Privacy & Data Protection

1. Global Landscape — Privacy Models

Central bank digital currencies present an inherent tension: the state gains the technical capability to monitor every transaction its citizens make, yet must simultaneously respect privacy rights, comply with data protection law, and maintain public trust. How jurisdictions navigate this tension defines their CBDC's privacy model. Based on analysis of 20 jurisdictions across five regions, four distinct privacy architectures have emerged. The architectures are not mutually exclusive — several jurisdictions (notably the EU and China) blend two models across online and offline modalities.

Of the 20 jurisdictions, 6 have launched or operate a live/pilot-scale CBDC (

Bahamas Sand Dollar,

Nigeria eNaira,

Jamaica JAM-DEX,

China e-CNY at pilot scale,

India e₹, and the Eastern Caribbean DCash — the last now suspended), 1 is explicitly anti-CBDC (the

United States), and the remaining 13 are at research, design, or pilot stages. Privacy design — and the surveillance fears it provokes — is a recurring determinant of whether these projects advance, stall, or fail at adoption.

Model A: Cash-Equivalent Anonymity for Small Transactions

Concept. Offline, device-to-device transactions below a defined threshold are designed to replicate the anonymity properties of physical cash. Neither the central bank, intermediaries, nor counterparties can observe the transaction details during or after completion.

Countries and mechanisms.

• EU (Digital Euro — offline modality). The ECB's proposed digital euro implements a tiered privacy architecture in which offline transactions are cash-like — "known only to payer and payee" — with data stored locally in a secure element on the user's device. Neither the Eurosystem nor PSPs can access offline transaction data. The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS), in Joint Opinion 02/2023 (17 October 2023), "strongly recommended" introducing a threshold below which even online low-value transactions are not traced for AML/CFT purposes — extending cash-like privacy into the digital domain. The European Parliament initially favoured an offline-first approach precisely because it provides inherently stronger privacy, but on 10 February 2026 adopted amendments endorsing both online and offline functionality (rejecting offline-only). Giesecke+Devrient was selected for the offline solution.
  • Source: EDPB — Joint Opinion 02/2023, 17 October 2023
  • Source: ECB — Preparation phase closing report, October 2025

• Sweden (e-Krona — Phase 4 offline card). The Riksbank's Phase 4 pilot (completed March 2024) tested an offline payment card that stores a "shadow wallet" balance locally. Offline transactions occur on the card without server contact and synchronise only upon reconnection. Security limits embedded in card firmware cap offline wallet balances at SEK 3,000 (~USD 286) and allow a maximum of 5 consecutive offline payments before reconnection. This creates "conditional anonymity" for small transactions within those bounds. The Riksbank has taken no issuance decision; its 2026 Payments Report recommends a parliamentary inquiry only once the EU's digital euro Regulation is finalised.
  • Source: Riksbank — E-krona pilot phase 4, March 2024

• Ghana (eCedi — offline-first). The Bank of Ghana's eCedi was designed offline-first: a token-based, stored-value, cash-like component tested via offline NFC POS, consecutive offline payments, and dual-mode operation in the 2022 pilot. Offline payments provide an inherent privacy benefit (no real-time central bank visibility). However, the BoG has published no detailed privacy specifications, no data-retention or government-access rules, and no wallet tiers; on 22 May 2026 the Governor declared the pilot "completed" and reframed near-term work toward wholesale/cross-border use, leaving retail privacy design unspecified.
  • Source: [Data Protection Act, 2012 (Act 843)] — Ghana data-protection framework; Data Protection Commission enforces

• BIS (Project Tourbillon). Demonstrated that payer anonymity is technically achievable using blind signatures and mix networks: "consumers paying merchants do not disclose personal information to anyone — not the merchant, banks, or the central bank." The project also tested quantum-resistant cryptography. Results published 2023.

  • Source: BIS — Project Tourbillon

Legal basis. GDPR (EU and Sweden); proposed Digital Euro Regulation COM(2023) 369 (offline privacy provisions); Ghana Data Protection Act 2012 (Act 843).

Outcomes and public reaction. The offline-first approach has strong support among European privacy advocates and data protection authorities. The EDPB/EDPS opinion is the most authoritative data protection assessment of any CBDC globally. However, an ECB survey (March 2025) found 58% of European citizens consider themselves "unlikely or very unlikely" to use the digital euro for everyday payments, indicating that privacy alone does not drive adoption. Ghana's offline-first design is one of Africa's most thoughtful, but repeated delays (2022→2023→2025→still pending) mean its privacy promises remain untested in production.

Model B: Tiered / Controllable Anonymity

Concept. A spectrum of privacy graduated by transaction value and wallet verification level. Small transactions via minimally verified wallets offer functional anonymity (or, in account-based designs, only reduced data collection); large transactions via fully verified wallets are fully traceable. The central bank retains the technical capability to de-anonymise any transaction through legal process — or, in account-based designs, retains comprehensive visibility throughout.

Countries and mechanisms.

• China (e-CNY — "controllable anonymity"). The PBOC describes its framework as "controllable anonymity" (可控匿名): "small amounts are anonymous, big amounts are traceable" (小额匿名、大额可溯). Category 4 wallets require only a phone number and are technically anonymous, with a balance cap of CNY 10,000 (~USD 1,400); Category 1 wallets (full ID + linked bank account) are fully traceable with caps up to CNY 500,000. The PBOC sees verified-wallet identities and aggregated amounts; anonymous-wallet identity can be obtained via legal process. Commercial banks hold customer KYC; merchant/counterparty access is encrypted via ID anonymization technology. The PIPL interaction remains underspecified. A January 2026 reclassification toward a commercial-bank deposit-money model (with interest-bearing verified wallets) gives commercial banks balance and interest data alongside transaction data, further complicating the privacy picture.
  • Source: PBOC — Balancing Privacy and Security (PDF), November 2022
  • Source: DigiChina (Stanford) — Controllable Anonymity Lexicon

• India (e-Rupee). The RBI's Concept Note (October 2022) establishes "reasonable anonymity" (cash-like) for small-value transactions and full traceability for large-value transactions under the PMLA. The specific threshold values have not been publicly disclosed as of June 2026. Wallet tiers run from Basic (minimal KYC / phone, higher anonymity) to Full KYC (Aadhaar/PAN verified, standard traceability, ₹1,00,000 holding cap). Banks see customer identity, balances, and transactions; the RBI sees aggregate issuance/redemption and states it does not need individual small-value data — though the centralized ledger could technically access all. Offline NFC transactions (officially launched October 2025) occur directly between wallets without server intermediation, providing inherent anonymity for small values.
  • Source: RBI Concept Note on CBDC (PDF), 7 October 2022, Section 7

• Nigeria (eNaira). A tiered-KYC system runs from Tier 0 (phone number only, N120,000 balance / N20,000 daily) to Tier 3 (BVN + enhanced verification, N5,000,000 / N2,000,000 daily). However, the account-based design means the CBN maintains a centralized ledger of all wallets and balances, with identity, transaction data, values, and history accessible to the CBN and intermediaries — eliminating cash anonymity at every tier. Academic analysis from Cambridge University's Journal of African Law concluded the CBN "misapprehends the meaning and scope of informed consent to data processing, allows monitoring and tracking of users."
  • Source: Cambridge Core — Assessing the Legal Status of the eNaira, 2023

• Bahamas (Sand Dollar). Three-tier KYC (Tier 1 simplified / Tier 2 regular / Tier 3 enhanced) balances inclusion against AML/CFT, but the Sand Dollar offers no anonymity at any tier — it is a fully auditable, non-anonymous transaction trail offering less privacy than cash, with per-wallet data encryption. The CBOB maintains a centralised KYC register and AML/CFT engine; law enforcement accesses data via legal channels.
  • Source: Central Bank of The Bahamas — Sand Dollar framework

• Jamaica (JAM-DEX). A tiered-KYC design (Low KYC, one government ID; Standard KYC) in which the user's identity is not recorded in transactions — only the transaction value is recorded for authentication. User data is stored with the wallet provider, not the BOJ, and is governed by Jamaica's Data Protection Act (2020) under the Office of the Information Commissioner. JAM-DEX is therefore not fully anonymous (the wallet provider sees transactions), and a BOJ official acknowledged the CBDC "allows monitoring of all in circulation."
  • Source: Bank of Jamaica — JAM-DEX; Jamaica Data Protection Act 2020

• Eastern Caribbean (DCash — pilot, now suspended). DCash used tiered wallets (Value-Based with simplified KYC and no bank account; Registered with full KYC) and a two-tier data-access model: the ECCB could view only anonymized transaction data (type and aggregate balances, no individual identities), while the wallet-hosting FI retained detailed identity and transaction data. HRF noted privacy/surveillance assessments were "not disclosed." DCash 2.0 development was suspended by the ECCB Monetary Council on 13 February 2026 in favour of a Fast Payment System + CAPS.

  • Source: ECCB / HRF CBDC Tracker

Legal basis. China: Personal Information Protection Law (PIPL), effective 1 November 2021. India: Digital Personal Data Protection Act 2023 (DPDP Act, Rules November 2025); RBI Act 1934 as amended. Nigeria: Nigeria Data Protection Act (NDPA) 2023 (eNaira guidelines predate it). Bahamas: data-protection and AML/CFT framework under CBOB. Jamaica: Data Protection Act 2020. Eastern Caribbean: each member state's own AML/CFT law applied.

Outcomes and public reaction. China's model has drawn sustained criticism from international observers who note the fundamental tension: the system provides the government with the technical capability for comprehensive financial surveillance, even if policy constraints nominally limit its use. India's RBI has not published specific privacy safeguards or anonymity thresholds, and the Human Rights Foundation has flagged the e-Rupee for surveillance risks; e₹-R circulation contracted ~24% YoY in FY2025-26 (its first reported decline). Nigeria's eNaira saw 98.5% of wallets inactive after one year (IMF Working Paper WP/23/104), with privacy concerns contributing to public distrust, and the CBN has pivoted toward a wholesale eNaira and a private stablecoin (cNGN). The Bahamas, Jamaica, and Eastern Caribbean account-based/tiered designs all delivered low adoption (<0.4%, ~0.1%, and ~0.16% of currency respectively), with surveillance comfort secondary to usability barriers.

Model C: Pseudonymised with Law Enforcement Access

Concept. All transactions are recorded on a centralized or distributed ledger, but user identity is pseudonymised at the central bank level. The central bank cannot identify individual users in normal operations; identification requires legal process involving intermediaries who hold KYC data. This is the dominant model among research-stage and wholesale-focused jurisdictions.

Countries and mechanisms.

• EU (Digital Euro — online modality). Online transactions are pseudonymised: the Eurosystem cannot identify individual users making or receiving payments. PSPs are the data controllers/processors for online KYC and are subject to standard AML/CFT requirements. The ECB's N-XT settlement engine uses a UTXO data model that does not need to know which wallet holds UTXOs, nor the identity or pseudonym of their owner, to process transactions — making the digital euro GDPR-compliant by design.
  • Source: ECB — Preparation phase closing report, October 2025

• UK (Digital Pound). The Bank of England has committed to making the digital pound "at least as private as current forms of digital money and potentially even more private." Neither the BoE nor the Government would access users' personal data; PIPs and ESIPs are the data controllers under UK GDPR + the Data Protection Act 2018, supervised by the ICO. The digital pound is not anonymous (identity verification required) — the House of Lords warned it "could not support anonymous transactions like cash" — but the Government has committed to enshrining privacy protections in primary legislation, and the BoE is exploring keeping personal data out of its core infrastructure entirely. The BoE collaborates with the MIT Digital Currency Initiative on PETs including pseudonymisation, zero-knowledge proofs, and secure multiparty computing.
  • Source: UK Parliament — Government agrees to privacy protections in digital pound legislation
  • Source: MIT DCI — Enhancing Privacy of a Digital Pound

• Brazil (Drex). The intended model separates participant-level privacy (banks cannot see other institutions' clients' transactions) from BCB supervisory access (full visibility for monetary policy, AML/CFT, and stability), constrained by the LGPD and banking secrecy (Complementary Law 105/2001). However, privacy proved to be the single most consequential obstacle: ZKP / on-chain transparency conflicted with banking secrecy and BCB visibility in a "trilemma" of privacy, decentralization, and programmability. None of the tested privacy solutions (Zether, Starlight, Rayls, ZKP Nova, Hamsa) was deemed production-mature. The BCB decommissioned the Hyperledger Besu platform on 10 November 2025 and is rebuilding "from scratch," narrowing scope to collateral/lien reconciliation.
  • Source: Ledger Insights — Brazil's DREX CBDC project pivots away from blockchain, August 2025

• Japan (Digital Yen). The BOJ treats privacy as a paramount design concern given Japan's cash culture, while acknowledging a CBDC "won't always match cash anonymity." The intermediated model applies data minimisation and separation of data functions: intermediaries hold customer personal/KYC data and can apply pseudonymisation, while the BOJ minimises the data it accesses or holds. The APPI (amended 2022) applies; a PETs research report was published January 2023. No issuance decision; a 2026 retail-CBDC decision is pending.
  • Source: Bank of Japan — CBDC experiments; PETs research report (January 2023)

• Singapore (Project Orchid / PBM). Singapore's wholesale-first strategy inherently limits privacy concerns (institutional disclosure). Its retail Purpose-Bound Money (PBM) operates through bank-operated wallets under standard banking KYC, and the PBM protocol does not require the central bank to hold individual transaction data — commercial banks (not MAS) are the data controllers under the PDPA 2012. Project Mandala used ZKPs and MPC for privacy-preserving compliance.
  • Source: Monetary Authority of Singapore — Orchid Blueprint; PDPA 2012; MAS Data Governance Guidance (May 2024)

• South Korea (Project Hangang). BOK Governor Rhee stated the design "chose to improve compliance at the sacrifice of privacy"; full anonymity was rejected because it would prevent wallet-freezing and AML. KYC through participating banks creates a full transaction trail, and programmable subsidy restrictions raise surveillance concerns over beneficiary spending. Deposit-token users provide personal information to their commercial bank, not to the BOK (confirmed by Deputy Governor Lee Jong-ryul); banks manage KYC. ZKP was explored; PIPA was amended February 2026 with fines up to 10% of revenue. Phase 1 paused June 2025; Phase 2 restarted March 2026.
  • Source: Bank of Korea — Project Hangang; PIPA (amended February 2026)

• Australia (Project Acacia / eAUD). Wholesale work carries low privacy sensitivity (institutional). In the earlier eAUD retail pilot the design was intermediated: the RBA saw transaction values and balances but not holder identity; participating institutions hold KYC identity. RDP 2024-02 found Australians' willingness to pay for full anonymity was only ~A$5/person/year, and a CBDC would likely allow ad hoc AUSTRAC data sharing for large transactions. Project Acacia's wholesale experimentation concluded February 2026, with the final report (18 May 2026) covering 20 use cases (12 pilot + 8 PoC) and A$4.4m wCBDC issued.
  • Source: Reserve Bank of Australia / DFCRC — Project Acacia final report (mr-26-13), 18 May 2026; RDP 2024-02

• Thailand. The completed retail CBDC pilot (Bang Khun Phrom, 2024) operated within Thailand's existing data-protection framework with the BOT as central validator and standard banking KYC via intermediaries; the PDPA B.E. 2562 governs. Anonymity tiers were not detailed for the pilot. Thailand has no plans for a full-scale retail CBDC and has pivoted to a Programmable Payment Sandbox for stablecoin experimentation. (Note: a separate government digital-wallet programme requires national ID and facial recognition — distinct from the BOT CBDC.)
  • Source: Bank of Thailand — retail CBDC pilot; PDPA B.E. 2562 (2019)

• Canada. Bank of Canada research concluded that "hard privacy" (cryptography) is insufficient and that "soft privacy" (authorized access, controls, limited retention, audits) is more promising; cash-like privacy is technically immature and incompatible with KYC/AML (SAN 2020-9). Any future CBDC would be governed by PIPEDA and provincial privacy law; OPC-funded research suggested a "direct CBDC" (central-bank record-keeping) as promising for privacy. Retail CBDC work was scaled down in September 2024.
  • Source: Bank of Canada — SAN 2020-9; SDP 2025-1 (PETs)

• United States (research only; anti-CBDC stance). The US has not issued and does not plan to issue a CBDC; Executive Order 14178 (23 January 2025) bars federal CBDC activity, and a statutory moratorium passed both chambers in differing forms but is not enacted. Privacy and surveillance are the central political issue driving opposition. The 2022 Federal Reserve "Money and Payments" paper envisioned any US CBDC as "privacy-protected" and intermediated (no direct Fed visibility), with private-sector intermediaries as data controllers under existing law (RFPA 1978, BSA 1970, GLBA 1999) and the Fourth Amendment. New Fed Chair Kevin Warsh (sworn in 22 May 2026) reaffirmed opposition to a retail CBDC. (Detailed treatment of the US position appears in Model E below.)
  • Source: Federal Reserve — "Money and Payments" (2022); EO 14178 (January 2025)

Legal basis. EU: GDPR (Regulation 2016/679). UK: UK GDPR (retained EU law) and Data Protection Act 2018. Brazil: Lei Geral de Proteção de Dados (LGPD), Law No. 13,709/2018 + banking secrecy (Complementary Law 105/2001). Japan: APPI (amended 2022). Singapore: PDPA 2012. South Korea: PIPA (amended February 2026). Australia: Privacy Act 1988 + AUSTRAC. Thailand: PDPA B.E. 2562 (2019). Canada: PIPEDA + provincial law. US: RFPA 1978, BSA 1970, GLBA 1999 + Fourth Amendment.

Outcomes and public reaction. The EU model is the most sophisticated attempt to balance privacy with AML/CFT at the technical level. The UK's approach is distinguished by its commitment to legislative guarantees, driven by sustained Parliamentary pressure. Brazil's experience is a cautionary tale: four years of testing could not resolve the privacy-compliance tension, forcing a fundamental architectural retreat. The wholesale-focused jurisdictions (Singapore, Australia, Thailand, Canada, South Africa) sidestep most retail privacy controversy by keeping CBDC institutional, while South Korea's explicit "compliance over privacy" choice sparked civil-society pushback.

Model D: Full Surveillance

Concept. The central bank maintains complete visibility over all transactions. No anonymity is provided by design. User registration requires government identity verification. Account freezing without judicial oversight is enabled.

Countries and mechanisms.

• Russia (Digital Ruble). The CBR has explicitly stated that digital ruble settlements "do not provide for the anonymity of payments" and that unique identifiers enable full traceability — complete de-anonymisation, rated "Very Weak." The CBR maintains records of all transactions; both commercial banks and the CBR perform AML monitoring, coordinated by Rosfinmonitoring. Wallet access requires Gosuslugi (government services portal) registration, a simple electronic signature, and in-person ESIA verification (rules tightened 6 February 2026). Programmable spending restrictions via smart contracts ("coloured funds," 17,000+ in pilot) can limit what money is spent on, and a 2025 law allows authorities to freeze accounts without court orders. Government/budget use went live 1 January 2026; a legally-mandated large-scale launch is set for 1 September 2026.
  • Source: Carnegie Endowment — Can the Digital Ruble Shield Russia From Western Sanctions?, October 2024
  • Source: HRF CBDC Tracker — Russia

Legal basis. Federal Law No. 340-FZ (signed 1 August 2023); Civil Code amendments (Articles 128, 140, 1128, 1174). No comprehensive data-protection law is applied to the CBDC.

Outcomes and public reaction. Polling (media-sourced, indicative) shows over 50% of Russians unwilling to use the digital ruble for daily transactions, nearly 50% viewing it as a tool for tighter state control, and only ~30% intending to use it despite ~70% awareness. The government has previously frozen accounts of opposition figures. The digital ruble is on track for mandatory rollout from 1 September 2026 (systemically important banks and retailers above RUB 120M revenue) regardless of public sentiment.

Model E: Anti-CBDC / Privacy as the Case Against Issuance

Concept. A distinct posture in which privacy and surveillance concerns are not a design parameter but the primary argument against issuing any retail CBDC at all. The state pre-empts the surveillance risk by prohibiting issuance and steering digital-payment innovation to the private sector (stablecoins, fast-payment rails).

Countries and mechanisms.

• United States (anti-CBDC). The US holds the strongest anti-issuance stance of any major economy. Executive Order 14178 (23 January 2025) bans federal CBDC activity and revoked the prior EO 14067; a statutory CBDC moratorium (in the ROAD to Housing Act) passed both the Senate (89-10, 12 March 2026) and the House (396-13, amended, 20 May 2026) in differing, unreconciled forms — so it is not yet enacted, leaving EO 14178 as the only binding prohibition. Any hypothetical US CBDC would have been intermediated and "privacy-protected" (2022 Fed paper), with private-sector intermediaries as data controllers under the RFPA, BSA, GLBA, and the Fourth Amendment — but opponents reject any digital dollar as a surveillance tool. The stablecoin-first alternative was advanced via the GENIUS Act (S. 1582), signed 18 July 2025 as Public Law 119-27. Fed Chair Kevin Warsh (sworn in 22 May 2026) reaffirms opposition to a retail CBDC.
  • Source: Executive Order 14178 (January 2025); GENIUS Act / Public Law 119-27 (July 2025)

Legal basis. EO 14178 (binding); GENIUS Act / PL 119-27 (stablecoin regulation); RFPA 1978, BSA 1970, GLBA 1999, Fourth Amendment (would govern any private intermediary).

Outcomes and public reaction. Surveillance fear has been politically decisive: it converted the US from an exploratory posture (Project Hamilton research) into the only major nation to formally bar CBDC development by executive action. This discourse strongly shapes global perceptions of CBDC privacy risk.

2. Comparative Analysis Table

The table below mirrors the privacy model, anonymity tier, and data-controller arrangement for all 20 jurisdictions (plus BIS/FATF guidance), drawn from the canonical fact matrix.

Aggregate readout (N = 20 jurisdictions).

• Privacy model distribution: Model A (cash-equivalent offline) primary or partial in 4 (EU offline, Sweden, Ghana — plus BIS as guidance); Model B (tiered/controllable) in 6 (China, India, Nigeria, Bahamas, Jamaica, Eastern Caribbean); Model C (pseudonymised w/ LE access) in 9 (EU online, UK, Brazil, Japan, Singapore, South Korea, Australia, Thailand, Canada — and the US would-be design); Model D (full surveillance) in 1 (Russia); Model E (anti-CBDC) in 1 (US). EU spans both A (offline) and C (online); China spans both B and an offline A component.
• No anonymity at any tier: 4 launched/live designs (Bahamas, Nigeria — account-based; Russia — by design; plus Jamaica records value-only, retaining provider-side visibility).
• "NOT VERIFIED" privacy detail: 1 has no published privacy specification (Ghana anonymity tier / data-retention rules); thresholds undisclosed in India; PIPL-PBOC interplay underspecified in China.
• Central bank holds no individual user data (by design or commitment): UK, EU (online pseudonymised + offline none), Singapore, South Korea, Australia, Japan, Jamaica (data with wallet provider) — a clear majority of design-stage projects converge on keeping identity with intermediaries.
• Central bank retains full individual visibility: Russia (by design), Nigeria + Bahamas (account-based centralized ledger), Brazil (intended BCB supervisory access).

3. Privacy-Enhancing Technologies

3.1 Zero-Knowledge Proofs (ZKPs)

How it works. A zero-knowledge proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. In a CBDC context, a ZKP could prove that a user's balance is sufficient to complete a transaction, or that a transaction complies with AML thresholds, without revealing the user's identity or balance.

CBDC projects that tested ZKPs.

Limitations. The BCB's conclusion after four years of ZKP testing is definitive: "The privacy technological solutions tested so far, despite evolution over the period, have not demonstrated the necessary maturity to ensure compliance with all legal requirements related to the preservation of privacy and the protection of personal data." The core problem is that ZKPs that truly protect user data also prevent the central bank from performing monetary controls and KYC/AML programs. The BCB described this as a "trilemma" of privacy, decentralization, and programmability — achieving all three simultaneously proved intractable with current technology, ultimately driving the November 2025 decommissioning of the Drex Besu platform.

Sources:

• Ledger Insights — Brazil's DREX wholesale CBDC pilot has been 'challenging', 2024
• MIT DCI — Enhancing Privacy of a Digital Pound
• BIS — Project Tourbillon

3.2 Blind Signatures (E-Cash Model)

How it works. The central bank signs a digital token without seeing its content (the "blinding" step). The user then "unblinds" the signed token to produce a valid CBDC token that cannot be linked back to the original signing request. This is the digital equivalent of a sealed envelope: the bank stamps the envelope without knowing what is inside.

CBDC projects that tested blind signatures.

• BIS Project Tourbillon (2023). The definitive experiment. Tourbillon combined blind signatures with mix networks to demonstrate that "consumers paying merchants do not disclose personal information to anyone — not the merchant, banks, or the central bank." The project also experimented with quantum-resistant blind signature schemes to future-proof against quantum computing threats.
  • Source: BIS — Project Tourbillon: exploring privacy, security and scalability for CBDCs

Limitations. Blind signatures achieve strong payer anonymity but create challenges for: (a) double-spending prevention (the central bank must verify token validity without linking to the original issuance); (b) law enforcement access (fully blind signatures are incompatible with AML/CFT requirements above de minimis thresholds unless combined with revocable anonymity mechanisms); (c) scalability at high transaction volumes. The FATF has confirmed that full anonymity is incompatible with its standards for transactions above threshold amounts.

3.3 Secure Enclaves / Trusted Execution Environments (TEEs)

How it works. A TEE is an isolated processing environment within a device's hardware (e.g., a smartphone's secure element or a dedicated security chip in a payment card) that protects data during processing. Transaction data processed within a TEE is inaccessible to the device's operating system, apps, or external observers.

CBDC projects using TEEs.

• EU Digital Euro — offline secure element. The offline solution stores cryptographically secure tokens in a secure element on the user's device (eSE/eSIM/NFC). Transaction details remain in the secure element, inaccessible to both the Eurosystem and PSPs. The ECB selected Giesecke+Devrient as the first-ranked provider for the offline solution (October 2025).

  • Source: ECB — Selected service providers, 2 October 2025

• Sweden e-Krona — Phase 4 payment card. The offline card uses embedded firmware with security limits (max SEK 3,000, max 5 offline transactions). The card stores a shadow wallet balance and tracks offline transactions locally. However, adjusting security limits requires physical card replacement — a significant operational limitation.

  • Source: Riksbank — E-krona pilot phase 4, March 2024

• China e-CNY — SIM card wallets and hardware wallets. Users install NFC-enabled SIM cards (which work with the phone powered off) or use IC cards, wearables (smart watches, ski gloves, badges), and secure-element devices for offline payments. Both payer and payee devices can be offline during the transaction (dual offline), as deployed at the 2022 Winter Olympics.

  • Source: Ledger Insights — China's SIM card wallet supports offline digital RMB payments

• Ghana eCedi & India e₹ — offline NFC stored-value. Ghana's offline-first eCedi uses a token-based, stored-value offline component (offline NFC POS, consecutive offline payments). India officially launched offline Digital Rupee at Global Fintech Fest (October 2025) using NFC tap-and-pay, telecom-assisted/feature-phone payments, and stored-value offline wallets — both relying on secure on-device storage for offline value.

  • Source: Bank of Ghana / G+D pilot results; RBI offline Digital Rupee launch (October 2025)

Limitations. TEE-based solutions depend on hardware security assumptions that may be compromised by side-channel attacks, supply chain vulnerabilities, or nation-state-level attackers. Physical card solutions face the problem of limit adjustment requiring card replacement. Smartphone-based TEEs vary in security across manufacturers. No TEE solution has been independently audited at scale for CBDC use as of June 2026.

3.4 Pseudonymisation Techniques

How it works. User identities are replaced with pseudonyms (e.g., one-time addresses, transaction tokens) that cannot be linked to real identities without additional information held separately by intermediaries. The central bank processes transactions using pseudonyms only.

CBDC projects using pseudonymisation.

• EU Digital Euro — N-XT engine. The UTXO model natively supports one-time addresses. "The settlement engine does not need to know which wallet holds UTXOs, nor the identity or pseudonym of their owner, to process transactions. The Eurosystem can perform settlement without knowing any user's balance or inferring payment patterns."

  • Source: ECB — Digital euro prototype summary (PDF), May 2023

• China e-CNY — ID anonymization. The e-CNY uses "ID anonymization technology between wallets" — personal information exchanged between wallets is anonymous to counterparties and commercial institutions. Payment information is encrypted and concealed from recipients.

  • Source: PBOC — Balancing Privacy and Security (PDF), November 2022

• UK Digital Pound — BoE/MIT DCI research. Pseudonymisation was one of three PETs evaluated in the one-year research programme. The BoE is exploring options to "prevent personal data from entering its core infrastructure at all."

  • Source: BoE — Responses to the digital pound consultation paper, January 2024

• Japan Digital Yen — intermediary pseudonymisation. The BOJ's intermediated model applies data minimisation and separation of data functions, with intermediaries able to pseudonymise user data so that the BOJ minimises the data it holds (PETs research report, January 2023).

  • Source: Bank of Japan — PETs research report (January 2023)

Limitations. Pseudonymisation is not anonymisation. Metadata analysis, traffic analysis, and correlation attacks can potentially re-identify users from pseudonymised data. The GDPR explicitly classifies pseudonymised data as personal data subject to regulation (Recital 26). The strength of pseudonymisation depends on the separation of pseudonym-to-identity mapping from transaction data — a separation that is policy-enforced, not cryptographically guaranteed.

3.5 Summary: PET Maturity Assessment

The BIS Working Paper No. 1242, "Privacy-enhancing technologies for digital payments" (2024), provides the most comprehensive technical assessment of PET applicability to CBDC. Its central finding is that no single PET solves the privacy-compliance tension; rather, a combination of PETs applied at different system layers — blind signatures for offline, pseudonymisation for online settlement, TEEs for device security — offers the most promising path. This layered approach aligns with the EU's dual-track architecture and the recommended tiered framework in Section 5.

Source: BIS Working Paper No. 1242 (PDF), 2024

4. What Works and What Doesn't

What Works

Legislative privacy guarantees (UK). The UK's approach of enshrining privacy protections in primary legislation — driven by active Parliamentary scrutiny from both the House of Lords and Treasury Committee — represents the strongest privacy governance model among CBDC projects. The Government's explicit commitment that data use would be limited to purposes "already permitted for law enforcement" provides a clear legal boundary. The combination of legislative guarantees, the explicit ban on government/central-bank programmability, and the MIT DCI research collaboration creates a multi-layered privacy framework.

Tiered anonymity with offline capability (EU). The digital euro's dual-track approach — cash-like privacy for offline transactions, pseudonymised online transactions — is the most technically sophisticated CBDC privacy design. The EDPB/EDPS recommendation for a low-value online privacy threshold further strengthens the model by extending cash-like treatment to small digital transactions. If adopted, this would make the digital euro the first CBDC to offer genuine privacy advantages over existing digital payments for most everyday transactions.

Keeping identity with intermediaries, not the central bank (UK, EU, Singapore, South Korea, Australia, Japan). A clear majority of design-stage projects converge on the principle that the central bank should never hold individual identity data — it sits with PSPs/PIPs (UK, EU), commercial banks (Singapore, South Korea, Japan), or use-case providers (Australia). South Korea's Deputy Governor explicitly confirmed deposit-token users provide personal information to their bank, "not to the BOK." This intermediary-custody model is the de facto international consensus for retail CBDC privacy.

PET research and experimentation (BIS). Project Tourbillon demonstrated that cash-like anonymity for CBDC is technically achievable using blind signatures and mix networks. Project Polaris published a handbook for offline CBDC payments addressing resilience and privacy. These BIS projects provide the empirical foundation that national central banks need to make informed PET choices.

Data protection law as hard constraint (Brazil, EU). Both Brazil (LGPD) and the EU (GDPR) treat data protection as a non-negotiable legal requirement for CBDC design. Brazil's BCB explicitly stated privacy solutions must "ensure compliance with all legal requirements" under the LGPD. This "privacy as prerequisite" stance — where the CBDC cannot launch until privacy is solved — is more protective than a "privacy as feature" approach where compliance is retrofitted.

Privacy concerns as a legitimate reason not to issue (US, South Africa, Canada). The US, South Africa, and Canada each concluded — at least for now — that the surveillance risk and the absence of a compelling use case outweigh the benefits of a retail CBDC. South Africa's November 2025 Position Paper ("no compelling immediate need") and Canada's September 2024 scale-down show that declining to launch can itself be a responsible, privacy-protective outcome where existing fast-payment rails serve the public.

What Doesn't Work

No privacy commitment (Nigeria). The eNaira's account-based design with a centralized ledger enables comprehensive transaction monitoring without meaningful privacy safeguards. The Regulatory Guidelines (2021) predated Nigeria's Data Protection Act (2023) and contain provisions that critics find inconsistent with robust data protection. The Human Rights Foundation flags Nigeria's track record as heightening the surveillance risk. Result: 98.5% wallet inactivity and a pivot toward a wholesale eNaira and a private stablecoin (cNGN).

Forced adoption without privacy (Russia). The digital ruble is designed as a surveillance instrument: explicitly non-anonymous, requiring government portal registration and in-person identity verification, with account-freeze powers exercisable without judicial oversight. Mandatory adoption timelines (1 September 2026 for major banks and large retailers) combined with zero privacy protections have produced over 50% public resistance. The gap between the state's coercive push and public reluctance is the digital ruble's defining tension.

Privacy solutions that block regulatory access (Brazil). The BCB's four-year experiment with ZKPs revealed a fundamental design challenge: privacy technologies that effectively protect users also prevent the central bank from performing monetary controls and AML/CFT compliance. The BCB concluded that it "is essential that authorities have visibility and control over the token to comply with their legal, regulatory or contractual obligations." This forced the abandonment of blockchain for the initial Drex launch (Besu platform decommissioned November 2025).

Unspecified privacy frameworks (India, Ghana). Despite promising "reasonable anonymity" in the 2022 Concept Note, the RBI has not published specific privacy safeguards, anonymity thresholds, or data-access limitations as of June 2026 — and e₹-R circulation fell ~24% that year. Ghana's eCedi, declared "pilot completed" in May 2026, likewise has no published privacy specification or data-retention/government-access rules. A voluntary anonymity promise from a central bank, without statutory backing and independent oversight, is insufficient. The centralized architectures create surveillance capability regardless of stated intentions.

Compliance prioritised over privacy without buy-in (South Korea). BOK Governor Rhee's candid statement that the design "chose to improve compliance at the sacrifice of privacy" — combined with programmable subsidy restrictions that track beneficiary spending — sparked civil-society privacy fears. Phase 1's very low transaction volume (692.46M won) against heavy per-bank infrastructure spend illustrates that a compliance-first design without public trust struggles to gain traction.

Lessons from China's "Controllable Anonymity" Model

China's controllable anonymity model merits extended analysis because it is the only privacy architecture that has been deployed at scale (3.48 billion cumulative transactions, CNY 16.7 trillion by November 2025). The model's strengths and weaknesses illuminate design choices facing every jurisdiction.

What the model achieves. The tiered wallet system genuinely provides different levels of identification depending on transaction value. Category 4 wallets (phone number only) offer practical anonymity for everyday transactions, with a balance cap of CNY 10,000. ID anonymization technology between wallets ensures that payment information is encrypted and concealed from counterparties. For the vast majority of everyday transactions — buying groceries, transit fares, small retail purchases — the user experience is functionally anonymous to other users and merchants.

What the model does not achieve. The PBOC retains the technical capability to link any phone number to a government ID (mandatory since 2010) and to trace any transaction through its centralized ledger. The PBOC's own paper acknowledges that "big data analysis" could flag suspicious patterns even in phone-number-only wallets, which authorities could investigate through "legal channels." The specific interplay between PIPL data-minimization obligations and the PBOC's analytical capabilities has not been publicly clarified. The January 2026 reclassification of e-CNY toward a commercial-bank deposit liability — with verified wallets now earning interest — further complicates the privacy picture, as commercial banks now hold balance and interest data alongside transaction data.

The fundamental critique. International observers — including Stanford's DigiChina project, the Atlantic Council, and PIIE — consistently note that "controllable anonymity" means the state decides how much anonymity to grant and can revoke it at will. This is a qualitative difference from physical cash, where anonymity is a physical property of the medium, not a policy choice that can be reversed. For jurisdictions with strong rule-of-law traditions, this distinction matters enormously; for jurisdictions where judicial oversight of state surveillance is weak, it matters even more.

The Surveillance Fear as Adoption Barrier

Evidence from multiple jurisdictions demonstrates that privacy concerns are a primary barrier to CBDC adoption:

• EU: 58% of European citizens "unlikely or very unlikely" to use the digital euro (ECB survey, March 2025). The EDPB/EDPS opinion was a direct response to surveillance concerns raised during the legislative process.

  • Source: CoinTelegraph — Europeans show little interest in digital euro, ECB survey reveals

• Russia: Over 50% unwilling to use the digital ruble; nearly 50% view it as a tool for state control (media-sourced polling, indicative).

  • Source: CBDC News EU — Russia's Digital Ruble: State-Driven Push Meets Public Skepticism, 2025

• UK: Over 50,000 consultation responses — the largest public response to any BoE consultation in memory — with privacy as the dominant concern. A Parliamentary petition to "Prevent the introduction of any programmable CBDC in the UK" received 31,476 signatures.

  • Source: UK Parliament Petitions — Prevent programmable CBDC

• United States: Surveillance fear is the defining driver of the anti-CBDC posture. It converted the US from an exploratory stance into the only major economy to ban federal CBDC development by executive action (EO 14178), with a statutory moratorium advancing (though not yet enacted) and a stablecoin-first alternative (GENIUS Act / PL 119-27). This discourse strongly shapes global perceptions.

• South Korea: BOK Governor Rhee's "compliance at the sacrifice of privacy" framing sparked civil-society fears and contributed to low Phase 1 engagement.

• Nigeria: The forced cash-restriction policy of December 2022 — designed partly to push eNaira adoption — triggered protests, bank attacks, and deepened distrust. The government was forced to extend old banknote validity.

  • Source: Carnegie Endowment — Why Nigeria's Controversial Naira Redesign Policy Hasn't Met Its Objectives, January 2024

5. Recommended Framework

5.1 Minimum Privacy Standards for CBDC

Based on the comparative evidence, the following minimum privacy standards should be adopted by any jurisdiction designing a CBDC:

1. Statutory privacy guarantees. Privacy protections must be enacted in primary legislation, not left to central bank policy or technical design alone. The UK model — where Parliament extracted an explicit commitment to enshrine privacy in law — should be the baseline. Voluntary central bank commitments are insufficient: "it is conceivable that [the Bank and Government] may in future be tempted to try to make use of such a powerful source of information" (UK Treasury Committee, December 2023).

2. Data minimisation by design. The central bank settlement layer should process the minimum data necessary for transaction validation. The EU's N-XT engine — which settles transactions "without knowing any user's balance or inferring payment patterns" — demonstrates that this is technically achievable.

3. No central bank access to personal data. The BoE and ECB models both prevent the central bank from accessing user identity data; Singapore, South Korea, Japan, and Australia keep identity with intermediaries. Personal data should reside exclusively with intermediaries subject to existing data protection law.

4. Independent data protection oversight. A data protection authority independent of the central bank must have supervisory jurisdiction over CBDC data processing. The EDPB/EDPS role in the EU provides the model; the ICO (UK), IMY (Sweden), and Information Regulator (South Africa) are equivalents.

5. Prohibition on government programmability. The UK's commitment — enshrined in writing and to be legislated — that neither the central bank nor the government can program the CBDC or restrict spending is essential. The EU similarly excludes programmable money on the core ledger. Russia's "coloured funds" are the anti-pattern. This must be a statutory prohibition, not a policy promise.

6. Right to cash. No CBDC should be deployed without parallel legislation guaranteeing continued access to physical cash. Sweden, the UK, and the EU have all moved in this direction. The EU's "single currency package" (June 2023) includes COM(2023) 364 on legal tender of euro banknotes and coins alongside the digital euro regulation.

7. Audit trail with access controls. Transaction data must be retained for AML/CFT purposes, but access to that data must be governed by strict legal process requirements. The UK model — where data use is limited to purposes "already permitted for law enforcement" — provides a clear boundary. Russia's model — where authorities can freeze accounts without court orders — is the anti-pattern.

8. Transparency reporting. Central banks should publish annual transparency reports disclosing: (a) the number of law enforcement data requests received and fulfilled; (b) the scope of data shared with government agencies; (c) any changes to the privacy architecture. No CBDC project has committed to this as of June 2026, but the EU's proposed Fraud Detection and Prevention Mechanism would benefit from such accountability.

5.2 Tiered Approach: Anonymous Small, Pseudonymised Medium, Full KYC Large

The recommended three-tier framework, consistent with FATF risk-based approach principles:

5.3 Threshold Recommendations with Country Precedents

5.4 GDPR / Data Protection Law Compatibility Checklist

For any jurisdiction with GDPR-equivalent data protection law:

• Lawful basis identified for each category of personal data processing (consent, legal obligation, public interest)
• Data Protection Impact Assessment (DPIA) completed before launch, published or submitted to supervisory authority
• Data minimisation implemented at settlement layer — central bank cannot access identity data
• Purpose limitation enforced — transaction data processed only for stated purposes; no secondary use without new lawful basis
• Storage limitation defined — retention periods for transaction data specified and enforced
• Data subject rights preserved — right to access, rectification, erasure (where compatible with AML obligations)
• Cross-border transfer safeguards in place for multi-CBDC platforms (adequacy decisions, standard contractual clauses, or binding corporate rules)
• Centralized identifier registry avoided or justified — EDPB/EDPS questioned necessity of centralised user identifier; decentralised alternatives considered
• Fraud detection mechanism scope defined — EDPB/EDPS found the EU's proposed FDPM "lacks foreseeability"; processing of personal data must be clearly specified
• Offline transaction data handling defined — whether offline transaction logs are retroactively auditable upon reconnection must be specified (India and Ghana have not clarified this)
• Independent supervisory authority designated with jurisdiction over CBDC data processing
• Pseudonymised data treated as personal data — GDPR explicitly requires this; pseudonymisation is a safeguard, not an exemption

6. Decision Matrix

The following matrix enables regulators to evaluate their CBDC privacy framework against the dimensions that matter most for public trust, legal compliance, and adoption:

How to Use This Matrix

Regulators should score their CBDC design against each dimension on a three-point scale:

• Green (Strong): Legal framework enacted; technical safeguard implemented and tested; independent oversight in place.
• Amber (Partial): Policy commitment made but not legislated; technical safeguard designed but untested at scale; oversight planned but not independent.
• Red (Weak/Absent): No commitment; no safeguard; no oversight.

Minimum threshold for launch: No CBDC should proceed to public deployment with a Red score on any of the first four dimensions (legal foundation, central bank data access, offline privacy, PET selection). The experiences of Nigeria (Red on multiple dimensions, 98.5% inactivity) and Russia (Red on legal foundation for privacy, >50% public resistance) demonstrate the consequences of launching without adequate privacy infrastructure.

Sequencing recommendation: Based on comparative evidence, the optimal sequence is:

1. Before design phase: Engage data protection authority and conduct preliminary DPIA; establish legislative privacy commitments (UK model).
2. During design phase: Select and test PETs; define wallet tiers and thresholds; develop offline capability (EU/BIS model).
3. Before pilot: Complete DPIA; publish privacy architecture; engage public consultation (UK: 50,000 responses; EU: EDPB/EDPS opinion).
4. Before launch: Enact primary legislation with privacy guarantees; establish independent oversight; publish transparency reporting framework.
5. Post-launch: Monitor adoption against privacy metrics; publish first transparency report within 12 months; review thresholds based on empirical data.

Jurisdictional Privacy Scoreboard (June 2026)

Scores reflect the privacy posture of jurisdictions with a live, piloting, or design-stage CBDC, plus notable non-issuers. Jurisdictions that have declined to issue a retail CBDC (US, Canada, South Africa) are scored on the privacy posture of their stated design intentions or anti-CBDC rationale.

Sources Consolidated

Primary Sources — Central Banks and International Bodies

• PBOC, "Balancing Privacy and Security: Theory and Practice of the E-CNY's Managed Anonymity," November 2022 — PDF
• ECB, "Preparation phase closing report," October 2025 — Link
• ECB FAQs on the digital euro — Link
• EDPB, Joint Opinion 02/2023, 17 October 2023 — Link
• Bank of England, "Responses to the digital pound consultation paper," January 2024 — Link
• UK Parliament, "Government agrees to privacy protections in digital pound legislation" — Link
• UK Treasury Committee, "The digital pound: still a solution in search of a problem?," December 2023 — Link
• RBI Concept Note on CBDC, October 2022 — PDF
• RBI Annual Report 2025-26, May 2026 (e₹-R circulation ₹771.7 crore at 31 Mar 2026) — self-reported figures, flagged accordingly
• Bank of Canada, Staff Analytical Note 2020-9 (privacy) and SDP 2025-1 (PETs) — Link
• Reserve Bank of Australia / DFCRC, Project Acacia final report (mr-26-13), 18 May 2026; RDP 2024-02 (willingness to pay for anonymity)
• Bank of Korea, Project Hangang materials; PIPA (amended February 2026)
• Monetary Authority of Singapore, Orchid Blueprint; PDPA 2012; MAS Data Governance Guidance (May 2024)
• Bank of Japan, CBDC Experiments report (2025); PETs research report (January 2023)
• Bank of Thailand, retail CBDC pilot (Bang Khun Phrom, 2024); PDPA B.E. 2562 (2019)
• CBR, "Large-scale introduction of digital ruble to begin 1 September 2026" — Link
• Riksbank, "E-krona pilot phase 4," March 2024 — Link
• Central Bank of The Bahamas, Sand Dollar framework; Bank of Jamaica, JAM-DEX framework (Data Protection Act 2020); ECCB DCash materials
• Bank of Ghana, eCedi pilot results (G+D); Data Protection Act, 2012 (Act 843)
• CBN Regulatory Guidelines on the eNaira, October 2021 — PDF
• SARB, Position Paper on the Necessity of a Retail CBDC, 27 November 2025; Project Khokha 1/2 materials (POPIA)
• Federal Reserve, "Money and Payments: The U.S. Dollar in the Age of Digital Transformation," 2022; Executive Order 14178 (January 2025); GENIUS Act / Public Law 119-27 (July 2025)
• BIS, "Project Tourbillon" — Link
• BIS, "Project Polaris: handbook for offline payments with CBDC" — Link
• BIS Working Paper No. 1242, "Privacy-enhancing technologies for digital payments," 2024 — Link
• FATF, "Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs," October 2021 — Link

Secondary Sources — Analysis and Reporting

• DigiChina (Stanford), "Controllable Anonymity Lexicon" — Link
• Carnegie Endowment, "Can the Digital Ruble Shield Russia From Western Sanctions?," October 2024 — Link
• Carnegie Endowment, "Why Nigeria's Controversial Naira Redesign Policy Hasn't Met Its Objectives," January 2024 — Link
• Cambridge Core, "Assessing the Legal Status of the eNaira," 2023 — Link
• HRF CBDC Tracker — Russia, Nigeria, India, Brazil
• MIT Digital Currency Initiative, "Enhancing Privacy of a Digital Pound" — Link
• Ledger Insights, "Brazil's DREX CBDC project pivots away from blockchain," August 2025 — Link
• IMF Working Paper WP/23/104, "Nigeria's eNaira, One Year After," May 2023 — Link
• ECB — Selected service providers, 2 October 2025 — Link
• EUR-Lex, COM(2023) 369 — Link
• CBDC News EU, "Russia's Digital Ruble: State-Driven Push Meets Public Skepticism," 2025 — Link

Verification Notes

All factual claims in this document mirror the canonical per-jurisdiction fact matrix (.claude/cbdc-frameworks-fact-matrix.json), which is the verified source of truth for this refresh. Adoption and transaction figures that originate from issuing authorities are flagged as self-reported. The following items remain unverified, undisclosed, or represent gaps:

1. India anonymity threshold values: The RBI has not published specific thresholds separating "small" and "large" transactions for privacy purposes. UNVERIFIED.
2. India / Ghana offline transaction auditability: Whether offline NFC transaction logs are retroactively auditable upon device reconnection has not been specified by the RBI or the BoG. NO DATA FOUND.
3. Ghana retail privacy specification: The Bank of Ghana has published no detailed privacy specifications, data-retention rules, government-access rules, or wallet tiers for the eCedi (pilot declared "completed" 22 May 2026). NOT VERIFIED.
4. China PIPL-PBOC interplay: No public enforcement actions or regulatory guidance specifically addressing PIPL compliance in the context of e-CNY data collection were found; the January 2026 deposit-money reclassification adds commercial-bank balance/interest data to the privacy picture. NO DATA FOUND on the specific interplay.
5. EU low-value online privacy threshold: The EDPB/EDPS recommended this, but the European Parliament (10 February 2026) endorsed both online and offline functionality without adopting a specific low-value online anonymity threshold; the ECON Committee vote on the draft report is scheduled 23 June 2026. STATUS: recommendation only, not yet adopted.
6. Brazil production privacy solution: The BCB has not identified a privacy solution for the rebuilt Drex; the Hyperledger Besu platform was decommissioned 10 November 2025 and the project is rebuilding "from scratch" with no firm launch date. UNRESOLVED.
7. Russia offline privacy: No explicit offline functionality for the digital ruble is described in the source matrix. NOT VERIFIED.
8. Eastern Caribbean (DCash) transaction volume & merchant limits: The ECCB did not publicly release granular transaction-volume statistics; merchant wallet limits NOT VERIFIED. DCash 2.0 development is SUSPENDED (13 February 2026).
9. Cross-border CBDC privacy standards: No international framework or standard specifically addresses privacy in multi-CBDC cross-border transactions. FATF Recommendation 16 applies in principle but has not been adapted for CBDC-specific scenarios. GAP.

Last updated: 2026-06-04