IOSCO

Confidentiality is workable so long as the regulated firm can identify parties and disclose on demand.

What IOSCO actually says

IOSCO pulls in both directions, which makes it more interesting than most. Its DeFi work treats pseudonymity as an obstacle, citing participants who use multiple addresses to obfuscate activity, and answers by identifying responsible persons. But its November 2025 tokenisation report is the only text from a financial standard-setter that names over-transparency as a risk in its own right. It records an inherent conundrum between data privacy and transparency, warns that ledger immutability could cause unintended user confidentiality breaches and collide with requirements such as the GDPR right to be forgotten, and notes that visible transaction flows can worsen a redemption run. That is a securities regulator arguing that too much publicity is a market-integrity problem, not just a privacy one.

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.