🏛️ Central bank digital currencies

What a CBDC is, and what almost everyone mislabels as one

A central bank digital currency (CBDC) is a claim on the central bank, denominated in the national unit of account and held in digital form. It is made available to parties that normally have no access to the central bank's balance sheet. What sets a CBDC apart from other payment instruments is the issuer of the claim, not its technical form. A bank account balance is a claim on a commercial bank. A stablecoin is a claim on its private issuer. A banknote and a CBDC are claims on the central bank. Implementation choices, such as the underlying technology, the use of a distributed ledger, or a mobile app, vary from project to project. None of them is part of the definition.

Bakong is Cambodia's national payment system. The National Bank of Cambodia has run it since 2020 on distributed ledger infrastructure (Hyperledger Iroha), in both riels and dollars. It processed 1.325 billion transactions in 2025 (National Bank of Cambodia). The press routinely calls it the world's most widely adopted CBDC. Yet the balances that move through it are tokenized commercial bank deposits, not central bank money. Bakong is a national payment system run by the central bank and a major tool for de-dollarization, but it does not meet the definition of a CBDC.

• “CBDC” ≠ “blockchain”: the Sand Dollar, JAM-DEX, and the eNaira run on a variety of architectures. Brazil's Drex, for its part, dropped much of its DLT component in late 2025, citing maintenance costs and unresolved privacy issues, and moved to a more centralized model.
• “CBDC” ≠ “instant payment”: PIX, UPI, PromptPay, and SEPA Instant settle in commercial bank money, with final interbank settlement in central bank money. None of them is a CBDC.
• “CBDC” ≠ “tokenized deposit”: Fnality (the Sterling Fnality Payment System, live since 2023) backs its tokens with an omnibus account at the Bank of England. The central bank tokenizes nothing; it holds the collateral. Partior (a 2021 joint venture of J.P. Morgan, DBS, and Temasek) and Citi Token Services (2024) tokenize bank deposits.
• “CBDC launched” ≠ “CBDC adopted”: only three countries have issued a retail CBDC beyond the pilot stage, and none of the three has met its usage targets. Most of this guide is about that gap.

Where CBDCs actually stand: 146 jurisdictions, three launches, one ban

Three separate counters track CBDC deployment: the number of jurisdictions exploring one, the number of pilots under way, and the number actually issued. Their orders of magnitude are worlds apart. Almost every central bank in the world is working on a CBDC; almost none has issued one. Only three retail CBDCs have moved past the pilot stage, in the Bahamas, Jamaica, and Nigeria, and all three tell the same story. The systems work, but none has met its usage targets. One monetary union has shut its CBDC down, another central bank has ended its pilot, and the world's largest economy has banned itself by law from issuing one.

Central banks' stated motives have shifted in recent years. More than one jurisdiction in three says it has sped up its CBDC work because of the growth of stablecoins and crypto-assets (BIS, 2024 survey). The decline of cash, long cited as the main reason, has given way to competition from private digital money. The shift shows in the projects actually under way: fewer consumer wallets and far more wholesale settlement infrastructure than in the previous wave.

Retail and wholesale: two projects with the same name and nothing in common

The term CBDC covers two distinct instruments. They share neither users, nor risks, nor timelines, nor even the problem they solve. A retail CBDC puts central bank money in the hands of the public, so it affects the structure of bank deposits, privacy, and legal tender. A wholesale CBDC gives financial institutions a settlement token in central bank money that works on programmable platforms. It involves only institutions that already hold an account at the central bank, so it raises no disintermediation issue. The acronym is all the two instruments have in common, and several central banks pursue one without the other.

Wholesale CBDC has moved beyond lab experiments. The only wholesale CBDC in the world issued in live value and used to settle tokenized securities transactions is Project Helvetia Phase III. The Swiss National Bank has run it since 2023 with SIX Digital Exchange and the BIS. Its settlements are legally final. This case alone refutes the claim that no wholesale CBDC has ever been issued.

Direct, intermediated, platform: who owns the customer

Retail CBDC distribution follows one of three architectures. They differ in who holds the account or wallet and who faces the customer. The choice determines who handles onboarding, who pays for the app, who sees the data, and whether PSPs have any role at all. In the direct (one-tier) model, the central bank holds the accounts and deals with the public. In the intermediated (two-tier) model, the central bank issues and licensed intermediaries distribute, exactly as with banknotes. The platform model is a variant of the two-tier model: the central bank deliberately runs only the core system and leaves the entire customer interface to the private sector.

The intermediated model splits costs in a way that works against the distributor. The central bank issues a claim on itself for free and leaves private firms to bear the cost of onboarding, the app, customer support, and fraud prevention. The instrument generates no float, no deposits, and no interest. An intermediary therefore carries the cost of distribution without the revenue a deposit base usually brings. That is why intermediary compensation is a major issue in the European debate, and the question of who pays for distribution arises in the same terms in other CBDC projects.

• Israel lets non-banks in. The preliminary design of the digital shekel, published by the Bank of Israel in March 2025, adopts a two-tier model open to non-bank intermediaries. That design choice shifts value directly toward PSPs.
• Singapore took a different route. The Monetary Authority of Singapore's Project Orchid (2021) did not recommend a retail CBDC. It produced a Purpose Bound Money protocol that applies to tokenized deposits and stablecoins: the goal was programmability, not a new issuer.
• Japan is moving slowly, on purpose. After two proof-of-concept phases (2021–2023), the Bank of Japan has been running a Pilot Program with a CBDC Forum since April 2023. It explicitly makes any issuance conditional on legislation and public debate.
• Ghana never rolled it out. The Bank of Ghana's eCedi, announced in June 2021, designed with Emtech, and billed as able to pay offline, never left the pilot stage in a country where mobile money already handles most retail payments.

Holding limits, waterfalls, and remuneration: the three parameters that decide everything

A retail CBDC with no holding limit would expose the banking system to a massive outflow of deposits. Under stress, nothing would stop a depositor from instantly moving an entire account balance into an asset with no counterparty risk, available 24/7 and backed by the central bank. That digital run risk is why every serious retail CBDC project builds in brakes on holdings. Those brakes shape the payment experience, the transaction failure rate, and the commercial viability of the whole system.

LIMIT = 3000.00          holding limit tested by the ECB (closing report, Oct. 2025)

--- INCOMING PAYMENT (waterfall) ---------------------------------
cbdc_balance    = 2850.00
amount_received =  400.00
headroom        = LIMIT - cbdc_balance = 150.00

  if amount_received <= headroom:
      credit the full amount in CBDC
  else:
      credit 150.00 in CBDC
      sweep  250.00 to the linked bank account      <-- WATERFALL
      -> ONE transaction for the payer, TWO entries to reconcile

--- OUTGOING PAYMENT (reverse waterfall) -------------------------
cbdc_balance    =   40.00
amount_due      =  120.00
shortfall       =   80.00

  pull 80.00 from the linked bank account            <-- REVERSE WATERFALL
  then pay 120.00 in CBDC

  BREAKING POINT: if the linked account is unavailable,
  the CBDC payment fails even though the holder "had the money".
  This case needs its own failure code and its own fallback flow.

Outside the euro area, the limits under discussion differ in both scale and logic. For the digital pound, the Bank of England has floated a holding limit of around £10,000. In China, a management framework that took effect on January 1, 2026 brings the e-CNY closer to deposit money that could pay interest, whereas until then it had been designed as a simple substitute for banknotes. That shift radically changes the question of competition with bank deposits, since an interest-bearing instrument competes head-on with a bank account. Kazakhstan comes at the issue from another angle. The National Bank of Kazakhstan has piloted the digital tenge since 2023 with the National Payment Corporation. The central bank's governor describes it as a tool for transparency and control over public sector transactions (Astana Times, November 2025), not as a general-purpose retail payment method.

• A holding limit creates a new failure code that exists nowhere in the card world: “payee at limit.” It has to be handled on the acceptance side, not passed through raw to the merchant.
• The waterfall doubles the entries. A single incoming payment can generate two movements on two different instruments, and merchant reconciliation has to match both to one order.
• The reverse waterfall creates an external dependency on the linked bank account, with its own availability and operating hours. A CBDC payment's SLA can be no better than the linked account's.
• A ban on holdings by legal entities, pushed by the European Parliament, requires automatic, immediate conversion whenever a payment comes in: the merchant never holds a CBDC balance.

Privacy, offline payments, and programmability: where the real debate is

A CBDC is the only payment method whose political acceptability depends on a technical property of the system: what the state can see of payments. Serious projects are explicitly designed so the central bank does not hold users' identities. In the digital euro design, the Eurosystem processes pseudonymous identifiers, and the ECB states that it “will not be able to link a transaction to a natural person” (report closing the preparation phase, October 2025). Identity stays with the distributing intermediary, which already holds it for its AML/CFT obligations.

An offline payment is a transaction settled directly between two devices, with no network connection. It is the hardest building block, and the one that matters most. It relies on a secure element built into the device, which stores the value and transaction details locally. No server is involved. It is the only mode that offers privacy comparable to cash, and the only one that lets people pay when the network is down. That resilience justifies a large share of the public investment. The price is exposure to double-spending risk that only hardware can contain, and reconciliation that is necessarily deferred. In the European negotiations, the Council requires that payers be able to choose between online and offline payment wherever acceptance is mandatory. A merchant subject to that obligation therefore has to support two separate checkout flows.

• India: programmability, openly embraced and targeted. The Reserve Bank of India is steering the e₹ toward programmability for subsidies (programs run in Gujarat, Puducherry, and Chandigarh) rather than everyday payments, where UPI is already entrenched.
• Kazakhstan: tracing public spending. The National Bank of Kazakhstan presents the digital tenge as a tool for transparency and control over public sector transactions, particularly public procurement.
• Singapore: programmability without a CBDC. Purpose Bound Money, which grew out of Project Orchid (Monetary Authority of Singapore, since 2021), applies earmarked-use logic to tokenized deposits and stablecoins. It shows the function can be delivered without issuing retail central bank money.
• Nigeria: refocusing on government payments. The Nigeria Payments System Vision 2028 refocuses the eNaira on government-to-person and cross-border payments. The use case that survives the failure of mass adoption is government disbursements.
• Russia: compulsion by law rather than by code. The digital ruble does not need to be programmable to be imposed. Mandatory acceptance is written into law, on a phased timetable from 2026 to 2028.

The digital euro: the world's best-documented project, and the most demanding for a PSP

The digital euro is the only major retail CBDC project whose rulebook, business model, costs, and legislative debates are public. Central banks outside the euro area use it as a design reference. It also has a feature no other program of its size shares. Distribution would be mandatory for some providers, and acceptance mandatory for some merchants. Its reach would therefore be set by EU regulation, not by user and merchant demand.

• Read the rulebook, not the press releases. Version 0.91 (July 2026) already sets out the functional and nonfunctional requirements, the dispute management framework, and the certification specifications. It is the document that determines what the project will cost a PSP.
• Plan ahead for certification. A payment scheme with a rulebook means a compliance and certification process for each participant and each channel, on a timeline nobody controls as the deadline nears.
• Treat offline as a hardware project. The secure element creates a dependency on the device, its life cycle, and its suppliers. This is not a software project.
• Do not confuse a decision with a timeline. Issuance still depends on an EU regulation that had not been adopted at the time of writing. A product plan that treats 2029 as a certainty stakes the company on a legislative bet.

mBridge, Agorá, and cross-border payments: where CBDCs create real value

In cross-border payments, wholesale CBDC is used to tackle the limitations of correspondent banking. A conventional cross-border payment passes through a chain of correspondent banks in different time zones and with different operating hours, creating intraday exposures and delays measured in days. Multi-CBDC platforms aim to replace that chain with a unified ledger where the currency legs settle simultaneously and with finality. Two projects dominate the field, and their institutional paths have diverged sharply.

Two points stand out. First, volumes are still experimental. A CHF 800,000 live-value test across 17 scenarios validates a legal and technical chain, but it is nowhere near the volume of a payment rail in production. Second, geopolitics has already settled part of the question. mBridge, the only multi-CBDC project that actually works, is run by a consortium centered on Hong Kong, Beijing, Bangkok, Abu Dhabi, and Riyadh, without the BIS. The G20's flagship cross-border project, Nexus, has deliberately set CBDCs aside and instead links existing instant payment systems. The most advanced example of that approach is UPI-PayNow (2023), the world's first direct link between two national instant payment systems. It is operated by NPCI International Payments Ltd and Banking Computer Services, under the authority of the RBI and the MAS.

China's setup is the only one that pairs a mass-market retail CBDC with a cross-border ambition backed by real infrastructure. The e-CNY International Operation Center officially opened in Shanghai on September 24, 2025, under what the PBoC calls the principles of “no disruption, compliance, and interoperability.” Three platforms were announced: the e-CNY Cross-Border Digital Payment Platform, the e-CNY Blockchain Service Platform, and the Digital Asset Platform. By June 2026, 26 financial institutions had signed on as direct participants, including Standard Chartered China and branches of Chinese banks in Thailand, Singapore, Laos, and Qatar. Cross-border renminbi payments also have CIPS, a settlement rail that processed 8.44 million transactions worth RMB 180,150 billion in 2025. CIPS had 210 direct and 1,619 indirect participants as of June 30, 2026, yet it still relies on SWIFT messaging for more than 80% of its flows.

What it means in practice for a PSP

Adding a retail CBDC to an acceptance chain undermines several assumptions that existing systems were built on, starting with who the issuer is, whether a transaction can be reversed, and the absence of any limit on balances. None of the three holds, and the table below lists more. The resulting gaps show up in customer service, reconciliation, and dispute numbers, not in the instrument's advertised features. The breaks described below apply in every country.

• Reconciliation: plan for two entries. A payment received through the waterfall generates one movement in CBDC and one on the linked account, for a single order. Matching has to key on the order reference, not the instrument.
• Failure codes: create new ones. “Payee at limit,” “linked account unavailable,” and “offline wallet not synced” have no card equivalent. Reporting them as generic declines leaves operations flying blind.
• Offline: accept deferred reconciliation. Payments made without a network only come through when the device resyncs. The POS journal and settlement reports will temporarily diverge. That is normal, but only if it has been planned for and explained to the merchant.
• Mandatory acceptance: map your merchant base. Where the law requires acceptance with size-based exemptions (the euro area, still under negotiation; Russia, by statute), the first task is to identify which merchants in the portfolio are in scope, and from what date.
• Pricing: do not model a unit margin. On an instrument with a capped fee and a regulated revenue split, a PSP's value lies in adjacent services (omnichannel acceptance, reconciliation, dispute management, reporting), not in basis points.
• Never promise an issuance date. For the three major projects (digital euro, digital pound, digital yen), no decision to issue has been taken, and each one hinges on a legislative or political decision.