§11 Central Bank Digital Currency and Payment Systems

Tension at the fiscal–monetary boundary takes a new technical form in the advance of central bank digital currency (CBDC); this chapter examines that shock.

When Bitcoin was born in 2009, it pointed straight at pain points in existing payment infrastructure: Why do global transfers take days, several intermediaries, opaque fees, and a permission that any node can deny at any time? More than a decade later, that question reached the community of central banks worldwide. The rise of Central Bank Digital Currency (CBDC) is the traditional monetary system’s active response to the digital challenge—an attempt to renew the underlying architecture of payment technology while retaining the core authority of the sovereign monetary system. That renewal will reshape competition in the financial system and continue to contend with the on-chain asset ecosystem. This chapter surveys CBDC’s conceptual spectrum, national practices, and the institutional logic behind them.

Section 1. The Layered Structure and Operating Logic of Payment Systems

Any discussion of CBDC must rest on a clear grasp of existing payment systems. Modern payments are highly layered: final settlement relies on central-bank reserves; everyday transactions run through commercial-bank account systems; payment networks (UnionPay, Visa, Mastercard, SWIFT) connect different account systems as upper-layer intermediaries.

The system runs relatively smoothly in advanced economies, but several structural defects remain. Speed: domestic retail payments in mobile-payment–advanced countries can settle in seconds, but cross-bank and cross-border payments still depend on batch clearing; T+1 or even T+3 cycles are outdated today. Cost: domestic transfer fees in advanced economies have fallen sharply, but the median fee for international remittances remains around 6%, far above acceptable levels; remittance rates in low-income countries are higher still, and those remittances are often an important income source for developing-country households¹. Inclusion: about 1.4 billion adults worldwide remain unbanked, without access to basic financial services, concentrated mainly in Sub-Saharan Africa, South Asia, and Southeast Asia¹. Programmability: existing payment systems cannot natively support conditionally triggered payments, automatic compliance checks, cross-border asset settlement, and other smart-contract functions; the digital economy’s demand for conditional payments and traditional payment infrastructure show a widening rift. Technical roles of payment layering, correspondent banking, and the SWIFT message stack appear in Chapter 8, Section 5; this section only lists the friction inventory that official CBDC narratives target.

“Programmable money” is a pivot concept for the next stage of digital payments. Traditional money is in essence non-programmable: a banknote or a bank transfer carries only amount and payee information and cannot embed any use conditions. Smart-contract money can embed logic: automatically complete payment only after goods arrive at a specified address; embed restrictions: government subsidy vouchers usable only for specified categories of consumption; embed triggers: automatically execute refinancing when rates exceed a threshold. Fisher in Stabilizing the Dollar once imagined periodically adjusting the dollar’s gold content by a wholesale price index so that the monetary unit would carry computable purchasing power rather than a fixed metal weight²—today’s embedded logic of CBDC and on-chain protocols can be read as an extension of that “rules-based money” idea into the digital age. Programmability upgrades money from a single tool of value transfer into a logic layer that can carry complex economic contracts. If CBDC integrates with smart-contract infrastructure, it will produce material efficiency gains in targeted government subsidies, supply-chain finance, conditional payments, and similar scenes, and will open new tool space at the level of monetary-policy implementation—for example, injecting purpose-specific money directly into particular groups, precisely limiting its use, and bypassing inefficient transmission chains.

CBDC’s appearance is cast in official discourse as a technical upgrade solving the problems above—supplying digital cash backed by sovereign credit, bypassing inefficient middle layers, lowering payment costs, and expanding financial inclusion. That positioning should be read as follows: a BIS 2023 survey of 86 central banks found 93% engaged in CBDC work, yet successful cases of large-scale retail replacement of existing account systems remain few³—between technical possibility and institutional landing sit observable bottlenecks such as holding caps, two-tier operation, compliance interfaces, and network effects. Behind official narratives lie more complex strategic considerations: meeting the regulatory challenge of private stablecoins and crypto assets, maintaining monetary sovereignty over payment data, and gaining first-mover advantage in digital-money infrastructure amid geopolitical competition. Whether CBDC can produce statistically significant improvement in remittance costs, unbanked coverage, or cross-border latency must be tested with corridor panels and pilot countries’ active-wallet shares; one cannot read “payment monopoly already broken” straight from a whitepaper roadmap.

Section 2. CBDC’s Conceptual Spectrum and Classification

CBDC is not a single technical scheme but a broad conceptual framework covering multiple technical architectures and policy-design choices. Distinguish these differences before discussing policy effects.

Wholesale CBDC and retail CBDC are the most basic classification. Wholesale CBDC faces financial institutions, used for interbank clearing and financial-market settlement; in essence it digitally upgrades central-bank reserves and may introduce distributed-ledger technology to raise settlement efficiency. This type has almost no direct effect on the general public; it is mainly a technical update of back-office infrastructure among financial institutions, with relatively limited political controversy. Retail CBDC is the type that sparks broad discussion: it faces individuals and firms directly; any citizen can hold a digital wallet “directly” booked at the central bank, bypassing commercial banks as intermediaries of money holding.

Account-based and token-based are another important dimension. Account-based CBDC resembles a digital bank account at the central bank; transactions require real-name identity verification. Token-based CBDC resembles digital cash, held as electronic tokens, transferable anonymously or semi-anonymously, closer to the functional features of physical cash. The two modes differ sharply in privacy protection, compliance monitoring, and AML/KYC difficulty, and therefore diverge sharply in political acceptability.

Direct, indirect, and hybrid classify operating architectures. Direct CBDC is provided by the central bank to the public; the central bank bears all customer relationships and technical maintenance. Indirect CBDC (also called synthetic CBDC or sCBDC) is provided to the public by authorized intermediaries (commercial banks, payment service providers), backed by fully reserved central-bank liabilities; users actually hold private institutions’ liabilities rather than direct claims on the central bank. Hybrid combines the two: the central bank maintains a backup ledger; day-to-day operations are borne by intermediaries. Direct type puts the greatest competitive pressure on commercial banks; indirect type maximally preserves the existing financial architecture; hybrid is a compromise.

Niepelt further aligns the above classifications with policy questions: wholesale CBDC mainly answers whether final settlement must still stack T+1 and correspondent banks; retail CBDC must simultaneously answer whether the public can still convert private deposits at par into public money and whether non-banks can access central-bank liabilities⁴. His 2024 Journal of Finance paper then asks about architecture choice: when banks have market power on the deposit side, optimal CBDC and reserve rates should differentiate, and CBDC’s optimal share in payments may be higher than deposits—unless the social cost of central-bank refinancing to banks is too high⁵. The BIS 2020 seven-central-bank principles and Bindseil’s 2024 survey both stress two-tier operation (central bank issues, private institutions reach users) as the default preference—not a technical necessity, but a way to keep disintermediation risk in an acceptable range: user wallets are maintained by banks or payment institutions; central-bank liabilities remain on the balance sheet, paired with holding caps discussed in Section 4. The BIS 2021 system-design and interoperability report further clarifies engineering constraints: identity, wallet, and ledger layers must separately connect to existing RTGS and card schemes; retail CBDC is an incremental module, not an overnight replacement of the wholesale stack⁶. China’s e-CNY two-tier architecture and the “waterfall mechanism” in ECB legislative drafts (excess CBDC automatically swept back to the bank end) institutionalize this approach. On-chain protocol readers easily take “bypassing banks” as pure technical gain; academic dialogue reminds us that which layer is bypassed—the retail interface, credit creation, or central-bank final settlement—has sharply different consequences.

Section 3. Major CBDC Practices Worldwide

As of 2026, more than 130 countries are researching, piloting, or launching CBDC to varying degrees, covering over 95% of global GDP. The BIS 2023 survey of 86 central banks shows 93% engaged in CBDC work, more than half in pilot or advanced development—a share unimaginable when the BIS issued its first joint-principles report in 2020³. Boar, Holden, and Wadsworth’s 2021 prior survey of the same cohort already showed an inflection: about 86% of central banks in active research or experiment, 60% running proofs of concept or pilots—CBDC shifted rapidly from “whether” to “how”⁶. Several representative practices deserve deeper analysis.

China’s e-CNY is to date the largest and most mature retail CBDC deployment. The People’s Bank of China began research in 2014 and launched a series of pilots from 2020 in Shenzhen, Shanghai, Beijing, and other major cities. e-CNY adopts a two-tier operating architecture: the PBOC issues; commercial banks and some payment institutions operate, providing digital wallets and everyday payment services to the public. The technical design is “controllable anonymity”—small amounts anonymous (protecting personal privacy), large amounts real-name (meeting AML requirements). e-CNY is explicitly positioned as a digital form of cash, pays no interest, and mainly aims to raise retail payment efficiency, lower cash-management costs, and, at a deeper level, strengthen control over cross-border payment data.

The Bahamas Sand Dollar, formally launched in October 2020, was among the world’s earliest fully launched national retail CBDCs. Its background is the Bahamas’ archipelagic geography: dispersed islands make physical cash distribution costly; many residents (especially on remote islands) lack banking services. The Sand Dollar is accessible via mobile phone, lowering the threshold for financial services—a classic case of CBDC as an inclusion tool. Limited by the Bahamas’ economic scale, its systemic impact is relatively limited.

The ECB’s digital euro project has progressed relatively cautiously. The ECB began a two-year investigation phase in 2021, entered preparation in 2023, and is not expected to reach actual deployment before 2027–2028. European concerns about CBDC concentrate on two points: impact on the commercial-banking system, and privacy (European public expectations for financial-data privacy are far higher than in Asia; government control of payment data is viewed with high vigilance). Digital-euro design principles explicitly include offline payment capability (no network needed, closer to cash) and holding caps (preventing excessive deposit substitution).

Nigeria’s eNaira, launched in October 2021, was Africa’s first national CBDC. Adoption has been disappointing: an IMF 2022 country report citing central-bank data shows about 8.4 million cumulative wallet registrations by August 2022, but monthly active transaction counts long stayed low—the IMF estimates the share of population in actual daily use on the order of about 0.5%, far below mobile payments and dollar stablecoins locally⁷. Causes include lack of use cases, technical instability, and mismatch with existing mobile-payment habits. The case supplies an important warning: between government’s capacity to launch CBDC and the market’s willingness to adopt lies an observable gulf; technology-first deployment without real use cases and user incentives tends toward idle fate.

eNaira’s failure is not unique; it reflects a basic law of monetary economics: money’s value comes from wide use; to be widely adopted, users must first believe others will also adopt. Fernández-Villaverde and Sanches (2019) in the International Economic Review formalize this coordination dilemma: a new payment medium must cross a critical network size—before the threshold, private adoption incentives are insufficient; if government cannot supply a strong enough initial anchor (tax, subsidy, compulsory settlement), CBDC can long remain in a “registered but unused” equilibrium⁸. That does not contradict Keister and Monnet’s more optimistic conclusion that CBDC reduces normal maturity mismatch: the latter discusses financial stability after adoption; the former discusses whether adoption occurs—Nigeria’s eNaira is stuck at the latter. Government can push initial adoption by compulsion (e.g. taxes paid in CBDC) or incentive (e.g. subsidies disbursed via CBDC), but the degree of compulsion determines how “real” CBDC penetration is. Digital payment tools that truly gained mass use in Nigeria have often been mobile apps and dollar stablecoins that solve users’ real pain points, not policy-driven CBDC—eNaira’s lesson: without real scenes and incentives, technical deployment alone does not buy adoption. Observable contrasts include: pilot-country CBDC active wallets as a share of M2 or adult population; whether corridor remittance costs fall significantly because of CBDC; whether on-chain stablecoin receive intensity in high-friction economies is systematically higher than CBDC penetration—if any of the three fails to improve, the claim “CBDC has rewritten the payment monopoly” is unsupported; only “the sovereign is experimenting” is supported.

Section 4. CBDC’s Impact on the Commercial-Banking System

Retail CBDC’s most contested policy effect is structural impact on the existing commercial-banking system. In the current system, personal savings are held as deposits at commercial banks; banks use those deposits as funding and, through credit creation, lend to households and firms—the economy’s primary credit intermediaries. If retail CBDC is convenient to use, free of credit risk (central-bank liabilities have no commercial-bank failure counterparty risk), and offers competitive store-of-value features, large-scale migration of funds from bank deposits to CBDC wallets becomes a reasonable expectation.

This deposit disintermediation risk can be described numerically at stress-test magnitude (not a forecast): if only 5% of China’s household deposits migrated to e-CNY, then on PBOC 2024 financial-institutions credit-receipts-and-payments household deposits of about RMB 150 trillion, about RMB 7.5 trillion would be involved; if some corporate demand deposits are included, the order of magnitude can approach RMB 12 trillion—this book takes the latter as a tail-scenario illustration⁹. Contraction of the deposit base would directly compress banks’ lending capacity, possibly triggering credit contraction and higher rates, contrary to CBDC’s original aim of raising payment efficiency. Fisher already stressed in 1911 that check deposits and coin jointly constitute the circulating medium; deposit migration changes the entire credit-creation structure, not merely payment technology¹⁰. For smaller banks, deposit disintermediation may trigger liquidity crisis and then systemic financial risk.

In a financial crisis, CBDC’s deposit-disintermediation effect may amplify sharply, forming new systemic fragility. If public confidence in commercial banks falls, the incentive to hold CBDC (credit-risk-free central-bank direct liabilities) rather than bank deposits (with counterparty risk) can surge, potentially triggering an extreme “digital bank run.” Keister and Monnet’s model reminds us that this concern is correct in direction, unsettled in net effect—CBDC availability reduces banks’ normal maturity mismatch, partly offsetting run exposure; but instant migration of funds to CBDC in crisis can still serve as a signal of weak banks, shortening the supervisory response window¹¹. In traditional banking, withdrawals are constrained by physical conditions (ATM networks, business hours, counter queues), objectively buffering the speed of panic transmission. If CBDC is provided as a mobile app, funds can move in seconds; panic transmission is orders of magnitude faster than traditional runs, and the time for systemic pressure to accumulate shrinks sharply—unless holding caps, waterfall mechanisms, and tiered remuneration make CBDC inferior to bank deposits at the margin, “digital run” tail risk must be modeled separately in stress tests¹². This is a systemic-risk dimension of CBDC design not yet fully researched; central banks designing holding caps and technical architecture need to bring this scenario into stress-test frameworks rather than leave it for future crises to test.

Central banks have designed various “anti-disintermediation” mechanisms against this risk: caps on individual CBDC holdings (the ECB proposes €3,000 per person; early e-CNY pilots set similar limits); paying no interest on CBDC (reducing its attraction as a store of value); under indirect architectures, ensuring commercial banks remain the user interface (preserving customer relationships and some profit sources). These measures to some extent weaken CBDC’s potential benefits, yet are necessary compromises for financial-system stability.

Bindseil and Auer et al.’s survey of the disintermediation literature notes that shock size depends heavily on whether CBDC resembles cash or deposits—if interest-bearing and uncapped, some models show euro-area CBDC as a share of broad money reaching double digits; if non-interest-bearing with a per-person cap of about €3,000, total absorption is on the order of €1 trillion, with possibly limited marginal effects on bank net interest margins and credit supply, but higher crisis-tail sensitivity to holding caps and rate design¹². Brunnermeier, James, and Landau’s work on “the digitalization of money” adds a platform dimension: when large tech platforms bundle payments, data, and credit, bank liabilities may be eroded not only by CBDC but by “in-platform closed-loop money”; retail CBDC is here envisioned as a public option to maintain unit-of-account unity and monetary sovereignty—forming triangular competition with private stablecoins and on-chain public-domain money (VRC-10) for the “default dollar” in emerging markets, not a simple “state vs crypto” binary.

The deeper question: in the macro-policy framework, are CBDC and the commercial-banking system complements or substitute competitors? If the central bank decides to provide uncapped CBDC deposits to the public and pay interest on them, the central bank in substance becomes a giant “commercial bank,” squeezing private banking and changing the whole financial system’s credit-allocation mechanism—Sargent and Wallace’s (1981) unpleasant monetarist arithmetic may appear faster in this scenario: in high-debt regimes, interest-bearing CBDC attracts the public to hold central-bank liabilities, fiscal financing pressure rises, and the central bank is forced to accommodate with inflation¹³. Leeper (1991) and Woodford (1996) formalize the same logic: under “active fiscal, passive monetary” equilibria, public-debt expansion is more likely to be validated by a rising price level than by tax adjustment—interest-bearing, uncapped retail CBDC amounts to writing unpleasant arithmetic onto the digital ledger¹⁴. This is the outcome most CBDC designers explicitly try to avoid, but “what counts as enough complement rather than excessive substitute” has no clear technical boundary.

Section 5. The Regulatory Logic of Payment Licenses and the Interest Landscape

Access qualifications for payment systems are strictly regulated. Obtaining a payment license means being allowed to provide customers with money-movement services; this entry barrier takes different forms in different countries: U.S. money-services business (MSB) licenses, China’s payment-business permits, EU payment institution (PI) and electronic-money institution (EMI) licenses. These permits are not only legal requirements of regulatory compliance but also critical moats of market competition.

The official logic of payment licensing is: payment systems carry massive fund flows; once a payment provider fails or mismanages, customer funds face loss risk and systemic financial risk may spread. Strict capital requirements, reserve-management rules, operating standards, and periodic audits aim to ensure licensed institutions have sufficient financial soundness and compliance capacity. From this angle, payment licensing is a necessary institutional design for financial consumer protection and system stability. Friedman, discussing the roots of inflation, noted that only government monopoly of the central bank and the printing press can create monetary expansion beyond output; firms and households lack that power¹⁵—payment-access licensing, in a sense, extends the state’s monopoly control over money creation and transfer channels.

Yet payment licensing is also a protective device for the existing interest landscape. Licensed large banks and payment institutions have built complex compliance infrastructure over years and can easily clear entry hurdles; startups and nontraditional actors entering the payment market face compliance investment and approval cycles that form substantial barriers to entry. National regulators generally show caution or even resistance when issuing payment licenses to crypto-asset firms; the official reason is AML/CFT risk, but critics note that this caution also conveniently protects traditional financial institutions from competitive shock. Historically, every major technical change in financial services has been accompanied by lagged adaptation of the regulatory framework: credit cards, ATMs, internet banking, mobile payments—all without exception moved from regulatory confusion to gradual normalization, eventually finding institutional equilibrium in competition. Crypto payment protocols are in the early stage of this adaptation; the ending is unpredictable, but the direction is more likely finer licensing than total blockade.

As CBDC advances, the payment-license landscape is being reshaped. On one hand, indirect CBDC architectures require that non-bank payment institutions can also become authorized operators, partly opening channels for non-banks into core payment rails; on the other, CBDC launch may further strengthen scrutiny standards for access institutions on “systemic importance” grounds, forming higher thresholds. Stablecoin issuers and crypto payment platforms face rising compliance pressure in multiple major jurisdictions; regulatory-arbitrage space is narrowing. For blockchain payment protocols, obtaining payment-system access within bearable compliance cost is a necessary gate from technical experiment to real scaled deployment.

Section 6. Intersection and Tension Between On-Chain Assets and CBDC

CBDC and on-chain assets (including stablecoins, native tokens, and tokenized real-world assets) do not evolve in two parallel universes. They collide at multiple functional junctions—payment settlement, asset custody, and currency conversion—with both collaborative possibilities and deep institutional competition.

In cross-border payments and settlement, CBDC and on-chain stablecoin paths may converge. The BIS-led mBridge project (a multilateral wholesale CBDC platform involving the Hong Kong, Thai, UAE, and Mainland Chinese central banks, among others) entered a minimum viable product phase in 2024 after a 2022 proof of concept: multiple countries’ CBDCs perform PvP (payment-versus-payment) atomic settlement on the same distributed ledger, aiming to compress cross-border payments from days to seconds and reduce dependence on correspondent networks¹⁶. Project Dunbar (Australian, Malaysian, Singaporean, and South African central banks, 2022 PoC) and Project Aber (Saudi and UAE dual-central-bank wholesale CBDC, 2020 PoC) supply complementary samples: Dunbar validates shared clearing logic under a multi-CBDC platform; Aber validates cross-border PvP by dual issuers on the same ledger—together with mBridge they show that sovereign paths’ interoperability experiments at the wholesale layer lead the retail layer by years⁶. The BIS 2023 Future of the Monetary System report lists this alongside tokenized deposits and unified ledgers as three main lines of “next-generation financial infrastructure”—wholesale CBDC handles final settlement among central banks; on-chain stablecoins handle permissionless retail cross-border; the two overlap functionally in “remittance and trade settlement,” but diverge on compliance and sovereign control. Niepelt warns that allowing non-residents to hold domestic retail CBDC may introduce new channels for cross-border arbitrage and exchange-rate transmission; mBridge’s choice of the wholesale layer keeps spillovers within the interbank sphere. Bahaji and Prat’s ECB research on cross-border payments further notes that CBDC–stablecoin corridor competition turns less on technical speed itself than on whether compliance interfaces and FX liquidity close—if on-chain assets cannot connect to wholesale CBDC hubs, they must still “land” via bank gateways¹⁷. For VRC-10 and similar protocols, mBridge is not a direct competitor but a reference for standardizing the sovereign clearing layer: if interoperability interfaces are closed, on-chain assets must still land through banks or compliance gateways; if APIs open, protocol settlement may coexist with wholesale CBDC hubs—depending on whether regulation accepts “on-chain state as final settlement,” still to be tested by regulatory and judicial practice.

In tokenized-asset settlement, wholesale CBDC is seen as the most promising atomic settlement medium. Once bonds, equities, real estate, and other real assets are tokenized, settlement theoretically needs a monetary form that runs on the same digital rail as the tokenized assets to complete delivery-versus-payment. If traditional bank transfers are used, settlement still occurs across two separate systems and friction remains. If wholesale CBDC interoperates with tokenized-asset platforms, true instant atomic settlement becomes possible, eliminating counterparty risk. This application scene is logically promising and is a direction actively pursued by major financial centers.

Tension exists mainly at the retail layer. On-chain stablecoins (especially dollar stablecoins) already provide convenient digital-dollar holding and transfer services to millions of users worldwide, especially in emerging markets with strong dollarization tendencies—Chainalysis’s 2024 Geography Report shows Argentina, Turkey, and other high-inflation economies with on-chain stablecoin receive intensity well above the global mean, yet penetration still far below everyday retail fiat¹⁸, a technically feasible fragment, not sufficient evidence that “private dollars have replaced domestic currency.” If CBDC forcibly replaces private stablecoins that already have network effects on grounds of defending monetary sovereignty, it may trigger fierce regulatory–market conflict. Friedman and Schwartz’s historical research shows that when monetary authorities fail to prevent sharp contraction of the money stock, real recession often deepens¹⁹—if retail CBDC triggers deposit disintermediation and credit contraction, its macro consequences are not essentially different from the path the quantity theory of money warns against. On the other side, VRC-10 (Bitcurrency, public-domain money standard; PCIM competitively issued with Bitgold dynamic-tier overcollateralization (circulation-triggered referenda, upper tier about 161.8%, $C_0>100\%$)) and the VRC-11 private-domain layer must be stratified (parameters in the glossary); Openverse and similar protocols, on whitepaper terms, keep functional independence from any sovereign CBDC—issuance rules readable on-chain, decoupled from political power; whether they coexist with CBDC in interoperability and compete with sovereign money in narrative awaits mainnet scale and regulatory precedents, and should not be cast as an oppositional ending straight from a whitepaper. How this competitive landscape evolves will largely shape the digital-money ecosystem’s map over the next decade—possibility must be tested with penetration, corridor costs, and compliance-interface coverage, not fixed a priori.

Section 7. Regulatory Contests and the Reordering of Monetary Order

CBDC’s advance is not only a payment-technology upgrade but a deep contest over future monetary-order leadership. Participants include: national central banks (seeking to maintain sovereign-money status), commercial banks (seeking to protect deposit bases and payment profits), tech firms and payment platforms (seeking to convert technical advantage into access rights to the monetary system), and on-chain protocol communities (seeking to challenge permissioned access systems with open standards).

From a geopolitical dimension, CBDC competition is evolving into a national version of the digital-money standards contest. The dollar system’s global dominance rests to a considerable degree on the SWIFT message network and U.S. financial institutions’ control of correspondent networks—SWIFT’s technical position and message–RTGS layering (see Chapter 8, Section 5); Western countries’ 2022 SWIFT restrictions on some Russian banks showed that this infrastructure can be mobilized as a geopolitical tool, and also pushed more countries to assess diversification of payment infrastructure—this is an observable event, not proof that the dollar clearing system has already been replaced. Brunnermeier and Landau’s 2022 digital-euro study commissioned by the European Parliament operationalizes monetary sovereignty as: in domestic contracts and retail payments, the unit of account and final settlement remain anchored by domestic public money, not implicitly replaced by global stablecoins or foreign platform money²⁰. Cross-border promotion of e-CNY is read by some analysts as potential infrastructure that may bypass the dollar clearing system—wholesale CBDC experiments such as mBridge have shown technical possibility of second-level PvP, but retail-layer share, non-resident holding rules, and FX liquidity interfaces still determine actual spillovers; if the EU digital euro achieves scaled deployment within the euro area, on whitepaper terms it could strengthen the euro’s de facto monopoly in member payment systems. These deployment logics if realized may reshape the global monetary pattern of “dollarization” at the technical level—until then, they should be read as sovereign experimentation and standards competition, not completed order reordering.

Blockchain payment protocols’ distinctive geopolitical attribute is that their design itself belongs to no sovereign state. Bitcoin nodes are distributed within countries and each subject to territorial law, but their accounting and clearing rules do not depend on any single jurisdiction’s licensed clearing infrastructure—no country’s node enjoys a privilege to veto network-wide transactions; stablecoin transfers on Ethereum likewise need no clearing node approved by any state. VTP (Value Transfer Protocol), on the Openverse roadmap, pursues on whitepaper terms decoupling of value-transfer paths from any single country’s financial infrastructure—whether it is realized, and whether “landing” is still required before compliance gateways, awaits interoperability tests and regulatory precedents. This denationalized neutrality is both a source of political attraction and the greatest resistance it faces in major countries’ regulatory frameworks: no major country is willing to accept a monetary order in which it “cannot sanction other countries through the payment system”—because that means abandoning an extremely effective foreign-policy tool.

CBDC advance gives on-chain protocol communities two simultaneous pulls: large-scale sovereign experimentation on ledgers, contracts, and cross-border wholesale rails supplies a comparable reference for open standards; if the retail layer squeezes private stablecoins that already have network effects by compulsory means, it directly compresses on-chain protocols’ operating space. Whether the two tracks can coexist at interoperability interfaces depends on whether regulation accepts “on-chain state as final settlement”—Section 6’s contrast of mBridge and VRC-10 is a concretization of that interface question.

Section 8. The Privacy Dilemma and Design Boundaries of Digital Cash

Among all CBDC policy discussions, privacy is the dimension of highest public concern and most intractable institutional design. A rarely stated but widely cherished property of physical cash is its anonymity: when you buy anything with cash, the merchant knows only how much was received, not who you are; the bank does not know your purchasing habits; the government does not know your consumption records. That anonymity is a deliberately retained social function, not a technical bug—it protects individuals from discrimination based on consumption preferences, protects political dissenters from being tracked by donation records, and protects ordinary citizens from ubiquitous financial surveillance.

If retail CBDC is deployed in an account-based design requiring full real-name identity authentication, the central bank (or its authorized institutions) will hold every transaction record: when, where, to whom, how much. Technically, this is unprecedented financial-surveillance capacity. Supporters argue it can greatly raise AML and CFT efficiency and reduce tax evasion, corruption, and illicit transactions; critics note that any large-scale database held by government may be abused—whether for commercial data analysis, tracking political dissent, or future administrations using it to suppress opposition. The disagreement falls at the level of political institutions; technology itself cannot guarantee that power will not be abused.

In the EU’s digital-euro design, “protecting payment privacy” is explicitly listed as a core design principle, and offline payment schemes based on hardware secure elements are explored (users hold CBDC balances on local devices; offline transfers need no network verification, achieving near-cash privacy protection). Bindseil and Panetta’s 2021 occasional paper calls this design tiered privacy: small offline amounts anonymous, large online amounts auditable—alongside holding caps and waterfall mechanisms in digital-euro legislative drafts as “control devices,” aiming to draw a line between AML and cash-like anonymity rather than all-or-nothing²¹. Auer, Cornelli, and Frost in a BIS quarterly survey remind that the default state of account-based retail CBDC is fully chain-traceable—if legislation does not clearly provide offline/token options, privacy protection will be weaker than cash and far stronger than bank secrecy for deposits²¹. The scheme is technically feasible but faces challenges at the compliance-supervision layer: if offline payments are fully anonymous, they bypass AML/KYC requirements, and regulators are highly alert. Finding an acceptable balance between privacy protection and compliance monitoring is among the hardest political-technical problems in CBDC design.

On-chain privacy protocols (such as Zcash’s zk-SNARKs, Monero’s ring signatures, and Ethereum Layer-2 privacy applications) offer another approach: cryptographically protect transaction privacy while, when necessary, allowing authorized parties (regulators, court orders) to selectively disclose specific transaction information. This “optional disclosure” design tries to draw a finer boundary between personal privacy and lawful supervision. Whether governments accept it depends on whether power is willing to accept cryptographic constraints—a political choice, not a technical one. The tug-of-war between privacy rights and regulatory transparency will be a main line of digital-money policy debate over the next decade; the equilibrium can only emerge slowly through repeated contests among legislation, technology, and civil society, and will not be fixed unilaterally by any single side.