The Major Blind Spot of CBDCs: The Korean White Paper Overlooks Privacy

Context

In July 2026, the Korean central bank (BoK) published a report on its "unified ledger" – Project Hangang – a common settlement infrastructure for CBDCs, regulated stablecoins, and private tokenized assets. Ledger Insights notes that this reference document is "silent on privacy": no data protection architecture, no pseudonymization framework, no mention of the right to erasure. A major gap as the BIS and several central banks (ECB, Fed, BoE) advance their own digital currency projects.

Data

• Project Hangang (BoK): Korean unified ledger (wholesale CBDC + commercial tokenized deposits) – 7 participating banks in Phase I (2026)
• mCBDC Bridge (BIS Innovation Hub): Phase 3 underway, involving 4 central banks – PBoC (China), HKMA (Hong Kong), BoT (Thailand), CBUAE (UAE) – a project distinct from the Korean Hangang
• e-CNY (China): deployed in 26 provinces, cumulative transaction volume exceeding 1,800 billion RMB since 2020 (PBoC, 2023) – precedent of architecture without strong confidentiality
• ECB: digital euro project in preparation phase, scheduled for 2027-2028; 99% of public consultation responses expressed privacy concerns
• BVI offshore: $1.2 billion in registered stablecoins (tokenization hub, 2026)
• Only 3 countries have adopted a fully operational retail CBDC: Bahamas (Sand Dollar), Jamaica (JAM-DEX), Nigeria (eNaira)

Analysis (Mechanism)

The Korean blind spot reveals a systemic issue: central banks design CBDCs as efficient settlement systems, not as systems for protecting civil liberties. A unified ledger without privacy is technically a mass financial surveillance infrastructure. The mechanism is simple: every transaction on a non-pseudonymized ledger is visible to the operator—the central bank or its technical delegate. The e-CNY precedent shows the direction this architecture can take, with full state access to transaction histories. The technical solution exists—zero-knowledge proofs (ZKP) can prove AML compliance without revealing data—but their computational cost and implementation complexity remain major obstacles.

Probabilistic Scenarios

• Scenario 1 – Late Amendment (45%): Under pressure from GDPR in Europe and BIS privacy guidelines, Korea and other central banks introduce confidentiality layers (ZKP) before operational deployment.
• Scenario 2 – Regulatory Bifurcation (35%): Western CBDCs (ECB, BoE) adopt privacy by design; Asian CBDCs remain open to surveillance. Two incompatible standards, friction in cross-border payment corridors.
• Scenario 3 – Political Blockage (20%): Retail CBDCs are blocked in Western democracies under pressure from parliaments and public opinion, delaying their deployment by 3-5 years.

Portfolio Implications

• Private stablecoins (USDC, USDT, new Visa/BlackRock networks): indirect beneficiaries if retail CBDCs stall politically—the gap is filled by regulated private operators.
• ZKP infrastructure (Fireblocks, Chainalysis solutions, ZK protocols): privacy technologies become strategic for banks seeking to position themselves in CBDC infrastructure.
• CBDC custodians (large commercial banks): regulatory exposure if their role as technical delegate involves full access to transaction data.

Risks & Blind Spots

• The privacy vs. AML traceability debate is a false technical dilemma: ZKPs allow compliance to be proven without revealing data. But their adoption requires political will, which few central banks have expressed.
• A government can technically impose a backdoor on a unified ledger without making it public—risk of undetectable covert surveillance.
• South Korea has a robust data protection framework (PIPA); the absence of mention in the report may be temporary and addressed in a later project phase.

To Monitor

Publication of the BIS privacy framework (H2 2026), ECB consultation on the digital euro (autumn 2026), Phase 2 results of Project Hangang, Phase 3 results of mCBDC Bridge, reaction of the European Parliament, ZKP advances in BIS Innovation Hub pilot projects.