Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.
What Hong Kong SAR actually says
A good illustration of exclusion happening without a rule that mentions the thing being excluded. Hong Kong's platform guidelines say nothing about privacy coins, anonymity or mixers anywhere in the text. What they require is that any token offered to retail clients be an eligible large-cap virtual asset, present in at least two acceptable indices from two different providers. Monero and Zcash fail that liquidity test, so they are absent from retail without any policy against confidentiality ever being stated. The wider posture is expansionist on tokenisation and stablecoins, with the first licences granted in April 2026. The June 2025 policy statement setting the digital asset strategy is similarly silent: privacy is not argued against, it is simply never raised.
The instruments that matter
- VATP Guidelines, June 2023, paragraph 7.8
- retail tokens must be eligible large-cap virtual assets, included in at least two acceptable indices from two different providers, one of them IOSCO-compliant
- No anonymity language at all
- the full text of the guidelines contains no mention of privacy coins, anonymity or mixers; paragraph 7.8 Note 3 allows case-by-case appeal to the SFC
- Stablecoins Ordinance (Cap. 656), from 1 August 2025
- first two licences granted 10 April 2026, to Anchorpoint Financial and HSBC
- Policy Statement 2.0, 26 June 2025
- sets the LEAP framework and endorses Project Ensemble; contains no reference to privacy, confidentiality or anonymity anywhere
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- AustraliaAsia-Pacific · Travel rule without a threshold, no coin ban
- SingaporeAsia-Pacific · Regulates anonymity by risk assessment, not prohibition
- IndiaAsia-Pacific · No crypto statute, regulated through AML and tax
- JapanAsia-Pacific · Untraceability barred by self-regulation, now moving into ordinance
- South KoreaAsia-Pacific · Identity-maximalist, and exporting the model
- TaiwanAsia-Pacific · The travel rule that has never come into force
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.