Three Things We Learned About What Banks Need to Build Successful Blockchains

Earlier this year, we co-authored the first privacy report from the Enterprise Ethereum Alliance, written with its Privacy Working Group. The EEA is the standards body that helps banks, asset managers, and enterprises adopt Ethereum. The report, State of Privacy on Ethereum for Enterprise, brought together 26 experts across 11 organizations, among them Consensys, EY, Kaleido, ZKsync, and the Ethereum Foundation. 

Four people from our team contributed to the report.

The privacy report's purpose was direct: give the people who are bringing tokenized assets onchain, the CIOs, compliance officers, and digital asset leads, a clear map of the privacy options they can actually put into production today.

One evidence rubric was applied to every contributor, scoring seven privacy approaches against the same bar.

We contributed Polygon CDK to that map. Here are three things writing it taught us.

1. For institutions, privacy is a precondition for coming onchain

The largest bond and derivatives markets in the world are still waiting to come onchain, and the blocker isn't speed or cost. 

It's that a public blockchain shows everyone everything: transaction amounts, counterparties, positions, and the strategy behind them. 

Banks will not move a $100 trillion bond market onto infrastructure where competitors can watch every trade settle. Add the regulatory layer, and full transparency turns from an asset into a liability.

We learned that no single approach covers every privacy requirement, which is also built into our approach with Polygon CDK, a composable design space for institutions to deploy privacy as needed, along a spectrum. 

Transaction amounts, counterparty identity, business logic, and regulatory access each call for different techniques. The institutions reading this report match the right method to the use case in front of them, which is exactly why a vast array of open choices is more important than rigid design constraints and ecosystem lock-in. 

2. Institutions want privacy AND access to vast onchain liquidity

The most useful thing the report surfaced about our own design is that we made two choices which play well with institutional finance.

The first is configurability. Institutional requirements move. A trading venue might launch fairly open, then tighten as a regulator weighs in. 

So we built privacy into Polygon CDK as a spectrum rather than a switch. An institution can start with a more open chain and progressively tighten it to a fully private configuration as compliance demands change, with no migration and no replatforming. The report captured this as our defining characteristic: configurable privacy. Katana runs the same stack openly in production, while T-REX Ledger, with $100B committed by Apex Group, sits at the private end with FHE-based cryptography via Zama.

The second is connectivity. Most enterprise privacy designs make a chain private by cutting it off from wider crypto liquidity; tapping into existing global onchain liquidity then requires third-party bridges that introduce new surface areas of failure and attack. 

We built Polygon CDK so a private chain stays connected. Every CDK chain reaches global liquidity through Agglayer, settling cross-chain transfers with zero-knowledge proofs instead of third-party bridges. 

Private, publicly verifiable on Ethereum, and connected to onchain liquidity from day one: holding all three at once is the position we care about.

3. Where data lives is part of privacy

Privacy isn't only about who can read data. 

For a regulated institution, it's also about which jurisdiction data physically sits in and who has the right to control or remove records, as hard requirements. These are regulatory requirements that can work awkwardly against a permanent, public, global ledger.

With Polygon CDK, an institution's transaction data never needs to leave its own environment. This is the private validium architecture we shipped in May: the data stays in a node the institution runs in its own cloud or on-prem, and only a cryptographic fingerprint of each batch is posted to Ethereum. Validity proofs come from Succinct's SP1 Hypercube, the same proving system generating proofs in production on Katana today.

Think of it as a sealed envelope: the institution keeps the contents, and posts only a tamper-proof seal that Ethereum can verify without ever opening it. The institution decides where the data lives.

What's next

Institutions are preparing to bring trillions in assets onchain, and they won't move without confidentiality they can verify. 

We're excited to be part of building the shared privacy ecosystem where they can weigh their options.

Read the full EEA Privacy Working Group report: State of Privacy on Ethereum for Enterprise.

Get early access to the Open Money Stack and start building your institutional-grade blockchain today.