BIS Warns Bank Breaches Undermine “Cash-Like Privacy” Claims for Digital Cash

The Bank for International Settlements (BIS) says digital cash systems can, in principle, deliver the privacy protections associated with physical cash—while also stressing that current implementations still leave significant security and operational questions open.

In its Project Aurum Phase 2 report, BIS describes a privacy-preserving digital cash prototype built on its existing Aurum codebase. The institution frames the effort as a “balanced approach” between full anonymity and complete transparency, and cautions that real-world risks—particularly around data exposure from bank-side breaches—remain central to the design challenge.

Key takeaways

• BIS argues digital cash can be engineered to provide “cash-like privacy,” but emphasizes that the underlying stack is not yet “production ready.”
• Project Aurum Phase 2 uses BIS’s Aurum codebase to prototype technical building blocks for a privacy-preserving CBDC-style system.
• According to BIS, a compromise of one bank could leak customer data held by that bank, but should not automatically reveal customer identities associated with other counterparties.
• The report suggests that a validator-level compromise alone would not be sufficient to expose end users.

What BIS says “cash-like privacy” should look like

Project Aurum Phase 2 centers on how a central bank digital currency (CBDC) could be designed to protect user privacy in ways that resemble the limits of cash. BIS does not claim that existing technology already solves the problem at scale; instead, it treats the prototype as an engineering step toward a privacy-enhancing system.

In the Phase 2 work, BIS implements a privacy-preserving digital cash prototype that relies on its Aurum codebase. BIS positions the approach as a tradeoff: it aims to preserve privacy for users while still providing a level of accountability necessary for the network’s operation. That framing matters because CBDC debates frequently split along two extremes—absolute anonymity versus full traceability—while real systems often require the ability to prevent misuse, reconcile balances, and manage operational controls.

Where privacy could break: bank breaches and data exposure

A major theme in BIS’s findings is how privacy guarantees behave under partial failures. BIS writes that compromising a bank could expose customer data. However, it adds an important boundary: such a breach would not expose customer identities tied to other counterparties.

In other words, BIS is effectively describing a threat model where privacy protections are designed to be compartmentalized. If one participant in the system is compromised, the damage should be limited to data the compromised party can access—not a blanket disclosure of all users across the network.

BIS also addresses validator risk. It states that compromising at the validator level, by itself, would not be enough to expose end users. While these statements do not eliminate all concerns—because real deployments involve multiple layers of infrastructure and governance—they provide clearer guidance than broad privacy claims alone.

Why BIS’s approach matters amid CBDC surveillance fears

CBDCs have faced persistent criticism from privacy advocates who argue that central bank issuance could enable financial surveillance and greater control over individuals’ funds. Those fears have often been grounded in the perception that the same technical features that make CBDCs manageable for regulators could also make them intrusive.

BIS’s report attempts to answer that critique by demonstrating how a CBDC-like system could be engineered around privacy constraints. Still, BIS’s repeated caveat—that the technology is not “production ready”—signals that the issue is not settled. For investors, developers, and policymakers watching the CBDC debate, the practical question is whether privacy-enhancing features can be made robust under real operational conditions: key management, auditability, incident response, and the varied behaviors of participating institutions.

Recent policy and code controversies keep the debate sharp

The BIS report arrives in a climate where CBDC efforts have repeatedly triggered controversy. In 2023, Brazil’s central bank published the source code for its CBDC pilot, and—within days—observers highlighted surveillance and control mechanisms they said were embedded in the code, including the ability for the central bank to freeze or reduce user funds within CBDC wallets. (The Brazilian central bank’s publication is available via its press materials: bcb.gov.br.)

Separately, earlier this year, US President Donald Trump signed an executive order banning federal agencies from issuing a CBDC in January, citing concerns including financial stability and privacy. Cointelegraph previously reported on the executive order and the creation of a working group around digital assets: cointelegraph.com.

Taken together, these episodes highlight why BIS’s Phase 2 emphasis on privacy under compromise is likely to resonate beyond academia. The core dispute is not only whether a system can be private in theory, but also how it behaves when systems are pressured—by hacks, internal misuse, or administrative controls.

What to watch next

BIS’s Project Aurum Phase 2 offers a more concrete look at how privacy-preserving digital cash might be engineered, along with a candid assessment of remaining gaps. The next key developments to monitor are whether BIS can move from prototype to deployable infrastructure without weakening the privacy boundaries it describes—and how policymakers will evaluate those guarantees against existing privacy and governance concerns.