Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.
What Israel actually says
Israel splits cleanly along the axis this whole section turns on. On chain, the constraint is light: no instrument restricts anonymity-enhancing assets or transfers to self-hosted wallets, and those questions fall under ordinary anti-money-laundering supervision rather than any dedicated rule. Off chain, the regime got considerably heavier a year ago. Amendment 13 to the Protection of Privacy Law came into force in August 2025, requiring privacy protection officers, widening the definition of sensitive data, and giving the regulator administrative orders and fines with real weight behind them. For a firm handling personal data alongside on-chain activity, the binding compliance burden here comes from the data protection side, not the financial one.
The instruments that matter
- No crypto-specific anonymity rule
- no Israeli instrument restricts privacy coins or transfers to self-hosted wallets; both sit under general anti-money-laundering monitoring
- Prohibition on Money Laundering Order (2018)
- financial asset service providers owe customer due diligence, beneficiary and ownership declarations, monitoring and reporting, with source-of-funds enquiry above roughly ILS 100,000 of annual activity
- Amendment 13 to the Protection of Privacy Law, in force 14 August 2025
- mandates privacy protection officers, broadens sensitive data, adds data broker duties, and gives the authority administrative orders, cease-and-desist powers and substantial fines
- Bank of Israel Directive 411 (2022)
- bars banks from blanket refusal of crypto-related transactions
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- GhanaMiddle East & Africa · The regulator that put self-custody in writing
- NigeriaMiddle East & Africa · Securities-first, with banking access restored
- SeychellesMiddle East & Africa · No anonymity rule, but the offshore route is closing
- BahrainMiddle East & Africa · A listing test written against effects, not asset names
- KenyaMiddle East & Africa · The ban written into primary legislation, not a rulebook
- QatarMiddle East & Africa · Exclusion by perimeter rather than prohibition
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.