BIS Warns Digital Cash’s Privacy Gains Face Risk From Bank Breaches

The Bank for International Settlements (BIS) says digital cash can be designed to deliver privacy characteristics similar to physical cash—but its latest research also underlines that significant technical and security questions remain before such systems can be deployed at scale.

In a Project Aurum Phase 2 report released Tuesday, BIS describes a privacy-preserving digital cash prototype built on its existing Aurum codebase, aiming to balance “cash-like privacy” with the practical realities of running a system involving banks and validators.

Key takeaways

• BIS argues digital cash can be engineered to preserve cash-like privacy while still enabling certain system-level functions.
• The BIS report cautions the underlying technology stack is not yet “production ready,” leaving open questions for real-world adoption.
• According to BIS, compromising one bank would expose that bank’s customer data but would not reveal identities of customers at other counterparties.
• BIS says a compromise limited to the validator layer is not sufficient on its own to expose end users’ identities.
• The findings come amid ongoing political and public scrutiny of CBDCs, particularly around surveillance and control concerns.

Cash-like privacy, but with a narrower threat model

BIS’s Project Aurum Phase 2 centers on the technical requirements for building privacy-preserving central bank digital currency (CBDC) systems. The report’s central premise is straightforward: if digital cash is intended to emulate the privacy of cash transactions, it must limit how much information can be extracted by any single participant in the network.

In the report, BIS states that the phase implements a prototype that uses its existing Aurum codebase to strike a “balanced approach” between two extremes often cited in CBDC debates: complete anonymity versus fully transparent transactions.

However, BIS also stresses that translating the concept into an operational system is not yet resolved. It describes the technology stack as not “production ready,” signaling that the prototype is still at a research-and-testing stage rather than a blueprint for immediate deployment.

What happens if banks or validators are compromised

A major portion of the report addresses privacy risks linked to security compromises. BIS found that if one bank is compromised, the attacker could access data related to that bank’s customers. But BIS adds an important constraint: the compromise would not expose customer identities belonging to users of other counterparties.

BIS further notes that a compromise restricted to the validator layer alone would not be enough to expose end users.

For investors, traders, and builders watching the CBDC space, this distinction matters because it frames privacy as an outcome of system architecture—not only cryptography in isolation. In other words, who holds what capability, and what that capability can reveal, becomes a key element of whether “digital cash” truly reduces surveillance risk.

Why regulators and critics remain skeptical

The BIS report lands in a debate that has been driven by concerns from CBDC critics about financial surveillance. The underlying issue is not merely whether transactions can be kept private, but whether the broader design could enable monitoring, auditing, or operational controls that users might find invasive.

The BIS research does not eliminate those concerns, and its own warning that the stack is not yet production ready suggests remaining uncertainty around how these systems would behave under real operational pressure, scaling demands, and evolving threat scenarios.

The broader tension in the CBDC conversation is visible in earlier developments. For example, in 2023, Brazil’s central bank published the source code for its CBDC pilot. BIS notes that, within days, people identified embedded surveillance and control mechanisms in that code, including the ability for the central bank to freeze or reduce user funds within CBDC wallets. While BIS’s Phase 2 prototype is not described as a direct response to Brazil’s design choices, it reflects the same governance and privacy fault lines that have shaped public perception of CBDCs.

Political signals and the uneven path to deployment

The Project Aurum update also arrives amid shifting political views in the United States. Earlier this year, US President Donald Trump banned federal agencies from issuing a CBDC in January, citing concerns tied to financial stability and privacy.

That stance highlights how even technically sophisticated privacy research may still face adoption hurdles rooted in policy, legal frameworks, and public trust. BIS’s Phase 2 findings may inform future design conversations, but political decisions can still determine how quickly—if at all—CBDC systems move from prototypes to real-world issuance.

What to watch next

BIS’s Phase 2 offers a clearer view of how privacy boundaries could be enforced in a digital-cash architecture, but its admission that the stack is not yet production ready—and its emphasis on specific compromise scenarios—means observers should watch for follow-on testing, threat-model refinement, and how these ideas translate into implementable governance and security guarantees.