No settled rule on confidentiality yet; the framework is in draft or newly in force.
What Taiwan actually says
Two things commonly reported about Taiwan are wrong. The VASP Act is not pending; it passed its third reading on 30 June 2026, though commencement still has to be designated and licensing runs on a 21-month tail after that. And the travel rule, often described as operative with an NT$30,000 threshold, has never been in force at all. The provision has carried a deferred effective date since 2021, and the regulator confirmed in writing in August 2026 that it has still not been implemented, setting out a phased plan starting with domestic transfers in October 2026. There is no named privacy-coin prohibition. For now Taiwan is the outlier: a registration regime in force, and the transfer-identity machinery still switched off.
The instruments that matter
- VASP Act passed third reading 30 June 2026, promulgated 22 July 2026
- 56 articles defining seven service categories and requiring central bank consent plus FSC permission for stablecoin issuance; commencement is delegated to the Executive Yuan and has not been set, after which firms have 12 months to apply and 21 to be licensed
- Travel rule not implemented
- the FSC confirmed in writing on 4 August 2026 that the mechanism has to date not been implemented, five years after the provision was made
- Phased plan announced
- domestic VASP-to-VASP from October 2026, cross-border from end-2027, applying to transfers of any value with NT$30,000 as an enhanced-data trigger
- Mandatory registration from 30 November 2024
- under the Money Laundering Control Act; nine firms had registered as at 22 September 2025
- No functioning data protection authority
- Constitutional Court judgment 111-憲判-13 of 12 August 2022 gave three years to build an independent supervisory mechanism; that deadline lapsed unmet in August 2025
- PDPA Article 1-1 has never commenced
- it designates a Personal Data Protection Commission as competent authority, but the Executive Yuan has not set a commencement date and the body remains a preparatory office
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- ThailandAsia-Pacific · Closed by whitelist, not by prohibition
- AustraliaAsia-Pacific · Travel rule without a threshold, no coin ban
- Hong Kong SARAsia-Pacific · Retail exclusion by liquidity gate, not by anonymity rule
- IndiaAsia-Pacific · No crypto statute, regulated through AML and tax
- JapanAsia-Pacific · Untraceability barred by self-regulation, now moving into ordinance
- SingaporeAsia-Pacific · Regulates anonymity by risk assessment, not prohibition
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.