Zama's Privacy Token Reaches Revolut's 70 Million Users, Two Years Before The EU Rulebook

Zama said on Monday that its token is now buyable inside the Revolut app. The company’s own words: “Today, $ZAMA is available directly in the Revolut app, making it easier than ever to access the technology powering confidential onchain finance.” On X the next morning it put a number on the audience and added a plan: a Learn and Earn campaign “inside @Revolut later this year”, and “$ZAMA is now live for Revolut’s 70 million users.”

Revolut has published nothing: no newsroom post, and no named executive speaking on any official channel. One side of this partnership is announcing it.

What Zama built

Fully homomorphic encryption lets a computer do arithmetic on encrypted data without ever unlocking it. The idea dates to 1978; the first working version came from IBM’s Craig Gentry in 2009, at a speed Zama describes as “roughly a trillion times slower than normal computation”.

Zama, founded in 2020 by Rand Hindi and Pascal Paillier, has spent six years making it fast enough to use. Paillier’s name is on one of the schemes the field is built from, and Nigel Smart is Chief Academic Officer: a heavy bench of cryptographers for a token project.

The output is the Zama Protocol, which the company describes as “not a new L1 or L2, but rather a cross-chain confidentiality layer sitting on top of existing chains”. Contracts on Ethereum hand out pointers, off-chain coprocessors do the encrypted maths, and a 13-node network holds the decryption keys. Zama raised $73m in March 2024 and $57m in June 2025 at more than $1bn.

Throughput has gone “from 0.2 transactions per second to over 20 transactions per second on CPU”, with graphics cards due by the end of 2026 for “an expected 500-1000 TPS per chain”. A single confidential transfer costs between $0.008 and $0.80.

What the token actually is

$ZAMA is an ERC-20 on Ethereum, issued by ZAMA Switzerland AG of Zug, registered on 11 April 2025 and distinct from the research business. It pays protocol fees and is staked by the operators running the network. The white paper is blunt about what it is not: “The Token does not represent nor confer any ownership, equity interest, participation, corporate governance rights… nor any entitlement to business revenues, profit sharing.”

Total supply is 11 billion and the issuer holds 30 per cent. About a fifth was circulating at the February launch, and the rest becomes tradable over four years, with team and venture allocations of 20 per cent each behind multi-year lockups.

The feature that carries this story is a choice: “Users can choose between ERC-20 fungible token standard or ERC-7984 confidential fungible token standard, both on Ethereum.” Confidentiality is a mode the holder switches on, not the default.

Why does an optional privacy setting attract a regulator?

Because the EU wrote its definition to cover exactly that. The Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, defines the term at Article 2(25).

“‘anonymity-enhancing coins’ means crypto-assets that have built-in features designed to make crypto-asset transfer information anonymous, either systematically or optionally.”

Regulation (EU) 2024/1624, Article 2(25)

Article 79(1) then prohibits credit institutions, financial institutions and crypto-asset service providers from keeping “anonymous crypto-asset accounts as well as any account otherwise allowing for the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins”. It applies from 10 July 2027.

Whether $ZAMA falls inside that definition is a question for lawyers and supervisors, and Zama’s own documents nowhere address the term. What can be said is that the regulation’s wording and the token’s technical disclosure describe the same feature, and that the regulation anticipated the optional case specifically.

The lighter version of the rule is already live. MiCA’s Article 76(3) requires trading platforms to keep out assets with “an inbuilt anonymisation function” unless holders and their transaction history “can be identified”. The precedent is on record too: Kraken pulled Monero for European customers in October 2024, saying it had “no choice but to delist Monero (XMR) in the European Economic Area (EEA) due to regulatory changes”.

Zama’s answer is to push compliance down to the application: “the protocol itself has no say on who can access which encrypted value. Developers decide.” That is a coherent engineering position. It is not obviously the position the AML rulebook takes, which puts the duty on the firm holding the account.

Revolut is the one carrying the licence

Revolut passed 70 million customers in its 2025 annual report, made $2.3bn of profit before tax on $6.0bn of revenue, and has 13 million UK customers. Revolut Bank UK Ltd has been authorised since July 2024 and left mobilisation in March 2026. It is a real bank now, with a real regulator, listing a token whose selling point is that transactions can be made unreadable.

None of that is unlawful today. From July 2027 the firm holding the account is the one the rule binds.

The distribution is the achievement, the deadline is the risk

Getting a cryptography research token in front of 70 million retail banking customers is a real piece of distribution, and Zama has better science behind it than most things reaching that shelf.

The date to keep is 10 July 2027. Between now and then, either supervisors decide an opt-in confidential mode is not what Article 2(25) meant, or a bank with 70 million customers has a decision to make about a token it never announced.