BIS unveils digital cash privacy prototype: privacy and compliance can coexist by design, but deployment is not yet possible
【Verified facts | October 13, 2026】The Bank for International Settlements (BIS) has published the Phase 2 report for Project Aurum, showcasing an exploratory “digital cash” prototype. The project is a collaboration between the BIS Innovation Hub, the Hong Kong Monetary Authority, The Hong Kong Polytechnic University, and the Hong Kong Applied Science and Technology Research Institute. Its goal is to reduce unnecessary exposure of personal information in everyday payments while retaining checks required by law, such as those for anti-money laundering, counter-terrorist financing, and fraud prevention. The design combines data encryption, BBS+ signatures, pseudonym mechanisms, and zero-knowledge proofs: during verification and settlement, it is generally unnecessary to disclose a payer’s name, account, or complete payment history to every participant. Regulated banks still retain account-opening identity information and cooperate with investigations when legally required. The report stresses that this is only a research prototype for exploring privacy-enhancing technologies, not a central bank digital currency system ready for production.
【My assessment | What this means for the crypto market】This research discusses centrally issued digital cash accessed through regulated banks; it is not equivalent to Bitcoin or public-chain tokens. Its significance lies in turning the question of “how payment privacy affects compliance” into testable technical and governance choices: privacy need not rely solely on institutions promising not to look at data; data partitioning, zero-knowledge proofs, and other technologies may also reduce the routine exposure of payment information across parties. If similar designs are adopted in real-world central bank or bank payment pilots in the future, they could raise the design bar for privacy, identity verification, and audit capabilities in regulated stablecoins, tokenized deposits, and on-chain payment solutions. However, the report itself proposes no policy decisions, issuance timetable, or specific market products, so it does not justify inferring that stablecoin demand or demand for any particular token will change in the near term. This round of screening Binance spot trading volumes also found no single asset directly linked to the report, so no token tag is included.
The report also does not present privacy as a cost-free solution: stronger privacy protections may slow transaction processing and make it harder to accommodate complex financial products; moreover, if a wallet with the highest level of anonymity loses its access credentials, its funds may be unrecoverable. The bank data separation described in the report only illustrates how the prototype limits what different participants can see. It does not guarantee that institutional databases in the real world cannot be breached, nor does it mean that no user data can ever be leaked.
【Practical steps】Ordinary users do not need to treat this prototype research as a warning that requires them to move their assets immediately. When using digital wallets or payment services, they should still check what identity information the product retains, with whom data is shared, and what rules apply to account recovery and dispute resolution. When assessing stablecoin or tokenized payment projects, consider asking: “Who can see transaction and identity data? Under what legal conditions can identities be revealed? Can credentials be recovered if lost? Has the privacy mechanism undergone an independent security assessment?” Use these as a checklist rather than relying solely on claims of “privacy protection.”
【What to watch next and conditions that would invalidate this assessment】Watch for whether BIS publishes follow-up tests or code, whether participating institutions advance the prototype to a controlled pilot, how it performs in practice, what wallet recovery solutions are offered, and what specific requirements regulators in different jurisdictions set for privacy and audit rights. If the project remains at the research-demonstration stage for the long term, its market impact will mainly be as a source of ideas and design references. If a central bank or major payment institution formally launches a production-grade pilot and discloses user numbers, interoperability, and compliance rules, the assessment of how this affects competition between existing stablecoins and tokenized payment solutions will need to be updated. Prototype results cannot directly establish the privacy or security performance of a real-world deployment.
Sources: BIS official report page (2026-10-13, including summary and report PDF) https://www.bis.org/publications/project-aurum-phase-2-exploring-privacy-enhancing-technologies-digital-cash; BIS, “Privacy-enhancing technologies for digital cash: Project Aurum Phase 2” report PDF https://www.bis.org/publications/project-aurum-phase-2-exploring-privacy-enhancing-technologies-digital-cash.pdf; Cointelegraph (2026-10-13, coverage of the report’s key findings) https://cointelegraph.com/news/bis-digital-cash-privacy-bank-data-breaches
【Verified facts | October 13, 2026】The Bank for International Settlements (BIS) has published the Phase 2 report for Project Aurum, showcasing an exploratory “digital cash” prototype. The project is a collaboration between the BIS Innovation Hub, the Hong Kong Monetary Authority, The Hong Kong Polytechnic University, and the Hong Kong Applied Science and Technology Research Institute. Its goal is to reduce unnecessary exposure of personal information in everyday payments while retaining checks required by law, such as those for anti-money laundering, counter-terrorist financing, and fraud prevention. The design combines data encryption, BBS+ signatures, pseudonym mechanisms, and zero-knowledge proofs: during verification and settlement, it is generally unnecessary to disclose a payer’s name, account, or complete payment history to every participant. Regulated banks still retain account-opening identity information and cooperate with investigations when legally required. The report stresses that this is only a research prototype for exploring privacy-enhancing technologies, not a central bank digital currency system ready for production.
【My assessment | What this means for the crypto market】This research discusses centrally issued digital cash accessed through regulated banks; it is not equivalent to Bitcoin or public-chain tokens. Its significance lies in turning the question of “how payment privacy affects compliance” into testable technical and governance choices: privacy need not rely solely on institutions promising not to look at data; data partitioning, zero-knowledge proofs, and other technologies may also reduce the routine exposure of payment information across parties. If similar designs are adopted in real-world central bank or bank payment pilots in the future, they could raise the design bar for privacy, identity verification, and audit capabilities in regulated stablecoins, tokenized deposits, and on-chain payment solutions. However, the report itself proposes no policy decisions, issuance timetable, or specific market products, so it does not justify inferring that stablecoin demand or demand for any particular token will change in the near term. This round of screening Binance spot trading volumes also found no single asset directly linked to the report, so no token tag is included.
The report also does not present privacy as a cost-free solution: stronger privacy protections may slow transaction processing and make it harder to accommodate complex financial products; moreover, if a wallet with the highest level of anonymity loses its access credentials, its funds may be unrecoverable. The bank data separation described in the report only illustrates how the prototype limits what different participants can see. It does not guarantee that institutional databases in the real world cannot be breached, nor does it mean that no user data can ever be leaked.
【Practical steps】Ordinary users do not need to treat this prototype research as a warning that requires them to move their assets immediately. When using digital wallets or payment services, they should still check what identity information the product retains, with whom data is shared, and what rules apply to account recovery and dispute resolution. When assessing stablecoin or tokenized payment projects, consider asking: “Who can see transaction and identity data? Under what legal conditions can identities be revealed? Can credentials be recovered if lost? Has the privacy mechanism undergone an independent security assessment?” Use these as a checklist rather than relying solely on claims of “privacy protection.”
【What to watch next and conditions that would invalidate this assessment】Watch for whether BIS publishes follow-up tests or code, whether participating institutions advance the prototype to a controlled pilot, how it performs in practice, what wallet recovery solutions are offered, and what specific requirements regulators in different jurisdictions set for privacy and audit rights. If the project remains at the research-demonstration stage for the long term, its market impact will mainly be as a source of ideas and design references. If a central bank or major payment institution formally launches a production-grade pilot and discloses user numbers, interoperability, and compliance rules, the assessment of how this affects competition between existing stablecoins and tokenized payment solutions will need to be updated. Prototype results cannot directly establish the privacy or security performance of a real-world deployment.
Sources: BIS official report page (2026-10-13, including summary and report PDF) https://www.bis.org/publications/project-aurum-phase-2-exploring-privacy-enhancing-technologies-digital-cash; BIS, “Privacy-enhancing technologies for digital cash: Project Aurum Phase 2” report PDF https://www.bis.org/publications/project-aurum-phase-2-exploring-privacy-enhancing-technologies-digital-cash.pdf; Cointelegraph (2026-10-13, coverage of the report’s key findings) https://cointelegraph.com/news/bis-digital-cash-privacy-bank-data-breaches