Malaysia

A regulated firm must be able to attribute activity to an identified person, and assets or accounts that make that impossible are barred at the licensed perimeter. This is a rule about attribution, not about whether amounts are public.

What Malaysia actually says

The most explicit categorical ban in the Asia-Pacific set, and notable for how it is drafted. Malaysia does not list forbidden coins. It prohibits exchange operators from permitting a privacy token to be offered for trading, then defines a privacy token by purpose: one intended to enhance user anonymity and transaction confidentiality. That catches the technique wherever it appears, including designs that did not exist when the rule was written, and it applies regardless of whether an asset is otherwise reputable. The same revision liberalised elsewhere, moving listing decisions to the exchange's own board under documented criteria. So Malaysia loosened its grip on what may be listed while tightening it specifically around confidentiality.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.