Technological innovations enable digital privacy, but pose fundamental conflicts between freedom and control. We study the design of privacy-enhanced payment systems, valued for legitimate transactions but vulnerable to illicit financial activities. We distinguish two dimensions of privacy: identity privacy, the masking of beneficiary owners of accounts, and transaction privacy, confidentiality in activity. Identity-private systems are suboptimal, enabling illicit operations to scale by distributing activity across...