Panel | Compliant Privacy: Oxymoron or Future? | Common S3nse - 2026

[music]

So, I think we're still using slido.com. So, if you have any questions, just enter the code 2626. That'll come up on my phone and we can ask them of the panel. Hello, hello.

Okay, if you would each like to give a uh introduction of yourselves, what you do, what your company is, and also interestingly, how do you define privacy? Because it's one of those big words that I think we all use quite differently.

Hello. Ah, okay, this works. Uh hi guys, my name is Mathias. I'm with Bermuda. Um I've been in crypto for quite a long time.

Uh I used to be at ConsenSys building wallets, and then before I worked in banking. Uh also for quite some time, first just traditional banking, but then also with some crypto angles. Um why privacy? Um well, I think privacy is a very general term, so it's always difficult to like really grasp what privacy really means, but I think there's two elements that are very important. Um one, I think privacy can enable um integrity for any system, which I think is very important.

And then uh obviously agency. Um agency for users, but also for for for sort of the counterparty. Um that's why I think privacy is really important, and that's what we also focus on at uh Bermuda.

Three, I think. Yeah, doesn't matter. Okay. Um I like it when bathroom stalls have doors. Uh like you can choose who sees you, you know, take a dump.

It's nice.

And who are you? If you wish to share.

I'm me and Soleimani, co-founder of privacy pools. It's compliant privacy. Yep. It has a door.

Hi. I'm Shayna. I'm the founder of Soda Labs. My background is a cyber security and cryptography. I've been doing cyber security for 20 years.

And got curious about cryptography, did my masters and PhD in that in MPC. And in Soda Labs we also solve compliant privacy.

Thank you. Now, is compliant privacy a genuine redesign or is it a survival strategy?

I'll ask that. Is it a survival strategy? Not at all. I mean

[clears throat]

those two things go hand in hand. You know, on the surface they appear to be in conflict which you know, sometimes they are but I guess they're all very much interrelated. Ultimately, when we think of privacy we think specifically of Bermuda more as privacy as as an output. And what is underneath is a system. And that system or many systems they have specific objectives and those objectives need to be enforced and so compliance is an enforcement mechanism and the output of that can be the level of privacy that is possible to exist on that particular system.

So

[clears throat]

I think compliance is sort of a relevant component of this whole ecosystem. And the specific compliance architecture that exists somewhat determines what level of privacy is possible and what level of agency is ultimately possible. So, rather than being sort of completely against compliance, we try to rethink how clients compliance can be done. Specifically, ZK I think is very powerful to enable verification mechanisms that are much more in favor of end users and give end users a lot more agency while at the same time being able to enforce specific rules that are based on a specific system. So, I think those two elements go hand in hand and you know, they sound always very sort of like contradictory, but um we try to take a neutral approach to provide architecture that allows many systems to exist.

Many systems to enforce their rules and obviously empower sort of the the the users and participants of of the ecosystem. And so, I think it's a natural component and we try to educate both sides in the best way that we can to find better ways of enforcing compliance while enabling privacy that benefits everyone.

So, do you think compliance would happen if the regulators weren't asking for it? It would be a natural product of the search for privacy.

So, [clears throat] I mean, the the thing is um if you operate in any system and you have multiple participates participants, unless you have complete anarchy, you have to follow a specific set of rules and sort of like the enforcement of those rules needs to be handled by some form of apparatus and you can call it compliance or you can call it something else. You know, I think if you want to have a system that scales, you need to have some form of rules that everybody has to adhere to and therefore you need to have some form of compliance mechanism. Now, when you think of like, you know, state-enforced mechanisms, those are particular enforcement mechanisms that are obviously heavily debated in in in in the privacy act system, but, you know, I would say it's very I would say unrealistic to think that there can be any system that doesn't have any set of rules that everybody has to adhere to, and therefore some form of compliance needs to exist for a system to really to thrive, I would say.

And I mean, Avichai, would you agree?

Uh I do. I think um to today we have we have sort of privacy in the internet, right? It's a better ridiculously, it's a better privacy than we have on blockchains. Um and we take it as the lower bound, right? We want to improve it.

We don't want to blockchains to take us backward. Um and we have compliance on the internet, so this is the bare minimum.

Um So, what was the question again initially, cuz you asked another one?

Uh the initial question is is compliant privacy a genuine redesign or a survival strategy?

Genuine redesign or a survival strategy.

It can be both.

Yeah, it's a little bit of both. Um and then your second question was if regulators weren't, you know, requesting it, would you still do it basically? Uh and I've had this argument with a lot of people on the internet um because I've had a personal journey that's taken me from helping with Tornado Cash to now being a compliance guy. Uh so, now I've been accused of selling out my Cypherpunk principles uh by a whole bunch of anarchists who demand that privacy be completely open to everyone or else is seemingly, you know, less used you know, less morally valuable or something like that. Uh and there's uh both moral and uh legal considerations in this and they are, you know, there's like philosophical and practical that they map to and it's like, on the one hand, right, I have enemies, you know, uh I'm like an Iranian, I don't really like the Islamic Republic, you know, uh maybe there's somebody at the Islamic Republic who is like using Tornado Cash and benefiting from that.

Uh you know, I wasn't like our intention for North Korea to be a power user of this platform. Uh so, you know, there's ways of designing things that are totally open that people that you don't want can, you know, take advantage of. And it wouldn't It's not that it's that the problem is that that their participation can then cause problems for everybody else who's using it. All right, if it didn't matter that they were using it, then I wouldn't care, but because they participate, then you know, when you withdraw, it could be you or the IRGC or North Korea or whatever. Uh and that presents a problem.

Uh it presents a problem for people who would prefer not to associate uh with, you know, those potential organizations. Um and people who from a legal perspective cannot. Right? And so, as a US citizen, I cannot uh interact with, you know, North Korea or um the IRGC, but as a uh European citizen, you might prefer not to. Um and so, building the tools for people to build essentially uh I would call it community sovereignty, where they, like for example, in privacy pools, we allow people to deposit, but then we monitor the deposits and we individually approve each one.

Uh and the what we're doing is we're checking that the money isn't coming from, for example, Nobatex, which is the largest exchange uh in Iran, or, you know, known hacks in the crypto space that we can see and trace. And so, as a result, you know, we have built what we have identified as, you know, both adhering to like a legal strategy, but also, you know, trying to keep out people that we would prefer not to associate with, even if it's not necessarily required by law, if we see it. Um and so, I think that's a valuable thing for communities to be able to define and enforce their own boundaries.

So, your definition of compliance would be what the individual who uses it wants compliance to be, and then it will be enforced.

Yes, and as a citizen of the United States, I would prefer my compliance to not put me in prison.

Okay. Do you think compliance is a technical property of the system, or does it depend on who's asking and what they're allowed to see?

Um Well, I mean, one [clears throat] thing that is always dangerous is this like get getting sucked into having to take a position as any crypto protocol. Specifically in in in privacy, I think it's advisable to build something where you don't have to take a position to the extent possible. I mean, what Ed just mentioned, the I you know, you have to adhere to certain um standards that avoid uh you getting into legal trouble, but to the extent possible, you should try to stay as neutral as possible. Also, because then you can allow many systems to coexist at the same time. And [clears throat] so, what we try to do is, specifically in the context of compliance, to make sure that there can be multiple policies enforced at the same time.

What those policies are, whether they are or Um, based on specific jurisdictions, or they're specific to a company, or whether they're community-based, uh, that doesn't really matter. Uh, but we try to facilitate, um, the coexistence of multiple of such ecosystems. Um, essentially leveraging the the the power that we have, uh, of blockchain and NZK to create a new, uh, global layer through which everybody can sort of interact, um, while at the same time be, um, able to enforce those specific policies, uh, and and from a compliance perspective then be able to, um, somewhat control those flows, while at the same time being able to operate on this global layer. Um, I think that's something really important, um, and will change many approaches that we see, uh, specifically in the privacy space where we have this fragmentation, um, where you have individual protocols that sort of silo themselves from the broader EVM ecosystem, uh, which creates a lot of fragmentation and, uh, I think is is not necessarily the advantages.

Thank you. So, in creating a system that allows whichever jurisdiction you're focusing on to be automatically compliant, it's kind of forcing onto the user, or not allowing the user to be compliant because the system is already handling the multi-jurisdictional issues.

Yeah, exactly. Um, and you know what's really important about ZK is

[clears throat]

that it can, um, really transform the type of compliance that exists today, um, where essentially we have this fallback mechanism that, uh, compliance is enforced through mass surveillance, uh, and nobody wants to have mass surveillance. It is, uh, really counterproductive to, um, sort of the kind of value flows that exist, and counterproductive to the user's agency. Um, so, the more effective verification mechanisms you have, the less you need to disclose, and the more agency you can provide to the user. Um, and also at the same time you can enforce multiple, um, policies at the same time. And so, it really reduces the possibility of abuse, systematic abuse of power of those who essentially control the systems.

So, in that context, I think there there's really a lot of opportunity to reinvent compliance in the way that it's done. And and I think that's sort of like one of the objectives that we have as a privacy protocol as well.

So, Abishai, do you think it's a technical property?

I think compliance is embedded in everything we do. It's not only about privacy. Like the moment you you get into this world, you're born into some state, right? And all of them have different regulations. Maybe except Liberland.

Um and we didn't break down compliance. Like, what does it mean? So, I mean, touches a little bit about the geopolitics. Like, which state I'm allowed to to interact with, but there are a lot of other aspects that are not geopolitics. They're more micro economics like um um money laundering and um uh travel rule compli- regulations.

So, there are rules that obligates um money processors to know actually to know the the data, who is transferring to whom. Um it's not their obligation is not to verify. It's actually to know. They have to have the data right now. So, even even if you convince them, "Look, you have all the tools to verify that I'm a good person.

I didn't do anything wrong." They cannot accept it right now. They have to get the data. So, the the there are two paths paths that we can uh take. One is to They're not necessarily contradicting, but one is to push uh towards transforming the regulation into changing the obligations that each party has.

And the other is to try to embed the existing tools that we have into existing regulation. Uh I think we should do both. The the first one will take more time, and the second will it it's probably uh we're ready for the market. Yeah.

Anything to add?

Um yeah, so the question was is compliance a technical property of the system? Uh I would say not. Um I would say it's enabled by certain technical properties of the system. Uh for example, uh I do willfully engage in money laundering from the perspective of the Islamic Republic by sneaking money into Iranian activists. This is not a crime in the United States uh to do this if I comply with US sanctions and you know, provide updates to OFAC, and I do this through the proper channels.

Uh it's crime in the Islamic Republic. I don't give a

[snorts] [clears throat]

Uh I use every privacy tool out there, you know, Zcash, Monero, Railgun, Solana stuff, you know. Um and and yeah, um but however, uh you know, at the same time I'm building my tools to provide compliance with US laws. So, uh you know, it's not uh purely technical if we for example, approved different actors who deposited and rejected different actors, then it would not be compliant in the United States because if we accept, you know, money for uh entities that the United [clears throat] States consider terrorist, then you know, we're no longer compliant. So, that's a a very social uh boundary, not a technological one, but it is enabled by technology. Like, the Tornado Cash developers, they built what is called the compliance tool.

And the compliance tool allowed individuals who uh use the system to use their node to generate a proof that you could show somebody that would allow them to uh you know, prove that you you prove to them that uh your deposit is connected to your specific withdrawal, so you could docs yourself. Right? And you could do this on demand if somebody requested it and if you consented to it. And there was a whole paper written by this blockchain professor, Fabian Schär, about why this should be the basis of regulating Tornado Cash. Uh he published this in the St.

Louis Federal Reserve. And uh the idea was that, you know, uh regulated financial institutions would allow users to use Tornado Cash and then deposit proceeds from Tornado Cash if the users then gave those uh institutions the information about where their money specifically came from. Um and so, uh that could have been a path at regulating this, and this was always something that was possible. Um and so, uh we still have not actually had regulation about, you know, privacy. We all say compliance.

We have no idea uh where the regulation is actually going to land. That's why he's building every option. Uh like, um you know, StarkNet co- has something they call privacy, it's backdoored, right? Like, people are adapting to not knowing where the uh ball's going to land. Um but, you know, uh like, even in the Netherlands, this is the one of the funniest things about the the case, right?

They they were like, "You guys didn't stop anyone from using this even though you knew it could be used for crime." And then they didn't ban it. Right? Like, the No one It was never illegal the entire time to use Tornado Cash in the Netherlands. Like if this thing is only possibly could be used for money laundering, then why didn't you ban it?

Maybe you are are actually the one who had the power to stop people from using this, and you didn't exercise your power to stop people from using it. You should be liable for all the crimes that people have committed. But, you know, that's that's a different story. So, we'll we'll see where the regulations actually end up. Like uh Tornado Cash is in this like weird space where it got sanctioned, and then you would have been liable for up to 25 years in federal prison for touching it, in any way interacting with it, and then it got unsanctioned.

So, is it a is it okay to use now? Is it not? And it's like technically it's okay, but nobody actually knows if you know, using it might result in some other crime, you know, designation down the road. And so, it's in a weird gray area where there has been no legislation that says this thing is actually okay to use under these conditions or not. So, we will see.

So, there's that kind of idea of retroactive compliance. Like do what you want until we decide it's not okay, and then we'll tell you it's not okay, and it's too late.

I mean, I think like I'm not a lawyer, but there's like what? Continental law and the other one. And like the whole point of European law is that like unless it's actually explicitly unlawful, then it is lawful. Whereas in America you have like precedent law, and so then it could, you know, be unlawful as a result of a different court case. Something like that.

So, Yeah, I mean I'm I'm mostly most annoyed by the fact that they went after the developers themselves. And they went after them with criminal penalties and jail time. I think in most of the other cases that this kind of thing happens, it's a fine. And an understanding that, you know, moving forward, we will uh try and do better in some ways, right? Uh

[snorts]

and, you know, in their court cases, uh no nobody acknowledged the benefit or the attempt at building the compliance tool, which was then the basis of this proposal for, you know, regulatory policy, uh which I think is um short-sighted and unfair.

Do you think there's a clear idea that liability should be on the individuals using it, the people who make it, the people who manage it, or the government who regulate it?

Uh yeah, I think the individuals who commit the crimes using the thing should be held liable, not the developers who made the thing.

Okay, so in the next 5 years, where do we see compliant privacy going?

Um I mean, I would hope that we advance this conversation. Um I think the examples that I mean just mentioned are very relevant. Um because it shows this lack of understanding um from the regulatory regulatory side in terms of how the technology works and how it's supposed to be uh managed. Um I think there's a mindset shift that is required to uh rethink how systems can exist and how they can be implemented from a technological perspective. Um there's a huge gap that we I think need to close over the next 5 years, and once that understanding is there, then I think uh it's much easier to find out ways that actually work uh in reality.

Um How far we get in the next 5 years, I'm I'm not particularly sure, but I mean, we doing our part in sort of helping uh advocate for that. Um there's definitely a lot of interest and movement uh at least in the US to um advance on that front, which is great. Hopefully other jurisdictions will follow. And um you know, if we see a continued trend of stable coins and other sort of regulated use cases coming on chain and businesses actually discovering the ability to do on chain commerce at scale then I think this will be a natural accelerator of not only privacy but also the compliance conversation. So, I'm pretty bullish on that.

You know, again, I think this mental switch will unlock a lot but we have more and more people coming to the table to to facilitate that conversation and I think in the next 5 years we'll see a lot of transformation on that front.

Um Again, what what was the question?

5 years compliance.

Yeah.

[laughter]

Yeah. Um As long as institutions are coming in, I I think they will they will find ways to to get privacy with compliance. I don't think there is any other way that institutions will use blockchains as financial rails and be exposed to to all sorts of um drawbacks that that there are on blockchains with relation to privacy. So if in 5 years they catch up and use blockchains as as rails for finance, then I think it will work well with privacy.

Yeah, I think I'm also optimistic. Um I had the opportunity when I was here last uh visit, it was June. Uh Alexy was presenting at the Dutch Blockchain Week. And there was a a guy who I'd talked to at Alexy's uh trial, and he was like part of the Dutch government. And he was um at the time like very much, you know, uh Alexy is should be held responsible, somebody needs to be held responsible.

Like this was you know, there's crimes committed. Um and I think since then he's like come around, you know, and been like actually I don't know if uh this is the best outcome. Uh and so I think um as people have seen how, you know, like understand more about blockchains, understand more about privacy systems, uh understand the nuances of what developers can and cannot do in these systems, um they empathize a bit more. Uh and I think that's he like he's not, you know, necessarily alone. Um and so I can see this mindset uh shifting.

And so I think in the next 5 years we will have, you know, legislation that says what are the limits, you know, what how should compliance work. Um and we'll have a lot more clarity and uh it will not be seen as only a thing for criminals. Uh the benefits of privacy will also be understood and uh you know, it's weird because in in the EU you have like GDPR and at the same time they're like, yes, but the money, you know, like that has to like you can't have privacy for that. So there's some uh you know, disconnect there that I think will be reconciled.

All regulation bodies like MiCA and MiFID, they all mention privacy. It's like a myth that it's illegal. So

Yeah, it's right now it's like an individual court uh for his trial specifically that was like, you know, it's not a good thing, you know, basically that this uh should only like having privacy like the desire for privacy is indicative of an interest in money laundering is like equated, you know.

Yeah, I get it. I think it's a showcase. I like to to maybe intimidate other people that build stuff with that intention. Um You know much better than than I am about this case.

Yeah, I mean like it's it's you know, it's like again in the US. They're like, "Ah, we will stop charging developers for, you know, unli- it's like Romans just sitting there like, "Okay, me too, right?" Like Uh, can you get me off for the thing that you were stopping to charge everyone for? Uh, cuz that's the thing that I'm you know. Uh, like has 5-year conviction for, so it's like

Thank you. Do we have any questions in the room before we close up? Nope. Okay, well, thank you everybody. Been very interesting talk.

Thank you.

Cheers.

Thank you.

I still don't know how soda works. I wanted to learn.

[snorts]

Thank you very much. Thank you Camilla, Amin, Mathias, and Avishay.

Um Fun announcement, uh, check out v2.privacypools.com. Uh, we are testing some stuff in prod. $100 [snorts] limit.

Okay, you heard the man. No airdrop. What you say? No airdrop?

Definitely no airdrop.

Oh, come on, man.