The amount of capital that will be unlocked in the next couple of years on stuff like this is mind-blowing, actually.
There's a lot to be done. One thing you mentioned, obviously, is privacy, right? In the early days, when we started crypto — you and I, I think, pretty much at the same time — there was a big narrative about money laundering, we're not able to see transactions, yada yada yada. Ironically, I think we could both argue that there's too much transparency in digital assets, and that's one of the reasons when you built Canton, you put privacy at the core of it.
Do you believe that there's still a lack of focus on privacy in digital assets, and that without privacy, we're not going to see digital assets grow? I always give the analogy of HTTP and HTTPS and encryption, or even if I do a SWIFT transfer now, nobody sees where it's going outside of the bank. How do you see that pendulum of privacy, and do you believe that where we're going to end up is different than where it is now?
I think that if the internet didn't have privacy, it wouldn't be where it is today. I think that crypto started from a world where it was all about how to prevent any censorship, and as a result of that, the default architecture was that data needs to be replicated everywhere. So, the transaction that happens on any public blockchain, with the exception of Canton, automatically gets replicated across the entire chain. Now that people woke up and realized, well, we need to solve for privacy, people are effectively at this crossroads where they're saying, I either accept the architecture of public chains and now I need to figure out how do I put the kibosh on all the data — ZK encryption, hardware — but it still doesn't negate the fact that the data has been replicated everywhere.
I give this example a lot of times, Henry. In the US, when you look at HIPAA, the privacy regulation around medical data, one of the things that it says is that if I took Henry, your medical data, and I have encrypted it with the best encryption in the world — let's just accept that — but I send it to someone else encrypted, I have violated your HIPAA rights. And the reason is because the assumption is that one day that could be broken. And as a result of that, when that happens, all of your sensitive data exists somewhere else. And therefore, you can't send someone's personal data. I think the same problem exists in a lot of those networks that have been designed to fully replicate. Bad things do happen. We took that approach from very early on to say, well, why do I need to replicate my data everywhere? I have my data. Everyone who is a stakeholder to a transaction with me has my data. I don't really need to replicate my data everywhere. So, we took a different approach. We will see what approach wins long term. I don't have a crystal ball. I do, though, think that without privacy, this will not take the adoption that we want it to take.
It's very interesting. What you mentioned — the debate has shifted. When we have this talk with even law enforcement or regulators, they're so focused on transparency and transaction monitoring and so on and so forth. But for a lot of these financial institutions, they have the opposite problem, right? The restrictions on privacy are mind-blowing. It's interesting your views on ZK and zero-knowledge proofs. Do you believe that ZK, the whole concept of zero-knowledge proof, is going to succeed? Do you think it has a use case, or just conceptually, for what you mentioned already — that the data is already out, its shelf life is limited?
So, Henry, you are part of an investment company, right? You have a fund?
Okay. Do you see yourself being able to accept a new LP with just a mathematical proof? You don't see their passport, you don't know who they are. You just take their money. They send you the money with stablecoins, and all you get is a ZK proof saying this person is okay.
As long as regulators allow it, though, as a regulated entity, and there's a way of verifying that process and procedure.
Anytime soon? Do you see that happening anytime soon?
I don't think it's going to happen anytime soon.
Yeah. Just to get so many people collectively comfortable with KYC rules — these changes take decades, and I think it's going to take them some time to be comfortable with the concept of zero-knowledge proof.
I think that the problem here is that when the liability falls on you, it doesn't fall on the encryption, it falls on you.
Right? Meaning, if that person ended up being on the OFAC list, right, and a bad person, right, you're not going to be able to say to the regulator, 'But the ZK told me that's okay.' Right? Nobody would care. Everybody would just say you just took money from a sanctioned entity, and now you're in trouble. I think that challenge goes into a lot of examples where even if it has nothing to do with regulation, it's just that you bear the negative outcome if there's an issue with the tech.
I'll give you another example. If you do secured loans, right, you saw that there was recently this bug — this Orchid bug — where you could print assets out of thin air. Now, imagine that you give secured loans and someone provides you the collateral via ZK. So, you don't really see the collateral is there until the day that you might actually have to call on it. So, then at a given point of time, technically speaking, if there was a bug, the collateral could not be there. Would you be comfortable underwriting these loans?
Yeah, that's the issue people are going to have, of course.
But that has nothing to do with regulation. That just has to do with who bears the risk if there's an issue with the technology. And there's always an issue with technology. Just to be clear, Canton is not — I'm not making a statement that Canton cannot have issues. My point is, our view is that if you are a party to a transaction, you want to see the inputs to that transaction which you are now taking a potential outcome on. And by the way, even people in ZK are now talking about partial disclosures. Meaning, if you have a stake in the transaction, they will actually reveal some of the information for you. And if they kind of land in that world where if you are part of the transaction, we will reveal some of the information for you, my question is, why are you using ZK?
The idea of ZK was zero knowledge. Nobody gets to see the inputs. You just see the proof, and you just get comfortable with it.
In Canton, of course, when transactions happen within a Canton, and our users can go read about it, transactions are private to that Canton, for example. Do you foresee a model where, with the user's consent, his data will be shared more broadly? I guess especially for cross-cantonal transactions. I don't know if that's the right term, by the way, but the...
Yeah, I understand. The answer is absolutely yes, as long as the user has explicitly signed up for it. That's the...
That's the really nice thing is that in Canton, you could actually broadcast an individual's personal information, but you would actually have cryptographic evidence that the user has agreed for that to happen.
Yeah. Yeah. And that's the way it's probably going to work. As users are consenting and it's moving forward, then potentially there's a way of doing it. One last question as well for you: with the use of LLMs and AI now, how do you see privacy evolve and the use of Canton in an agentic payment and agentic world?
So, I think that for me, it's not necessarily about privacy or what. I think that the most important thing is — and you know, before you went all in on this industry, you worked at a big consulting firm that worked with a lot of the clients that we work with. And you know that even today, with all of the volume that we do, there's a lot of breaks, right?
I remember when the US moved to T+1, a lot of the banks said, 'If we move to T+0, our back office, middle office will just break. We would not be able to handle the time for settlement with the amount of breaks that are happening.' So, there's still a lot of breaks. Inherently, in what people say around agents is that the number of transactions is going to grow exponentially. And therefore, you must have a back-end system that is deterministic, meaning I know that if I'm going to create a transaction, I have 100% certainty that it will go through. Otherwise, this thing doesn't happen. This is, by the way, why people are so excited about stablecoins and agents — because I know that if I can send a stablecoin, that stablecoin will get to its destination. But that's just true to any type of on-chain asset. The value of blockchain is that I know for certainty that if I'm allowed to perform a transaction on a blockchain, that transaction will actually be completed, right? I think that has a lot of value.
So, things will be very, very interesting how these things will develop over the next couple of years. What is the biggest risk we're facing, you think, as an industry? You mentioned now, obviously, you're getting a lot of the DTCC, a lot of social players. What is the biggest single risk we're facing of this vision that we all have not being materialized?
A lot of times when I talk to investors, they ask me a very similar question. They ask something in a slightly different form. They ask, 'So, who's your biggest competitor?'
