Would this work? https://en.wikipedia.org/wiki/GNU_Taler
I have my doubts:
"designed to be anonymous for the payer, but payees are always identified"
Why not anonymity for both sides?