Soda Labs

NYDFS

The most privacy-restrictive US regulator, state or federal

Regulator or standard-setterAmericasRestricts anonymity

Anonymity-enhancing assets or unattributed transfers are barred outright, or barred for regulated firms.

What NYDFS actually says

Where federal policy has softened around non-custodial software, New York has not moved at all. Its licensees must run blockchain analytics across onboarding, monitoring and sanctions screening, tracing the flow of funds through the chain and treating anything processed through a mixer as a monitored typology. The listing guidance is the most explicit anti-anonymity language from any US regulator: a coin cannot be self-certified if it has features designed to facilitate obfuscation or concealment of identity. The framework was extended to all New York banking organisations in 2025. To its credit the guidance is honest about its own limits, conceding that analytics may not identify underlying owners without off-chain verification.

The instruments that matter

Guidance on the use of blockchain analytics, 28 April 2022
licensees must trace the flow of funds through the blockchain, and it names virtual currency processed through a mixer or tumbler as a monitored typology
Listing guidance, 15 November 2023
a coin cannot be self-certified if it is designed or substantially used to circumvent laws, or has features designed to facilitate the obfuscation or concealment of the identity of an individual or entity
Extended to banking organizations, 17 September 2025
the analytics framework now applies to all New York banking organizations
A candid limitation
the guidance concedes analytics may not identify underlying owners absent further off-chain verification

What this means for confidential transactions

Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.

Compliant by default.

See how selective disclosure satisfies a supervisor without publishing your book to the world.