The European Union’s Markets in Crypto-Assets Regulation (MiCA), which entered full enforcement in June 2024, requires crypto-asset service providers (CASPs) to implement comprehensive KYC, AML, and transaction monitoring. The FATF Travel Rule, adopted by over 60 jurisdictions, requires virtual asset service providers (VASPs) to transmit originator and beneficiary information for transactions above defined thresholds. The US Treasury’s OFAC enforces sanctions against specific addresses and protocols, criminalizing interaction with designated entities.
Simultaneously, the EU’s General Data Protection Regulation (GDPR) mandates data minimization, the right to erasure, and purpose limitation for personal data processing. Switzerland’s revised Federal Act on Data Protection (nFADP) strengthens these protections further. The EU’s e-Privacy Regulation (in development) adds restrictions on metadata collection.
These frameworks are not merely in tension. They impose contradictory obligations. Compliance with the Travel Rule requires collecting and transmitting personal data. Compliance with GDPR requires minimizing the collection and enabling the deletion of that same data. A crypto service provider that fully complies with both frameworks simultaneously is navigating a legal impossibility, which is why every major exchange maintains a legal team dedicated to interpreting the overlap.
The Regulatory Landscape
MiCA (EU)
MiCA is the most comprehensive crypto-specific regulation globally. Its key privacy-relevant requirements:
CASP registration and supervision. Any entity providing crypto-asset services in the EU must register with a national competent authority (NCA) and comply with organizational, governance, and prudential requirements.
Customer due diligence. CASPs must implement KYC procedures equivalent to those required of traditional financial institutions under the Anti-Money Laundering Directive (AMLD). This includes identity verification, ongoing transaction monitoring, and suspicious activity reporting.
Transfer of funds regulation. For crypto-asset transfers, MiCA incorporates the Travel Rule: CASPs must collect and transmit sender and recipient information for all transfers, with no minimum threshold for transfers between two CASPs. The EU’s implementation is stricter than FATF’s recommendation, which suggests thresholds of $1,000 or $3,000.
Impact on privacy tools. MiCA does not explicitly ban privacy coins or mixing protocols. However, the requirement to identify originator and beneficiary for every CASP-mediated transfer effectively excludes privacy-enhanced transactions from the regulated ecosystem. Major EU exchanges (Bitstamp, Kraken’s EU entity) have delisted Monero and other privacy coins in response to MiCA compliance requirements.
FATF Travel Rule
The Financial Action Task Force’s Recommendation 16, applied to virtual assets, requires VASPs to collect and transmit:
- Originator name
- Originator account number (wallet address)
- Originator geographic address, national identity number, or date and place of birth
- Beneficiary name
- Beneficiary account number
For cross-border transfers, this information must be transmitted from the originating VASP to the beneficiary VASP. The technical challenge is significant: there is no standardized messaging protocol for VASP-to-VASP data transmission. Solutions like TRISA, Shyft, and Notabene have emerged, but interoperability remains incomplete.
As of early 2026, over 60 jurisdictions have implemented or announced implementation of the Travel Rule. Compliance rates vary. The US, EU, Singapore, and Japan have active enforcement. Many jurisdictions have adopted the rule formally but lack enforcement infrastructure.
OFAC Sanctions
The US Treasury’s Office of Foreign Assets Control (OFAC) maintains the Specially Designated Nationals (SDN) list, which includes specific cryptocurrency addresses. US persons and entities are prohibited from transacting with these addresses.
The Tornado Cash designation in August 2022 was the first time OFAC sanctioned a smart contract (a piece of open-source code) rather than a person or entity. The Fifth Circuit’s subsequent ruling upheld portions of the designation while acknowledging that immutable smart contracts present novel legal questions. The legal landscape remains unsettled.
The OFAC model creates a compliance requirement that extends beyond the regulated financial system. Any US person who interacts with a sanctioned address (even unknowingly, such as receiving unsolicited funds from a sanctioned source) faces potential liability. This has a chilling effect on privacy tool usage, as users cannot be certain that a mixing pool or privacy protocol does not contain sanctioned funds.
Swiss nFADP
Switzerland’s revised Federal Act on Data Protection (nFADP), effective since September 2023, is the most privacy-protective national data law among jurisdictions with significant crypto industry presence.
Key provisions relevant to crypto:
Data minimization (Art. 6). Controllers may process personal data only to the extent that it is adequate, relevant, and limited to what is necessary.
Privacy by design and by default (Art. 7). Technical and organizational measures must be designed to implement data protection principles from the outset.
Cross-border transfer restrictions (Art. 16-17). Personal data may only be transferred to countries with adequate data protection. The US is not on Switzerland’s adequacy list (following the Schrems II logic), requiring additional safeguards for any data transfer to US-based entities.
Criminal penalties. Unlike GDPR, which imposes administrative fines on organizations, the nFADP imposes criminal penalties on individuals (data protection officers, executives) who willfully violate the act. Fines up to CHF 250,000 can be imposed on the responsible individual.
For crypto service providers domiciled in Switzerland (including Stealth Cloud, structured as a Swiss Verein in Zug), the nFADP creates a legal framework where data minimization is not just good practice but a criminal liability issue.
The Contradiction Matrix
The regulatory overlap creates specific contradictions:
Collection vs. Minimization
The Travel Rule requires collecting originator and beneficiary identifying information. GDPR Article 5(1)(c) requires that data collection be “limited to what is necessary.” If a service can verify transaction legitimacy without collecting full identity data (through ZK proofs of compliance, for example), then collecting the full identity data arguably violates the minimization principle.
The European Data Protection Board (EDPB) has acknowledged this tension in a 2025 guidance document but has not provided a definitive resolution. The practical result: CASPs collect the data (Travel Rule compliance) and argue that the Travel Rule constitutes a legal basis for processing (GDPR Article 6(1)(c), legal obligation), while acknowledging the minimization principle limits what they can do with the data beyond compliance.
Retention vs. Erasure
Anti-money laundering regulations typically require 5-year data retention. GDPR grants individuals the right to erasure (Article 17). A user who requests deletion of their KYC data faces a legal impasse: the CASP cannot delete data that AML regulations require them to retain. The resolution is that AML retention obligations override the right to erasure for the duration of the retention period, but this is a legal interpretation, not a clean regulatory harmonization.
Transparency vs. Immutability
GDPR requires that data controllers be able to rectify inaccurate personal data (Article 16). Blockchain data is immutable. If a CASP records identifying information on-chain (or if the on-chain record itself constitutes personal data, as some regulators argue), rectification is technically impossible.
The CNIL (France’s data protection authority) issued guidance suggesting that data controllers should store personal data off-chain, using only pseudonymous references on-chain. This is the approach Stealth Cloud’s GhostPass implements: the on-chain footprint is a hash, the personal data (to the extent it exists, which in GhostPass is none) is off-chain and ephemeral.
Architectural Approaches to the Tightrope
Approach 1: Full Compliance (Regulated Exchange Model)
Collect all required data, implement all monitoring, maintain all records, and comply with all erasure requests after the retention period expires. This is the Coinbase/Kraken/Binance model.
The privacy cost is total: the service provider holds comprehensive identity data, transaction history, and behavioral metadata. The user trusts the service to protect this data and to comply with legal requests (but not extralegal requests). A data breach at a fully compliant exchange exposes everything.
Approach 2: Minimal Surface (Protocol-Level Privacy)
Design the protocol so that the regulated entity cannot collect the data even if required to. If the transactions are encrypted at the protocol level (as in Aztec or Monero), the service provider cannot comply with the Travel Rule because the necessary information does not exist in a readable form.
The regulatory cost is severe: these protocols cannot operate within the regulated financial system. Exchanges delist the tokens. Payment processors refuse to settle. The protocol exists outside the compliance perimeter.
Approach 3: Zero-Knowledge Compliance
Emerging approaches use zero-knowledge proofs to satisfy regulatory requirements without revealing unnecessary data. The concept:
- A user obtains a verifiable credential from a KYC provider (identity is verified once).
- When transacting, the user presents a ZK proof derived from the credential: “I am KYC-verified, I am not on a sanctions list, and my jurisdiction permits this transaction.”
- The receiving service verifies the proof. The proof reveals compliance status without revealing name, address, or other identifying information.
Projects like zkPass, Polygon ID, and Sismo (before its sunset) have demonstrated this pattern. The regulatory acceptance is the bottleneck: no major jurisdiction has formally accepted a ZK proof of compliance as satisfying Travel Rule obligations. But the technical infrastructure exists, and regulatory sandboxes in Switzerland (FINMA’s fintech sandbox), the UK (FCA sandbox), and Singapore (MAS sandbox) are testing these approaches.
Approach 4: Jurisdictional Architecture
Structure the service so that the regulated entity and the privacy-preserving protocol are in different legal contexts. The regulated entity (a CASP in the EU) handles fiat on/off-ramps with full compliance. The privacy-preserving protocol (a smart contract with no legal entity) handles the on-chain interactions.
This is the approach that Stealth Cloud navigates. Domiciled in Switzerland under the nFADP’s strong data minimization requirements, the architecture collects zero personal data by design. GhostPass authenticates with a wallet signature, stores only a hash, and maintains no user database. There is no Travel Rule obligation because there is no funds transfer. There is no KYC requirement because there is no financial service. The application layer is architecturally outside the CASP perimeter.
The Swiss Position
Switzerland occupies a unique position in the regulatory landscape. The Swiss Financial Market Supervisory Authority (FINMA) has been comparatively progressive in crypto regulation, licensing several crypto banks (SEBA, Sygnum) and establishing clear categorizations for digital assets.
The nFADP’s data minimization requirements create a competitive advantage for Swiss-domiciled privacy infrastructure. A Swiss entity that collects minimal data (because the nFADP requires it) is simultaneously compliant with Swiss data protection law and architecturally resistant to foreign data requests (because there is minimal data to produce).
The cross-border transfer restrictions under nFADP Article 16 add another layer: personal data processed by a Swiss entity cannot be freely transferred to the US or other jurisdictions without adequate protection. This creates a jurisdictional data shield that complements the architectural privacy of zero-knowledge systems.
FINMA’s regulatory sandbox allows fintech companies with less than CHF 1 million in public deposits to operate without a banking license. This sandbox has been used by several privacy-focused crypto projects to test compliance models that leverage ZK proofs and data minimization.
The Trajectory
The regulatory trajectory is toward more surveillance, not less. The EU’s proposed Anti-Money Laundering Authority (AMLA), expected to be operational by 2028, will provide direct EU-level AML supervision for the largest CASPs. The US is considering legislation that would require KYC for self-hosted wallets interacting with regulated entities. Several jurisdictions are exploring bans on privacy coins.
The counter-trajectory is technological. ZK-proof systems are becoming more efficient. Account abstraction enables compliance modules that can be added to smart accounts. Decentralized identity standards are maturing to support selective disclosure. The technology for “compliance without surveillance” is being built. The question is whether regulators will accept it.
The most likely outcome is bifurcation: a regulated perimeter where full compliance is required (fiat on/off-ramps, custody services, lending) and a permissionless perimeter where privacy-preserving protocols operate (DeFi, messaging, authentication). The boundary between these perimeters is the regulatory tightrope. Services like Stealth Cloud position themselves in the permissionless perimeter by architectural design, not by regulatory evasion.
The Stealth Cloud Perspective
The regulatory tightrope is real, but it is not symmetric. Collecting data you do not need creates both regulatory liability (under GDPR/nFADP data minimization) and security liability (every stored datum is a breach target). Stealth Cloud resolves the contradiction by refusing the premise. GhostPass does not collect personal data, so there is no data to minimize, retain, rectify, erase, or transfer. The most compliant data processing is the data processing that does not occur. Swiss law requires minimization. Our architecture achieves elimination. The tightrope is narrowest for those carrying the most data. We carry none.