BIS Speeds Up Digital Cash Proofs. The Payment Clock Is Still Missing.

The Bank for International Settlements' Project Aurum Phase 2 report says a graphics processor cut the time to generate a cryptographic payment proof from 2.86 seconds to 0.4 seconds for one input coin, and from 29 seconds to 1.76 seconds for 20 inputs. Those results make a privacy-preserving digital cash design more plausible. They measure one stage of a payment, not the time a customer waits for confirmation.

That distinction matters because Aurum makes privacy a payment-rail design choice. Regular transfers conceal the coins being spent from a trusted validator while allowing it to check that a payment is valid. The prototype also offers a faster way to merge many small coins. That option discloses the input coins to the validator and lets it connect them to their immediate prior transactions. A future operator would have to decide when that narrower privacy setting is acceptable, and who controls the choice.

Faster proof, incomplete payment measurement

Aurum's payer and payer's bank jointly construct a payment. The user's phone creates a lightweight ownership proof and a double-spending tag for each input coin. The bank then generates the heavier zero-knowledge proof, and a separate validator checks the transaction. This split avoids asking a phone to do the full computation or handing the bank the user's private key, according to the BIS technical account.

The published test ran on a cloud instance with a Tesla T4. It therefore says something about bank-side computation on that setup. It does not measure the full path from a customer's tap to confirmation. The report gives no end-to-end payment latency, transaction throughput, timed validator stage, phone model or measured phone-side proof time. It describes verification as lightweight, but provides no separate validator benchmark. The BIS report cites no independent end-to-end payment benchmark. A 0.4-second proof is not a 0.4-second payment.

The report itself says the new proofs increase transaction latency against Aurum Phase 1. Pseudonym checks, ownership-proof verification and output-coin checks add work beyond proof generation. Its QR-code discussion supplies another boundary: a compressed pseudonym is about 1.5 KB and may be difficult to scan with an older 5-megapixel phone in poor light. That is a device-usability observation, not a measured retail payment trial. A production test would need the same workload across phones, banks and validator, including peak traffic and failed or retried payments.

The shortcut gives the validator a view

The privacy mechanism changes what each party sees. In a regular transfer, the validator receives a double-spending tag and proof but cannot use those to identify the underlying input coin. Its payment value is encrypted. The BIS data-access matrix gives the system operator, such as a central bank, no routine access to retail identities or transaction fields. The validator gets the payee's pseudonym by default, but neither party's legal identity nor the amount. Payer and payee banks retain the data needed to process their sides of the payment.

Coin fragmentation creates pressure to relax that arrangement. A shop receiving many small coins may want to combine them. The optional batch transaction removes the arithmetic-circuit proof for the merge and reveals the input coins to the validator. The BIS report's Annex D says the validator can then link those coins to the transactions that created them, one backward hop. Prior regular transfers still hide their inputs. Under the report's stated assumptions, the validator cannot follow that lineage further or learn the holders' legal identities from the batch alone. The report calls batching faster but does not give a measured batch time or speedup.

The qualification is institutional. The batch claim assumes a trusted validator that does not collude with other parties. The report says its separation of data reduces overlap available for collusion, including between a merchant and the validator. It does not turn that assumption into a field test against every joint-data attack. Privacy against a validator acting alone is a narrower promise than privacy against parties pooling records.

Legal anonymity is also absent by design. Banks onboard customers and retain identity information. The BIS account of pseudonyms and auditability says an issuing bank can resolve a user's identity for authorised investigation. The data-access matrix gives a compliance authority no direct ledger access by default. It does not eliminate legally mediated access through the bank. In effect, Aurum moves the identity key to regulated intermediaries and limits routine exposure across the rail.

Hong Kong has not chosen this retail rail

The BIS project page calls Aurum an exploratory proof of concept, not a production stack. The Hong Kong Monetary Authority's e-HKD Phase 2 report prioritises wholesale use. It says retail extension depends on market demand, technology and a compelling case, while policy, legal and technical groundwork continues. The HKMA's later annual-report account still describes retail e-HKD as a potential future extension. Existing e-HKD pilot activity and wholesale digital-money use do not establish Aurum as a chosen consumer architecture.

Privacy concerns surfaced among participants in one selected HKMA pilot. The HKMA report says about 35% of respondents in a tokenised-asset-settlement pilot survey were less likely to use e-HKD for routine payments because of concern over central-bank access to personal and transaction data. It does not establish the survey's sample or question wording in that passage. The figure should not be read as a Hong Kong population estimate.

For a policymaker, the immediate choice is more precise than whether digital cash is private. It is whether the regular path's stronger transaction separation is worth its processing and device costs, and whether a faster consolidation path should expose a limited transaction link to a validator. The next evidence is a full payment clock and a live governance model for that validator. Aurum supplies neither yet.