sodalabs.xyz/privacy-hub/regulation/jur-wyoming) [Builds with privacy tech]: Wyoming is the clearest example in the United States of a legislature building around self-custody rather than treating it as a gap. - [California](https://www.sodalabs.xyz/privacy-hub/regulation/jur-california) [Confidential with disclosure]: California is the counterweight to Wyoming within the same country, and the contrast is instructive because neither state legislates about anonymity at all. - [Texas](https://www.sodalabs.xyz/privacy-hub/regulation/jur-texas) [Builds with privacy tech]: Texas belongs in this section for what it does not do. Non-stablecoin cryptocurrency does not require a money transmitter licence there, which leaves a large share of activity outs… ### Asia-Pacific (18) - [Monetary Authority of Singapore](https://www.sodalabs.xyz/privacy-hub/regulation/reg-mas) [Confidential with disclosure]: Worth reading closely because it is the road not taken elsewhere. - [Hong Kong SFC](https://www.sodalabs.xyz/privacy-hub/regulation/reg-hk-sfc) [Confidential with disclosure]: A useful case study in how a market gets closed without a rule that mentions the thing being closed out. - [Japan FSA and JVCEA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-japan-fsa) [Attribution required]: Japan is the clearest example of a rule written against untraceability rather than against named assets, and of that rule being applied by an industry body rather than a regulator. - [APG](https://www.sodalabs.xyz/privacy-hub/regulation/reg-apg) [Attribution required]: Standards do not travel by themselves, and this is the machinery that moves them across Asia. - [Australia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-australia) [Confidential with disclosure]: Australia constrains confidentiality through anti-money-laundering law and not through any coin-specific rule. - [Thailand](https://www.sodalabs.xyz/privacy-hub/regulation/jur-thailand) [Attribution required]: Thailand is the jurisdiction most often cited as having banned privacy coins, and the claim does not survive reading the instrument. - [India](https://www.sodalabs.xyz/privacy-hub/regulation/jur-india) [Attribution required]: India has no bespoke crypto statute and regulates the sector through anti-money-laundering law and tax instead. - [Singapore](https://www.sodalabs.xyz/privacy-hub/regulation/jur-singapore) [Confidential with disclosure]: The one jurisdiction in this section that declined to exclude anonymity-enhancing assets and chose to price the risk instead. - [Hong Kong SAR](https://www.sodalabs.xyz/privacy-hub/regulation/jur-hong-kong) [Confidential with disclosure]: A good illustration of exclusion happening without a rule that mentions the thing being excluded. - [Taiwan](https://www.sodalabs.xyz/privacy-hub/regulation/jur-taiwan) [Regime still forming]: Two things commonly reported about Taiwan are wrong. The VASP Act is not pending; it passed its third reading on 30 June 2026, though commencement still has to be designated and li… - [South Korea](https://www.sodalabs.xyz/privacy-hub/regulation/jur-south-korea) [Attribution required]: The most identity-maximalist regime covered here, and the only one actively trying to export it. - [Japan](https://www.sodalabs.xyz/privacy-hub/regulation/jur-japan) [Attribution required]: Japan shows the pattern in this section at its clearest: the rule is written against untraceability, never against named assets. - [China](https://www.sodalabs.xyz/privacy-hub/regulation/jur-china) [Attribution required]: Two things are true here at once, and most coverage reports only the first. - [Kazakhstan](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kazakhstan) [Confidential with disclosure]: Worth correcting a claim that circulates about Kazakhstan: the law does not establish a state system watching digital asset transactions. - [Malaysia](https://www.sodalabs.xyz/privacy-hub/regulation/jur-malaysia) [Attribution required]: The most explicit categorical ban in the Asia-Pacific set, and notable for how it is drafted. - [Philippines](https://www.sodalabs.xyz/privacy-hub/regulation/jur-philippines) [Confidential with disclosure]: Read in full, the circular contains no provision on privacy coins, mixers or tumblers, and no express treatment of self-hosted wallets. - [Bangladesh](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bangladesh) [Attribution required]: Bangladesh is a useful reminder that a country does not need a crypto statute to prohibit crypto. - [Sri Lanka](https://www.sodalabs.xyz/privacy-hub/regulation/jur-sri-lanka) [Regime still forming]: Sri Lanka occupies the position a lot of countries were in five years ago and few still are: crypto is neither licensed nor forbidden. ### Middle East & Africa (18) - [VARA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-vara) [Attribution required]: Most regimes reach anonymity-enhanced assets sideways, through listing criteria, liquidity gates or traceability tests. - [DFSA and ADGM FSRA](https://www.sodalabs.xyz/privacy-hub/regulation/reg-uae-free-zones) [Attribution required]: The two financial free zones inside the UAE regulate separately from Dubai's virtual assets authority, and they went a step further than it did. - [MENAFATF](https://www.sodalabs.xyz/privacy-hub/regulation/reg-menafatf) [Attribution required]: The regional counterpart to the Asian body, and the reason the Gulf entries in this section rhyme with one another. - [Israel](https://www.sodalabs.xyz/privacy-hub/regulation/jur-israel) [Confidential with disclosure]: Israel splits cleanly along the axis this whole section turns on. - [United Arab Emirates](https://www.sodalabs.xyz/privacy-hub/regulation/jur-uae) [Attribution required]: If you want the counterexample to the pattern running through this section, it is here. - [Kenya](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kenya) [Attribution required]: Most prohibitions in this section live in rulebooks that a regulator can amend without going back to a legislature. - [Ghana](https://www.sodalabs.xyz/privacy-hub/regulation/jur-ghana) [Confidential with disclosure]: Worth citing well beyond Ghana, because a central bank stated plainly in writing what most regimes leave to inference. - [South Africa](https://www.sodalabs.xyz/privacy-hub/regulation/jur-south-africa) [Attribution required]: The most precisely drafted travel rule in this section, and the one that leaves least room. - [Bahrain](https://www.sodalabs.xyz/privacy-hub/regulation/jur-bahrain) [Attribution required]: Bahrain never names a coin, and its rule is broader for it. Licensees may not list assets that facilitate, or may facilitate, obfuscation or concealment of a client or counterparty… - [Qatar](https://www.sodalabs.xyz/privacy-hub/regulation/jur-qatar) [Attribution required]: Qatar reaches exclusion without ever writing a prohibition on anonymity, because its perimeter is drawn as a positive list. - [Nigeria](https://www.sodalabs.xyz/privacy-hub/regulation/jur-nigeria) [Confidential with disclosure]: Nigeria took the securities route rather than building a bespoke crypto statute, bringing digital assets under the securities regulator through the 2025 Act while the 2022 rules co… - [Seychelles](https://www.sodalabs.xyz/privacy-hub/regulation/jur-seychelles) [Confidential with disclosure]: Seychelles matters here because of how many crypto entities are domiciled in it rather than because of anything it says about confidentiality, and it says nothing. - [Oman](https://www.sodalabs.xyz/privacy-hub/regulation/jur-oman) [Attribution required]: Most rules in this section reach assets, and a few reach tools. - [Rwanda](https://www.sodalabs.xyz/privacy-hub/regulation/jur-rwanda) [Confidential with disclosure]: Rwanda uses a technique worth understanding because it is different from a ban. - [Mauritius](https://www.sodalabs.xyz/privacy-hub/regulation/jur-mauritius) [Confidential with disclosure]: Mauritius matters here out of proportion to its size, because a great many crypto entities are domiciled in it. - [Kuwait](https://www.sodalabs.xyz/privacy-hub/regulation/jur-kuwait) [Attribution required]: Kuwait is worth including precisely because its regulators said the quiet part out loud. - [Egypt](https://www.sodalabs.xyz/privacy-hub/regulation/jur-egypt) [Attribution required]: Egypt inverts the usual shape of an entry in this section. There is no crypto privacy regime to describe because there is no lawful crypto activity: the banking law requires centra… - [Morocco](https://www.sodalabs.xyz/privacy-hub/regulation/jur-morocco) [Regime still forming]: Morocco is moving from prohibition toward a framework, and the direction is genuinely liberalising after years in which crypto activity sat outside the exchange control rules.