Technological innovations enable digital privacy, but pose fundamental conflicts between freedom and control. We study the design of privacy-enhanced payment systems, valued for legitimate transactions but vulnerable to illicit financial activities. We distinguish two dimensions of privacy: identity privacy, the masking of beneficiary owners of accounts, and transaction privacy, confidentiality in activity. Identity-private systems are suboptimal, enabling illicit operations to scale by distributing activity across multiple accounts. The optimal system involves provision of transaction privacy is complex and tailored to payoff frontiers of illicit actors but adopts a simple design when considering robustness to innovations in techniques of illicit actors. Our framework generates a ranking of payment systems; public blockchains, despite abuse of identity-privacy, can dominate legacy systems under strong enforcement capabilities. However, when enforcement capabilities are too strong, the dominance switches in favor of legacy systems as public blockchains fail to provide meaningful privacy to users.