Kazakhstan

Confidentiality is workable so long as the regulated firm can identify the parties and disclose on demand. Encrypted amounts are not the thing being restricted.

What Kazakhstan actually says

Worth correcting a claim that circulates about Kazakhstan: the law does not establish a state system watching digital asset transactions. It requires each licensed operator to run its own analysis and control system, built to the National Bank's specification, which is a mandated chain-analytics obligation rather than centralised surveillance. The teeth are in the identification rule. Operators must hold information sufficient to identify both sender and recipient, and a transfer with incomplete information is suspended and then refused. Unsecured digital assets remain legal but are stripped of status as a means of payment or a financial instrument. A second, separate track exists inside the Astana financial centre under its own regulator, whose terms we could not verify.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.