The Capital Markets and Technology Association (CMTA) has released CMTAT Confidential, a new implementation of its open security token framework that brings on-chain privacy to tokenized financial instruments and stablecoins without compromising regulatory compliance.

Built on the Zama Protocol, using Fully Homomorphic Encryption (FHE), together with OpenZeppelin's Confidential Contracts library, CMTAT Confidential encrypts token balances and transfer amounts on-chain, addressing one of the most important barriers to institutional adoption of public blockchains in capital markets.

Addressing a Critical Gap for Institutional Tokenization

As financial institutions recognize tokenized securities and stablecoins as central to the future of digital financial markets, the need for transaction privacy has become increasingly important.

The CMTAT standard addresses compliance challenges through whitelisting and governance controls. CMTAT Confidential completes the picture by solving the privacy challenge.

A standard designed for financial instruments

CMTAT is an open smart contract framework developed collaboratively by banks, lawyers, custodians and technologists defining everything a security token needs, including various compliance features. The specifications are blockchain agnostic with implementations available for different blockchain ecosystems, available under open-source licenses that give financial institutions the flexibility to build compliant, customized tokenization solutions without proprietary lock-in.

Maintained by the not-for-profit association CMTA, CMTAT was built for real tokenization workloads across the capital markets spectrum. CMTAT Confidential reflects how, as a living open standard, CMTAT continues to evolve as institutional requirements and regulatory frameworks develop.

Building Confidentiality on top of CMTAT

CMTAT Confidential extends the existing modular CMTAT architecture with confidentiality powered by the Zama Protocol. It builds on OpenZeppelin's Confidential Contracts library while reusing the existing Solidity implementation of CMTAT's compliance modules.

All token balances and transfer amounts are encrypted using FHE — a cryptographic technique that enables computation directly on encrypted data without ever decrypting it. The Zama Protocol combines FHE with Multi-Party Computation (MPC) for threshold decryption and Zero-Knowledge Proofs of Knowledge (ZKPoKs) for input validation.

Key features of CMTAT Confidential include:

• Confidential Balances: All balances are encrypted and only authorized parties can decrypt
• Confidential Transfers: Transfer amounts are submitted as encrypted inputs with Zero-Knowledge Proofs of Knowledge (ZKPoKs)
• Compliance Controls: Pause, freeze, and forced transfer capabilities for compliance
• Role-Based Access Control: Granular permissions for minting, burning, pausing, and enforcement
• Document Management: Attach terms, documents, and metadata to tokens
• ERC-7984 Standard: Based on OpenZeppelin's implementation of ERC-7984 confidential tokens

CMTAT Confidential follows the same modular architecture as the standard CMTAT, meaning issuers can adopt confidentiality selectively with only the modules that require privacy carrying the cryptographic overhead. The rest of the lifecycle (mint, burn, freeze, pause) works identically.

Built Collaboratively

The code was developed by Taurus based on the OpenZeppelin library, reviewed by CMTA's Technical Committee and with contributions from Zama, and submitted to CMTA members for consultation.

A formal security audit was conducted by OpenZeppelin and the Nethermind AuditAgent tool was used in preparation for the audit.

In a proof of concept, Seturion (Boerse Stuttgart Group), through its subsidiary BX Digital, designed and validated confidential Delivery-versus-Payment (DvP) settlement architectures for tokenized assets using CMTAT on EVM test blockchains. The architecture leverages the Zama Protocol to enable confidential on-chain settlement using tGBP (by BCP Technologies) while preserving regulatory oversight.

Significance for Capital Markets

The release of CMTAT Confidential represents a meaningful step forward for the use of public blockchains in regulated finance. By combining compliance controls with cryptographically enforced transaction privacy, CMTA is providing the infrastructure that financial institutions need to issue and manage tokenized securities and stablecoins on public blockchain networks.

CMTA remains committed to developing open, standards-based infrastructure for the tokenized economy to ensure that digital transformation in capital markets proceeds on a foundation of legal certainty, technical rigour, and shared industry standards.

CMTAT Confidential is publicly available in CMTA's GitHub repository: https://github.com/CMTA/CMTAT-Confidential

Links:

Github repository: https://github.com/CMTA/CMTAT-Confidential/ 

OpenZeppelin Audit report blog: https://www.openzeppelin.com/news/cmtat-confidential-audit 

Seturion POC:

• Mode A Cash Confidential DvP: ERC20 asset on the seller side vs. confidential asset on the buyer side
• Mode B Fully Confidential DvP: Confidential asset on the seller side vs. confidential asset on the buyer side

CMTAT Confidential Specifications in PDF: