Sri Lanka

No settled rule on confidentiality yet; the framework is in draft or newly in force.

What Sri Lanka actually says

Sri Lanka occupies the position a lot of countries were in five years ago and few still are: crypto is neither licensed nor forbidden. The central bank has said it has authorised nobody to operate schemes involving virtual currencies and approved no token offering, and has warned about the risks, but it has not prohibited holding or trading. That leaves no privacy position to describe, because there is no regime to have one. It also leaves users without the protections a licensing regime brings. Movement toward registration of providers with the financial intelligence unit has been proposed rather than enacted, so the vacuum is the current state rather than a settled policy.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.