Privacy in digital money depends on where information exists before anyone promises to protect it. The Bank for International Settlements’ latest Aurum work explores a payment design that exposes less customer information across the system. Its significance lies in changing that architecture, rather than proving that a central-bank digital currency can already deliver complete anonymity at national scale.
Project Aurum Phase 2, published on October 13, is a prototype for examining privacy-enhancing technologies alongside compliance needs. For banks and payment providers, the financially relevant question is how much sensitive data they must retain, who can use it and what operational work remains when less information is routinely shared.
A smaller shared record changes the breach boundary
The full BIS report describes a design combining cryptographic techniques so that payments can be checked without routinely exposing sensitive details to parties that do not need them. Regulated banks still perform onboarding and retain account-identity information. Reducing shared visibility therefore changes who can learn about a payment; it does not eliminate all records of the customer.
Its privacy table makes a specific comparison. Compromising a validator would not reveal end-user identities in the model. Compromising a bank could put that bank’s customer data at risk without revealing the identities of other banks’ customers. This is an architectural containment claim, not a statement that banks cannot suffer damaging breaches.
The accompanying footnote is essential: this assessment concerns payment data in Aurum’s components and does not include personal data held elsewhere in an organisation. A production provider could have other relevant databases. The report therefore cannot establish a blanket security guarantee for the entire institution or every combination of its systems.
The useful economic inference is that collecting and distributing less identifying data can reduce the scope of some exposures. It does not make the remaining data harmless. Assessing a provider requires attention to the information it actually retains and the connections between those records, rather than simply whether its payment ledger is described as private.
Compliance still has an owner and an operating cost
The BIS project description emphasises configurable functions for compliance and operations. Different policy choices can produce different privacy settings. A technical ability to minimise disclosure is consequently not identical to a jurisdiction choosing the most private available configuration.
The intermediary’s role remains substantial. Customer onboarding, handling lawful requests and maintaining access controls require people, processes and accountable decisions. A privacy-preserving payment core can change those tasks without abolishing them. The report is not evidence of a specified cost saving, revenue stream or procurement award for any bank or software supplier.
There is also a continuity question. The report identifies dependence on the bank that initially verified the user: if it becomes unavailable, access may be lost even though the user’s pseudonymous presence remains valid. Portability across intermediaries is discussed as a direction for future development. Privacy protection and reliable access are therefore separate dimensions of a usable payment service.
Europe illustrates why payment modes need separate claims
The ECB’s description of digital-euro privacy provides a useful comparison from a different project. It describes offline payments whose details would be known only to the payer and recipient. For online use, it describes pseudonymised information for the Eurosystem and access by intermediaries to data needed for legal compliance. These are design descriptions, not proof that Aurum has implemented Europe’s proposal or that a public rollout has occurred.
The comparison shows why a broad claim of cash-like privacy needs a specified payment mode and observer. Keeping identity from the central infrastructure differs from keeping it from the onboarding bank. Offline and online arrangements can also face different constraints. Treating them as a single promise obscures which information is protected from whom.
In their October 2023 joint opinion on the proposed digital euro, the EDPB and EDPS called for clearer justification of a single identifier access point and clearer allocation of fraud-related data processing. That historical regulatory assessment is a reminder to define necessity and responsibility. It is not a finding about the final legal position in October 2026, nor an evaluation of Aurum itself.
A working demonstration has a different burden from public money
The strongest favourable interpretation is that privacy and compliance need not be an all-or-nothing choice. Aurum offers a concrete design to examine instead of relying entirely on institutional assurances. Its remaining limitations do not erase that contribution: limiting unnecessary data sharing can be useful even when regulated intermediaries retain defined information.
But the report explicitly calls the technology exploratory and not production-ready. A functioning prototype does not establish dependable peak-load operation, workable incident recovery or the costs of serving a general population. Those require evidence from the intended implementation, its governance and its operating environment.
Independent security evaluation, documented data retention, demonstrated continuity across intermediary failures and performance under realistic payment demand would make the case more concrete. The relevant measures would need to be reported for the chosen privacy settings, because changing a configuration can change the balance being evaluated.
The investment implication is a method of assessment rather than a forecast. Payment infrastructure should be judged by its actual data boundaries and service obligations, not by a privacy label alone. Aurum advances the design discussion while leaving the business and operational burden of public deployment to be demonstrated.