diff --git a/Cargo.lock b/Cargo.lock
index 8d8ad59395..5fe2a0568a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -285,7 +285,7 @@ dependencies = [
  "nom",
  "num-traits",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "time",
 ]
 
@@ -858,7 +858,7 @@ dependencies = [
  "mime",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -1187,7 +1187,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09dc0086e469182132244e9b8d313a0742e1132da43a08c24b9dd3c18e0faf3a"
 dependencies = [
  "serde",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -4147,7 +4147,7 @@ dependencies = [
  "rand 0.9.1",
  "ring 0.17.14",
  "socket2 0.5.10",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tinyvec",
  "tokio",
  "tracing",
@@ -4175,7 +4175,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls 0.23.28",
  "rustls-platform-verifier",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tinyvec",
  "tokio",
  "tokio-rustls 0.26.2",
@@ -4199,7 +4199,7 @@ dependencies = [
  "rand 0.9.1",
  "resolv-conf",
  "smallvec 1.15.1",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
 ]
@@ -4221,7 +4221,7 @@ dependencies = [
  "resolv-conf",
  "rustls 0.23.28",
  "smallvec 1.15.1",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-rustls 0.26.2",
  "tracing",
@@ -5545,7 +5545,7 @@ dependencies = [
  "multiaddr 0.18.1",
  "pin-project 1.1.10",
  "rw-stream-sink",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -5577,7 +5577,7 @@ dependencies = [
  "quick-protobuf-codec 0.3.1 (git+https://github.com/tari-project/rust-libp2p.git?rev=debc01257dd979418d7793f2dc91d25471de5c38)",
  "rand 0.8.5",
  "rand_core 0.6.4",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "web-time",
 ]
@@ -5610,7 +5610,7 @@ dependencies = [
  "quick-protobuf",
  "rand 0.8.5",
  "rw-stream-sink",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "unsigned-varint 0.8.0",
  "web-time",
@@ -5632,7 +5632,7 @@ dependencies = [
  "lru",
  "quick-protobuf",
  "quick-protobuf-codec 0.3.1 (git+https://github.com/tari-project/rust-libp2p.git?rev=debc01257dd979418d7793f2dc91d25471de5c38)",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "web-time",
 ]
@@ -5697,7 +5697,7 @@ dependencies = [
  "quick-protobuf",
  "quick-protobuf-codec 0.3.1 (git+https://github.com/tari-project/rust-libp2p.git?rev=debc01257dd979418d7793f2dc91d25471de5c38)",
  "smallvec 1.15.1",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
 ]
 
@@ -5715,7 +5715,7 @@ dependencies = [
  "serde",
  "sha2",
  "tari_crypto",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "zeroize",
 ]
@@ -5786,7 +5786,7 @@ dependencies = [
  "rand 0.8.5",
  "snow",
  "static_assertions",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "x25519-dalek",
  "zeroize",
@@ -5816,7 +5816,7 @@ dependencies = [
  "prometheus-client",
  "quick-protobuf",
  "quick-protobuf-codec 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tracing",
 ]
 
@@ -5851,7 +5851,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls 0.23.28",
  "socket2 0.5.10",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
 ]
@@ -5874,7 +5874,7 @@ dependencies = [
  "quick-protobuf-codec 0.3.1 (git+https://github.com/tari-project/rust-libp2p.git?rev=debc01257dd979418d7793f2dc91d25471de5c38)",
  "rand 0.8.5",
  "static_assertions",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "web-time",
 ]
@@ -5896,7 +5896,7 @@ dependencies = [
  "quick-protobuf",
  "quick-protobuf-codec 0.3.1 (git+https://github.com/tari-project/rust-libp2p.git?rev=debc01257dd979418d7793f2dc91d25471de5c38)",
  "rand 0.8.5",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "web-time",
 ]
@@ -5986,7 +5986,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls 0.23.28",
  "rustls-webpki 0.103.3",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "x509-parser 0.17.0",
  "yasna",
 ]
@@ -6013,7 +6013,7 @@ dependencies = [
  "either",
  "futures 0.3.31",
  "libp2p-core",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tracing",
  "yamux 0.12.1",
  "yamux 0.13.5",
@@ -6236,7 +6236,7 @@ checksum = "656b3b27f8893f7bbf9485148ff9a65f019e3f33bd5cdc87c83cab16b3fd9ec8"
 dependencies = [
  "libc",
  "neli",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "windows-sys 0.59.0",
 ]
 
@@ -6353,7 +6353,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb4bdc8b0ce69932332cf76d24af69c3a155242af95c226b2ab6c2e371ed1149"
 dependencies = [
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "zerocopy",
  "zerocopy-derive",
 ]
@@ -7146,7 +7146,7 @@ dependencies = [
  "log",
  "netlink-packet-core",
  "netlink-sys",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -7844,7 +7844,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
 dependencies = [
  "memchr",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "ucd-trie",
 ]
 
@@ -8259,7 +8259,7 @@ dependencies = [
  "memchr",
  "parking_lot",
  "protobuf",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -8574,7 +8574,7 @@ dependencies = [
  "asynchronous-codec",
  "bytes 1.10.1",
  "quick-protobuf",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "unsigned-varint 0.8.0",
 ]
 
@@ -8602,7 +8602,7 @@ dependencies = [
  "rustc-hash 2.1.1",
  "rustls 0.23.28",
  "socket2 0.5.10",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "web-time",
@@ -8623,7 +8623,7 @@ dependencies = [
  "rustls 0.23.28",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "tinyvec",
  "tracing",
  "web-time",
@@ -10093,7 +10093,7 @@ checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "time",
 ]
 
@@ -10721,7 +10721,7 @@ dependencies = [
  "tari_template_lib",
  "tari_transaction_components",
  "tari_utilities",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tonic 0.13.1",
  "ts-rs",
  "url",
@@ -10951,7 +10951,7 @@ dependencies = [
  "tari_state_tree",
  "tari_template_lib_types",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -11081,7 +11081,7 @@ dependencies = [
  "tari_transaction_manifest",
  "tari_utilities",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "wasmer",
  "wasmer-middlewares",
 ]
@@ -11109,7 +11109,7 @@ dependencies = [
  "tari_hashing",
  "tari_template_abi",
  "tari_template_lib",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "ts-rs",
 ]
 
@@ -11130,7 +11130,7 @@ dependencies = [
  "tari_shutdown",
  "tari_sidechain",
  "tari_template_lib_types",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "url",
 ]
@@ -11155,7 +11155,7 @@ dependencies = [
  "tari_template_lib",
  "tari_transaction_components",
  "tari_utilities",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "url",
 ]
@@ -11232,7 +11232,7 @@ dependencies = [
  "tari_template_manager",
  "tari_transaction",
  "tari_validator_node_rpc",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "tokio",
  "tower-http",
@@ -11265,7 +11265,7 @@ dependencies = [
  "tari_template_abi",
  "tari_template_lib_types",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "ts-rs",
  "utoipa",
@@ -11281,7 +11281,7 @@ dependencies = [
  "tari_epoch_manager",
  "tari_ootle_common_types",
  "tari_validator_node_rpc",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11295,7 +11295,7 @@ dependencies = [
  "serde",
  "tari_crypto",
  "tari_hashing",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11360,7 +11360,7 @@ dependencies = [
  "tari_rpc_framework",
  "tari_shutdown",
  "tari_swarm",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -11396,7 +11396,7 @@ dependencies = [
  "tari_engine_types",
  "tari_ootle_common_types",
  "tari_template_lib_types",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "ts-rs",
 ]
 
@@ -11433,7 +11433,7 @@ dependencies = [
  "tari_template_manager",
  "tari_transaction",
  "tari_transaction_components",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "toml 0.9.6",
  "url",
@@ -11463,7 +11463,7 @@ dependencies = [
  "tari_mmr",
  "tari_template_lib",
  "tari_template_lib_types",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "ts-rs",
 ]
 
@@ -11509,7 +11509,7 @@ dependencies = [
  "tari_state_tree",
  "tari_template_lib",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "ts-rs",
 ]
@@ -11531,7 +11531,7 @@ dependencies = [
  "tari_ootle_storage",
  "tari_template_lib",
  "tari_utilities",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11556,7 +11556,7 @@ dependencies = [
  "tari_transaction_manifest",
  "tari_utilities",
  "tari_wallet_daemon_client",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "tokio",
  "url",
@@ -11573,6 +11573,7 @@ dependencies = [
  "crc32fast",
  "digest",
  "rand 0.8.5",
+ "serde",
  "serde_json",
  "subtle",
  "tari_crypto",
@@ -11580,9 +11581,9 @@ dependencies = [
  "tari_hashing",
  "tari_ootle_common_types",
  "tari_template_lib",
- "tari_template_test_tooling",
  "tari_utilities",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
+ "ts-rs",
  "zeroize",
 ]
 
@@ -11613,7 +11614,7 @@ dependencies = [
  "tari_transaction",
  "tari_transaction_components",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "ts-rs",
  "webauthn-rs",
@@ -11640,7 +11641,7 @@ dependencies = [
  "tari_template_builtin",
  "tari_template_lib",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "url",
 ]
@@ -11715,7 +11716,7 @@ dependencies = [
  "tari_utilities",
  "tari_wallet_daemon_client",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tower-http",
  "url",
@@ -11771,7 +11772,7 @@ dependencies = [
  "proto_builder",
  "tari_metrics",
  "tari_shutdown",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-util 0.7.16",
  "tower 0.5.2",
@@ -11804,7 +11805,7 @@ dependencies = [
  "tari_state_tree",
  "tari_template_manager",
  "tari_validator_node_rpc",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11876,7 +11877,7 @@ dependencies = [
  "tari_hashing",
  "tari_jellyfish",
  "tari_utilities",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11899,7 +11900,7 @@ dependencies = [
  "tari_ootle_common_types",
  "tari_shutdown",
  "tari_utilities",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tower-http",
  "webrtc",
@@ -11928,7 +11929,7 @@ dependencies = [
  "tari_template_lib_types",
  "tari_transaction",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11943,7 +11944,7 @@ dependencies = [
  "tari_jellyfish",
  "tari_ootle_common_types",
  "tari_template_lib",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -11965,7 +11966,7 @@ dependencies = [
  "libp2p",
  "libp2p-messaging",
  "libp2p-substream",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -12006,7 +12007,7 @@ dependencies = [
  "tari_transaction_components",
  "tari_validator_node_client",
  "tari_wallet_daemon_client",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "toml 0.9.6",
  "tonic 0.13.1",
@@ -12103,7 +12104,7 @@ dependencies = [
  "tari_template_builtin",
  "tari_template_lib",
  "tari_validator_node_rpc",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
 ]
@@ -12126,7 +12127,7 @@ dependencies = [
  "tari_template_lib",
  "tari_transaction",
  "tari_transaction_manifest",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -12158,7 +12159,7 @@ dependencies = [
  "tari_engine_types",
  "tari_ootle_common_types",
  "tari_template_lib",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "ts-rs",
 ]
 
@@ -12241,7 +12242,7 @@ dependencies = [
  "tari_template_builtin",
  "tari_template_lib",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
@@ -12319,7 +12320,7 @@ dependencies = [
  "tari_transaction_components",
  "tari_validator_node_client",
  "tari_validator_node_rpc",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
  "tower-http",
  "url",
@@ -12348,7 +12349,7 @@ dependencies = [
  "tari_transaction",
  "tari_transaction_manifest",
  "tari_validator_node_client",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "tokio",
 ]
@@ -12372,7 +12373,7 @@ dependencies = [
  "tari_template_abi",
  "tari_template_lib_types",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "ts-rs",
 ]
 
@@ -12394,7 +12395,7 @@ dependencies = [
  "tari_rpc_framework",
  "tari_rpc_macros",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "tokio",
 ]
 
@@ -12412,7 +12413,7 @@ dependencies = [
  "tari_template_abi",
  "tari_template_lib",
  "tari_transaction",
- "thiserror 1.0.69",
+ "thiserror 2.0.17",
  "time",
  "ts-rs",
  "webauthn-rs-proto",
@@ -12533,11 +12534,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.17",
 ]
 
 [[package]]
@@ -12553,9 +12554,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -13159,7 +13160,7 @@ checksum = "6ef1b7a6d914a34127ed8e1fa927eb7088903787bcded4fa3eef8f85ee1568be"
 dependencies = [
  "chrono",
  "indexmap 2.11.4",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "ts-rs-macros",
 ]
 
@@ -13201,7 +13202,7 @@ dependencies = [
  "log",
  "rand 0.9.1",
  "sha1 0.10.6",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "utf-8",
 ]
 
@@ -14880,7 +14881,7 @@ dependencies = [
  "nom",
  "oid-registry 0.8.1",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.17",
  "time",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index c708c054ff..6adb3aabf1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -236,7 +236,7 @@ smallvec = "2.0.0-alpha.11"
 std-semaphore = "0.1.0"
 syn = "2.0"
 tempfile = "3.3.0"
-thiserror = "1.0.59"
+thiserror = "2.0.17"
 time = "0.3.15"
 tokio = { version = "1.47.1", default-features = false }
 tokio-stream = "0.1.17"
diff --git a/applications/tari_swarm_daemon/src/process_manager/processes/minotari_wallet.rs b/applications/tari_swarm_daemon/src/process_manager/processes/minotari_wallet.rs
index 2b85a1f3b4..4cdbbac1f1 100644
--- a/applications/tari_swarm_daemon/src/process_manager/processes/minotari_wallet.rs
+++ b/applications/tari_swarm_daemon/src/process_manager/processes/minotari_wallet.rs
@@ -8,15 +8,10 @@ use minotari_node_grpc_client::grpc;
 use minotari_wallet_grpc_client::WalletGrpcClient;
 use serde::Serialize;
 use tari_crypto::tari_utilities::ByteArray;
-use tari_engine_types::{
-    confidential::{AbridgedTransactionKernel, EncodedMerkleProof, MinotariBurnClaimProof},
-    template_lib_models::EncryptedData,
-};
-use tari_template_lib_types::crypto::{
-    PedersenCommitmentBytes,
-    RistrettoPublicKeyBytes,
-    Scalar32Bytes,
-    SchnorrSignatureBytes,
+use tari_engine_types::confidential::{AbridgedTransactionKernel, EncodedMerkleProof, MinotariBurnClaimProof};
+use tari_template_lib_types::{
+    crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, Scalar32Bytes, SchnorrSignatureBytes},
+    EncryptedData,
 };
 use tari_transaction_components::transaction_components::{memo_field::TxType, MemoField};
 use tari_wallet_daemon_client::types::ClaimBurnProof;
diff --git a/applications/tari_wallet_cli/src/command/transaction.rs b/applications/tari_wallet_cli/src/command/transaction.rs
index e35f74590a..c759017167 100644
--- a/applications/tari_wallet_cli/src/command/transaction.rs
+++ b/applications/tari_wallet_cli/src/command/transaction.rs
@@ -41,7 +41,7 @@ use tari_engine_types::{
 };
 use tari_ootle_address::OotleAddress;
 use tari_ootle_common_types::{Epoch, SubstateAddress, SubstateRequirement};
-use tari_ootle_wallet_sdk::apis::confidential_transfer::ConfidentialTransferInputSelection;
+use tari_ootle_wallet_sdk::{apis::confidential_transfer::ConfidentialTransferInputSelection, crypto::memo::Memo};
 use tari_template_lib::{
     constants::STEALTH_TARI_RESOURCE_ADDRESS,
     models::{BucketId, NonFungibleAddress, NonFungibleId},
@@ -153,6 +153,9 @@ pub struct ConfidentialTransferArgs {
     /// The address of the resource to send. If not provided, use the default Tari confidential resource
     #[clap(long)]
     resource_address: Option<ResourceAddress>,
+    /// An optional memo to include in the confidential output
+    #[clap(long, short = 'm')]
+    memo_message: Option<String>,
 }
 
 #[derive(Debug, Subcommand, Clone)]
@@ -416,6 +419,7 @@ pub async fn handle_confidential_transfer(
         amount,
         destination_address,
         common,
+        memo_message,
     } = args;
 
     // let AccountByNameResponse { account, .. } = client.accounts_get_by_name(&source_account_name).await?;
@@ -429,6 +433,9 @@ pub async fn handle_confidential_transfer(
             max_fee: common.max_fee,
             output_to_revealed: false,
             proof_from_badge_resource: None,
+            memo: memo_message
+                .map(|s| Memo::new_message(s).ok_or_else(|| anyhow!("Invalid memo length")))
+                .transpose()?,
             dry_run: false,
         })
         .await?;
diff --git a/applications/tari_walletd/src/handlers/accounts.rs b/applications/tari_walletd/src/handlers/accounts.rs
index e36ab8bbef..7baf2348fe 100644
--- a/applications/tari_walletd/src/handlers/accounts.rs
+++ b/applications/tari_walletd/src/handlers/accounts.rs
@@ -17,6 +17,7 @@ use tari_engine_types::{
 };
 use tari_ootle_common_types::{optional::Optional, SubstateRequirement};
 use tari_ootle_wallet_crypto::{
+    memo::Memo,
     UnblindedOutputStatement,
     UnblindedStealthInputStatement,
     UnblindedStealthOutputStatement,
@@ -455,17 +456,18 @@ pub async fn handle_claim_burn(
         .burn_public_key
         .try_from_byte_type()
         .map_err(|e| invalid_params("claim_proof.reciprocal_claim_public_key", Some(e)))?;
-    let mask_and_value = sdk.stealth_crypto_api().decrypt_value_and_mask(
+    let decrypted = sdk.stealth_crypto_api().decrypt_value_and_mask(
         &claimed_encrypted_data,
         &claim_proof.commitment,
         claim_nonce_keypair.secret_key(),
         &reciprocal_claim_public_key_expanded,
+        true,
     )?;
 
     let mask = sdk.key_manager_api().next_key(KeyBranch::StealthMask)?;
 
-    let final_amount = mask_and_value
-        .value
+    let final_amount = decrypted
+        .value()
         .checked_sub_positive(max_fee.into())
         .ok_or_else(|| invalid_params("max_fee", Some("more fees paid than claimed amount")))?;
 
@@ -487,12 +489,17 @@ pub async fn handle_claim_burn(
     let account_owner_public_key = account_owner.to_public_key();
     let view_only = sdk.key_manager_api().get_view_only_key(account.view_only_key_id())?;
     let view_only_public_key = view_only.to_public_key();
+    let memo = Memo::new_message("Claimed burned XTR from L1").expect("valid memo");
     // NOTE: the confidential encryption format and the bullet proofs currently do not support amounts larger than
     // u64::MAX. Apart from it being insane/basically impossible to have that much XTR in a single UTXO, the L1 emission
     // will reach this much in many thousands of years.
-    let encrypted_data =
-        sdk.stealth_crypto_api()
-            .encrypt_value_and_mask(final_amount_u64, &mask.key, &view_only_public_key, &nonce)?;
+    let encrypted_data = sdk.stealth_crypto_api().encrypt_value_and_mask(
+        final_amount_u64,
+        &mask.key,
+        &view_only_public_key,
+        &nonce,
+        Some(&memo),
+    )?;
 
     let tag = sdk.stealth_crypto_api().derive_stealth_output_tag(
         network,
@@ -521,7 +528,7 @@ pub async fn handle_claim_burn(
 
     // Generate the correct secret to spend the claimed output
     let input = UnblindedStealthInputStatement {
-        mask_and_value,
+        mask_and_value: decrypted.into_mask_and_value(),
         owner_secret: claim_nonce_keypair.secret_key().clone(),
         public_nonce: reciprocal_claim_public_key_expanded,
     };
@@ -904,6 +911,7 @@ pub async fn handle_confidential_transfer(
                 max_fee: req.max_fee.unwrap_or(DEFAULT_FEE),
                 output_to_revealed: req.output_to_revealed,
                 proof_from_resource: req.proof_from_badge_resource,
+                memo: req.memo,
                 is_dry_run: req.dry_run,
             })
             .await?;
@@ -946,6 +954,7 @@ pub async fn handle_stealth_transfer(
         max_fee: req.max_fee,
         blinded_output_amount: req.blinded_output_amount,
         revealed_output_amount: req.revealed_output_amount,
+        output_memo: req.output_memo,
         is_dry_run: req.dry_run,
     };
     if let Err(err) = params.validate(network) {
diff --git a/applications/tari_walletd/src/handlers/confidential.rs b/applications/tari_walletd/src/handlers/confidential.rs
index 7b8c250866..057589b793 100644
--- a/applications/tari_walletd/src/handlers/confidential.rs
+++ b/applications/tari_walletd/src/handlers/confidential.rs
@@ -102,6 +102,7 @@ pub async fn handle_create_transfer_proof(
         &output_mask.key,
         &public_nonce,
         &account_key.secret,
+        req.memo.as_ref(),
     )?;
 
     let resource = sdk.substate_api().fetch_resource(req.resource_address).await?;
@@ -150,6 +151,7 @@ pub async fn handle_create_transfer_proof(
             &change_mask.key,
             &public_nonce,
             &change_mask.key,
+            None,
         )?;
 
         sdk.confidential_outputs_api().add_output(ConfidentialOutputModel {
@@ -163,6 +165,7 @@ pub async fn handle_create_transfer_proof(
             view_only_key_id: account.view_only_key_id(),
             owner_key_id: account.owner_key_id(),
             encrypted_data: encrypted_data.clone(),
+            memo: None,
             public_asset_tag: None,
             status: OutputStatus::LockedUnconfirmed,
             lock_id: Some(lock_id),
@@ -246,6 +249,8 @@ pub async fn handle_create_output_proof(
         &output_mask.key,
         &public_nonce,
         &output_mask.key,
+        // TODO: Support memos
+        None,
     )?;
 
     let statement = UnblindedOutputStatement {
diff --git a/applications/tari_walletd/src/handlers/stealth_utxos.rs b/applications/tari_walletd/src/handlers/stealth_utxos.rs
index 4236a6873f..1d5c683772 100644
--- a/applications/tari_walletd/src/handlers/stealth_utxos.rs
+++ b/applications/tari_walletd/src/handlers/stealth_utxos.rs
@@ -46,6 +46,7 @@ pub async fn handle_list(
                 address: o.to_utxo_address(),
                 value: o.value,
                 status: o.status,
+                memo: o.memo,
                 is_burnt: o.is_burnt,
                 is_frozen: o.is_frozen,
                 is_on_chain: o.is_on_chain,
diff --git a/applications/tari_walletd/web_ui/src/components/Memo.tsx b/applications/tari_walletd/web_ui/src/components/Memo.tsx
new file mode 100644
index 0000000000..836c7c9707
--- /dev/null
+++ b/applications/tari_walletd/web_ui/src/components/Memo.tsx
@@ -0,0 +1,22 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+import { Memo } from "@tari-project/typescript-bindings";
+
+export type MemoProps = {
+  memo?: Memo | null;
+};
+
+export function Memo({ memo }: MemoProps) {
+  if (!memo) {
+    return <span>--</span>;
+  }
+
+  if ("Message" in memo) {
+    return <span>{memo ? memo.Message : "No Memo"}</span>;
+  }
+  if ("Bytes" in memo) {
+    return <span>{memo ? Buffer.from(memo.Bytes).toString("hex") : "No Memo"}</span>;
+  }
+
+  return <span>{JSON.stringify(memo)}</span>;
+}
diff --git a/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/components/SendMoney.tsx b/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/components/SendMoney.tsx
index fe2edacc9c..d19f088f17 100644
--- a/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/components/SendMoney.tsx
+++ b/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/components/SendMoney.tsx
@@ -190,6 +190,7 @@ export function SendMoneyDialog(props: SendMoneyDialogProps) {
         output_to_revealed: !transferFormState.outputToConfidential,
         input_selection: transferFormState.inputSelection as ConfidentialTransferInputSelection,
         badge: transferFormState.badge,
+        output_memo: transferFormState.memo ? { Message: transferFormState.memo } : undefined,
       };
 
       const result = await sendIt?.({ ...currentTransfer, dry_run: true, max_fee: 3000 });
@@ -253,6 +254,7 @@ export function SendMoneyDialog(props: SendMoneyDialogProps) {
         output_to_revealed: !transferFormState.outputToConfidential,
         input_selection: transferFormState.inputSelection as ConfidentialTransferInputSelection,
         badge: transferFormState.badge,
+        output_memo: transferFormState.memo ? { Message: transferFormState.memo } : undefined,
       };
 
       await sendIt?.({
diff --git a/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/steps/FormStep.tsx b/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/steps/FormStep.tsx
index 1a91894f95..16a6914d04 100644
--- a/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/steps/FormStep.tsx
+++ b/applications/tari_walletd/web_ui/src/routes/AssetVault/Tokens/steps/FormStep.tsx
@@ -41,6 +41,7 @@ export interface SendMoneyFormState {
   amount: string;
   fee: string;
   badge: string | null;
+  memo: string;
 }
 
 interface FormStepProps {
@@ -174,6 +175,17 @@ export default function FormStep({
               }
               label="Send Confidential Outputs"
             />
+            {transferFormState.outputToConfidential ? (
+              <TextField
+                name="memo"
+                label="Memo message (optional, max 253 characters)"
+                inputProps={{ maxLength: 253 }}
+                value={transferFormState.memo}
+                onChange={onFormValueChange}
+                style={{ flexGrow: 1 }}
+                disabled={disabled}
+              />
+            ) : null}
             <InputLabel id="select-input-selection">Input Selection</InputLabel>
             <Select
               name="inputSelection"
diff --git a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
index fbfaa4ffb2..d329c33e9c 100644
--- a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
+++ b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
@@ -31,6 +31,7 @@ import PlaceHolder from "./components/PlaceHolder";
 import SortableHeader from "./components/SortableHeader";
 import useCurrencyStore from "@store/currencyStore";
 import { useParams } from "react-router-dom";
+import { Memo } from "@components/Memo";
 
 function StealthUtxoList({ account }: { account: Account }) {
   const [page, setPage] = useState(0);
@@ -63,12 +64,13 @@ function StealthUtxoList({ account }: { account: Account }) {
   );
 
   const columnWidths = {
-    1: "30%",
-    2: "20%",
+    1: "10%",
+    2: "15%",
     3: "20%",
-    4: "10%",
+    4: "25%",
     5: "10%",
     6: "10%",
+    7: "10%",
   };
 
   return (
@@ -88,9 +90,10 @@ function StealthUtxoList({ account }: { account: Account }) {
                     getDisplayName={getStatusDisplayName}
                   />
                 </TableCell>
-                <TableCell width={columnWidths[4]}>Burnt</TableCell>
-                <TableCell width={columnWidths[5]}>Frozen</TableCell>
-                <TableCell width={columnWidths[6]}>On Chain</TableCell>
+                <TableCell width={columnWidths[4]}>Memo</TableCell>
+                <TableCell width={columnWidths[5]}>Burnt</TableCell>
+                <TableCell width={columnWidths[6]}>Frozen</TableCell>
+                <TableCell width={columnWidths[7]}>On Chain</TableCell>
               </TableRow>
             </TableHead>
             <TableBody>
@@ -108,6 +111,9 @@ function StealthUtxoList({ account }: { account: Account }) {
                       <DataTableCell>
                         <StatusChip status={utxo.status} />
                       </DataTableCell>
+                      <DataTableCell>
+                        <Memo memo={utxo.memo} />
+                      </DataTableCell>
                       <DataTableCell>{utxo.is_burnt ? "Yes" : "No"}</DataTableCell>
                       <DataTableCell>{utxo.is_frozen ? "Yes" : "No"}</DataTableCell>
                       <DataTableCell>{utxo.is_on_chain ? "Yes" : "No"}</DataTableCell>
diff --git a/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts b/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
index 92b3763e8b..12e3bc9b7e 100644
--- a/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
+++ b/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
@@ -46,6 +46,7 @@ import {
   ComponentAddressOrName,
   ConfidentialTransferInputSelection,
   decodeOotleAddress,
+  Memo,
   OutputStatus,
   ResourceAddress,
   ResourceType,
@@ -125,6 +126,7 @@ export interface TransferParams {
   input_selection: ConfidentialTransferInputSelection;
   badge: string | null;
   dry_run: boolean;
+  output_memo?: Memo;
 }
 
 export const useAccountsTransfer = () => {
@@ -143,6 +145,7 @@ export const useAccountsTransfer = () => {
           proof_from_badge_resource: params.badge,
           input_selection: params.input_selection,
           output_to_revealed: params.output_to_revealed,
+          output_memo: params.output_memo || null,
           dry_run: params.dry_run,
         };
         return accountsConfidentialTransfer(transferRequest);
@@ -155,6 +158,7 @@ export const useAccountsTransfer = () => {
           max_fee,
           blinded_output_amount: params.output_to_revealed ? 0 : params.amount,
           revealed_output_amount: params.output_to_revealed ? params.amount : 0,
+          output_memo: params.output_memo || null,
           dry_run: params.dry_run,
         };
         return accountsStealthTransfer(transferRequest);
diff --git a/bindings/src/index.ts b/bindings/src/index.ts
index bda8aae6ba..484e7eb15f 100644
--- a/bindings/src/index.ts
+++ b/bindings/src/index.ts
@@ -63,6 +63,7 @@ export * from "./types/LeaderFee";
 export * from "./types/LockFlag";
 export * from "./types/LogEntry";
 export * from "./types/LogLevel";
+export * from "./types/Memo";
 export * from "./types/Metadata";
 export * from "./types/MinotariBurnClaimProof";
 export * from "./types/Network";
diff --git a/bindings/src/types/Memo.ts b/bindings/src/types/Memo.ts
new file mode 100644
index 0000000000..6aad4efb2c
--- /dev/null
+++ b/bindings/src/types/Memo.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Memo = { Message: string } | { Bytes: string };
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts b/bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts
index 13ff6e9180..93247461b9 100644
--- a/bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts
+++ b/bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts
@@ -1,6 +1,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Amount } from "../Amount";
 import type { ConfidentialTransferInputSelection } from "../ConfidentialTransferInputSelection";
+import type { Memo } from "../Memo";
 import type { OotleAddress } from "../OotleAddress";
 import type { ResourceAddress } from "../ResourceAddress";
 import type { ComponentAddressOrName } from "./ComponentAddressOrName";
@@ -14,5 +15,6 @@ export type ConfidentialTransferRequest = {
   max_fee: number | null;
   output_to_revealed: boolean;
   proof_from_badge_resource: ResourceAddress | null;
+  memo?: Memo | null;
   dry_run: boolean;
 };
diff --git a/bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts b/bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts
index 2a969cb5c1..9e73ffc0d0 100644
--- a/bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts
+++ b/bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts
@@ -1,5 +1,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Amount } from "../Amount";
+import type { Memo } from "../Memo";
 import type { ResourceAddress } from "../ResourceAddress";
 import type { RistrettoPublicKeyBytes } from "../RistrettoPublicKeyBytes";
 import type { ComponentAddressOrName } from "./ComponentAddressOrName";
@@ -10,4 +11,5 @@ export type ProofsGenerateRequest = {
   account: ComponentAddressOrName | null;
   resource_address: ResourceAddress;
   destination_public_key: RistrettoPublicKeyBytes;
+  memo?: Memo | null;
 };
diff --git a/bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts b/bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts
index 2915778631..12c7197436 100644
--- a/bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts
+++ b/bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts
@@ -1,6 +1,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Amount } from "../Amount";
 import type { ConfidentialTransferInputSelection } from "../ConfidentialTransferInputSelection";
+import type { Memo } from "../Memo";
 import type { OotleAddress } from "../OotleAddress";
 import type { ResourceAddress } from "../ResourceAddress";
 import type { ComponentAddressOrName } from "./ComponentAddressOrName";
@@ -13,5 +14,6 @@ export type StealthTransferRequest = {
   max_fee: number;
   blinded_output_amount: Amount;
   revealed_output_amount: Amount;
+  output_memo?: Memo | null;
   dry_run: boolean;
 };
diff --git a/bindings/src/types/wallet-daemon-client/UtxoInfo.ts b/bindings/src/types/wallet-daemon-client/UtxoInfo.ts
index f60d4cb936..3edb379b13 100644
--- a/bindings/src/types/wallet-daemon-client/UtxoInfo.ts
+++ b/bindings/src/types/wallet-daemon-client/UtxoInfo.ts
@@ -1,5 +1,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Amount } from "../Amount";
+import type { Memo } from "../Memo";
 import type { OutputStatus } from "../OutputStatus";
 import type { UtxoAddress } from "../UtxoAddress";
 
@@ -7,6 +8,7 @@ export type UtxoInfo = {
   address: UtxoAddress;
   value: Amount;
   status: OutputStatus;
+  memo: Memo | null;
   is_burnt: boolean;
   is_frozen: boolean;
   is_on_chain: boolean;
diff --git a/clients/wallet_daemon_client/src/types.rs b/clients/wallet_daemon_client/src/types.rs
index 371a30fc50..874fc3738c 100644
--- a/clients/wallet_daemon_client/src/types.rs
+++ b/clients/wallet_daemon_client/src/types.rs
@@ -40,6 +40,7 @@ use tari_ootle_common_types::{
 };
 use tari_ootle_wallet_sdk::{
     apis::{confidential_transfer::ConfidentialTransferInputSelection, key_manager::KeyBranch},
+    crypto::memo::Memo,
     models::{
         Account,
         AuthoredTemplateModel,
@@ -54,17 +55,9 @@ use tari_ootle_wallet_sdk::{
 };
 use tari_template_abi::{FunctionDef, TemplateDef};
 use tari_template_lib::{
-    models::{
-        ConfidentialOutputStatement,
-        EncryptedData,
-        NonFungibleId,
-        ResourceAddress,
-        UtxoAddress,
-        UtxoId,
-        VaultId,
-    },
+    models::{ConfidentialOutputStatement, NonFungibleId, ResourceAddress, UtxoAddress, UtxoId, VaultId},
     prelude::{ComponentAddress, ConfidentialWithdrawProof, ResourceType, RistrettoPublicKeyBytes},
-    types::{crypto::PedersenCommitmentBytes, Amount, TemplateAddress},
+    types::{crypto::PedersenCommitmentBytes, Amount, EncryptedData, TemplateAddress},
 };
 use tari_transaction::{Instruction, Transaction, TransactionId, UnsignedTransaction};
 use time::PrimitiveDateTime;
@@ -497,10 +490,10 @@ pub struct ProofsGenerateRequest {
     pub reveal_amount: Amount,
     #[serde(deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
-    // TODO: #[serde(deserialize_with = "string_or_struct")]
     pub resource_address: ResourceAddress,
-    // TODO: For now, we assume that this is obtained "somehow" from the destination account
     pub destination_public_key: RistrettoPublicKeyBytes,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memo: Option<Memo>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
@@ -554,6 +547,8 @@ pub struct ConfidentialTransferRequest {
     pub max_fee: Option<u64>,
     pub output_to_revealed: bool,
     pub proof_from_badge_resource: Option<ResourceAddress>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memo: Option<Memo>,
     pub dry_run: bool,
 }
 
@@ -1070,6 +1065,8 @@ pub struct StealthTransferRequest {
     pub max_fee: u64,
     pub blinded_output_amount: Amount,
     pub revealed_output_amount: Amount,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub output_memo: Option<Memo>,
     pub dry_run: bool,
 }
 
@@ -1110,6 +1107,7 @@ pub struct UtxoInfo {
     pub address: UtxoAddress,
     pub value: Amount,
     pub status: OutputStatus,
+    pub memo: Option<Memo>,
     pub is_burnt: bool,
     pub is_frozen: bool,
     pub is_on_chain: bool,
diff --git a/crates/engine_types/src/confidential/claim.rs b/crates/engine_types/src/confidential/claim.rs
index 5917c2092b..ffb10126b5 100644
--- a/crates/engine_types/src/confidential/claim.rs
+++ b/crates/engine_types/src/confidential/claim.rs
@@ -6,8 +6,8 @@ use std::{fmt, fmt::Display};
 use serde::{Deserialize, Serialize};
 use tari_common_types::types::FixedHash;
 use tari_template_lib::{
-    models::EncryptedData,
     prelude::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, SchnorrSignatureBytes},
+    types::EncryptedData,
 };
 
 use crate::serde_with;
diff --git a/crates/engine_types/src/crypto/output.rs b/crates/engine_types/src/crypto/output.rs
index 00ecf0f346..e476e8f869 100644
--- a/crates/engine_types/src/crypto/output.rs
+++ b/crates/engine_types/src/crypto/output.rs
@@ -4,7 +4,7 @@
 use borsh::BorshSerialize;
 use tari_bor::{Deserialize, Serialize};
 use tari_crypto::ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey};
-use tari_template_lib::{models::EncryptedData, prelude::RistrettoPublicKeyBytes};
+use tari_template_lib::types::{crypto::RistrettoPublicKeyBytes, EncryptedData};
 
 use crate::{
     crypto::{ElgamalVerifiableBalance, ElgamalVerifiableBalanceBytes},
diff --git a/crates/p2p/src/conversions/transaction.rs b/crates/p2p/src/conversions/transaction.rs
index 334590c2cf..89b8a305e8 100644
--- a/crates/p2p/src/conversions/transaction.rs
+++ b/crates/p2p/src/conversions/transaction.rs
@@ -37,7 +37,6 @@ use tari_template_lib::{
         ComponentAddress,
         ConfidentialOutputStatement,
         ConfidentialWithdrawProof,
-        EncryptedData,
         StealthInput,
         UnspentOutput,
         ViewableBalanceProof,
@@ -45,6 +44,7 @@ use tari_template_lib::{
     prelude::AccessRules,
     types::{
         crypto::{BalanceProofSignature, PedersenCommitmentBytes, RangeProofBytes, RistrettoPublicKeyBytes, UtxoTag},
+        EncryptedData,
         ObjectKey,
     },
 };
diff --git a/crates/template_abi/src/rust.rs b/crates/template_abi/src/rust.rs
index 6304b46e3a..a23a2f8c7a 100644
--- a/crates/template_abi/src/rust.rs
+++ b/crates/template_abi/src/rust.rs
@@ -48,7 +48,6 @@ mod rust_std {
         cmp,
         fmt,
         format,
-        io,
         iter,
         marker,
         mem,
diff --git a/crates/template_lib/src/models/mod.rs b/crates/template_lib/src/models/mod.rs
index 486d498607..a05a306a57 100644
--- a/crates/template_lib/src/models/mod.rs
+++ b/crates/template_lib/src/models/mod.rs
@@ -31,7 +31,6 @@ mod bucket;
 mod claimed_output_tombstone;
 mod component;
 mod confidential_proof;
-mod encrypted_data;
 #[macro_use]
 mod metadata;
 mod non_fungible;
@@ -52,7 +51,6 @@ pub use bucket::*;
 pub use claimed_output_tombstone::*;
 pub use component::*;
 pub use confidential_proof::*;
-pub use encrypted_data::*;
 pub use metadata::*;
 pub use non_fungible::*;
 pub use proof::*;
diff --git a/crates/template_lib/src/models/unspent_output.rs b/crates/template_lib/src/models/unspent_output.rs
index a284b6fa79..1ea5153c57 100644
--- a/crates/template_lib/src/models/unspent_output.rs
+++ b/crates/template_lib/src/models/unspent_output.rs
@@ -2,9 +2,12 @@
 //    SPDX-License-Identifier: BSD-3-Clause
 
 use tari_bor::{Deserialize, Serialize};
-use tari_template_lib_types::crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, UtxoTag};
+use tari_template_lib_types::{
+    crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, UtxoTag},
+    EncryptedData,
+};
 
-use crate::models::{EncryptedData, ViewableBalanceProof};
+use crate::models::ViewableBalanceProof;
 
 /// An unspent output that does not reveal the value and the owner of the coin it represents.
 ///
diff --git a/crates/template_lib/src/prelude.rs b/crates/template_lib/src/prelude.rs
index c1e917460c..baa8c12604 100644
--- a/crates/template_lib/src/prelude.rs
+++ b/crates/template_lib/src/prelude.rs
@@ -38,6 +38,8 @@ pub use tari_template_lib_types::{
         SignaturePayload,
     },
     custom_signature_domain,
+    MaxBytes,
+    MaxString,
     ResourceType,
     TemplateAddress,
 };
diff --git a/crates/template_lib/src/models/encrypted_data.rs b/crates/template_lib_types/src/encrypted_data.rs
similarity index 61%
rename from crates/template_lib/src/models/encrypted_data.rs
rename to crates/template_lib_types/src/encrypted_data.rs
index b791cc121e..03c486f223 100644
--- a/crates/template_lib/src/models/encrypted_data.rs
+++ b/crates/template_lib_types/src/encrypted_data.rs
@@ -1,33 +1,34 @@
-//    Copyright 2025 The Tari Project
-//    SPDX-License-Identifier: BSD-3-Clause
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
 
-use tari_bor::{Deserialize, Serialize};
-use tari_template_lib_types::serde_helpers;
+use serde::{Deserialize, Serialize};
+
+use crate::max_bytes::MaxBytes;
+
+const MAX_SIZE: usize = EncryptedData::ENCRYPTED_DATA_SIZE_WITHOUT_MEMO + EncryptedData::MAX_MEMO_SIZE;
 
 /// Used by the receiver to determine the value and mask of the commitment. Used in stealth and confidential transfers,
 /// as well as Minotari burns
-#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
-pub struct EncryptedData(
-    #[serde(with = "serde_helpers::dynamic_hex")]
-    #[cfg_attr(feature = "ts", ts(type = "string"))]
-    Box<[u8]>,
-);
+pub struct EncryptedData(#[cfg_attr(feature = "ts", ts(type = "string"))] MaxBytes<MAX_SIZE>);
 
 impl EncryptedData {
-    pub const ENCRYPTED_DATA_SIZE_TOTAL: usize = Self::SIZE_NONCE + Self::SIZE_VALUE + Self::SIZE_MASK + Self::SIZE_TAG;
+    pub const ENCRYPTED_DATA_SIZE_WITHOUT_MEMO: usize =
+        Self::SIZE_NONCE + Self::SIZE_VALUE + Self::SIZE_MASK + Self::SIZE_TAG;
+    pub const MAX_MEMO_SIZE: usize = 255;
     pub const SIZE_MASK: usize = 32;
     pub const SIZE_NONCE: usize = 24;
     pub const SIZE_TAG: usize = 16;
     pub const SIZE_VALUE: usize = size_of::<u64>();
 
     pub const fn min_size() -> usize {
-        Self::ENCRYPTED_DATA_SIZE_TOTAL
+        Self::ENCRYPTED_DATA_SIZE_WITHOUT_MEMO
     }
 
     pub const fn max_size() -> usize {
-        Self::min_size() + 256
+        MAX_SIZE
     }
 
     pub fn len(&self) -> usize {
@@ -69,12 +70,14 @@ impl TryFrom<Vec<u8>> for EncryptedData {
     type Error = usize;
 
     fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
-        if value.len() < Self::min_size() {
-            return Err(value.len());
+        let len = value.len();
+        if len < Self::min_size() {
+            return Err(len);
         }
-        if value.len() > Self::max_size() {
-            return Err(value.len());
+        if len > Self::max_size() {
+            return Err(len);
         }
-        Ok(Self(value.into_boxed_slice()))
+        let bytes = value.try_into().map_err(|_| len)?;
+        Ok(Self(bytes))
     }
 }
diff --git a/crates/template_lib_types/src/lib.rs b/crates/template_lib_types/src/lib.rs
index b09e65a628..b2527cbb31 100644
--- a/crates/template_lib_types/src/lib.rs
+++ b/crates/template_lib_types/src/lib.rs
@@ -6,18 +6,24 @@ mod amount;
 #[macro_use]
 pub mod crypto;
 pub mod bytes;
+mod encrypted_data;
 pub mod engine_args;
 mod entity_id;
 mod error;
 mod hash;
 pub mod hex;
+mod max_bytes;
+mod max_string;
 mod resource_type;
 pub mod serde_helpers;
 
 pub use amount::*;
+pub use encrypted_data::*;
 pub use entity_id::*;
 pub use error::*;
 pub use hash::*;
+pub use max_bytes::MaxBytes;
+pub use max_string::MaxString;
 pub use resource_type::*;
 
 /// The address of a Template
diff --git a/crates/template_lib_types/src/max_bytes.rs b/crates/template_lib_types/src/max_bytes.rs
new file mode 100644
index 0000000000..7c284e88d1
--- /dev/null
+++ b/crates/template_lib_types/src/max_bytes.rs
@@ -0,0 +1,175 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::ops::{Deref, DerefMut};
+
+use crate::{
+    hex::{bytes_from_hex, bytes_to_hex},
+    serde_helpers::BytesVisitor,
+};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
+pub struct MaxBytes<const N: usize> {
+    bytes: Box<[u8]>,
+}
+
+impl<const N: usize> Deref for MaxBytes<N> {
+    type Target = [u8];
+
+    fn deref(&self) -> &Self::Target {
+        &self.bytes
+    }
+}
+
+impl<const N: usize> MaxBytes<N> {
+    pub fn new_checked(bytes: impl Into<Box<[u8]>>) -> Option<Self> {
+        let bytes = bytes.into();
+        if bytes.len() <= N {
+            Some(Self { bytes })
+        } else {
+            None
+        }
+    }
+
+    pub fn into_vec(self) -> Vec<u8> {
+        self.bytes.into_vec()
+    }
+}
+
+impl<const N: usize> AsRef<[u8]> for MaxBytes<N> {
+    fn as_ref(&self) -> &[u8] {
+        &self.bytes
+    }
+}
+
+impl<const N: usize> DerefMut for MaxBytes<N> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        // Mutable but not resizeable
+        &mut self.bytes
+    }
+}
+
+impl<const N: usize> Default for MaxBytes<N> {
+    fn default() -> Self {
+        Self {
+            bytes: vec![0u8; N].into_boxed_slice(),
+        }
+    }
+}
+
+impl<const N: usize> TryFrom<Vec<u8>> for MaxBytes<N> {
+    type Error = ();
+
+    fn try_from(value: Vec<u8>) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(())
+    }
+}
+
+impl<const N: usize> From<MaxBytes<N>> for Vec<u8> {
+    fn from(value: MaxBytes<N>) -> Self {
+        value.into_vec()
+    }
+}
+
+impl<const N: usize> serde::Serialize for MaxBytes<N> {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where S: serde::Serializer {
+        if serializer.is_human_readable() {
+            let hex = bytes_to_hex(&self.bytes);
+            serializer.serialize_str(&hex)
+        } else {
+            serializer.serialize_bytes(&self.bytes)
+        }
+    }
+}
+
+impl<'de, const N: usize> serde::Deserialize<'de> for MaxBytes<N> {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where D: serde::Deserializer<'de> {
+        if deserializer.is_human_readable() {
+            let s = String::deserialize(deserializer)?;
+            if s.len() > N * 2 {
+                return Err(serde::de::Error::custom(format!(
+                    "byte array length exceeds maximum of {}",
+                    N
+                )));
+            }
+            let bytes = bytes_from_hex(&s).map_err(serde::de::Error::custom)?;
+            MaxBytes::new_checked(bytes.into_boxed_slice())
+                .ok_or_else(|| serde::de::Error::custom(format!("byte array length exceeds maximum of {}", N)))
+        } else {
+            let bytes = deserializer.deserialize_byte_buf(BytesVisitor::new())?;
+            if bytes.len() > N {
+                return Err(serde::de::Error::custom(format!(
+                    "byte array length exceeds maximum of {}",
+                    N
+                )));
+            }
+            Ok(MaxBytes::new_checked(bytes.into_owned()).expect("length checked above"))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    mod new_checked {
+        use super::*;
+
+        #[test]
+        fn it_returns_some_if_data_le_size() {
+            let b = vec![1, 2, 3];
+            let mb = MaxBytes::<5>::new_checked(b).unwrap();
+            assert_eq!(mb.len(), 3);
+            assert_eq!(&mb[..], &[1, 2, 3]);
+        }
+
+        #[test]
+        fn it_returns_none_if_data_gt_size() {
+            let b = vec![1; 6];
+            let mb = MaxBytes::<5>::new_checked(b);
+            assert!(mb.is_none());
+        }
+    }
+
+    mod serde_impl {
+        use super::*;
+
+        #[test]
+        fn it_deserializes_and_serializes_human_readable() {
+            let original = MaxBytes::<5>::new_checked(vec![1, 2, 3, 4, 5]).unwrap();
+            let serialized = serde_json::to_string(&original).unwrap();
+            assert_eq!(serialized, "\"0102030405\"");
+            let deserialized: MaxBytes<5> = serde_json::from_str(&serialized).unwrap();
+            assert_eq!(original, deserialized);
+        }
+
+        #[test]
+        fn it_serializes_and_deserializes_as_bytes() {
+            let original = MaxBytes::<5>::new_checked(vec![1, 2, 3, 4, 5]).unwrap();
+            let serialized = tari_bor::encode(&original).unwrap();
+            // Assert that it encodes to a BOR bytes value using the Bytes variant
+            let val: tari_bor::Value = tari_bor::decode(&serialized).unwrap();
+            assert_eq!(val, tari_bor::Value::Bytes(vec![1, 2, 3, 4, 5]));
+            // Now decode it back
+            let deserialized: MaxBytes<5> = tari_bor::decode(&serialized).unwrap();
+            assert_eq!(original, deserialized);
+        }
+
+        #[test]
+        fn it_fails_to_deserialize_if_length_is_too_large() {
+            let json = "\"010203040506\""; // 6 bytes, max is 5
+            let err: serde_json::Error = serde_json::from_str::<MaxBytes<5>>(json).unwrap_err();
+            assert!(err.to_string().contains("byte array length exceeds maximum"));
+
+            let bytes = MaxBytes::<5> {
+                bytes: vec![1; 6].into_boxed_slice(),
+            };
+            let serialized = tari_bor::encode(&bytes).unwrap();
+            let err = tari_bor::decode::<MaxBytes<5>>(&serialized).unwrap_err();
+            assert!(err.to_string().contains("byte array length exceeds maximum"));
+        }
+    }
+}
diff --git a/crates/template_lib_types/src/max_string.rs b/crates/template_lib_types/src/max_string.rs
new file mode 100644
index 0000000000..ca5bc517fc
--- /dev/null
+++ b/crates/template_lib_types/src/max_string.rs
@@ -0,0 +1,111 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::ops::{Deref, DerefMut};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct MaxString<const N: usize> {
+    s: Box<str>,
+}
+
+impl<const N: usize> Deref for MaxString<N> {
+    type Target = str;
+
+    fn deref(&self) -> &Self::Target {
+        &self.s
+    }
+}
+
+impl<const N: usize> MaxString<N> {
+    pub fn new_checked(bytes: impl Into<Box<str>>) -> Option<Self> {
+        let s = bytes.into();
+        if s.len() <= N {
+            Some(Self { s })
+        } else {
+            None
+        }
+    }
+
+    pub fn into_string(self) -> String {
+        self.s.into_string()
+    }
+}
+
+impl<const N: usize> AsRef<str> for MaxString<N> {
+    fn as_ref(&self) -> &str {
+        &self.s
+    }
+}
+
+impl<const N: usize> DerefMut for MaxString<N> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        // Mutable but not resizeable
+        &mut self.s
+    }
+}
+
+impl<const N: usize> serde::Serialize for MaxString<N> {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where S: serde::Serializer {
+        serializer.serialize_str(&self.s)
+    }
+}
+
+impl<'de, const N: usize> serde::Deserialize<'de> for MaxString<N> {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where D: serde::Deserializer<'de> {
+        let s = String::deserialize(deserializer)?;
+        let len = s.len();
+        MaxString::new_checked(s)
+            .ok_or_else(|| serde::de::Error::custom(format!("string length exceeds maximum of {}: got {}", N, len)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    mod new_checked {
+        use super::*;
+
+        #[test]
+        fn it_returns_some_if_data_le_size() {
+            let b = "123";
+            let mb = MaxString::<5>::new_checked(b).unwrap();
+            assert_eq!(mb.len(), 3);
+            assert_eq!(&mb[..], "123");
+        }
+
+        #[test]
+        fn it_returns_none_if_data_gt_size() {
+            let b = "123456";
+            let mb = MaxString::<5>::new_checked(b);
+            assert!(mb.is_none());
+        }
+    }
+
+    mod serde_impl {
+        use super::*;
+
+        #[test]
+        fn it_serializes_and_deserializes_as_string() {
+            let original = MaxString::<5>::new_checked("12345").unwrap();
+            let serialized = tari_bor::encode(&original).unwrap();
+            // Now decode it back
+            let deserialized: MaxString<5> = tari_bor::decode(&serialized).unwrap();
+            assert_eq!(original, deserialized);
+        }
+
+        #[test]
+        fn it_fails_to_deserialize_if_length_is_too_large() {
+            let json = "\"123456\""; // 6 chars, max is 5
+            let err: serde_json::Error = serde_json::from_str::<MaxString<5>>(json).unwrap_err();
+            assert!(err.to_string().contains("string length exceeds maximum"));
+
+            let bytes = MaxString::<5> { s: "123456".into() };
+            let serialized = tari_bor::encode(&bytes).unwrap();
+            let err = tari_bor::decode::<MaxString<5>>(&serialized).unwrap_err();
+            assert!(err.to_string().contains("string length exceeds maximum"));
+        }
+    }
+}
diff --git a/crates/template_lib_types/src/serde_helpers.rs b/crates/template_lib_types/src/serde_helpers.rs
index 6cd78d0e7d..edbfac0b0b 100644
--- a/crates/template_lib_types/src/serde_helpers.rs
+++ b/crates/template_lib_types/src/serde_helpers.rs
@@ -15,6 +15,19 @@ pub enum BytesCow<'a> {
     Owned(Box<[u8]>),
 }
 
+impl<'a> BytesCow<'a> {
+    pub const fn len(&self) -> usize {
+        match self {
+            BytesCow::Borrowed(v) => v.len(),
+            BytesCow::Owned(v) => v.len(),
+        }
+    }
+
+    pub const fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
 impl BytesCow<'_> {
     pub fn into_owned(self) -> Box<[u8]> {
         match self {
diff --git a/crates/template_test_tooling/src/support/confidential.rs b/crates/template_test_tooling/src/support/confidential.rs
index 9da1cafed4..dc1cdaf0c5 100644
--- a/crates/template_test_tooling/src/support/confidential.rs
+++ b/crates/template_test_tooling/src/support/confidential.rs
@@ -10,8 +10,8 @@ use tari_crypto::{
 use tari_engine_types::crypto::commit_amount_checked;
 use tari_ootle_wallet_crypto::{confidential, MaskAndValue, UnblindedOutputStatement};
 use tari_template_lib::{
-    models::{ConfidentialOutputStatement, ConfidentialWithdrawProof, EncryptedData},
-    types::Amount,
+    models::{ConfidentialOutputStatement, ConfidentialWithdrawProof},
+    types::{Amount, EncryptedData},
 };
 
 pub fn generate_confidential_output_statement<A: Into<Amount>>(
diff --git a/crates/template_test_tooling/src/support/stealth.rs b/crates/template_test_tooling/src/support/stealth.rs
index 707e0a795a..186dc00352 100644
--- a/crates/template_test_tooling/src/support/stealth.rs
+++ b/crates/template_test_tooling/src/support/stealth.rs
@@ -18,11 +18,12 @@ use tari_ootle_wallet_crypto::{
     UnblindedStealthOutputStatement,
 };
 use tari_template_lib::{
-    models::{EncryptedData, StealthOutputsStatement, StealthTransferStatement},
+    models::{StealthOutputsStatement, StealthTransferStatement},
     prelude::{crypto::ValueKnowledgeProof, RistrettoPublicKeyBytes},
     types::{
         crypto::{StealthValueProof, UtxoTag},
         Amount,
+        EncryptedData,
     },
 };
 
diff --git a/crates/wallet/crypto/Cargo.toml b/crates/wallet/crypto/Cargo.toml
index 3d72b3d3b6..4271f19c3a 100644
--- a/crates/wallet/crypto/Cargo.toml
+++ b/crates/wallet/crypto/Cargo.toml
@@ -14,19 +14,22 @@ tari_crypto = { workspace = true }
 tari_hashing = { workspace = true }
 tari_utilities = { workspace = true }
 
+argon2 = "0.5.3"
 blake2 = { workspace = true }
 chacha20poly1305 = { workspace = true }
-argon2 = "0.5.3"
 crc32fast = "1.5.0"
-subtle = "2.6.1"
 digest = { workspace = true }
 rand = { workspace = true }
+serde = { workspace = true, optional = true, features = ["derive"] }
+subtle = "2.6.1"
 thiserror = { workspace = true }
+ts-rs = { workspace = true, optional = true }
 zeroize = { workspace = true, features = ["simd"] }
 
 [dev-dependencies]
-tari_template_test_tooling = { workspace = true }
 serde_json = { workspace = true }
 
 [features]
-default = []
\ No newline at end of file
+default = []
+serde = ["dep:serde"]
+ts = ["dep:ts-rs"]
\ No newline at end of file
diff --git a/crates/wallet/crypto/src/confidential.rs b/crates/wallet/crypto/src/confidential.rs
index 49185c3bf7..d99f9c7a0c 100644
--- a/crates/wallet/crypto/src/confidential.rs
+++ b/crates/wallet/crypto/src/confidential.rs
@@ -140,7 +140,7 @@ mod tests {
     use rand::rngs::OsRng;
     use tari_crypto::{keys::SecretKey, ristretto::RistrettoSecretKey};
     use tari_engine_types::confidential::validate_confidential_statement;
-    use tari_template_lib::{models::EncryptedData, types::Amount};
+    use tari_template_lib::types::{Amount, EncryptedData};
 
     use super::*;
 
diff --git a/crates/wallet/crypto/src/encrypted_data.rs b/crates/wallet/crypto/src/encrypted_data.rs
index 1c5f64b6ab..4f4dcd7813 100644
--- a/crates/wallet/crypto/src/encrypted_data.rs
+++ b/crates/wallet/crypto/src/encrypted_data.rs
@@ -21,50 +21,61 @@ use tari_crypto::{
 };
 use tari_engine_types::{crypto::get_commitment_factory, ToByteType};
 use tari_hashing::TransactionSecureNonceKdfDomain;
-use tari_template_lib::{models::EncryptedData, prelude::PedersenCommitmentBytes};
+use tari_template_lib::types::{crypto::PedersenCommitmentBytes, EncryptedData};
 use tari_utilities::{safe_array::SafeArray, ByteArray};
 use zeroize::{Zeroize, Zeroizing};
 
-use crate::{kdfs, kdfs::EncryptedDataKey, MaskAndValue, WalletCryptoError};
+use crate::{kdfs, kdfs::EncryptedDataKey, memo::Memo, DecryptedData, MaskAndValue, WalletCryptoError};
 
 pub fn unblind_output(
     output_commitment: &PedersenCommitmentBytes,
     output_encrypted_value: &EncryptedData,
     claim_secret: &RistrettoSecretKey,
     reciprocal_public_key: &RistrettoPublicKey,
-) -> Result<MaskAndValue, WalletCryptoError> {
+    skip_memo: bool,
+) -> Result<DecryptedData, WalletCryptoError> {
     let encryption_key = kdfs::encrypted_data_dh_kdf_aead(claim_secret, reciprocal_public_key);
 
-    let (value, mask) = extract_value_and_mask(&encryption_key, output_commitment, output_encrypted_value)?;
-    let commitment = get_commitment_factory().commit_value(&mask, value);
+    let decrypted = decrypt_data(&encryption_key, output_commitment, output_encrypted_value, skip_memo)?;
+    let commitment = decrypted.to_commitment().ok_or_else(|| WalletCryptoError::Invariant {
+        // Currently impossible
+        details: format!(
+            "Failed to create commitment from decrypted data (value {} exceeds u64::MAX)",
+            decrypted.mask_and_value.value
+        ),
+    })?;
     if output_commitment.as_bytes() == commitment.as_bytes() {
-        Ok(MaskAndValue {
-            value: value.into(),
-            mask,
-        })
+        Ok(decrypted)
     } else {
-        Err(WalletCryptoError::UnableToOpenCommitment)
+        Err(WalletCryptoError::CommitmentMismatchDecryptedData)
     }
 }
 
-pub fn encrypt_value_and_mask(
+pub fn encrypt_data(
     amount: u64,
     mask: &RistrettoSecretKey,
     encryption_key: &RistrettoSecretKey,
+    memo: Option<&Memo>,
 ) -> Result<EncryptedData, WalletCryptoError> {
     let commitment = get_commitment_factory().commit_value(mask, amount).to_byte_type();
-    let encrypted_data = encrypt_data(encryption_key, &commitment, amount, mask)?;
+    let encrypted_data = encrypt_data_inner(encryption_key, &commitment, amount, mask, memo)?;
     Ok(encrypted_data)
 }
 
-pub fn extract_value_and_mask(
+pub fn decrypt_data(
     encryption_key: &RistrettoSecretKey,
     commitment: &PedersenCommitmentBytes,
     encrypted_data: &EncryptedData,
-) -> Result<(u64, RistrettoSecretKey), WalletCryptoError> {
-    let (value, mask) = decrypt_data_and_mask(encryption_key, commitment, encrypted_data)
-        .map_err(|e| WalletCryptoError::FailedDecryptData { details: e.to_string() })?;
-    Ok((value, mask))
+    skip_memo: bool,
+) -> Result<DecryptedData, WalletCryptoError> {
+    let (value, mask, memo) = decrypt_inner(encryption_key, commitment, encrypted_data, skip_memo)?;
+    Ok(DecryptedData {
+        mask_and_value: MaskAndValue {
+            value: value.into(),
+            mask,
+        },
+        memo,
+    })
 }
 
 fn inner_encrypted_data_kdf_aead(
@@ -81,12 +92,13 @@ fn inner_encrypted_data_kdf_aead(
 
 const ENCRYPTED_DATA_TAG: &[u8] = b"TARI_AAD_VALUE_AND_MASK_EXTEND_NONCE_VARIANT";
 
-pub(crate) fn encrypt_data(
+fn encrypt_data_inner(
     encryption_key: &RistrettoSecretKey,
     commitment: &PedersenCommitmentBytes,
     value: u64,
     mask: &RistrettoSecretKey,
-) -> Result<EncryptedData, aead::Error> {
+    memo: Option<&Memo>,
+) -> Result<EncryptedData, WalletCryptoError> {
     fn payload_slice_mut(bytes: &mut [u8]) -> &mut [u8] {
         bytes
             .get_mut(EncryptedData::payload_offset()..)
@@ -111,7 +123,11 @@ pub(crate) fn encrypt_data(
     let cipher = XChaCha20Poly1305::new(GenericArray::from_slice(aead_key.reveal()));
 
     // Encode the value and mask
-    let mut bytes = vec![0; EncryptedData::min_size()];
+    let mut bytes = vec![
+        0;
+        memo.map(|_| EncryptedData::max_size())
+            .unwrap_or(EncryptedData::min_size())
+    ];
     let payload_mut = payload_slice_mut(&mut bytes);
     payload_mut
         .get_mut(..EncryptedData::SIZE_VALUE)
@@ -121,30 +137,62 @@ pub(crate) fn encrypt_data(
         .get_mut(EncryptedData::SIZE_VALUE..EncryptedData::SIZE_VALUE + EncryptedData::SIZE_MASK)
         .unwrap()
         .copy_from_slice(mask.as_bytes());
+
+    if let Some(m) = memo {
+        let mut memo_slice_mut = payload_mut
+            .get_mut(EncryptedData::SIZE_VALUE + EncryptedData::SIZE_MASK..)
+            .expect("invariant violation: bytes length is less than SIZE_VALUE + SIZE_MASK");
+        m.encode_into(&mut memo_slice_mut)
+            .map_err(|e| WalletCryptoError::FailedEncryptData {
+                details: format!("Failed to encode memo: {}", e),
+            })?;
+    }
+
     // Encrypt in place
     match cipher.encrypt_in_place_detached(&nonce, ENCRYPTED_DATA_TAG, payload_mut) {
         Ok(tag) => {
             tag_slice_mut(&mut bytes).copy_from_slice(&tag);
             nonce_slice_mut(&mut bytes).copy_from_slice(&nonce);
 
-            Ok(EncryptedData::try_from(bytes).expect("bytes length == EncryptedData::min_size()"))
+            Ok(EncryptedData::try_from(bytes).expect("bytes length <= EncryptedData::max_size()"))
         },
         Err(err) => {
             bytes.zeroize();
-            Err(err)
+            Err(err.into())
         },
     }
 }
 
-pub fn decrypt_data_and_mask(
+fn decrypt_inner(
     encryption_key: &RistrettoSecretKey,
     commitment: &PedersenCommitmentBytes,
     encrypted_data: &EncryptedData,
-) -> Result<(u64, RistrettoSecretKey), aead::Error> {
+    skip_memo: bool,
+) -> Result<(u64, RistrettoSecretKey, Option<Memo>), WalletCryptoError> {
     // Extract the tag, nonce, and ciphertext
-    let tag = Tag::from_slice(encrypted_data.tag_slice().ok_or(aead::Error)?);
-    let nonce = XNonce::from_slice(encrypted_data.nonce_slice().ok_or(aead::Error)?);
-    let mut bytes = Zeroizing::new(encrypted_data.payload_slice().ok_or(aead::Error)?.to_vec());
+    let tag = Tag::from_slice(
+        encrypted_data
+            .tag_slice()
+            .ok_or_else(|| WalletCryptoError::FailedDecryptData {
+                details: "Failed to get tag slice".to_string(),
+            })?,
+    );
+    let nonce =
+        XNonce::from_slice(
+            encrypted_data
+                .nonce_slice()
+                .ok_or_else(|| WalletCryptoError::FailedDecryptData {
+                    details: "Failed to get nonce slice".to_string(),
+                })?,
+        );
+    let mut bytes = Zeroizing::new(
+        encrypted_data
+            .payload_slice()
+            .ok_or_else(|| WalletCryptoError::FailedDecryptData {
+                details: "Failed to get payload slice".to_string(),
+            })?
+            .to_vec(),
+    );
 
     // Set up the AEAD
     let aead_key = inner_encrypted_data_kdf_aead(encryption_key, commitment);
@@ -156,19 +204,30 @@ pub fn decrypt_data_and_mask(
     // Decode the value and mask
     let mut value_bytes = [0u8; EncryptedData::SIZE_VALUE];
     value_bytes.copy_from_slice(bytes.get(..EncryptedData::SIZE_VALUE).ok_or(aead::Error)?);
-    Ok((
-        u64::from_le_bytes(value_bytes),
-        RistrettoSecretKey::from_canonical_bytes(
-            bytes
-                .get(EncryptedData::SIZE_VALUE..EncryptedData::SIZE_VALUE + EncryptedData::SIZE_MASK)
-                .ok_or(aead::Error)?,
-        )
-        .expect("The length of bytes is exactly SIZE_MASK"),
-    ))
+    let value = u64::from_le_bytes(value_bytes);
+    let mask_bytes = bytes
+        .get(EncryptedData::SIZE_VALUE..EncryptedData::SIZE_VALUE + EncryptedData::SIZE_MASK)
+        .ok_or(aead::Error)?;
+    let mask = RistrettoSecretKey::from_canonical_bytes(mask_bytes).expect("The length of bytes is exactly SIZE_MASK");
+    let mut memo_bytes = bytes
+        .get(EncryptedData::SIZE_VALUE + EncryptedData::SIZE_MASK..)
+        .expect("invariant violation: bytes length is less than SIZE_VALUE + SIZE_MASK");
+
+    let memo = if skip_memo || memo_bytes.is_empty() {
+        None
+    } else {
+        // Note any remaining bytes after memo decodes are discarded
+        let memo = Memo::decode_from(&mut memo_bytes).map_err(|e| WalletCryptoError::FailedDecryptData {
+            details: format!("Failed to decode memo: {}", e),
+        })?;
+        Some(memo)
+    };
+    Ok((value, mask, memo))
 }
 
 #[cfg(test)]
 mod tests {
+
     use tari_crypto::{keys::SecretKey, ristretto::RistrettoSecretKey};
     use tari_engine_types::{crypto::get_commitment_factory, ToByteType};
 
@@ -180,9 +239,67 @@ mod tests {
         let amount = 100;
         let commitment = get_commitment_factory().commit_value(&key, amount).to_byte_type();
         let mask = RistrettoSecretKey::random(&mut OsRng);
-        let encrypted = encrypt_data(&key, &commitment, amount, &mask).unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, None).unwrap();
+
+        let (value, msk, memo) = decrypt_inner(&key, &commitment, &encrypted, false).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert!(memo.is_none());
+        assert_eq!(encrypted.len(), EncryptedData::min_size());
+    }
+
+    #[test]
+    fn it_encrypts_and_decrypts_with_memo() {
+        let key = RistrettoSecretKey::random(&mut OsRng);
+        let amount = 100;
+        let commitment = get_commitment_factory().commit_value(&key, amount).to_byte_type();
+        let mask = RistrettoSecretKey::random(&mut OsRng);
+        let memo = Memo::new_message("The quick brown fox jumps over the lazy dog").unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, Some(&memo)).unwrap();
+        assert!(!String::from_utf8_lossy(encrypted.as_bytes()).contains("the lazy dog"));
+
+        let (value, msk, decrypted_memo) = decrypt_inner(&key, &commitment, &encrypted, false).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert_eq!(decrypted_memo.unwrap(), memo);
+
+        // Test with bytes
+        let memo = Memo::new_bytes([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]).unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, Some(&memo)).unwrap();
+        let (value, msk, decrypted_memo) = decrypt_inner(&key, &commitment, &encrypted, false).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert_eq!(decrypted_memo.unwrap(), memo);
+
+        // With empty memo
+        let memo = Memo::new_bytes([]).unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, Some(&memo)).unwrap();
+        let (value, msk, decrypted_memo) = decrypt_inner(&key, &commitment, &encrypted, false).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert_eq!(decrypted_memo.unwrap(), memo);
+
+        // With max bytes
+        let memo = Memo::new_bytes([0u8; Memo::MAX_BYTES_LENGTH]).unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, Some(&memo)).unwrap();
+        let (value, msk, decrypted_memo) = decrypt_inner(&key, &commitment, &encrypted, false).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert_eq!(decrypted_memo.unwrap(), memo);
+    }
+
+    #[test]
+    fn it_always_returns_a_none_memo_if_skip_memo_is_true() {
+        let key = RistrettoSecretKey::random(&mut OsRng);
+        let amount = 100;
+        let commitment = get_commitment_factory().commit_value(&key, amount).to_byte_type();
+        let mask = RistrettoSecretKey::random(&mut OsRng);
+        let memo = Memo::new_message("The quick brown fox jumps over the lazy dog").unwrap();
+        let encrypted = encrypt_data_inner(&key, &commitment, amount, &mask, Some(&memo)).unwrap();
 
-        let val = decrypt_data_and_mask(&key, &commitment, &encrypted).unwrap();
-        assert_eq!(val.0, 100);
+        let (value, msk, decrypted_memo) = decrypt_inner(&key, &commitment, &encrypted, true).unwrap();
+        assert_eq!(value, amount);
+        assert_eq!(msk, mask);
+        assert!(decrypted_memo.is_none());
     }
 }
diff --git a/crates/wallet/crypto/src/error.rs b/crates/wallet/crypto/src/error.rs
index 4fdeb6f96a..3566214ff2 100644
--- a/crates/wallet/crypto/src/error.rs
+++ b/crates/wallet/crypto/src/error.rs
@@ -32,12 +32,16 @@ pub enum WalletCryptoError {
     ConfidentialProof(#[from] ConfidentialProofError),
     #[error("Failed to decrypt data: {details}")]
     FailedDecryptData { details: String },
-    #[error("Unable to open the commitment")]
-    UnableToOpenCommitment,
+    #[error("Failed to encrypt data: {details}")]
+    FailedEncryptData { details: String },
+    #[error("Commitment does not match commitment derived from decrypted data")]
+    CommitmentMismatchDecryptedData,
     #[error("Invalid argument {name}: {details}")]
     InvalidArgument { name: &'static str, details: String },
     #[error("AEAD error: {0}")]
     AeadError(aead::Error),
+    #[error("BUG: Invariant violated: {details}")]
+    Invariant { details: String },
 }
 
 impl From<aead::Error> for WalletCryptoError {
diff --git a/crates/wallet/crypto/src/lib.rs b/crates/wallet/crypto/src/lib.rs
index 9bdeb3f521..5f95365a0b 100644
--- a/crates/wallet/crypto/src/lib.rs
+++ b/crates/wallet/crypto/src/lib.rs
@@ -13,6 +13,7 @@ mod unblinded_statement;
 mod value_lookup;
 
 pub mod encryption;
+pub mod memo;
 pub mod viewable_balance_proof;
 
 pub use error::*;
diff --git a/crates/wallet/crypto/src/memo.rs b/crates/wallet/crypto/src/memo.rs
new file mode 100644
index 0000000000..6f7acf6e48
--- /dev/null
+++ b/crates/wallet/crypto/src/memo.rs
@@ -0,0 +1,239 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use std::{cmp, io};
+
+use tari_template_lib::types::{MaxBytes, MaxString};
+
+/// These are selected to be out of range of the Minotari memo field tags
+/// See:
+/// https://github.com/tari-project/tari/blob/221d715e2447e6ca33e2ebcba11e915d24edac15/base_layer/transaction_components/src/transaction_components/memo_field.rs
+#[repr(u8)]
+enum MemoTag {
+    Message = 0x10,
+    Bytes = 0x11,
+}
+
+impl MemoTag {
+    pub fn from_u8(value: u8) -> Option<Self> {
+        match value {
+            0x10 => Some(Self::Message),
+            0x11 => Some(Self::Bytes),
+            _ => None,
+        }
+    }
+}
+
+const MAX_BYTES_LENGTH: usize = 253;
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
+pub enum Memo {
+    /// UTF-8 encoded string message
+    Message(#[cfg_attr(feature = "ts", ts(type = "string"))] MaxString<MAX_BYTES_LENGTH>),
+    /// Arbitrary bytes
+    Bytes(#[cfg_attr(feature = "ts", ts(type = "string"))] MaxBytes<MAX_BYTES_LENGTH>),
+}
+
+impl Memo {
+    /// EncryptedData memo size (255) - 2 (enum tag + length (u8))
+    pub const MAX_BYTES_LENGTH: usize = MAX_BYTES_LENGTH;
+
+    pub fn new_message(s: impl Into<Box<str>>) -> Option<Self> {
+        let s = s.into();
+        let s = MaxString::new_checked(s)?;
+        Some(Self::Message(s))
+    }
+
+    pub fn new_bytes(b: impl Into<Box<[u8]>>) -> Option<Self> {
+        let b = b.into();
+        let b = MaxBytes::new_checked(b)?;
+        Some(Self::Bytes(b))
+    }
+
+    pub fn as_bytes(&self) -> &[u8] {
+        match self {
+            Memo::Message(s) => s.as_bytes(),
+            Memo::Bytes(b) => b.as_ref(),
+        }
+    }
+
+    pub fn len(&self) -> usize {
+        match self {
+            Memo::Message(s) => s.len(),
+            Memo::Bytes(b) => b.len(),
+        }
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn as_message(&self) -> Option<&str> {
+        match self {
+            Memo::Message(s) => Some(s),
+            Memo::Bytes(_) => None,
+        }
+    }
+
+    // We implement a custom encoding (that **almost** matches borsh). Because we are very byte constrained and since we
+    // know that the max length is 253 bytes we can use a single byte for the length. Borsh uses a u32 for length (3
+    // extra bytes of overhead).
+
+    pub fn encode_into<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+        let len = self.len();
+        let len = u8::try_from(len).expect("len <= MAX_BYTES_LENGTH <= 255");
+        match self {
+            Self::Message(s) => {
+                writer.write_all(&[MemoTag::Message as u8])?;
+                writer.write_all(&[len])?;
+                writer.write_all(s.as_bytes())?;
+            },
+            Self::Bytes(b) => {
+                writer.write_all(&[MemoTag::Bytes as u8])?;
+                writer.write_all(&[len])?;
+                writer.write_all(b.as_ref())?;
+            },
+        }
+        Ok(())
+    }
+
+    pub fn decode_from<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+        let mut tag = [0u8; 1];
+        reader.read_exact(&mut tag)?;
+        let tag = MemoTag::from_u8(tag[0]);
+
+        let Some(tag) = tag else {
+            // Fallback for future versions, preserve unknown memos as bytes (up to the max size)
+            let mut buf = vec![0u8; Self::MAX_BYTES_LENGTH];
+            let bytes_read = read_until_len_or_eof(&mut buf, reader, Self::MAX_BYTES_LENGTH)?;
+            buf.truncate(bytes_read);
+            return Ok(Self::new_bytes(buf).expect("length checked"));
+        };
+
+        let mut len_buf = [0u8; 1];
+        reader.read_exact(&mut len_buf)?;
+        let len = len_buf[0] as usize;
+        if len > Self::MAX_BYTES_LENGTH {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("Memo length {} exceeds maximum {}", len, Self::MAX_BYTES_LENGTH),
+            ));
+        }
+        let mut buf = vec![0u8; len];
+        reader.read_exact(&mut buf)?;
+        match tag {
+            MemoTag::Message => {
+                let s =
+                    String::from_utf8(buf).map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "Invalid UTF-8"))?;
+                Ok(Self::new_message(s).expect("length checked (buf.len() <= MAX_BYTES_LENGTH)"))
+            },
+            MemoTag::Bytes => Ok(Self::new_bytes(buf).expect("length checked (buf.len() <= MAX_BYTES_LENGTH)")),
+        }
+    }
+}
+
+fn read_until_len_or_eof<R: io::Read>(mut buf: &mut [u8], reader: &mut R, max_len: usize) -> io::Result<usize> {
+    let mut bytes_read = 0;
+    while !buf.is_empty() {
+        match reader.read(buf) {
+            Ok(0) => break,
+            Ok(n) => {
+                // Subtraction is safe because bytes_read <= max_len
+                let bytes_to_take = cmp::min(n, max_len - bytes_read);
+                bytes_read += bytes_to_take;
+                // Copied from std::io::Read::read_exact but added the following to break if we reach max_len
+                if bytes_read == max_len {
+                    break;
+                }
+
+                buf = &mut buf[bytes_to_take..];
+            },
+            Err(ref e) if e.kind() == io::ErrorKind::Interrupted => {},
+            Err(e) => return Err(e),
+        }
+    }
+
+    Ok(bytes_read)
+}
+
+#[cfg(test)]
+mod tests {
+    use tari_template_lib::types::EncryptedData;
+
+    use super::*;
+
+    #[test]
+    fn it_returns_none_if_max_bytes_len_exceeded() {
+        let bytes = vec![0u8; Memo::MAX_BYTES_LENGTH + 1];
+        let memo = Memo::new_bytes(bytes);
+        assert!(memo.is_none());
+    }
+
+    #[test]
+    fn it_encodes_and_decodes() {
+        let original = Memo::new_message("Hello, world!").unwrap();
+        let mut buf = Vec::new();
+        original.encode_into(&mut buf).unwrap();
+        let decoded = Memo::decode_from(&mut buf.as_slice()).unwrap();
+        assert_eq!(original, decoded);
+
+        let original = Memo::new_bytes(vec![1, 2, 3, 4, 5]).unwrap();
+        let mut buf = Vec::new();
+        original.encode_into(&mut buf).unwrap();
+        let decoded = Memo::decode_from(&mut buf.as_slice()).unwrap();
+        assert_eq!(original, decoded);
+
+        // Empty memo
+        let original = Memo::new_message("").unwrap();
+        let mut buf = Vec::new();
+        original.encode_into(&mut buf).unwrap();
+        let decoded = Memo::decode_from(&mut buf.as_slice()).unwrap();
+        assert_eq!(original, decoded);
+
+        // Max size memo
+        let bytes = vec![0u8; Memo::MAX_BYTES_LENGTH];
+        let original = Memo::new_bytes(bytes).unwrap();
+        let mut buf = Vec::new();
+        original.encode_into(&mut buf).unwrap();
+        let decoded = Memo::decode_from(&mut buf.as_slice()).unwrap();
+        assert_eq!(original, decoded);
+    }
+
+    #[test]
+    fn it_fails_to_decode_if_length_is_too_big() {
+        // THis is valid encoding but the length exceeds the max allowed length
+        let encoded = [vec![MemoTag::Bytes as u8, (Memo::MAX_BYTES_LENGTH + 1) as u8], vec![
+            1u8;
+            Memo::MAX_BYTES_LENGTH +
+                1
+        ]]
+        .concat();
+        let _err = Memo::decode_from(&mut encoded.as_slice()).unwrap_err();
+    }
+
+    #[test]
+    fn it_fails_to_decode_if_length_mismatches() {
+        // This is invalid encoding as the length (10) exceeds the actual data length (5)
+        let encoded = [vec![MemoTag::Message as u8, 10u8], vec![1u8; 5]].concat();
+        let _err = Memo::decode_from(&mut encoded.as_slice()).unwrap_err();
+    }
+
+    #[test]
+    fn it_falls_back_to_bytes_with_unknown_variants() {
+        let encoded = [vec![0u8, 5], vec![1u8; 5]].concat();
+        let decoded = Memo::decode_from(&mut encoded.as_slice()).unwrap();
+        // Includes the length byte in the bytes since some future unknown variant may not be length prefixed
+        assert_eq!(decoded, Memo::new_bytes(vec![5, 1, 1, 1, 1, 1]).unwrap());
+    }
+
+    #[test]
+    fn it_borsh_encodes_to_max_bytes() {
+        let bytes = vec![0u8; Memo::MAX_BYTES_LENGTH];
+        let memo = Memo::new_bytes(bytes).unwrap();
+        let mut buf = Vec::new();
+        memo.encode_into(&mut buf).unwrap();
+        // We want the encoded memo to fit in the max size of an EncryptedData payload (i.e 255 bytes)
+        assert!(buf.len() <= EncryptedData::max_size() - EncryptedData::min_size());
+    }
+}
diff --git a/crates/wallet/crypto/src/stealth.rs b/crates/wallet/crypto/src/stealth.rs
index cf9403d466..ec740d395c 100644
--- a/crates/wallet/crypto/src/stealth.rs
+++ b/crates/wallet/crypto/src/stealth.rs
@@ -161,10 +161,7 @@ mod tests {
         ristretto::{RistrettoPublicKey, RistrettoSecretKey},
     };
     use tari_engine_types::stealth::validate_stealth_outputs_statement;
-    use tari_template_lib::{
-        models::EncryptedData,
-        types::{crypto::UtxoTag, Amount},
-    };
+    use tari_template_lib::types::{crypto::UtxoTag, Amount, EncryptedData};
 
     use super::*;
     use crate::UnblindedOutputStatement;
diff --git a/crates/wallet/crypto/src/unblinded_statement.rs b/crates/wallet/crypto/src/unblinded_statement.rs
index e793693e1a..673798e3fc 100644
--- a/crates/wallet/crypto/src/unblinded_statement.rs
+++ b/crates/wallet/crypto/src/unblinded_statement.rs
@@ -3,10 +3,9 @@
 
 use tari_crypto::ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey, RistrettoSecretKey};
 use tari_engine_types::crypto::commit_amount_checked;
-use tari_template_lib::{
-    models::EncryptedData,
-    types::{crypto::UtxoTag, Amount},
-};
+use tari_template_lib::types::{crypto::UtxoTag, Amount, EncryptedData};
+
+use crate::memo::Memo;
 
 #[derive(Debug, Clone)]
 pub struct UnblindedOutputStatement {
@@ -47,6 +46,34 @@ impl MaskAndValue {
     }
 }
 
+#[derive(Debug, Clone)]
+pub struct DecryptedData {
+    pub mask_and_value: MaskAndValue,
+    pub memo: Option<Memo>,
+}
+
+impl DecryptedData {
+    pub fn into_mask_and_value(self) -> MaskAndValue {
+        self.mask_and_value
+    }
+
+    pub fn value(&self) -> Amount {
+        self.mask_and_value.value
+    }
+
+    pub fn mask(&self) -> &RistrettoSecretKey {
+        &self.mask_and_value.mask
+    }
+
+    pub fn memo(&self) -> Option<&Memo> {
+        self.memo.as_ref()
+    }
+
+    pub fn to_commitment(&self) -> Option<PedersenCommitment> {
+        self.mask_and_value.to_commitment()
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct UnblindedStealthInputStatement {
     pub mask_and_value: MaskAndValue,
diff --git a/crates/wallet/crypto/tests/output_statement.rs b/crates/wallet/crypto/tests/output_statement.rs
index 3b04a4f7b0..30a3c3778a 100644
--- a/crates/wallet/crypto/tests/output_statement.rs
+++ b/crates/wallet/crypto/tests/output_statement.rs
@@ -16,8 +16,7 @@ use tari_ootle_wallet_crypto::{
     UnblindedStealthInputStatement,
     UnblindedStealthOutputStatement,
 };
-use tari_template_lib::{models::EncryptedData, types::Amount};
-use tari_template_test_tooling::support::stealth::test_sender_public_nonce;
+use tari_template_lib::types::Amount;
 
 #[test]
 fn it_create_a_valid_revealed_only_proof() {
@@ -29,7 +28,7 @@ fn it_create_a_valid_revealed_only_proof() {
 }
 
 mod stealth_tests {
-    use tari_template_lib::types::crypto::UtxoTag;
+    use tari_template_lib::types::{crypto::UtxoTag, EncryptedData};
 
     use super::*;
 
@@ -122,7 +121,10 @@ mod stealth_tests {
                     mask: output_mask,
                     resource_view_key: None,
                     // This is client/wallet on-chain data and not required for spending in tests
-                    sender_public_nonce: test_sender_public_nonce(),
+                    sender_public_nonce: {
+                        let (_sk, pk) = create_key_pair_from_seed(0);
+                        pk
+                    },
                     minimum_value_promise: 0,
                     encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
                 };
diff --git a/crates/wallet/crypto/tests/viewable_balance_proof.rs b/crates/wallet/crypto/tests/viewable_balance_proof.rs
index f76977c53f..26681867a0 100644
--- a/crates/wallet/crypto/tests/viewable_balance_proof.rs
+++ b/crates/wallet/crypto/tests/viewable_balance_proof.rs
@@ -11,9 +11,8 @@ use tari_crypto::{
 use tari_engine_types::crypto::validate_elgamal_verifiable_balance_proof;
 use tari_ootle_wallet_crypto::{confidential, AlwaysMissLookupTable, UnblindedOutputStatement};
 use tari_template_lib::{
-    models::EncryptedData,
     template_dependencies::{decode_exact, encode_with_len},
-    types::Amount,
+    types::{Amount, EncryptedData},
 };
 use tari_utilities::ByteArray;
 
diff --git a/crates/wallet/sdk/Cargo.toml b/crates/wallet/sdk/Cargo.toml
index ecae5c04ca..4f54e5f4fc 100644
--- a/crates/wallet/sdk/Cargo.toml
+++ b/crates/wallet/sdk/Cargo.toml
@@ -13,7 +13,7 @@ tari_common_types = { workspace = true }
 tari_crypto = { workspace = true, features = ["borsh"] }
 tari_engine_types = { workspace = true }
 tari_ootle_common_types = { workspace = true }
-tari_ootle_wallet_crypto = { workspace = true }
+tari_ootle_wallet_crypto = { workspace = true, features = ["serde"] }
 tari_template_builtin = { workspace = true }
 tari_consensus_types = { workspace = true }
 tari_transaction_components = { workspace = true }
diff --git a/crates/wallet/sdk/src/apis/confidential_crypto.rs b/crates/wallet/sdk/src/apis/confidential_crypto.rs
index 71be0868a6..75d319e0d6 100644
--- a/crates/wallet/sdk/src/apis/confidential_crypto.rs
+++ b/crates/wallet/sdk/src/apis/confidential_crypto.rs
@@ -5,17 +5,19 @@ use tari_common_types::types::PrivateKey;
 use tari_crypto::ristretto::RistrettoPublicKey;
 use tari_ootle_wallet_crypto::{
     confidential,
-    encrypted_data::{encrypt_value_and_mask, extract_value_and_mask, unblind_output},
+    encrypted_data::{decrypt_data, encrypt_data, unblind_output},
     kdfs,
+    memo::Memo,
     ConfidentialProofError,
+    DecryptedData,
     MaskAndValue,
     UnblindedOutputStatement,
     WalletCryptoError,
 };
 use tari_template_lib::{
-    models::{ConfidentialOutputStatement, ConfidentialWithdrawProof, EncryptedData},
+    models::{ConfidentialOutputStatement, ConfidentialWithdrawProof},
     prelude::PedersenCommitmentBytes,
-    types::Amount,
+    types::{Amount, EncryptedData},
 };
 
 pub struct ConfidentialCryptoApi;
@@ -68,20 +70,22 @@ impl ConfidentialCryptoApi {
         mask: &PrivateKey,
         public_nonce: &RistrettoPublicKey,
         secret: &PrivateKey,
+        memo: Option<&Memo>,
     ) -> Result<EncryptedData, ConfidentialCryptoApiError> {
         let key = kdfs::encrypted_data_dh_kdf_aead(secret, public_nonce);
-        let data = encrypt_value_and_mask(amount, mask, &key)?;
+        let data = encrypt_data(amount, mask, &key, memo)?;
         Ok(data)
     }
 
-    pub fn extract_value_and_mask(
+    pub fn decrypt_output_data(
         &self,
         encryption_key: &PrivateKey,
         commitment: &PedersenCommitmentBytes,
         encrypted_data: &EncryptedData,
-    ) -> Result<(u64, PrivateKey), ConfidentialCryptoApiError> {
-        let value_and_mask = extract_value_and_mask(encryption_key, commitment, encrypted_data)?;
-        Ok(value_and_mask)
+        skip_memo: bool,
+    ) -> Result<DecryptedData, ConfidentialCryptoApiError> {
+        let decrypted = decrypt_data(encryption_key, commitment, encrypted_data, skip_memo)?;
+        Ok(decrypted)
     }
 
     pub fn generate_output_proof<A: Into<Amount>>(
@@ -104,14 +108,16 @@ impl ConfidentialCryptoApi {
         output_encrypted_value: &EncryptedData,
         claim_secret: &PrivateKey,
         reciprocal_public_key: &RistrettoPublicKey,
-    ) -> Result<MaskAndValue, ConfidentialCryptoApiError> {
-        let unmasked_output = unblind_output(
+        skip_memo: bool,
+    ) -> Result<DecryptedData, ConfidentialCryptoApiError> {
+        let decrypted = unblind_output(
             output_commitment,
             output_encrypted_value,
             claim_secret,
             reciprocal_public_key,
+            skip_memo,
         )?;
-        Ok(unmasked_output)
+        Ok(decrypted)
     }
 }
 
diff --git a/crates/wallet/sdk/src/apis/confidential_outputs.rs b/crates/wallet/sdk/src/apis/confidential_outputs.rs
index 925267f95f..298d616d02 100644
--- a/crates/wallet/sdk/src/apis/confidential_outputs.rs
+++ b/crates/wallet/sdk/src/apis/confidential_outputs.rs
@@ -179,16 +179,15 @@ where TStore: WalletStore
                 },
             };
 
-            let (_, mask) = self.crypto_api.extract_value_and_mask(
+            let decrypted = self.crypto_api.decrypt_output_data(
                 &shared_decrypt_key,
                 &output.commitment,
                 &output.encrypted_data,
+                true,
             )?;
 
-            outputs_with_masks.push(MaskAndValue {
-                value: output.value,
-                mask,
-            });
+            // We're resolving for spending so we don't need the memo
+            outputs_with_masks.push(decrypted.into_mask_and_value());
         }
         Ok(outputs_with_masks)
     }
@@ -292,9 +291,10 @@ where TStore: WalletStore
             &output.encrypted_data,
             &key.secret,
             &output_stealth_public_nonce,
+            false,
         );
-        let (value, status) = match unblinded_result {
-            Ok(output) => (output.value, OutputStatus::Unspent),
+        let (value, memo, status) = match unblinded_result {
+            Ok(output) => (output.value(), output.memo, OutputStatus::Unspent),
             Err(e) => {
                 warn!(
                     target: LOG_TARGET,
@@ -302,7 +302,7 @@ where TStore: WalletStore
                     commitment,
                     e
                 );
-                (Amount::zero(), OutputStatus::Invalid)
+                (Amount::zero(), None, OutputStatus::Invalid)
             },
         };
 
@@ -316,6 +316,7 @@ where TStore: WalletStore
             owner_key_id: account.owner_key_id,
             encrypted_data: output.encrypted_data.clone(),
             public_asset_tag: None,
+            memo,
             status,
             lock_id: None,
         })
diff --git a/crates/wallet/sdk/src/apis/confidential_transfer.rs b/crates/wallet/sdk/src/apis/confidential_transfer.rs
index caac8437ec..dd7b40ac5d 100644
--- a/crates/wallet/sdk/src/apis/confidential_transfer.rs
+++ b/crates/wallet/sdk/src/apis/confidential_transfer.rs
@@ -10,7 +10,7 @@ use tari_crypto::{keys::PublicKey, ristretto::RistrettoPublicKey};
 use tari_engine_types::{FromByteType, ToByteType};
 use tari_ootle_address::OotleAddress;
 use tari_ootle_common_types::{optional::IsNotFoundError, SubstateRequirement};
-use tari_ootle_wallet_crypto::{MaskAndValue, UnblindedOutputStatement};
+use tari_ootle_wallet_crypto::{memo::Memo, MaskAndValue, UnblindedOutputStatement};
 use tari_template_lib::{
     models::{ComponentAddress, ResourceAddress, VaultId},
     types::Amount,
@@ -318,6 +318,7 @@ where
                 &destination_pk,
                 params.confidential_amount(),
                 resource_view_key.clone(),
+                params.memo.as_ref(),
             )?)
         };
 
@@ -337,6 +338,7 @@ where
                 &account_public_key,
                 change_confidential_amount,
                 resource_view_key,
+                None,
             )?;
 
             let change_value = statement.amount;
@@ -355,6 +357,7 @@ where
                     owner_key_id: Some(account_key.key_id),
                     encrypted_data: statement.encrypted_data.clone(),
                     public_asset_tag: None,
+                    memo: None,
                     status: OutputStatus::LockedUnconfirmed,
                     lock_id: Some(inputs_to_spend.lock_id),
                 })?;
@@ -427,6 +430,7 @@ where
         dest_public_key: &RistrettoPublicKey,
         confidential_amount: Amount,
         resource_view_key: Option<RistrettoPublicKey>,
+        memo: Option<&Memo>,
     ) -> Result<UnblindedOutputStatement, ConfidentialTransferApiError> {
         if !confidential_amount.is_positive() {
             return Err(ConfidentialTransferApiError::InvalidParameter {
@@ -450,6 +454,7 @@ where
             &mask.key,
             dest_public_key,
             &nonce,
+            memo,
         )?;
 
         Ok(UnblindedOutputStatement {
@@ -486,6 +491,9 @@ pub struct ConfidentialTransferParams {
     pub output_to_revealed: bool,
     /// If some, instructions are added that create a access rule proof for this resource before calling withdraw
     pub proof_from_resource: Option<ResourceAddress>,
+    /// A memo to include in the output, if any. This memo is encrypted in the output and can only be decrypted by the
+    /// recipient
+    pub memo: Option<Memo>,
     /// Run as a dry run, no funds will be transferred if true
     pub is_dry_run: bool,
 }
diff --git a/crates/wallet/sdk/src/apis/stealth_crypto.rs b/crates/wallet/sdk/src/apis/stealth_crypto.rs
index 22884e7b3b..bc6815fbb1 100644
--- a/crates/wallet/sdk/src/apis/stealth_crypto.rs
+++ b/crates/wallet/sdk/src/apis/stealth_crypto.rs
@@ -10,20 +10,21 @@ use tari_engine_types::{crypto::get_commitment_factory, ConvertFromByteType};
 use tari_ootle_common_types::{base_layer_hashing::ownership_proof_hasher64, Network};
 use tari_ootle_wallet_crypto::{
     confidential,
-    encrypted_data::{encrypt_value_and_mask, unblind_output},
+    encrypted_data::{encrypt_data, unblind_output},
     kdfs,
+    memo::Memo,
     stealth,
     ConfidentialProofError,
-    MaskAndValue,
+    DecryptedData,
     UnblindedOutputStatement,
     UnblindedStealthInputStatement,
     UnblindedStealthOutputStatement,
     WalletCryptoError,
 };
 use tari_template_lib::{
-    models::{ConfidentialOutputStatement, EncryptedData, ResourceAddress, StealthTransferStatement},
+    models::{ConfidentialOutputStatement, ResourceAddress, StealthTransferStatement},
     prelude::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, SchnorrSignatureBytes},
-    types::{crypto::UtxoTag, Amount},
+    types::{crypto::UtxoTag, Amount, EncryptedData},
 };
 
 const LOG_TARGET: &str = "tari::ootle::wallet::sdk::stealth_crypto";
@@ -105,9 +106,10 @@ impl StealthCryptoApi {
         mask: &RistrettoSecretKey,
         public_key: &RistrettoPublicKey,
         secret: &RistrettoSecretKey,
+        memo: Option<&Memo>,
     ) -> Result<EncryptedData, StealthCryptoApiError> {
         let encryption_key = kdfs::encrypted_data_dh_kdf_aead(secret, public_key);
-        let data = encrypt_value_and_mask(amount, mask, &encryption_key)?;
+        let data = encrypt_data(amount, mask, &encryption_key, memo)?;
         Ok(data)
     }
 
@@ -131,14 +133,16 @@ impl StealthCryptoApi {
         output_commitment: &PedersenCommitmentBytes,
         claim_secret: &RistrettoSecretKey,
         reciprocal_public_key: &RistrettoPublicKey,
-    ) -> Result<MaskAndValue, StealthCryptoApiError> {
-        let unmasked_output = unblind_output(
+        skip_memo: bool,
+    ) -> Result<DecryptedData, StealthCryptoApiError> {
+        let decrypted = unblind_output(
             output_commitment,
             output_encrypted_value,
             claim_secret,
             reciprocal_public_key,
+            skip_memo,
         )?;
-        Ok(unmasked_output)
+        Ok(decrypted)
     }
 
     pub fn validate_burn_claim_ownership_proof(
diff --git a/crates/wallet/sdk/src/apis/stealth_outputs.rs b/crates/wallet/sdk/src/apis/stealth_outputs.rs
index 63e3f5e40a..0abff955d1 100644
--- a/crates/wallet/sdk/src/apis/stealth_outputs.rs
+++ b/crates/wallet/sdk/src/apis/stealth_outputs.rs
@@ -223,11 +223,13 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                 }
             })?;
 
-            let mask_and_value = self.crypto_api.decrypt_value_and_mask(
+            let decrypted = self.crypto_api.decrypt_value_and_mask(
                 &output.encrypted_data,
                 &output.commitment,
                 &view_only.secret,
                 &nonce,
+                // We dont need to decrypt the memo to spend the output
+                true,
             )?;
 
             let stealth_secret = self
@@ -236,7 +238,7 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
 
             inputs_with_masks.push(InputToSpend {
                 statement: UnblindedStealthInputStatement {
-                    mask_and_value,
+                    mask_and_value: decrypted.mask_and_value,
                     owner_secret: stealth_secret,
                     public_nonce: nonce,
                 },
@@ -519,10 +521,11 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                 &commitment,
                 &keys.view_only_key.secret,
                 &output_stealth_public_nonce,
+                false,
             );
 
-            let (value, status) = match unblinded_result {
-                Ok(mask_and_value) => {
+            let (value, memo, status) = match unblinded_result {
+                Ok(decrypted) => {
                     if let Some(ref owner_key) = keys.account_key {
                         let stealth_secret = self.crypto_api.derive_stealth_owner_secret(
                             network,
@@ -531,7 +534,7 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                         );
                         let stealth_address = RistrettoPublicKey::from_secret_key(&stealth_secret);
                         if output.owner_public_key == stealth_address.to_byte_type() {
-                            (mask_and_value.value, OutputStatus::Unspent)
+                            (decrypted.value(), decrypted.memo, OutputStatus::Unspent)
                         } else {
                             warn!(
                                 target: LOG_TARGET,
@@ -539,7 +542,7 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                                 stealth_address,
                                 output.owner_public_key
                             );
-                            (mask_and_value.value, OutputStatus::Invalid)
+                            (decrypted.value(), decrypted.memo, OutputStatus::Invalid)
                         }
                     } else {
                         info!(
@@ -547,7 +550,7 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                             "Output can only be viewed, not spent, as there is no owner key for view key {}",
                             keys.view_only_key.key_id,
                         );
-                        (mask_and_value.value, OutputStatus::Unspent)
+                        (decrypted.value(), decrypted.memo, OutputStatus::Unspent)
                     }
                 },
                 Err(e) => {
@@ -584,6 +587,7 @@ impl<'a, TStore: WalletStore> StealthOutputsApi<'a, TStore> {
                 owner_key_id: keys.account_key.as_ref().map(|k| k.key_id),
                 encrypted_data: output.output.encrypted_data.clone(),
                 tag_byte: output.tag,
+                memo,
                 status,
                 is_burnt: false,
                 is_frozen,
diff --git a/crates/wallet/sdk/src/apis/stealth_transfer.rs b/crates/wallet/sdk/src/apis/stealth_transfer.rs
index 53afe881f1..aa0f0442ce 100644
--- a/crates/wallet/sdk/src/apis/stealth_transfer.rs
+++ b/crates/wallet/sdk/src/apis/stealth_transfer.rs
@@ -15,6 +15,7 @@ use tari_ootle_common_types::{
     SubstateRequirement,
 };
 use tari_ootle_wallet_crypto::{
+    memo::Memo,
     MaskAndValue,
     UnblindedOutputStatement,
     UnblindedStealthInputStatement,
@@ -456,6 +457,7 @@ where
                     params.blinded_output_amount,
                     &params.resource_address,
                     resource_view_key.clone(),
+                    params.output_memo.as_ref(),
                 )
             })
             .transpose()?;
@@ -474,7 +476,7 @@ where
         // Generate fee change outputs if required
         let fee_change_output_statement = fee_change
             .is_positive()
-            .then(|| self.create_output_statement(&owner_address, fee_change, &params.resource_address, None))
+            .then(|| self.create_output_statement(&owner_address, fee_change, &params.resource_address, None, None))
             .transpose()
             .inspect_err(|e| {
                 warn!(target: LOG_TARGET, "Unlocking fee fund locks after error: {}", e);
@@ -499,7 +501,13 @@ where
         )?;
 
         if let Some(ref fee_change) = fee_change_output_statement {
-            self.add_unconfirmed_output_from_statement(lock_id, &owner_account, params.resource_address, fee_change)?;
+            self.add_unconfirmed_output_from_statement(
+                lock_id,
+                &owner_account,
+                params.resource_address,
+                fee_change,
+                None,
+            )?;
         }
 
         substate_inputs.extend(
@@ -745,10 +753,15 @@ where
                     reason: format!("Invalid owner account address: {e}"),
                 })?;
 
-        let change =
-            self.create_output_statement(&change_address, change_amount, &resource_address, resource_view_key)?;
+        let change = self.create_output_statement(
+            &change_address,
+            change_amount,
+            &resource_address,
+            resource_view_key,
+            None,
+        )?;
 
-        self.add_unconfirmed_output_from_statement(lock_id, account, resource_address, &change)?;
+        self.add_unconfirmed_output_from_statement(lock_id, account, resource_address, &change, None)?;
 
         Ok(Some(change))
     }
@@ -759,6 +772,7 @@ where
         account: &AccountWithAddress,
         resource_address: ResourceAddress,
         output: &UnblindedStealthOutputStatement,
+        memo: Option<Memo>,
     ) -> Result<(), StealthTransferApiError> {
         let output_value = output.statement.amount;
         if output_value.is_zero() {
@@ -779,6 +793,7 @@ where
             owner_key_id: account.owner_key_id(),
             encrypted_data: output.statement.encrypted_data.clone(),
             status: OutputStatus::LockedUnconfirmed,
+            memo,
             tag_byte: output.tag,
             lock_id: Some(lock_id),
             is_burnt: false,
@@ -794,6 +809,7 @@ where
         amount: Amount,
         resource_address: &ResourceAddress,
         resource_view_key: Option<RistrettoPublicKey>,
+        memo: Option<&Memo>,
     ) -> Result<UnblindedStealthOutputStatement, StealthTransferApiError> {
         if !amount.is_positive() {
             return Err(StealthTransferApiError::InvalidParameter {
@@ -817,6 +833,7 @@ where
             &mask.key,
             destination.view_only_key(),
             &nonce_secret,
+            memo,
         )?;
 
         // Create stealth address - used during spend time
@@ -863,6 +880,8 @@ pub struct StealthTransferParams {
     pub blinded_output_amount: Amount,
     /// Amount of the inputs to spend to a revealed output
     pub revealed_output_amount: Amount,
+    /// Optional memo to include a memo in the output. This memo is encrypted and can only be read by the recipient.
+    pub output_memo: Option<Memo>,
     /// Destination address used to derive the UTXO encryption keys, owner signature and the account in which to
     /// deposit revealed funds
     pub destination_address: OotleAddress,
diff --git a/crates/wallet/sdk/src/models/confidential_output.rs b/crates/wallet/sdk/src/models/confidential_output.rs
index 7c2f1eca71..b3776e1c80 100644
--- a/crates/wallet/sdk/src/models/confidential_output.rs
+++ b/crates/wallet/sdk/src/models/confidential_output.rs
@@ -3,10 +3,11 @@
 
 use std::str::FromStr;
 
+use tari_ootle_wallet_crypto::memo::Memo;
 use tari_template_lib::{
-    models::{EncryptedData, VaultId},
+    models::VaultId,
     prelude::{ComponentAddress, PedersenCommitmentBytes, RistrettoPublicKeyBytes},
-    types::Amount,
+    types::{Amount, EncryptedData},
 };
 
 use crate::models::{KeyId, WalletLockId};
@@ -22,6 +23,7 @@ pub struct ConfidentialOutputModel {
     pub owner_key_id: Option<KeyId>,
     pub encrypted_data: EncryptedData,
     pub public_asset_tag: Option<RistrettoPublicKeyBytes>,
+    pub memo: Option<Memo>,
     pub status: OutputStatus,
     pub lock_id: Option<WalletLockId>,
 }
diff --git a/crates/wallet/sdk/src/models/stealth_output.rs b/crates/wallet/sdk/src/models/stealth_output.rs
index 904339001e..9dd3b66174 100644
--- a/crates/wallet/sdk/src/models/stealth_output.rs
+++ b/crates/wallet/sdk/src/models/stealth_output.rs
@@ -1,10 +1,11 @@
 //   Copyright 2025 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
+use tari_ootle_wallet_crypto::memo::Memo;
 use tari_template_lib::{
-    models::{ComponentAddress, EncryptedData, UtxoAddress},
+    models::{ComponentAddress, UtxoAddress},
     prelude::{PedersenCommitmentBytes, ResourceAddress, RistrettoPublicKeyBytes},
-    types::{crypto::UtxoTag, Amount},
+    types::{crypto::UtxoTag, Amount, EncryptedData},
 };
 
 use crate::models::{KeyId, OutputStatus, WalletLockId};
@@ -22,6 +23,7 @@ pub struct StealthOutputModel {
     pub owner_key_id: Option<KeyId>,
     pub encrypted_data: EncryptedData,
     pub tag_byte: UtxoTag,
+    pub memo: Option<Memo>,
     pub status: OutputStatus,
     pub is_burnt: bool,
     pub is_frozen: bool,
diff --git a/crates/wallet/sdk/tests/base_layer_compat.rs b/crates/wallet/sdk/tests/base_layer_compat.rs
new file mode 100644
index 0000000000..1d9350496d
--- /dev/null
+++ b/crates/wallet/sdk/tests/base_layer_compat.rs
@@ -0,0 +1,19 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use tari_ootle_wallet_crypto::memo::Memo;
+use tari_transaction_components::transaction_components::{memo_field::TxType, MemoField};
+
+#[test]
+fn memo_is_compatible_with_bl_memo_field() {
+    let max_len_string = String::from_utf8(vec![b'a'; 254]).unwrap();
+
+    let memo_field = MemoField::new_open_from_string(&max_len_string, TxType::Coinbase).unwrap();
+    let memo_bytes = memo_field.to_bytes();
+
+    let memo = Memo::decode_from(&mut memo_bytes.as_slice()).unwrap();
+    assert_eq!(
+        memo,
+        Memo::new_bytes(memo_bytes[1..=Memo::MAX_BYTES_LENGTH].to_vec()).unwrap()
+    );
+}
diff --git a/crates/wallet/sdk/tests/confidential_output_api.rs b/crates/wallet/sdk/tests/confidential_output_api.rs
index df282d6681..9fd887ba9f 100644
--- a/crates/wallet/sdk/tests/confidential_output_api.rs
+++ b/crates/wallet/sdk/tests/confidential_output_api.rs
@@ -9,7 +9,7 @@ use tari_ootle_wallet_sdk::{
     models::{ConfidentialOutputModel, KeyId, OutputStatus},
     storage::{WalletStore, WalletStoreReader},
 };
-use tari_template_lib::models::EncryptedData;
+use tari_template_lib::types::EncryptedData;
 
 use crate::support::Test;
 
@@ -92,6 +92,7 @@ fn outputs_locked_and_finalized() {
             owner_key_id: Some(KeyId::derived(0)),
             encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
             public_asset_tag: None,
+            memo: None,
             status: OutputStatus::LockedUnconfirmed,
             lock_id: Some(proof_id),
         })
diff --git a/crates/wallet/sdk/tests/crypto_api.rs b/crates/wallet/sdk/tests/crypto_api.rs
index 6ca316ed11..82dc68e810 100644
--- a/crates/wallet/sdk/tests/crypto_api.rs
+++ b/crates/wallet/sdk/tests/crypto_api.rs
@@ -3,9 +3,15 @@
 
 mod support;
 
-use tari_crypto::{commitment::HomomorphicCommitmentFactory, keys::PublicKey, ristretto::RistrettoPublicKey};
+use tari_crypto::{
+    commitment::HomomorphicCommitmentFactory,
+    keys::PublicKey,
+    ristretto::RistrettoPublicKey,
+    tari_utilities::ByteArray,
+};
 use tari_engine_types::{crypto::get_commitment_factory, ToByteType};
 use tari_ootle_common_types::Network;
+use tari_ootle_wallet_crypto::memo::Memo;
 use tari_ootle_wallet_sdk::apis::stealth_crypto::StealthCryptoApi;
 
 use crate::support::{random_key, random_keypair, resource_address_from_seed};
@@ -75,12 +81,16 @@ mod encrypted_data {
         let mask = random_key();
         let (k1, p1) = random_keypair();
         let (k2, p2) = random_keypair();
-        let data = api.encrypt_value_and_mask(amount, &mask, &p2, &k1).unwrap();
+        let memo = Memo::new_message("Hello, world!").unwrap();
+        let data = api
+            .encrypt_value_and_mask(amount, &mask, &p2, &k1, Some(&memo))
+            .unwrap();
         let commitment = get_commitment_factory().commit_value(&mask, amount).to_byte_type();
 
-        let decrypted = api.decrypt_value_and_mask(&data, &commitment, &k2, &p1).unwrap();
+        let decrypted = api.decrypt_value_and_mask(&data, &commitment, &k2, &p1, false).unwrap();
 
-        assert_eq!(decrypted.value, amount);
-        assert_eq!(decrypted.mask, mask);
+        assert_eq!(decrypted.value(), amount);
+        assert_eq!(decrypted.mask().as_bytes(), mask.as_bytes());
+        assert_eq!(decrypted.memo(), Some(&memo));
     }
 }
diff --git a/crates/wallet/sdk/tests/support/harness.rs b/crates/wallet/sdk/tests/support/harness.rs
index 9ef00b2921..dffa3dd067 100644
--- a/crates/wallet/sdk/tests/support/harness.rs
+++ b/crates/wallet/sdk/tests/support/harness.rs
@@ -23,8 +23,9 @@ use tari_ootle_wallet_storage_sqlite::SqliteWalletStore;
 use tari_template_abi::TemplateDef;
 use tari_template_lib::{
     constants::STEALTH_TARI_RESOURCE_ADDRESS,
-    models::{ComponentAddress, EncryptedData, ResourceAddress, UtxoId, VaultId},
+    models::{ComponentAddress, ResourceAddress, UtxoId, VaultId},
     prelude::{Amount, PedersenCommitmentBytes, ResourceType, TemplateAddress},
+    types::EncryptedData,
 };
 use tari_transaction::{Transaction, TransactionId};
 
@@ -106,6 +107,7 @@ impl Test {
                 owner_key_id: Some(KeyId::derived(0)),
                 encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
                 public_asset_tag: None,
+                memo: None,
                 status: OutputStatus::Unspent,
                 lock_id: None,
             })
diff --git a/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql b/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
index b091a7516b..1895ecb7c4 100644
--- a/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
+++ b/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
@@ -152,6 +152,7 @@ CREATE TABLE confidential_outputs
     view_only_key_id    TEXT     NOT NULL,
     owner_key_id        TEXT     NULL,
     public_asset_tag    TEXT     NULL,
+    memo_json           TEXT     NULL,
     -- Status can be "Unspent", "Spent", "Locked", "LockedUnconfirmed", "Invalid"
     status              TEXT     NOT NULL,
     locked_at           DATETIME NULL,
@@ -245,6 +246,7 @@ CREATE TABLE stealth_outputs
     owner_key_id        TEXT     NULL,
     encrypted_data      BLOB     NOT NULL DEFAULT '',
     tag_byte            INTEGER  NOT NULL,
+    memo_json           TEXT     NULL,
     is_burnt            BOOLEAN  NOT NULL DEFAULT 0,
     is_frozen           BOOLEAN  NOT NULL DEFAULT 0,
     is_on_chain         BOOLEAN  NOT NULL,
diff --git a/crates/wallet/storage_sqlite/src/models/confidential_output.rs b/crates/wallet/storage_sqlite/src/models/confidential_output.rs
index 6d3c2df65f..46bd426e4a 100644
--- a/crates/wallet/storage_sqlite/src/models/confidential_output.rs
+++ b/crates/wallet/storage_sqlite/src/models/confidential_output.rs
@@ -2,9 +2,9 @@
 //   SPDX-License-Identifier: BSD-3-Clause
 
 use tari_ootle_wallet_sdk::{models::ConfidentialOutputModel, storage::WalletStorageError};
-use tari_template_lib::{
-    models::EncryptedData,
-    types::crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes},
+use tari_template_lib::types::{
+    crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes},
+    EncryptedData,
 };
 use time::PrimitiveDateTime;
 
@@ -23,6 +23,7 @@ pub struct ConfidentialOutput {
     pub view_only_key_id: String,
     pub owner_key_id: Option<String>,
     pub public_asset_tag: Option<String>,
+    pub memo_json: Option<String>,
     pub status: String,
     pub locked_at: Option<PrimitiveDateTime>,
     pub locked_by_proof: Option<i32>,
@@ -85,6 +86,7 @@ impl ConfidentialOutput {
                     item: "output",
                     details: "Corrupt db: invalid public asset tag".to_string(),
                 })?,
+            memo: self.memo_json.as_ref().map(deserialize_json).transpose()?,
             status: self.status.parse().map_err(|_| WalletStorageError::DecodingError {
                 operation: "try_into_output",
                 item: "output",
diff --git a/crates/wallet/storage_sqlite/src/models/stealth_output.rs b/crates/wallet/storage_sqlite/src/models/stealth_output.rs
index e5a7029e23..d75f150a94 100644
--- a/crates/wallet/storage_sqlite/src/models/stealth_output.rs
+++ b/crates/wallet/storage_sqlite/src/models/stealth_output.rs
@@ -4,10 +4,11 @@
 use diesel::dsl;
 use tari_ootle_wallet_sdk::{models::StealthOutputModel, storage::WalletStorageError};
 use tari_template_lib::{
-    models::{ComponentAddress, EncryptedData},
+    models::ComponentAddress,
     types::{
         amount,
         crypto::{RistrettoPublicKeyBytes, UtxoTag},
+        EncryptedData,
     },
 };
 use time::PrimitiveDateTime;
@@ -33,6 +34,7 @@ pub struct StealthOutput {
     pub owner_key_id: Option<String>,
     pub encrypted_data: Vec<u8>,
     pub tag_byte: i32,
+    pub memo_json: Option<String>,
     pub is_burnt: bool,
     pub is_frozen: bool,
     pub is_on_chain: bool,
@@ -78,6 +80,7 @@ impl StealthOutput {
                 }
             })?,
             tag_byte: UtxoTag::new(self.tag_byte as u32),
+            memo: self.memo_json.as_ref().map(deserialize_json).transpose()?,
             status: self.status.parse().map_err(|_| WalletStorageError::DecodingError {
                 operation: "try_into_output",
                 item: "output",
diff --git a/crates/wallet/storage_sqlite/src/schema.rs b/crates/wallet/storage_sqlite/src/schema.rs
index 5ca4d093d1..083801da62 100644
--- a/crates/wallet/storage_sqlite/src/schema.rs
+++ b/crates/wallet/storage_sqlite/src/schema.rs
@@ -50,6 +50,7 @@ diesel::table! {
         view_only_key_id -> Text,
         owner_key_id -> Nullable<Text>,
         public_asset_tag -> Nullable<Text>,
+        memo_json -> Nullable<Text>,
         status -> Text,
         locked_at -> Nullable<Timestamp>,
         lock_id -> Nullable<Integer>,
@@ -159,6 +160,7 @@ diesel::table! {
         owner_key_id -> Nullable<Text>,
         encrypted_data -> Binary,
         tag_byte -> Integer,
+        memo_json -> Nullable<Text>,
         is_burnt -> Bool,
         is_frozen -> Bool,
         is_on_chain -> Bool,
@@ -254,6 +256,8 @@ diesel::joinable!(confidential_outputs -> vaults (vault_id));
 diesel::joinable!(non_fungible_tokens -> vaults (vault_id));
 diesel::joinable!(shard_state_versions -> accounts (account_id));
 diesel::joinable!(shard_state_versions -> resources (resource_id));
+diesel::joinable!(stealth_outputs -> accounts (owner_account_id));
+diesel::joinable!(utxo_process_queue -> accounts (account_id));
 diesel::joinable!(vaults -> accounts (account_id));
 diesel::joinable!(vaults -> locks (locked_by));
 diesel::joinable!(webauthn_registration_passkeys -> webauthn_registrations (registration_id));
diff --git a/crates/wallet/storage_sqlite/src/writer.rs b/crates/wallet/storage_sqlite/src/writer.rs
index 7fe2095748..66ffdc3719 100644
--- a/crates/wallet/storage_sqlite/src/writer.rs
+++ b/crates/wallet/storage_sqlite/src/writer.rs
@@ -45,10 +45,11 @@ use tari_ootle_wallet_sdk::{
     storage::{WalletStorageError, WalletStoreReader, WalletStoreWriter},
 };
 use tari_template_lib::{
-    models::{ComponentAddress, EncryptedData, NonFungibleId, ResourceAddress, UtxoAddress, UtxoId, VaultId},
+    models::{ComponentAddress, NonFungibleId, ResourceAddress, UtxoAddress, UtxoId, VaultId},
     types::{
         crypto::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, UtxoTag},
         Amount,
+        EncryptedData,
         TemplateAddress,
     },
 };
@@ -947,6 +948,7 @@ impl WalletStoreWriter for WriteTransaction<'_> {
                 }
             })?,
             public_asset_tag: None,
+            memo: locked_output.memo_json.as_ref().map(deserialize_json).transpose()?,
             status: OutputStatus::LockedForSpend,
             lock_id: Some(lock_id),
         })
@@ -978,6 +980,7 @@ impl WalletStoreWriter for WriteTransaction<'_> {
                 confidential_outputs::view_only_key_id.eq(serialize_json(&output.view_only_key_id)?),
                 confidential_outputs::owner_key_id.eq(output.owner_key_id.as_ref().map(serialize_json).transpose()?),
                 confidential_outputs::encrypted_data.eq(output.encrypted_data.as_ref()),
+                confidential_outputs::memo_json.eq(output.memo.as_ref().map(serialize_json).transpose()?),
                 confidential_outputs::status.eq(output.status.as_key_str()),
                 confidential_outputs::lock_id.eq(output.lock_id),
             ))
@@ -1121,6 +1124,7 @@ impl WalletStoreWriter for WriteTransaction<'_> {
                 stealth_outputs::owner_key_id.eq(output.owner_key_id.as_ref().map(serialize_json).transpose()?),
                 stealth_outputs::encrypted_data.eq(output.encrypted_data.as_ref()),
                 stealth_outputs::tag_byte.eq(output.tag_byte.value() as i32),
+                stealth_outputs::memo_json.eq(output.memo.as_ref().map(serialize_json).transpose()?),
                 stealth_outputs::is_on_chain.eq(output.is_on_chain),
                 stealth_outputs::status.eq(output.status.as_key_str()),
                 stealth_outputs::is_burnt.eq(output.is_burnt),
diff --git a/integration_tests/src/wallet_daemon_client.rs b/integration_tests/src/wallet_daemon_client.rs
index 6c7289969f..ffaa62549b 100644
--- a/integration_tests/src/wallet_daemon_client.rs
+++ b/integration_tests/src/wallet_daemon_client.rs
@@ -126,6 +126,7 @@ pub async fn transfer_stealth(
             max_fee: 2000,
             blinded_output_amount: amount,
             revealed_output_amount: Default::default(),
+            output_memo: None,
             dry_run: false,
         })
         .await
@@ -881,6 +882,7 @@ pub async fn confidential_transfer(
         max_fee,
         resource_address,
         proof_from_badge_resource: None,
+        memo: None,
         dry_run: false,
         input_selection: ConfidentialTransferInputSelection::PreferRevealed,
         output_to_revealed: false,
diff --git a/integration_tests/tests/steps/wallet.rs b/integration_tests/tests/steps/wallet.rs
index a127438eb5..7d9cffa35d 100644
--- a/integration_tests/tests/steps/wallet.rs
+++ b/integration_tests/tests/steps/wallet.rs
@@ -13,8 +13,8 @@ use minotari_app_grpc::{
 use tari_engine_types::confidential::{AbridgedTransactionKernel, EncodedMerkleProof, MinotariBurnClaimProof};
 use tari_ootle_wallet_sdk::apis::key_manager::KeyBranch;
 use tari_template_lib::{
-    models::EncryptedData,
     prelude::{PedersenCommitmentBytes, RistrettoPublicKeyBytes, Scalar32Bytes, SchnorrSignatureBytes},
+    types::EncryptedData,
 };
 use tari_transaction_components::{
     tari_amount::T,