Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.
What Iceland actually says
Iceland is worth a card mainly for what it reveals about the EEA route into EU financial law. It adopted the European crypto framework a full year behind the union, shifting the internal dates forward so the transitional architecture still worked. More consequentially, the two instruments that matter most for confidentiality have arrived at different speeds. The travel rule was incorporated into the EEA agreement in June 2025 but the government's own database still records implementation as not begun, so the obligation exists in principle without national machinery. The EU anti-money-laundering regulation, which carries the 2027 prohibition on anonymous accounts, has not been incorporated at all. For now the binding rule here is the narrower trading-platform test.
The instruments that matter
- Act No. 101/2025 on markets in crypto-assets, 24 December 2025
- Article 16 brings it into force on 1 January 2026, a year behind the EU
- Dates shifted to preserve the transition
- MiCA references to 30 December 2024 read as 1 January 2026, and references to 30 July 2024 read as 1 February 2026
- Article 3 names the authorities
- the Central Bank of Iceland is the competent authority, with the financial supervisory function inside it and the EFTA Surveillance Authority exercising the powers MiCA gives ESMA
- The travel rule is incorporated but not implemented
- the EU transfer of funds regulation entered into force through the EEA on 24 June 2025, yet the government's own EEA database records implementation as not begun, with a national regulation still required
- The EU anti-money-laundering regulation is not incorporated
- it remains under examination by Iceland, Liechtenstein and Norway, so the EU prohibition on anonymous crypto accounts does not currently reach them
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- AustriaEurope · EU baseline, with an early transition close
- BelgiumEurope · EU baseline, with no national layer on confidentiality
- CzechiaEurope · EU baseline, supervised by the central bank
- DenmarkEurope · EU baseline, with tax as the historic pressure point
- EstoniaEurope · The licence cull that reshaped the European market
- FranceEurope · Hardest against anonymity, most literate about privacy tech
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.