Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.
What Israel actually says
Israel splits cleanly along the axis this whole section turns on. On chain, the constraint is light: no instrument restricts anonymity-enhancing assets or transfers to self-hosted wallets, and those questions fall under ordinary anti-money-laundering supervision rather than any dedicated rule. Off chain, the regime got considerably heavier a year ago. Amendment 13 to the Protection of Privacy Law came into force in August 2025, requiring privacy protection officers, widening the definition of sensitive data, and giving the regulator administrative orders and fines with real weight behind them. For a firm handling personal data alongside on-chain activity, the binding compliance burden here comes from the data protection side, not the financial one.
The instruments that matter
- No crypto-specific anonymity rule
- no Israeli instrument restricts privacy coins or transfers to self-hosted wallets; both sit under general anti-money-laundering monitoring
- Prohibition on Money Laundering Order (2018)
- financial asset service providers owe customer due diligence, beneficiary and ownership declarations, monitoring and reporting, with source-of-funds enquiry above roughly ILS 100,000 of annual activity
- Amendment 13 to the Protection of Privacy Law, in force 14 August 2025
- mandates privacy protection officers, broadens sensitive data, adds data broker duties, and gives the authority administrative orders, cease-and-desist powers and substantial fines
- Bank of Israel Directive 411 (2022)
- bars banks from blanket refusal of crypto-related transactions
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- GhanaMiddle East & Africa · The regulator that put self-custody in writing
- MauritiusMiddle East & Africa · A mature licensing regime that never mentions anonymity
- NigeriaMiddle East & Africa · Securities-first, with banking access restored
- RwandaMiddle East & Africa · Anonymity defined out of the regime rather than banned
- SeychellesMiddle East & Africa · No anonymity rule, but the offshore route is closing
- BahrainMiddle East & Africa · A listing test written against effects, not asset names
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.