The implementation must permit anonymity of buyers and sellers.
Independent transactions by a seller or a buyer must not be able
to be linked.
This may be the crux of the disagreement. The first sentence says the
system must "permit" anonymity of buyers and sellers, while the second
adds that independent transactions "must not be able to be linked."
In Mondex, each card or terminal records the last several
transactions. (Terminals may store a different number than cards.)
My recollection is that cards store between 10 and 20 transactions.
(Let's call it 10.) Each card/terminal has an ID, and that's recorded
along with the transaction info by the other party.
As Neal points out, you can use your card, then do 10 innocent
transactions to clear out the record in your card. That doesn't clear
out the record of the other party! If you buy groceries using your
Mondex card, then trade $5 + epsilon back and forth with various cards
10 times, then buy a magazine, the merchants can tell that the same
card was used for both transactions, even though the police wouldn't
be able to tell anymore *from your card* that you bought the
There's a kind of anonymity that mondex permits, but it allows third
parties to link independent transactions of a single buyer or seller.
There's nothing you can do to ensure that the other party has lost
their ability to link your independant transactions.