Bank of Korea's CBDC Unified Ledger Paper Says Nothing About Privacy

The Bank of Korea published a detailed design paper for Project Hangang, its unified ledger initiative combining tokenized deposits, wholesale CBDC, and programmable payment rails on a single central-bank-operated platform. The paper covers architecture, governance, and the two-tier monetary system at length. It does not mention privacy once. For compliance leads, auditors, and CFOs at firms operating in South Korea or watching CBDC design globally, that silence is a material governance signal ahead of Phase II trials launching later this month.

What Project Hangang Actually Does

Project Hangang is the Bank of Korea's working name for a unified ledger that sits commercial bank tokenized deposits alongside wholesale CBDC and programmable settlement logic on the same infrastructure. Seven commercial banks participated in Phase I earlier this year, with nine banks set to join Phase II. The central bank presented the paper at the ECB Forum, signalling that the design choices are being offered as a reference model to the broader central banking community.

The two-tier logic and why it creates a privacy tension

A core argument in the paper is that the two-tier monetary system should be preserved: commercial banks handle retail relationships and payments, while the central bank facilitates interbank settlement. That split has historically meant the central bank does not hold granular retail transaction data. Collapsing both layers onto a single platform the central bank builds and operates changes that calculus entirely. The paper does not address whether that shift is intentional, managed, or simply unconsidered.

Proof-of-authority and the visibility question

The platform uses a proof-of-authority consensus model, meaning the Bank of Korea controls node validation. Some degree of data partitioning almost certainly exists for competitive reasons: participating commercial banks would not accept rival institutions viewing their transaction flows. But partitioning between banks is not the same as limiting central bank visibility. The unresolved question is whether the central bank, as the platform operator, can see individual retail transactions. The paper provides no answer.

The Phase II Use Cases That Sharpen the Risk

The stakes rise when you look at what Phase II is actually testing. The Bank of Korea is preparing to run government disbursements through the platform. Phase I already processed retail payments involving 80,000 users and 12,000 merchants. The paper describes an ambitious target: tokenized deposits and wholesale CBDC to handle one quarter of National Treasury Fund disbursements by 2030.

Government disbursements as a privacy test case

Routing National Treasury disbursements through a central-bank-operated unified ledger creates a direct link between government payment flows and individual financial behaviour at scale. Whether that data sits in a partitioned silo, is accessible to the central bank, or could be compelled by other government agencies under existing Korean law are questions the paper does not raise. For any firm advising public-sector clients or auditing entities that receive or process government disbursements in Korea, this is a compliance architecture question, not merely a policy one.

What the 2023 Bank of Korea Paper Said

The omission in the Hangang paper is harder to explain away because it is not a new topic for the Bank of Korea. A 2023 paper from the same institution described active research into privacy-enhancing technologies for digital currency. The shift from active research to complete silence in a design paper that discusses tradeoffs in granular detail is notable. It does not necessarily mean privacy protections were not built in; it means they were not discussed, and that absence itself sends a signal about how the institution is framing the governance conversation publicly.

Why This Matters Beyond Korea

The Bank of Korea presented this paper at the ECB Forum, placing it explicitly in a cross-jurisdictional dialogue about CBDC architecture. European central banks and regulators watching unified ledger designs are operating in a legal environment where privacy obligations are considerably more codified: GDPR imposes strict requirements on data minimisation, purpose limitation, and access controls for personal data processed by public authorities. A CBDC architecture paper that treats privacy as optional commentary would face immediate scrutiny if replicated within the EU.

Parallels with EU data governance requirements

For EU-based compliance and audit professionals, the Hangang paper is a useful stress test for evaluating any unified ledger proposal closer to home. The relevant questions include: who operates the platform nodes; what transaction data is retained at the infrastructure layer; whether data minimisation principles are embedded in the ledger design rather than applied as an afterthought; and what access controls exist for the platform operator itself. These are questions that any competent GDPR or financial-data compliance review would surface. The fact that a central bank paper at an ECB forum did not surface them is a gap worth flagging.

For firms tracking programmable payment risks in parallel, the AML risks in programmable digital payment infrastructure and DORA ICT incident obligations for EU firms are both relevant reference points as central bank infrastructure expands into retail-adjacent territory.

Practical Takeaways for Compliance Leads and Auditors

The Hangang paper is not a final regulatory framework. It is a design document, and design documents shape what gets built. Compliance professionals engaging with clients who have Korean operations, or advising on CBDC readiness in any jurisdiction, should treat the following as open items when reviewing any unified ledger proposal:

• Identify whether the central bank, as platform operator, has unmediated access to retail transaction data and under what legal authority.
• Confirm whether data partitioning between institutions also limits central bank visibility, or only restricts commercial bank cross-visibility.
• Assess whether privacy-enhancing technologies are embedded in the ledger protocol or applied at the application layer, because the latter is easier to bypass or override.
• Examine what data retention obligations apply to wholesale CBDC settlement records and whether those records could be used to reconstruct retail flows.
• Check whether any existing privacy impact assessment has been conducted for government disbursement use cases, given the sensitivity of linking payment data to individual public-benefit recipients.

Source: Ledger Insights