Auditing Confidential Payments with Zama’s fhEVM
Confidential tokens give businesses privacy. Complyr lets them prove compliance without giving that privacy up.
Confidential tokens have solved one of blockchain’s biggest problems. Businesses can finally move money on chain without exposing sensitive financial information to competitors, customers, or the public.
But privacy introduces a new challenge.
If no one can see what a business paid, no one can verify that it followed its own financial rules either.
You can see this play out with something as simple as a startup. They start using confidential payments so competitors can’t track their burn rate, and it works great until an investor asks them to prove they stayed within budget. Suddenly there’s no good way to answer. If they decrypt everything to prove it, they’ve just undone the privacy they built in the first place. And if they simply ask to be trusted instead, that defeats the purpose of being on a blockchain to begin with, where trust isn’t supposed to be something you have to ask for.
This is the problem Complyr was built to solve.
Instead of forcing businesses to choose between privacy and accountability, Complyr allows auditors to verify compliance on encrypted payments without ever decrypting the underlying financial data.
How Complyr Solves It
The problem isn’t that businesses that use confidential payments can’t be audited.
It’s that confidential payments can’t be audited using the traditional process.
A traditional audit happens after the payment. The business prepares its records, hands them to an auditor, and the auditor verifies them.
That model stops working once the records themselves are encrypted.
Instead of moving confidential payments back off chain for inspection, Complyr moves the audit on chain. The audit runs where the payment happens, allowing the transaction to remain confidential while still being verified.
When a business makes a confidential payment on Complyr, it doesn’t just transfer funds. The transaction also carries the encrypted information needed to evaluate that payment against the auditor’s rules.
As soon as the payment is recorded, the audit runs automatically on the encrypted data. There is no separate reporting step and nothing for the business to upload later.
The payment and the audit become a single process.
Trustless by design
This architectural decision solves another problem that exists even outside blockchain.
Traditional audits depend on businesses reporting what they paid. Even when everyone acts honestly, the auditor is still relying on records prepared by the business itself.
Complyr removes that dependency entirely.
The audit is embedded directly into the confidential token transfer. The payment amount comes from the token contract itself, not from information the business submits afterward. Every configured audit check runs automatically as part of that transfer.
The business cannot decide which payments get audited.
It cannot forget to report a transaction.
It cannot submit different numbers later.
If a payment exists on chain, it has already been evaluated.
That makes the audit process trustless from the moment the payment is made.
How FHE Makes This Possible
The audit works because Fully Homomorphic Encryption allows computation on encrypted values.
Imagine an auditor wants to know whether any payment exceeded a spending limit.
Normally, both the payment amount and the limit would have to be decrypted before they could be compared.
Complyr never does that. Both the payment and the auditor’s threshold remain encrypted while the smart contract compares them directly. The result is a new encrypted value representing whether the payment exceeded the limit.
At this stage, nobody knows the answer. Not the smart contract. Not the business. Not the auditor.
Only after the comparison is complete does the Zama KMS decrypt the final result, revealing whether the rule was triggered while keeping the payment amount and threshold private.
The rest of Complyr builds on this same principle.
Budget checks compare encrypted payments against encrypted thresholds.
Category spending compares encrypted running totals against encrypted limits.
Recipient concentration checks compare encrypted cumulative payments to a vendor against encrypted thresholds.
Authorization checks compare encrypted payment requirements against encrypted approval levels.
Every audit procedure is simply another encrypted computation.
Designed for Real Auditors
Complyr wasn’t designed around a blockchain workflow. It was designed around how audit firms already work.
An audit is more than checking whether a payment exceeded a limit. Different members of an audit team perform different responsibilities and require different levels of visibility.
Complyr reflects this through tiered auditor roles.
An analytics auditor can review spending trends and investigate which rules were triggered without seeing every individual payment. A full auditor can decrypt the additional information required for a detailed investigation when their role requires it.
Real audits also extend beyond the blockchain. Auditors often need to verify invoices, purchase orders, or other supporting documents before reaching a conclusion.
To bridge that gap, every payment includes immutable hashes of its supporting documents. During an audit, the original documents can be compared against those hashes to prove they have not been modified since the payment was recorded.
Rather than replacing existing audit practices, Complyr extends them into confidential on chain finance.
Try It Yourself
The demo consists of two workspaces.
Business Workspace
Create a business, add an auditor, and make confidential payments. Payment amounts and business information are encrypted in the browser before being submitted on chain.
Auditor Workspace
Configure audit rules, review audit results, and decrypt only the information your assigned role allows you to access.
Live Demo
GitHub
What’s Next
Multi auditor engagements
The contracts already support a Signal auditor tier designed for larger audit teams.
This allows junior auditors to monitor audit results without receiving decryption rights, while senior auditors retain responsibility for configuring audit rules and performing detailed investigations.
The current client focuses on a single auditor workflow, but the underlying architecture already supports more collaborative engagements.
Expanding the audit library
The current implementation focuses on demonstrating that confidential auditing is possible.
Version 3 will introduce additional encrypted audit procedures without changing the architecture. As long as a rule can be expressed as an operation on encrypted data, it can become part of the audit process.
Final Thoughts
Complyr started as an exploration of a simple question: how do you audit a payment that no one can see?
Building it led us to an architecture that combines confidential payments with confidential auditing, allowing businesses to preserve privacy without giving up accountability.
This project was built and submitted as part of the Zama Builder’s Program (Builder Track). We hope it contributes to the growing ecosystem of applications being built on the fhEVM.