88 BIS Quarterly Review, March 2020
points of failure. Importantly, this decision can only be made once the architecture
has been decided upon, as DLT is only feasible for some operational setups. This is
why the choice of infrastructure lies in the pyramid’s second layer.
Two further consumer needs are easy, universal access and privacy by
default.
6
From a technical perspective, there is an underlying trade-off between
privacy and ease of access on the one hand and ease of law enforcement on the
other. The associated design choice – the pyramid’s third layer – is whether access
to the CBDC is tied to an identity system (ie an account-based technology) or
instead via cryptographic schemes that do not require identification (ie an access
technology based on so-called digital tokens).
The final consumer need we consider is that CBDCs should also enable cross-
border payments. At a design level, this could be arranged via technical connections
at the wholesale level that are built on today’s systems. Alternatively, novel
interlinkages could be envisaged at the retail level, ie allowing consumers to hold
foreign digital currencies directly. Importantly, the means of implementing the latter
option would depend on whether the CBDC was account- or token-based. This is
why this design choice belongs in the top layer of the pyramid.
Architecture: indirect or direct claims, and the operational
role for the central bank
The CBDC pyramid’s bottom layer is the legal structure of claims and the respective
operational roles of the central bank and private institutions in payments. Our
analysis starts with an overview of possible technical architectures for CBDCs. In all
three architectures shown in Graph 2, the central bank is, by definition, the only
party issuing and redeeming CBDC. We note that all three architectures could be
either account- or token-based, and might run on various infrastructures. These
choices are discussed below.
The key differences here are in the structure of legal claims and the record kept
by the central bank. In the “indirect CBDC” model (Graph 2, top panel), the
consumer has a claim on an intermediary, with the central bank keeping track only
of wholesale accounts. In the “direct CBDC” model (centre panel), the CBDC
represents a direct claim on the central bank, which keeps a record of all balances
and updates it with every transaction. The “hybrid CBDC” model (bottom panel), is
an intermediate solution providing for direct claims on the central bank while
allowing intermediaries to handle payments.
Consider first the indirect CBDC model (top panel). This term is used by Kumhof
and Noone (2018), and is equivalent to the “synthetic CBDC” in Adrian and Mancini-
Griffoli (2019). This model is also known as the “two-tier CBDC” for its resemblance
to the existing two-tier financial system; a token-based variant is proposed as a
“multi-cell CBDC” in Ali (2018). For consumers, this type of CBDC is not a direct
claim on the central bank. Instead, the intermediary (labelled “CBDC bank” in
Graph 2 for its close resemblance to a narrow payment bank) is mandated to fully
back each outstanding indirect CBDC-like liability to the consumer (labelled “ICBDC”
6
Privacy here means that the consumer’s data are used only in steps strictly necessary for the
specific purpose of determining whether a transaction is lawful and, if this the case, executing it. “By
default” implies that privacy is ensured without requiring any intervention by the user.
Electronic copy available at: https://ssrn.com/abstract=3561198