SEPTEMBER2022

TECHNICALEVALUATIONFORAU.S.CENTRALBANKDIGITALCURRENCY

SYSTEM

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM1

2TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

AboutthisDocument

ExecutiveOrder(EO)14067directedtheOfficeofScienceandTechnologyPolicytoproduceatechnicalevaluationtofacilitateandsupporttheintroductionofaCentralBankDigitalCurrency(CBDC)systemintheUnitedStates(U.S.),shouldonebeproposed.ThisreportlaysoutthepolicyobjectivesforaU.S.CBDCsystem,andproceedstoanalyzetechnicaldesignchoicesforaU.S.CBDCsystemwithrespecttothosepolicyobjectives.ThisreportalsoestimatesthefeasibilityofbuildingaU.S.CBDCminimumviableproductandassesseshowaU.S.CBDCsystemmayimpactFederalprocesses.ThisreportmakesrecommendationsonhowtopreparetheU.S.GovernmentforaU.S.CBDCsystem,butitdoesnotmakeanassessmentorrecommendationaboutwhetheraU.S.CBDCsystemshouldbepursued.

AbouttheOfficeofScienceandTechnologyPolicy

TheOfficeofScienceandTechnologyPolicy(OSTP)wasestablishedbytheNationalScienceandTechnologyPolicy,Organization,andPrioritiesActof1976toprovidethePresidentandotherswithintheExecutiveOfficeofthePresidentwithadviceonthescientific,engineering,andtechnologicalaspectsoftheeconomy,nationalsecurity,health,foreignrelations,theenvironment,andthetechnologicalrecoveryanduseofresources,amongothertopics.OSTPleadsinteragencyscienceandtechnologypolicycoordinationefforts,assiststheOfficeofManagementandBudgetwithanannualreviewandanalysisofFederalresearchanddevelopmentinbudgets,andservesasasourceofscientificandtechnologicalanalysisandjudgmentforthePresidentwithrespecttomajorpolicies,plans,andprogramsoftheFederalgovernment.Moreinformationisavailableat

/ostp

.

AbouttheInteragencyProcess

ThecreationofthisreportwascoordinatedthroughaninteragencyprocessledbytheAssistanttothePresidentforNationalSecurityAffairsandtheAssistanttothePresidentforEconomicPolicy,asdescribedinSection3ofEO14067.AlistofdepartmentsandagenciesinvolvedinthisinteragencyprocesscanbefoundinAppendixB.

CopyrightInformation

ThisdocumentisaworkoftheUnitedStatesGovernment,andthisdocumentisinthepublicdomain(see17U.S.C.§105).

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM3

Contents

Introduction 5

PolicyObjectivesforaU.S.CBDCSystem 7

TechnicalDesignChoicesforaU.S.CBDCSystem 11

Participants 12

TransportLayer 12

Interoperability 15

Governance 16

Permissioning 16

AccessTiering 18

IdentityPrivacy 20

Remediation 22

Security 24

Cryptography 24

SecureHardware 26

Transactions 27

Signatures 27

TransactionPrivacy 29

OfflineTransactions 30

TransactionProgrammability 32

Data 33

DataModel 33

LedgerHistory 34

Adjustments 36

Fungibility 36

HoldingLimits 38

AdjustmentsonTransactions 39

AdjustmentsonBalances 40

FeasibilityandResourcesforaU.S.CBDCSystemMinimumViableProduct 41

BriefSurveyofRelevantExperimentation 41

PublicSector 41

PrivateSector 42

......

4TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

EstimatingResourcesRequiredBasedonSetsofHypotheticalCBDCDesignChoices 42

ExampleSet#1:MinimallyComplex 43

ExampleSet#2:MoreComplexFocusingonBroaderParticipation 44

ExampleSet#3:MoreComplexFocusingonProgrammability,Privacy,andInclusion 44

ImpactofaU.S.CBDCSystemonFederalProcesses 46

CybersecurityandPrivacy 46

CustomerExperience 47

SocialSafetyNetPrograms 48

RecommendationsonPreparingforaU.S.CBDCSystem 50

AdvanceTechnicalWorkRelatedtoDigitalAssets 50

ContinueDigitalAssetsResearchandExperimentationWithintheFederalReserve 50

EstablishaDigitalAssetsR&DAgenda 50

ScaleUpTechCapacityAcrosstheFederalGovernment 51

AppendixA:DigitalServicesBestPractices 53

OpenSource 53

ModernTechnologyStack 54

AgileDevelopment 54

TeamStructure 55

AppendixB:InteragencyProcess 58

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM5

Introduction

ACentralBankDigitalCurrency(CBDC)isadigitalformofacountry’ssovereigncurrency.

1

IftheUnitedStatesissuedaCBDC,thisnewtypeofcentralbankmoneymayprovidearangeofbenefitsforAmericanconsumers,investors,andbusinesses.Forexample,aU.S.CBDCmightenabletransactionsthataremoreefficientandlessexpensive,particularlyforcross-borderfundstransfers.However,therearealsopotentialriskstoconsider.AU.S.CBDCmightaffecteverythingrangingfromthestabilityofthefinancialsystemtotheprotectionofsensitivedata.Recognizingthesepotentialupsidesanddownsides,theBiden-HarrisAdministrationiscommittedtofurtherexploringtheimplicationsof,andoptionsfor,issuingaCBDC.

OnMarch9,2022,PresidentBidensignedExecutiveOrder(EO)14067,EnsuringResponsibleDevelopmentofDigitalAssets,placingthehighesturgencyonresearchanddevelopmenteffortsintothepotentialdesignanddeploymentoptionsofaU.S.CentralBankDigitalCurrency(CBDC).

2

EO14067furtherdirectedtheFederalgovernmentto“prioritizetimelyassessmentsofpotentialbenefitsandrisksundervariousdesignstoensurethattheUnitedStatesremainsaleaderintheinternationalfinancialsystem.”Tohelpadvancethisdirective,Section5(b)(ii)ofEO14067orderedtheDirectoroftheOfficeofScienceandTechnologyPolicy(OSTP)andtheChiefTechnologyOfficeroftheUnitedStates–inconsultationwiththeSecretaryoftheTreasury,theChairoftheFederalReserve,andtheheadsofotherrelevantagencies–tosubmittothePresidentatechnicalevaluationforaU.S.CBDCsystem,shouldonebeproposed.

ThisreportbeginsbylayingoutthepolicyobjectivesforaU.S.CBDCsystem,outlinedinEO14067anddevelopedinfurtherdetailthroughaninteragencyprocessledbytheNationalEconomicCouncilandtheNationalSecurityCouncil.ThesepolicyobjectivesreflecttheAdministration’songoingcommitmenttodevelopandusetechnologyinaccordancewithdemocraticvalues.ThisreportthenanalyzesthetechnicaldesignchoicesforaU.S.CBDCsystem,focusingonhowthosechoiceswouldimpactthepolicyobjectivesforaU.S.CBDCsystem.Next,thisreportestimatesthefeasibilityofbuildingaminimumviableproductforaU.S.CBDCsystem,basedonhypotheticalcombinationsoftechnicaldesignchoices.Finally,thisreportassesseshowaU.S.CBDCsystemmayimpactFederalprocesses,focusingoncybersecurityandprivacy,customerexperience,andsocialsafetynetprograms.

ThisreportconcludesbymakingrecommendationsonhowtopreparetheFederalgovernmentforaU.S.CBDCsystem,shouldonebepursued.ItrecommendsthatOSTPhelpadvancetechnologyrelatedtoCBDCsaspartoftheCBDCWorkingGroupoutlinedintheDepartmentoftheTreasury’sreportonTheFutureofMoneyandPayments.ItencouragestheFederalReservetocontinueitsresearchandexperimentationonCBDCsystems,whilerecommendingthattheNationalScienceFoundation(NSF)andOSTPdevelopaNationalDigitalAssetsResearchandDevelopment(R&D)AgendatohelpspurinnovationthatcouldsupporttheFederalReserve’s

1OtherU.S.GovernmentreportsexplainCBDCsingreaterdepth.See,e.g.,

TheFutureofMoneyandPayments

.(Sep.2022).DepartmentoftheTreasury;and

MoneyandPayments:TheUSDollarintheAgeofDigital

Transformation

.(Jan.2022).TheFederalReserve.

2

ExecutiveOrder14067:EnsuringResponsibleDevelopmentofDigitalAssets

.(Mar.2022).FederalRegister.

......

6TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

efforts.Finally,itrecommendsscalinguprelevanttechnologicalinfrastructure,capacity,andexpertiseacrosstheFederalgovernmenttoharnessbenefitsandmitigaterisksofdigitalassets.

Itisalsoimportanttobrieflynotewhatthisreportdoesnotdo.ThisreportdoesnotmakeanyassessmentsorrecommendationsaboutwhetheraU.S.CBDCshouldbepursued.Additionally,thisreportdoesnotmakeanydesignchoicesforaU.S.CBDCsystem,ifonewereproposed.Instead,itfulfillsthemissionofEO14067byprovidingatimelyassessmentofpotentialbenefitsandrisksforaU.S.CBDCsystem.

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM7

PolicyObjectivesforaU.S.CBDCSystem

EO14067outlinestheprincipalpolicyobjectivesoftheUnitedStateswithrespecttodigitalassetsandprovidesadditionalprioritiesforaU.S.CBDC.ThisdocumentprovidesconsiderationsrelatedtochoicesandlimitationsthatshouldinformthedesignofaU.S.CBDCsystem,wherea“CBDCsystem”includestheCBDCitself,thepublicsectorandprivatesectorcomponentsthatarebuilttointeractwithit,andthelawsandregulationsthatapplytoeachofthosecomponents.

3

BuildingonthepolicyobjectivesdescribedinEO14067,aU.S.CBDCsystemshouldsupportthefollowingobjectives.

4

Whilesomeoftheseobjectivesmaybeintension,itisnottheaimofthisdocumenttoreconcileorprioritizethepolicyobjectiveslistedbelow.Additionally,thepurposeofthisdocumentisnottotakeapositiononwhetheraU.S.CBDCshouldbepursued,ortomakedecisionsregardingparticulardesignchoicesforaU.S.CBDCsystemtoachievethestatedobjectives.

1.Providebenefitsandmitigaterisksforconsumers,investors,andbusinesses

a.Consumers,investors,andbusinessesshouldbefinanciallyprotected.TheCBDCsystemshouldincludeappropriateprotectionsforcustodialandotherarrangementsrelatedtocustomerassetsandfunds,fraudulentandotherillegaltransactions,andmarketfailures.Itshouldalsoprovideforappropriatedisclosuresofrisk.

b.Consumers,investors,andbusinessesshouldbedigitallyprotected.TheCBDCsystemshouldincludeconsumerprotectionsbydesignanddefault.Theseprotectionsshouldincludemechanismsforhumanconsiderationandremedyofharms,andtheseprotectionsshouldbeaccessible,equitable,effective,maintained,accompaniedbyappropriateoperatortraining,andshouldnotimposeanunreasonableburdenonthepublic.

2.Promoteeconomicgrowthandfinancialstabilityandmitigatesystemicrisk

a.TheCBDCsystemshouldsupporteconomicactivity.TheCBDCsystemshouldbedesignedtointegrateseamlesslywithtraditionalformsoftheU.S.dollar.Inaddition,theCBDCshouldbeflexibleenoughtofacilitatearangeofeconomicpolicyobjectives,includingpromotingcompetitionandinnovation.Tosupporttheseobjectives,theCBDCsystemshouldbebothgovernableandsufficientlyadaptable.

b.TheCBDCsystemshouldensuretheresilienceofthefinancialsystem.TheCBDCsystemshouldbedesignedinawaythatisconsistentwithbroadfinancialintermediationandthatmitigatesconcentrationrisks.TheCBDCsystemshouldbedesignedtominimizetheoccurrenceofdestabilizingrunsandliquidityrisks.TheCBDCsystemshouldnotincreasesystemicrisk.

3Theterm“components”isbroadlyconstrued.Forexample,componentsmightincludesmartcards,mobileapplications,andintermediariesthatfulfillvariousrolesintheCBDCsystem.

4Theseobjectivesarealsoconsistentwiththe

G7PublicPolicyPrinciplesforRetailCBDCs

.(Oct.2021).G7.

......

8TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

c.TheCBDCsystemshouldbeoperableinnormalcircumstancesandunderstress.TheCBDCsystemshouldberesilientunderarangeofadversecircumstances,bothatinitialdeploymentandoveritslifecycle.WhenproblemsarediscoveredinCBDCfunctionality,thereshouldbeaclearprocessandadequatesupportformitigatingandresolvingthoseproblems.

3.Improvepaymentsystems

a.TheCBDCsystemshouldbefunctional.TheCBDCsystemshouldsupportthesmoothfunctioningofthepaymentsystembyensuringthattheCBDCsystemworks,includingatinitialdeployment,overitslifecycle,andwhenpartsofthesystemsarenonoperational.Furthermore,theCBDCsystemshouldfunctionefficientlyrelativetothecoststooperatesothatitcanalsoachievethepromisedbenefitsofaCBDCsystem.Todoso,theCBDCsystemshouldbedesignedsuchthatadequateresourcesandpersonneltrainingwillexistfordevelopingandmaintainingtheCBDCsystem’scomponents.

b.TheCBDCsystemshouldbeefficient.TheCBDCsystemshouldbeusableandprovideagoodcustomerexperience.Itshouldalsoallowforefficienciesthatmakeinvestmentsanddomesticandcross-borderfundtransfersandpaymentscheaper,faster,andsafer,bypromotinggreaterandmorecost-efficientaccesstofinancialproductsandservices.

c.TheCBDCsystemshouldbesecure.TheCBDCsystemshouldbeprotectedagainstcybersecurityattacksandfailures,andthesystemshouldensureassuranceandintegrityoftheCBDCandthesystemasawhole.TheCBDCsystemshouldbedesignedsothatconsumers,investors,businesses,andthepubliccantrustittobesecureandresilienttopotentialattacks,disasters,andfailures,aswellascyber,fraud,counterfeiting,andotheroperationalrisks.TheCBDCsystemshouldincludeappropriatecybersecurityandprivacyincidentmanagement,contingencyplans,andcontinuityplanstoensureavailabilityofitsfunctionalities,includinginthecaseofnaturaldisastersandforeignattacks.

d.TheCBDCsystemshouldbeflexible.TheCBDCsystemshouldsupportanecosystemofinnovationfromthepublicandprivatesectorsinordertomeetthevariousgoalsoftheUnitedStates.TheCBDCsystemitselfshouldbeextensibleandupgradeablesuchthatitcanbeiterateduponquicklytoimproveandharnessnewinnovation,aswellaschangingtechnologies,regulations,andneeds.

4.Ensuretheglobalfinancialsystemhastransparency,connectivity,andplatformandarchitectureinteroperabilityortransferability,asappropriate

a.TheCBDCsystemshouldbeappropriatelyinteroperable.TheCBDCsystemshould,whereappropriateandconsistentwithotherpolicypriorities,facilitatetransactionswithothercurrenciesandsystems,suchasphysicalcash,commercialbankdeposits,CBDCsissuedbyothermonetaryauthorities,andtheglobalfinancialsystem.TheCBDCsystemshouldbedesignedtoavoidrisksofharmtotheinternationalmonetarysystemandfinancialsystem,includingbroadmonetarysovereigntyandfinancialstability.TheCBDCsystemshouldbedesignedwith

......

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM9

appropriateconsiderationsfortransferabilityandorderlyterminationineventssuchasachangeinpolicyorendoflife.

5.Advancefinancialinclusionandequity

a.AllshouldbeabletousetheCBDCsystem.TheCBDCsystemshouldenable

accessforabroadsetofpotentialconsumersanduses,withappropriaterestrictionstomitigatespecificrisks(e.g.,destabilizingruns,moneylaundering).WhiletheCBDCsystemmayinitiallysupportfewerpotentialconsumersanduses,itshouldscaleandsupportabroaderrangeofusecasesovertime.Asitisdesigned,implemented,andmaintained,theCBDCsystemshouldtakeparticularnoticeofEO13985(AdvancingRacialEquityandSupportforUnderservedCommunitiesThroughtheFederalGovernment)andEO14058(TransformingFederalCustomerExperienceandServiceDeliverytoRebuildTrustinGovernment).

b.TheCBDCsystemshouldexpandequitableaccesstothefinancialsystem.TheCBDCsystemshouldexpandequitableaccesstodepositandpaymentproductsandservices,aswellascreditprovidedbybanksandothersources.Thisincludesexpandingequitableaccessforpeopleofcolor,ruralcommunities,individualswithouttheresourcestomaintainexpensivedevicesorreliableInternetaccess,andindividualswithcognitive,motor,orsensoryimpairmentsordisabilities.TheCBDCsystemshouldnotcreatenewinequities,includingthroughtechnologicalbarrierstouse.Technologicaladvances,educationalmaterial,andsupportshouldbeleveragedtoovercomethepotentialtechnicalandeconomicbarrierstousingCBDCthatmaydisproportionatelyharmsomecommunities.TheCBDCsystemshouldsupportpaymentstoandfromthepublicsectorandequity-advancinginitiatives,suchastheadministrationofsocialsafetynetprograms.However,useoftheCBDCsystemshouldnotbemandated.Offlinecapabilityshouldbeincorporated,andtheroleofcashshouldbepreserved.

6.Protectnationalsecurity

a.TheCBDCsystemshouldpromotecompliancewithAML/CFTrequirementsandmitigateillicitfinancerisks.TheCBDCsystemshouldbedesignedtofacilitatecompliancewithanti-moneylaundering(AML)andcombatingthefinancingofterrorism(CFT)requirements,aswellasrelevantsanctionsobligations.TheCBDCsystemshouldallowforthecollectionofinformationnecessarytofulfilltheserequirements,butnotmore.Thesystemshouldalsoenableadequatetransactionmonitoringtodetectandreportsuspiciousactivitytotherelevantauthority.TheCBDCsystemshouldbedesignedtoincludefeatures,orenableintermediariestoincludefeatures,toidentifyandmitigateillicitfinancerisks(e.g.,fraud,sanctionsevasion,moneylaundering),whileprovidingappropriateprotectionsforprivacy,civilandhumanrights,andcybersecurity.

b.TheCBDCsystemshouldsupportU.S.leadershipintheglobalfinancialsystem,includingtheglobalroleofthedollar.TheCBDCsystemshouldbeattheforefrontofresponsibledevelopmentanddesignofdigitalassetsandshouldunderpinnewformsofpayments.TheCBDCsystemshouldsupportscalability

......

10TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

andbecapableofmaintaininghighthroughput,speed,resiliency,security,andprivacyasitfacilitatesmillionsorbillionsofusersandglobaltransactionsthatarefast,efficient,andconvenient(forbothdomesticandcross-borderpayments,ifdeemedappropriate).ThefullyoperationalCBDCsystemshouldsupporthighuserandtransactionloads,includingduringsurgesintransactionvolume.

7.Provideabilitytoexercisehumanrights

a.TheCBDCsystemshouldrespectdemocraticvaluesandhumanrights.The

CBDCsystemshouldbedesignedandusedinaccordancewithcivilandhumanrights,suchasthoseprotectedbytheU.S.Constitution,aswellasthoseoutlinedintheUniversalDeclarationofHumanRightsandtheInternationalCovenantonCivilandPoliticalRights.TheCBDCsystemshouldhaveoversightandaccountabilitymechanismstoensurecompliancewithcivilandhumanrights.TheCBDCsystemshouldbeabletoincorporatetechnicalprotectionsthatpreventtheuseofCBDCinwaysthatviolatecivilorhumanrights.TheCBDCsystemshouldalsobeprotectedfromabuseduringperiodsofhighpoliticalvolatilityordeviationfromdemocraticvalues.

8.Alignwithdemocraticandenvironmentalvalues,includingprivacyprotections

a.Sensitivefinancialdatashouldbeprivate.TheCBDCsystemshouldmaintainprivacyandprotectagainstarbitraryorunlawfulsurveillance.TheCBDCdesign,deployment,andmaintenanceshouldadheretoprivacyengineeringandriskmanagementbestpractices,includingprivacybydesignanddisassociability.

5

Built-inprotectionsanddesignchoicesshouldensurethatprivacyisincludedbydefault,includingensuringthatdatacollectionconformstoreasonableexpectationsandonlydatathatisstrictlynecessaryforadvancingCBDCsystempolicyobjectivesiscollected.

b.TheCBDCsystemshouldbesustainable.TheCBDCsystemshouldbecompatiblewithU.S.environmentalpriorities,includingcuttingU.S.greenhousegaspollutionby50-52%from2005levelsby2030andtransitioningtoanet-zeroemissionseconomyby2050.TheCBDCsystemshouldminimizeenergyuse,resourceuse,greenhousegasemissions,otherpollution,andenvironmentalimpactsonlocalcommunities.Thesystemshouldimproveenvironmentalperformancerelativetothetraditionalfinancialsystem.

5Disassociabilityreferstotheprocessingofdataoreventswithoutassociationtoindividualsordevicesbeyondtheoperationalrequirementsofthesystem.See,e.g.,

NISTPrivacyFramework

.(Jan.2020).NationalInstituteofStandardsandTechnology,29.

TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM11

TechnicalDesignChoicesforaU.S.CBDC

System

EO14067directedOSTPtosubmittothePresidentareportthataddressesthetechnicalaspectsofthevariousCBDCdesigns,includingwithrespecttoemergingandfuturetechnologicaldevelopments.ThissectionprovidesalistofdesignchoicesthatcouldinformthetechnicaldesignofaU.S.CBDCsystem,aswellasananalysisoftheirbenefitsandrisks.Thissectionfocuseson18designchoices,dividedintosixcategories:Participants,Governance,Security,Transactions,Data,andAdjustments.

Thissection:

?DoesnotpresupposethataCBDCsystemwoulduseanyparticulartechnology(e.g.,adistributedledgertechnologyoracentrallymanageddatabase);

?DoesnotassumethataCBDCsystemwouldmaintainidenticalfunctionalitytocash;

?DoesnottakeanypositiononwhetherestablishingaCBDCsystemwouldbeinthebestinterestoftheUnitedStates;

?Doesnotprioritizethedesignchoicesinorderofimportance;

?Doesnotclaimthatthelistofdesignchoicesiscomplete;

?Doesnotassumeaparticulardistributionmodel,butdoes,forthesakeofanalysis,focusondesignchoiceswithmoreapplicabilityforaretailCBDCsystem;

6

?DoesnotassumethatallapplicabledesignfeaturesneedtobeincorporatedintoaCBDCsystematinitialdeployment;

?Doesemphasizethatmanydesignchoicesarelinkedtootherdesignchoices;and

?Does,forthesakeofanalysis,focusonthetwoendpointsforthespectrumofpossibilitiesforadesignchoice,eventhoughhybridoptionsarepossible,orpotentiallydesired.

Inordertofocustheanalysisonthedesignchoicesthatlikelymattertopolicymakers,thissectionmakesafewstartingassumptionsaboutthedesignofaU.S.CBDCsystem.WhileaU.S.CBDCsystemcould,intheory,bemostly“permissionless”

7

fromagovernancestandpoint,thisdesignchoiceintroducesalargenumberoftechnicalcomplexitiesandpracticallimitationsthatstronglysuggestthatapermissionlessapproachdoesnotmakesenseforasystemthathasatleastonetrustedentity(i.e.,thecentralbank).Itispossiblethatthetechnologyunderpinningapermissionlessapproachwillimprovesignificantlyovertime,whichmightmakeitmoresuitabletobeusedinaCBDCsystem.However,giventhestateofthetechnology,mostoftheanalysisthatfollowsassumesthatthereisacentralauthorityandapermissionedCBDCsystem.

6ManyofthesedesignchoicesarelikelyalsoapplicabletoawholesaleorhybridCBDCsystem.

7ACBDCsystemcouldeitherbemanagedbyasetoftrustedentities("permissioned")orbyanetworkofsystemparticipants("permissionless"),orsomecombinationofthetwo.Thisisdiscussedfurtherinthepermissioningdesignchoicelaterinthisreport.

......

12TECHNICALEVALUATIONFORAU.S.CBDCSYSTEM

DecidingwhetheraCBDCisin