No settled rule on confidentiality yet; the framework is in draft or newly in force.
What Ukraine actually says
An unusual case: the virtual assets law passed in February 2022 is recorded in the official register as never having entered into force. With no operative licensing regime, there is no in-force restriction on anonymity-enhancing assets and no constraint on unhosted wallets, not as a policy choice, but because the machinery was never switched on. A MiCA-based replacement passed first reading in 2025 and would change that quickly. The detail worth carrying forward is the central bank's e-hryvnia design note, which states plainly that the regulator will not have any personal information. Explicit commitments of that kind from a central bank are rare enough to be worth citing wherever they appear.
The instruments that matter
- Law No. 2074-IX on Virtual Assets, 17 February 2022
- recorded in the official register as not having entered into force; Ukraine therefore has no operative service provider licensing regime
- Draft law 10225-d
- introduced 24 April 2025 and drafted on a MiCA basis, passed first reading
- e-hryvnia design
- the National Bank states that payments are secured by it while the regulator will not have any personal information, alongside offline payments and DLT-based wallet recovery
- Data protection still on the 2010 law
- a GDPR-aligning draft was adopted as a basis in November 2024 and awaits second reading
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- GeorgiaEurope · The one place where privacy oversight went backwards
- NorwayEurope · MiCA via the EEA, with a privacy-innovation sandbox
- SwitzerlandEurope · Crypto-friendly and strict on anonymity at once
- TurkeyEurope · Caps, delays and a compelled purpose description
- United KingdomEurope · Risk-based, with an explicit central bank no-access pledge
- CJEU on identifiabilityEurope · Case law · is a wallet address personal data
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.