12 February 2020

ECB/BOJ joint research project on distributed ledger technologies

Balancing confidentiality and auditability
in a distributed ledger environment
Motivation of Stella phase 4
There has been a growing interest in developing settlement assets, such as stablecoins, central bankdigital currency (CBDC) or other types of digital assets, which could be used on platforms based on
distributed ledger technologies (DLT). Transactions on DLT networks arguably raise questions on privacy
since participating entities own nodes and share transaction information amongst themselves. So-called
privacy-enhancing technologies/techniques (PETs) have emerged to address these questions, focusing
for example on limiting access to information by third parties. At the same time, there need to bearrangements, including third parties which can check transactions (“auditor[s]”), in place on DLT-based
payment and settlement systems to ensure accountability.

Challenges arise when the auditor checks transactions that are made confidential using PETs. Stellaphase 4 therefore analyses how confidentiality and auditability could be balanced in a distributed ledger
environment. Through conceptual studies and practical experimentation, it explores how PETs wouldensure confidentiality, as well as the arrangements that accommodate the auditing of transactions in DLTbased financial market infrastructures (FMI).

Main results of Stella phase 4
Stella phase 4 outlines the fundamental features for ensuring the confidentiality of transactions, andassesses whether auditing could be done effectively even when confidentiality is ensured. The results
can be used as a starting point for choosing PETs and designing auditing processes for transactions.

Three categories of PETs
PETs can be divided into three categories based on the underlying concepts for making transaction
information confidential towards third parties (Figure A).
Segregating PETs ensure that each participant can only view a subset of all transactions
conducted in the network.

Hiding PETs make use of cryptographic techniques to prevent third parties from interpretingtransaction details.

Unlinking PETs make it difficult for third parties to determine transacting relationships from thesender/receiver information recorded on the ledger.

Figure A – Three categories of PETs

Segregating PETs
Ledger subset€100

Entity A(Sender)abTransaction

Entity B(Receiver)

Entity C(Third party)

Hiding PETs

Unlinking PETs

LedgerLedger€100?

Entity A(Sender)?

?

Transaction

Entity B(Receiver)

Entity A(Sender)

Entity C(Third party)abTransaction

Entity B(Receiver)

Entity C(Third party)

Three perspectives for auditability
Stella phase 4 proposes three key perspectives for assessing the auditability of each PET setup (FigureB).
Accessibility to the necessary information: whether the auditor can obtain with certainty theinformation it needs to conduct auditing activities.

Reliability of the obtained information: whether the auditor can interpret confidential transaction
information with certainty using the obtained information.

Efficiency of the auditing process: whether the auditing process could be conducted in amanner efficient enough for it to be feasible.
Page 2 of 3

Figure B – Concepts of auditing processes and three perspectives

Accessibility
Source ofnecessary information
Trustworthy
central source

Auditor

ParticipantsorNecessary
information
Confidential
transaction
information€100abTransaction

Efficiency

Reliability

Effective auditing can be achieved when the auditor receives necessary information from participants insuch a way that the three perspectives above are accommodated. The existence of trustworthy central
sources of information in auditing processes would be beneficial for effective auditing, since it would
ensure all three perspectives at the same time without requiring cooperation from the participants.
However, despite its contribution to effective auditing, the presence of such sources could present single
point of failure risks for the network.

Background on Project Stella
Since its inception in December 2016, Project Stella, a joint research project of the European Central
Bank (ECB) and the Bank of Japan (BOJ), has contributed to the ongoing debate via experimental workand conceptual studies exploring the opportunities and challenges of DLT for FMI.1 This work has
resulted in three previous reports. Phase 1, published in September 20172, analysed the processing oflarge-value payments using DLT; phase 2, published in March 20183, investigated securities delivery
versus payment in a DLT environment; and phase 3, published in June 20194, considered whether crossborder payments could potentially be improved, especially in terms of safety, by using DLT-relatedtechnologies.

1The analysis and experimental results presented in Project Stella are not geared towards replacing or complementing existingarrangements, which include central bank-operated payment systems. Moreover, legal and regulatory aspects are outside thescope of the project.

2

Payment systems: liquidity saving mechanisms in a distributed ledger environment, ECB and BOJ, September 2017.

3

Securities settlement systems: delivery-versus-payment in a distributed ledger environment, ECB and BOJ, March 2018.

4

Synchronised cross-border payments, ECB and BOJ, June 2019.

Page 3 of 3