BIS: Digital Cash Can Offer Cash-Like Privacy, but Bank Breaches Still Expose Users
Privacy is possible, but not production-ready
The Bank for International Settlements (BIS) said digital cash can deliver privacy close to that of physical cash, but added that the underlying technology is not yet ready for real-world use.
The finding comes from Project Aurum Phase 2, a BIS report published on Tuesday, October 13, 2026. The phase built a privacy-preserving digital cash prototype using BIS's existing Aurum codebase and aimed to strike a balance between full anonymity and complete transaction transparency.
BIS emphasized that a compromise of a single bank could expose that bank's customer data. However, the report noted that such a breach would not reveal customer identities held by other banks in the network. A validator-level compromise alone would not be sufficient to expose end users, according to the report.
Key findings from the Aurum report
- Digital cash can achieve what BIS calls "cash-like privacy," matching the anonymity of holding physical banknotes.
- The technology stack is not yet "production ready" according to BIS.
- A breach of one bank exposes its own customer data but does not reveal identities from other counterparties.
- A validator-level compromise by itself would not expose end users.
- The report outlines the technical features needed to build a privacy-preserving central bank digital currency (CBDC), a digital version of a country's official currency issued directly by its central bank.
Critics point to past surveillance features
CBDC opponents have long raised concerns about whether such systems could be used for financial surveillance. The report's discussion of privacy measures comes against that backdrop.
In 2023, Brazil's central bank published the source code for its CBDC pilot. Within days, reviewers noticed surveillance and control mechanisms embedded in the code that allowed the central bank to freeze or reduce funds inside user CBDC wallets.
Earlier this year, US President Donald Trump banned federal agencies from issuing a CBDC in January, citing financial stability and privacy concerns.
What is confirmed
The following points are supported by the BIS report as described in the source material:
- BIS says digital cash can achieve cash-like privacy.
- BIS says the technology is not yet production ready.
- A bank breach would expose that bank's customer data but not identities from other banks.
- A validator-level compromise alone would not expose end users.
- Brazil's 2023 CBDC pilot source code contained mechanisms to freeze or reduce user wallet funds.
- US federal agencies were barred from issuing a CBDC in January 2026 on stability and privacy grounds.
What remains open
The report does not state when, if ever, the technology will be production ready. The source material also does not describe the specific privacy techniques used in the Aurum prototype, and no timeline for real-world deployment was given.
Why this matters
The BIS work is significant because the organization coordinates central banks and influences how digital currencies are designed globally. If privacy-preserving digital cash can match physical cash while still letting central banks oversee the broader system, it may address the surveillance concerns that critics have raised about CBDCs.
On the other hand, the finding that a single bank breach can still expose its customers' data shows that privacy in digital cash does not mean full protection. Users would still depend on the security of the financial institutions that handle their digital money.
Source
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.