Ripple released XRP Ledger version 3.3.0 on August 6, 2026, introducing the Confidential MPT amendment (XLS-0096) — the ledger’s first implementation of zero-knowledge privacy for tokenized assets. The feature encrypts balances and transfer amounts while keeping account addresses visible, creating a design fundamentally different from privacy coins currently on the market.
Key innovation: Confidentiality is controlled by the token issuer rather than the user. The token creator decides at issuance whether balances will be encrypted, and that decision applies uniformly to all holders. Individual users cannot enable or disable privacy themselves.
The XLS-0096 amendment replaces plaintext Multi-Purpose Token balances with EC-ElGamal ciphertexts. When tokens are transferred, the amount is encrypted on-chain, while the sender’s and recipient’s balances are updated as encrypted values that cannot be read by third parties.
Validators do not need to decrypt the data to verify that a transaction is valid. The protocol uses a multi-layer zero-knowledge proof system:
Critically, the sender and recipient account addresses remain public. The type of token being transferred remains public. The fact that a transaction occurred also remains public. Only the amount transferred and the resulting balances are hidden.
Architectural distinction: For analytics firms and regulators, this is a meaningful difference — they can see that Account A transferred tokens to Account B, but they cannot see how much. Transaction graphs remain fully observable.
Comparisons with privacy coins are inevitable, but the architecture differs fundamentally in ways that matter to both regulators and users.
| Platform | Privacy Model | Control | Address Visibility |
|---|---|---|---|
| Monero | Mandatory by default | Cannot be disabled | Hidden |
| Zcash | Optional through zk-SNARKs | User chooses | Can be hidden |
| XRPL Confidential MPT | Issuer-controlled | Issuer decides at issuance | Always visible |
XRPL occupies a third category: privacy is neither mandatory nor user-selectable — it is controlled by the issuer. The privacy model is therefore determined by the entity with compliance obligations rather than by the individual user’s privacy preferences.
These amendments are not being built for a hypothetical future. XRP Ledger already hosts approximately $1.38 billion in tokenized real-world assets. Excluding RLUSD’s contribution of $845.7 million, more than $530 million in other tokenized assets are already on the ledger today.
These are not experimental deployments. Their presence on XRP Ledger represents real capital with real compliance requirements.
The transparency problem: When a single fund holds $200 million in tokenized Treasuries, every subscription, redemption and portfolio rebalance can be visible to competitors, front-runners and the public. Confidential MPT gives issuers the option to encrypt those movements while retaining the ability to share decrypted data with authorized auditors.
Version 1 of the amendment supports only direct MPT payments between accounts. DEX trades, escrow arrangements and payment channels are excluded from the initial scope. This means confidentiality currently applies to bilateral transfers rather than on-chain trading.
Before the code reached mainnet, a $550,000 Sherlock security contest identified 96 vulnerabilities across five amendments, including two critical flaws:
Both critical vulnerabilities were fixed before release. The contest demonstrated a mature security approach from Ripple, with extensive testing before production deployment.
Confidential MPT is one of five amendments in the release, representing one of the largest single protocol expansions in XRPL history:
Together, these amendments significantly expand XRPL functionality for institutional use, creating a broader platform for enterprise applications.
For activation, the amendment requires at least 80% support from trusted validators, maintained continuously for two weeks. This means the code is live in the software but is not yet enforced across the network.
Activation process: The amendment voting counter can be monitored on xrpl.org once the two-week window begins. Support must remain sustained — if it drops below 80% at any point, the timer resets.
The amendment is opt-in at the issuer level. An issuer creating a new MPT can choose whether token balances and transfers should be confidential. Issuers that opt in retain the ability to designate authorized parties — such as auditors, regulators or compliance officers — that can decrypt and verify the underlying amounts.
Freeze and clawback controls — the same mechanisms issuers already use for standard MPTs — remain fully functional.
The strongest argument against the importance of Confidential MPT is adoption. The feature is optional at the issuer level, and issuers face no penalty for ignoring it.
For sophisticated analytics firms, amount-hidden but graph-visible transactions can still reveal substantial information through:
A competitor monitoring an issuer’s on-chain activity may still be able to estimate approximate activity levels simply from the number and timing of transactions.
The success of Confidential MPT will depend on several critical factors over the coming months.
MiCA enforcement guidance: The European Banking Authority’s interpretation of whether issuer-gated encrypted transaction amounts satisfy Travel Rule obligations may determine whether European issuers can use Confidential MPT at all.
Critical question: If the EBA determines that the Travel Rule requires transaction amounts to remain visible for compliance purposes, European institutional issuers may be forced to avoid confidential tokens, geographically limiting adoption.
The introduction of Confidential MPT has different implications for different groups within the XRP Ledger ecosystem.
Large issuers of tokenized assets gain a tool for protecting competitively sensitive information. Strategic movements, portfolio rebalancing and large transactions no longer need to be visible to competitors in real time.
However, issuers must balance that benefit against compliance requirements and the additional operational complexity involved in managing encrypted balances.
Retail users do not receive direct control over privacy — the decision is made by the token issuer. Users can instead choose between tokens with confidential or transparent balances depending on their preferences.
On-chain analytics firms will need to adapt their tools to work with amount-hidden transactions. Traditional volume-based metrics may become less reliable, requiring new analytical methodologies.
Regulators receive a new type of supervisory data: visible transaction patterns without visible amounts. This may require new approaches to monitoring and enforcement.
Developers planning to integrate Confidential MPT need to understand the technical requirements of the implementation.
Sending clients must generate zero-knowledge proofs for each confidential transaction, which requires:
Wallets must support:
Developer consideration: The computational overhead of proof generation may be significant on mobile devices, potentially requiring optimization or server-assisted proof generation for resource-constrained clients.
Confidential MPT represents a distinct approach within the broader landscape of blockchain privacy technologies.
Unlike privacy coins focused on individual anonymity, Confidential MPT targets institutional requirements:
Other platforms use different approaches to on-chain privacy:
Each approach involves different trade-offs between privacy, compliance, performance and usability.
Introducing zero-knowledge proofs inevitably affects network performance.
Each confidential transaction requires:
Bulletproofs were chosen partly because of their relatively compact size compared with some other proof systems, but they still introduce additional overhead.
XRPL already has relatively high baseline throughput, so the additional overhead from confidential transactions may be manageable. However, widespread adoption could eventually require further optimization.
Scaling consideration: If a substantial share of transactions becomes confidential, cumulative overhead could eventually require adjustments to network parameters in order to maintain performance.
Confidential MPT represents a strategic move for Ripple within its broader institutional adoption strategy.
The feature strengthens XRPL’s positioning as an enterprise-grade platform for tokenized assets:
Confidential MPT complements other institutional features across the XRPL ecosystem:
Together, these features create a broader platform for institutional blockchain adoption.
The current implementation of Confidential MPT is likely only the first stage. Future enhancements may significantly expand its functionality.
Potential future additions include:
Potential optimizations include:
Development roadmap: Ripple is likely to iterate on Confidential MPT based on real-world usage and feedback from institutional adopters, expanding functionality while improving performance.
Confidential MPT exists within a complex regulatory environment that may ultimately determine its level of adoption.
The FATF Travel Rule requires virtual asset service providers to transmit information about transaction originators and beneficiaries above certain thresholds. A key question is whether issuer-gated encrypted transaction amounts satisfy these obligations.
If regulators require transaction amounts to remain directly visible for compliance purposes, this could significantly reduce the usefulness of Confidential MPT for regulated institutions.
Although account addresses remain visible, hidden transaction amounts may:
Different jurisdictions may adopt different approaches:
Confidential MPT represents a sophisticated approach to blockchain privacy that attempts to balance the competing interests of different stakeholders. Instead of choosing between complete transparency and complete anonymity, XRPL introduces a third option: institutionally controlled confidentiality.
Key characteristics of the model include:
For institutional issuers, this addresses a real problem: protecting competitively sensitive information while still meeting compliance obligations. For regulators, it offers a compromise in which transaction monitoring remains possible, although with important limitations.
Strategic significance: The success of Confidential MPT will not be measured simply by the number of encrypted transactions, but by whether it can attract institutional capital that would otherwise avoid public blockchains because of confidentiality concerns. If Ondo, Archax and other major issuers adopt the feature, it would signal that XRPL has addressed an important barrier to enterprise adoption.
However, challenges remain. Adoption is not guaranteed — issuers may prefer full transparency because it is operationally simpler. Regulatory clarity remains limited, and different jurisdictions may impose conflicting requirements. Technical overhead may also limit usability for certain applications.
For the broader crypto ecosystem, Confidential MPT represents an important experiment in institutional privacy. Its success or failure will provide valuable lessons for other platforms attempting to balance privacy with compliance. In a world where institutional adoption is increasingly important to mainstream blockchain adoption, such balanced approaches may prove essential.
Ultimately, Confidential MPT reflects the maturation of the blockchain industry — a shift from ideological purity toward practical solutions that address the real-world requirements of different stakeholders. It is not about maximizing privacy at any cost, but about creating tools that make blockchain technology viable for regulated industries and institutional capital.
The coming months will show whether this approach becomes a blueprint for institutional blockchain privacy or remains a niche feature. Regardless of the outcome, it represents a thoughtful attempt to solve one of the most difficult problems in blockchain adoption: how to preserve the benefits of public-ledger transparency without sacrificing the legitimate confidentiality needs of serious market participants.
“Privacy is not about hiding bad things, but about protecting legitimate interests. In an institutional context, that means protecting competitive intelligence and strategic information while remaining compliant with regulatory requirements.”
— David Chaum, cryptographer and pioneer of digital privacy
