The privacy dilemma: overseeing zero-knowledge finance within the EU and elsewhere

How regulators are balancing the "untraceable" promise of ZK-proofs with strict new anti-money laundering mandates – and what it means for the future of anonymous wealth.

Getty Images/Ekaterina Goncharova

Financial compliance has always existed on a precarious balance: regulators require enough visibility to prevent illicit activities, while users desire their financial transactions to remain confidential for basic payments or trades. In 2025, this dichotomy is more pronounced than ever. Stricter anti-money laundering (AML) regulations, expansive data protection frameworks, increased cross-border interactions, and simultaneously, enhanced privacy-focused technologies are shaping the landscape.

The positive aspect is that we no longer need to forfeit privacy for compliance. Zero-knowledge proofs (ZKPs) offer a resolution to the privacy paradox: regulators seek assurance that regulations are adhered to, but revealing complete identities and transaction specifics introduces security, legal, and data protection vulnerabilities. ZKPs allow a transition from “show me the data” to “show me a proof,” enabling companies to validate compliance without disclosing sensitive information.

This method is not intended to obscure regulatory scrutiny. Rather, it modernizes the compliance toolkit, allowing regulated entities to demonstrate their adherence to legal responsibilities (such as sanctions screening checks, KYC requirements, segregation of client assets, and capital assessments) without transferring or exposing the foundational data. ZKPs might be advantageous for users and, in the long run, for regulatory adherence, as proofs are verifiable and resistant to tampering.

What zero knowledge actually does

A zero-knowledge proof is a cryptographic method of asserting: “I can demonstrate that I complied with rule X, but I will not disclose the sensitive information typically needed to verify that.” In finance, “rule X” can be quite specific: “this wallet was checked against the current sanctions list”; “this user possesses a valid KYC credential from a recognized issuer”; “this exchange maintains client assets in a 1:1 ratio and they align with liabilities”; “this transaction falls below (or within) an acceptable threshold,” and so forth.

Currently, there may be legal obligations to report large datasets to designated regulators. While compliance with relevant data protection laws is mandatory, it also elevates the risk of cybersecurity incidents and misuse. A ZK-based approach validates the outcome without necessitating the disclosure of all inputs. Should a regulator require deeper insight, a mechanism can be established for selective disclosure of specific necessary data (viewing keys, time-limited access, and comprehensive audit logs, granted under due process as needed), akin to a permissioned regulatory portal or window.

Why this matters now

Three trends are converging.

In the EU, regulators are refining anti-money laundering (AML) controls, while GDPR and other privacy regulations emphasize the principles of data minimization and purpose limitation. These can work together rather than in opposition: compliance can offer the same or enhanced assurance with reduced routine exposure of personal data. This goal can be achieved by employing privacy-preserving reporting methods.

Secondly, digital identity frameworks (like those proposed under eIDAS 2.0) are nearing implementation. They rely on the same foundational elements as ZK: verifiable credentials, selective disclosure, and cryptographic attestations. This makes it increasingly feasible to issue transferable “I have passed KYC” or “I am not on the sanctions list” credentials that can be verified, not re-collected, across various services.

Lastly, regulators are investigating privacy-enhancing technologies, including models for proof verification.

What a proof-based compliance stack could look like

We already have existing examples. ZK-enhanced proof-of-reserves is the most recognized: an exchange demonstrates that it possesses sufficient assets to cover customer liabilities without disclosing individual account balances. This represents a zero-knowledge assurance.

The same can be applied to sanctions screening. Rather than submitting the complete identity each time, a wallet provides proof that it was checked against the most recent list at a specific moment. The regulator, or a regulated VASP on the other end, operates a verifier node to authenticate the validity and timeliness of the proof. It is important to note that ‘verifier nodes’ are a policy proposal functioning as an oversight mechanism for regulators to validate proofs without gathering bulk data.

This can also be implemented for asset segregation: a custodian can prove that client assets are not mixed with company funds through a range or sum proof, without exposing the entire ledger. This concept can even be integrated into smart contracts: transactions will not execute unless the proof is validated. This constitutes “programmable compliance” – rules applied at the time of transaction in ‘real time’, rather than post-factum.

For regulators, the fundamental transformation is the shift from gathering raw data to validating cryptographic evidence. They still obtain assurance, auditability, and traceability when there is a lawful basis to reveal identities. However, they are not required to hold or manage significant quantities of personal data by default, thereby reducing both operational and legal risks.

Answering key questions

Regulators are already initiating targeted ZK pilots, ranging from verifiable proof-of-reserves to Travel Rule compliance, which confirms user attributes without disclosing comprehensive datasets. As these foundational elements develop, they naturally scale into controls for market integrity, enabling firms to demonstrate compliance with concentration and exposure limits through range and sum proofs without revealing underlying positions.

Importantly, ZK does not equate to opacity; well-designed systems employ selective disclosure via viewing or multi-party keys. This guarantees that law enforcement access is limited, provable, and subject to due process rather than being universal and unmonitored.

What regulators could require

To operate effectively across borders, standards are necessary: standardized proof types (e.g., “not on sanctions list X as of date Y”), standardized credential formats, and standardized verifier logic that can be audited. This approach prevents each exchange, wallet, or bank from creating its own version and introducing unnecessary supervisory complexity for regulators.

Specifically, regulators may gain from six key aspects:

1. Outcomes over data (indicate what you proved, not all you possess);
2. Least-information proofs (prove only what is essential for this obligation);
3. Programmable checks (enforced at transaction time where appropriate);
4. Strong data-availability and exit mechanisms (users can always verify their balances and withdraw);
5. Verifiable verifier logic (inspections, test vectors, audit logs);
6. No generalized backdoors (disclosure only under lawful, narrow, logged processes).

Binance is a global exchange that already implements ZKPs for demonstrating reserves. Our proof-of-reserves (POR) system utilizes a Merkle tree – a cryptographic structure that consolidates numerous account entries into a single “fingerprint” – combined with zero-knowledge proofs to confirm that customer assets are entirely backed without disclosing individual balances. With each POR update, users can verify that their balance is included in the tree, while ZKPs ensure that the overall totals are accurate and that no negative or fabricated balances are present. The outcome is an independent, privacy-preserving verification of reserves that fosters trust without compromising personal data.

However, this extends beyond a single organization. If we manage this effectively, we can enhance financial compliance to be more precise, more respectful of privacy laws, and simpler to supervise.

This will necessitate collaboration. Regulators will need to establish proof standards they accept; the industry must align with and incorporate these standards, and standard-setting organizations will ensure that proof standards are interoperable across borders.

What success looks like

Success is defined when a user can validate legitimacy without oversharing; a bank, VASP, or exchange can fulfill AML/Travel Rule requirements with minimal data disclosures; a regulator can operate a verifier node and receive real-time assurance; and bad actors can be identified under clear, narrow, lawful conditions.

In summary, assurance with reduced disclosure. As cyber risks increase, privacy laws advance, and cross-border digital finance expands, transitioning from routine bulk data collection to verifiable proofs represents a practical enhancement to supervisory practices.

References to EU privacy law in this op-ed reflect the framework as of November 2025; the Commission’s Digital Omnibus proposals remain subject to change through the ordinary legislative process.