The Bank for International Settlements (BIS) assessed that digital currencies can also deliver privacy at a level similar to cash. It said risks such as potential data leaks at financial institutions remain, meaning it is too early to introduce a current prototype into an actual service.

Cointelegraph, a blockchain media outlet, reported on Oct. 13 local time that the BIS, in a Phase 2 report on “Project Aurum” released that day, presented the technical feasibility and limitations of a privacy-preserving digital cash prototype.

The study focused on testing privacy protection technologies for central bank digital currencies (CBDCs). Using the existing Aurum code base, the BIS built a prototype that sought a balance between full anonymity and complete transaction transparency. It confirmed the potential for “cash-like privacy,” but said the current technical configuration does not yet reach the level needed for deployment in live services.

A key issue is how much customer information could be exposed if the system is compromised. The BIS said that if a single bank is attacked, that bank’s customer information could leak, but the system is designed so that it would not reveal the identities of customers at the counterparty bank. Even if a verifier is attacked, that alone does not immediately expose end-user information. It said there are mechanisms to limit the scope of damage, but they do not eliminate the security risks at financial institutions that hold customer information.

These limitations intersect with concerns about surveillance surrounding CBDCs. Critics have repeatedly raised the issue that central banks or governments could track payment data and control transactions. The BIS presented the feasibility of privacy-preserving design in the study, but drew a line by saying the prototype’s technical results do not mean it is ready for commercial rollout.

Disputes over CBDCs’ control functions have also emerged during development. After Brazil’s central bank released the source code for a 2023 CBDC pilot, critics said it included functions that could freeze funds in users’ wallets or reduce balances. The case shows that, in designing digital currencies, issues extend beyond privacy protection to include the operating entity’s authority and the scope of its exercise.

Opposition to introducing a CBDC is also continuing in the United States. U.S. President Donald Trump banned federal agencies from issuing a CBDC in January, citing concerns over financial stability and privacy. In Congress, arguments led mainly by Republicans are also emerging that CBDCs should be permanently banned.

The report shows there is still a gap between CBDCs’ technical potential and readiness for real-world operation. It said that even if cash-like privacy can be achieved, security at financial institutions holding user information and overall system stability must also be ensured. In future talks on adoption, the main tasks are expected to include how much to reduce data leak risks and how to control the authority of the operating entity, alongside payment efficiency.