Privacy in digital central bank money: trade-offs

A central bank digital currency, or CBDC, is a digital form of a country's money issued directly by its central bank. Unlike a bank deposit, it would be a liability of the central bank itself. Because it could be used for everyday payments, a general-purpose version would generate a large record of who paid whom, when and for what. That record is the source of the privacy debate. Some people see a digital currency as a convenient public service. Others see a possible tool for watching citizens. Both views are held sincerely, and both point to the same design question: who can see which part of the payment trail, and under what rules? Nothing here has been settled, and no single design is assumed. The same question comes back wherever the idea is studied.

Design papers describe a few building blocks. In an intermediated model, banks and payment firms deal with customers, check identities and run wallets, while the central bank keeps the core ledger. This keeps the central bank away from daily customer contact. Identity verification would be required for most users, to meet anti-money-laundering rules. Privacy can then be handled in layers. The intermediary may see a customer's activity, the central bank may see only totals or pseudonymous records, and law enforcement may gain access through a legal process. A 2022 discussion paper from a national central bank set out one such design, privacy-protected, intermediated, widely transferable and identity-verified, without taking a policy decision.

Consider a made-up shopper named Lena who pays for groceries and a gym membership with a digital currency wallet from her bank. The bank sees both payments because it runs her wallet and must know who she is. The shop sees that a payment arrived but not her full balance. The central bank sees that the system processed many payments but, in this design, not her name. Later an investigator suspects a different customer of fraud and obtains a court order, which lets the bank reveal that customer's records. Lena's records stay with her bank. Her privacy depends less on the technology than on the rules about who may ask for data and who may grant it.

Several tensions explain why privacy is hard to promise. A system with full anonymity would make it easier to hide money laundering, tax evasion and fraud. A system with full transparency would let officials, hackers or insiders reconstruct someone's life from payment data. Anything in between needs trusted parties and clear limits, and trust can fail through leaks, misuse or a change of law. Security analysts also note that a general-purpose digital currency would hold sensitive personal and transaction data, which makes it an attractive target for attackers. The International Monetary Fund notes that privacy here is partly a political and social question, and that privacy and crime prevention pull in opposite directions without a complete fix.

A reader can judge any specific proposal by asking a handful of questions. Which organizations hold identity data, and which hold payment records? Is the data kept in one central place or spread across intermediaries? Who may request access, and does a court have to approve it? Are small everyday payments treated differently from large ones? Is there a legal limit on how long records are kept? Can a user hold some value offline, with no network record at all? Does a published privacy law, or an independent oversight body, cover the system? The answers differ from one proposal to the next, so a general statement about digital central bank money rarely applies to a particular country.

Central banks, the Federal Reserve system and the International Monetary Fund have published discussion papers and security notes on these questions, and some national authorities run public consultations. Reading them shows how many choices remain open. This page does not argue for or against any digital currency, does not predict whether any country will issue one, and does not describe what a specific system would record. It is general education, not legal or financial advice. The sources below contain the original discussion of design options, security considerations and the policy trade-offs in each area, so a reader can follow the reasoning directly and judge any later proposal against it.

• Privacy in digital central bank money depends on who holds identity data, who holds payment records and who may request access
• Strong privacy and strong crime prevention pull against each other, and no design removes the conflict
• Intermediated designs keep customer contact with banks and payment firms, not with the central bank