Central banks are building confidentiality themselves
What the people writing the rules do when they design money
What Central banks are building confidentiality themselves actually says
The strongest evidence that public authorities do not equate confidentiality with wrongdoing is that they keep building it. The BIS Innovation Hub's Tourbillon prototypes, developed with the Swiss National Bank, were designed around payer anonymity: a consumer pays without revealing personal information to the merchant, to the banks or to the central bank, while the payee remains identified to their own bank. The BIS presents this as compatible with anti-money-laundering aims rather than in tension with them, precisely because the receiving side stays legible. The Bank of England has run comparable work on offline digital pound payments. Read together with the digital euro's offline design, the pattern is consistent: asymmetric privacy, where the party being paid is known and the party paying is not, is a design regulators actively pursue.
The instruments that matter
- BIS Project Tourbillon (final report, November 2023)
- retail CBDC prototypes built around payer anonymity, where the central bank sees the amount but not the consumer or the merchant, while the payee stays identified to their own bank
- Bank of England digital pound offline payments report (2025)
- assessed pseudonymisation, ephemeral key management and confidential computing with commercial partners
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- BIS Innovation HubGlobal · Central bank prototypes that build privacy on purpose
- Anonymity is not the same thing as confidentialityGlobal · Why two privacy designs get treated differently
- Erasure against an append-only ledgerGlobal · The one collision with no clean answer yet
- Proving where funds did not come fromGlobal · Association sets, and the Tornado Cash aftermath
- Sanctions screening on a confidential ledgerGlobal · The genuinely open problem
- Selective disclosure as a compliance primitiveGlobal · Bilateral disclosure versus publishing to everyone
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.