The regime itself mandates, pilots or funds privacy-preserving technology.
What BIS Innovation Hub actually says
If you want evidence that the institutions writing the rules do not equate confidentiality with crime, this is where to look. Tourbillon concluded that it is feasible to implement a CBDC providing payer anonymity while combating illicit transactions, with the consumer disclosing nothing to the merchant, the banks or the central bank, and compliance handled at the merchant's bank instead. Agorá goes further on the wholesale side, and its finding is the one worth quoting: a shared ledger does not require shared data. Each institution runs its own sanctions and anti-money-laundering screening locally and shares only a binary pass or fail with the group. That is compliance without data pooling, demonstrated by the central banks' own research arm rather than argued by vendors.
The instruments that matter
- Project Tourbillon, 29 November 2023
- eCash prototypes giving payer anonymity (no personal information disclosed to merchant, banks or central bank) with quantum-safe blind signatures at a 200x throughput cost
- Project Agorá, 27 May 2026
- seven central banks and 40+ institutions; a shared ledger does not require shared data, with each institution screening locally and sharing only binary pass or fail outcomes
- Project Aurum 2.0
- with the Hong Kong Monetary Authority, testing pseudonymisation and zero-knowledge proofs for retail CBDC privacy
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- Central banks are building confidentiality themselvesGlobal · What the people writing the rules do when they design money
- Convention 108+Global · The only binding international data protection treaty
- ISO and IEC standardsGlobal · The standards bodies that specify privacy instead of policing it
- NISTGlobal · The vocabulary that makes privacy claims testable
- Basel Committee, SCO60Global · Bank capital · the sharpest traceability rule anywhere
- Egmont GroupGlobal · How financial intelligence crosses borders
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.