A reading in five chapters
cbdc.study
On the quiet arrival of programmable money, and the questions we ought to be asking before the ledgers close.
An essay. No login, no newsletter, no sale.
I.
The Question
What happens when cash disappears? Not in the dramatic sense — no single night when the last paper note is set on fire — but slowly, the way languages fade, the way old switchboards were replaced by invisible packet-switched networks no one can point at. A central bank digital currency is proposed as the successor. It is money issued directly by the state, held as an entry on the central bank's ledger, transferred through apps and wallets and terminals. The description is tidy. The consequences are not.
The first questions are the ones we do not usually ask out loud. They are not about yield or regulation or settlement finality, although we will come to those. They are older questions, the ones that a newcomer to any system is forbidden from voicing because everyone else has agreed to pretend the system is obvious. Who writes the ledger? What does the ledger remember? Who can read what is written there, and for how long? Paper cash is forgetful. A coin handed across a counter has no memory of the hand that held it before. This forgetfulness is not a bug. It is a design property, and it is the property most in danger of being engineered out.
There are two official answers for why this is happening. The first is efficiency: cash is expensive to print, store, transport, audit. The second is inclusion: a digital wallet can reach anyone with a phone, and the unbanked can be banked by decree. Both answers are true. Both answers are insufficient. Neither answer explains why every major central bank has, in the last four years, assigned teams and committees and whitepapers to the same quiet project. The real reason is harder to say in a press release: the architecture of money is being rewritten, and no one wants to be the last to hold the pen.
The question that matters is not whether CBDCs will be issued. They will be; several already are. The question is what shape they take when they arrive. A CBDC can be built as a neutral pipe, indistinguishable from cash except that it travels at the speed of light. It can also be built as a programmable instrument — one that expires if unspent, refuses certain merchants, or funnels every transaction into a national database indexed by identity. The same three letters cover both futures. Only the engineering is different.1
So we begin, as any honest study does, in a state of not-knowing. The essay that follows does not pretend to resolve the question. It only insists that the question deserves to be held in full view, turned in the hand like a coin, before the last opportunity to ask it is spent.
II.
The Mechanism
Strip the rhetoric and a CBDC is a surprisingly simple object: a digital token, or a database entry, whose issuer is the central bank and whose value is denominated in the national unit of account. What changes is not the money but the route the money takes. Every deposit, every transfer, every settlement touches — at least potentially — a ledger operated not by a commercial bank but by the state itself.
The canonical architecture is the two-tier model. The central bank issues the CBDC and maintains the master ledger. Commercial banks and licensed wallet providers sit between the central bank and the public, handling onboarding, customer service, and most compliance work. The user sees a familiar app; the settlement happens one layer deeper.
A second architectural axis is account-based versus token-based. An account-based CBDC is an entry next to your name; a token-based CBDC is a bearer instrument, closer to cash, whose ownership is proved by a cryptographic key. The first is easier to regulate. The second is easier to defend, in the civil-liberties sense. Most proposed designs are hybrids.
A third axis, often underplayed in official documents, is privacy architecture. Fully traceable designs retain an identity-to-transaction link for every payment. Fully anonymous designs permit none. In between sits a spectrum: tiered anonymity (small amounts are private, large amounts are not), pseudonymous-by-default, zero-knowledge proofs that prove compliance without revealing identity. The choice is not technical; it is political.
The diagrams at right sketch the transaction path, the privacy spectrum, and a side-by-side comparison of cash, bank deposit, crypto, and CBDC. They are drawn by hand because the story they tell is not yet a product diagram. It is a conversation, still in the margin.
III.
The Stakes
Every monetary instrument is also an instrument of government. This sentence is easy to write and hard to sit with. The coin in your pocket is a promise, yes, but it is also a declaration: the state has granted you the right to transact without asking permission. Money that does not require permission is a rare kind of freedom. It does not feel like freedom, because it is ordinary — like the air in the room, noticed only when it thins.
“The most important property of cash is not that it is private. It is that it is forgetful.”
A badly designed CBDC would convert every purchase into a record, every record into a dossier, every dossier into a lever. Not because any particular official intends this — most officials drafting these systems are decent, careful people — but because the architecture permits it, and what architecture permits, some future administration will eventually use. This is not paranoia; it is institutional memory. The question is whether the system, as built, makes abuse easy or hard.
There are also the quieter stakes. Monetary policy in a fully digital regime acquires new levers: negative rates that cannot be escaped by holding paper, expiry dates on stimulus transfers, targeted assistance that can only be spent on specific categories of goods. Each of these is useful in some crisis and invasive in ordinary life. The design question is whether the levers exist at all, or exist only dormant, or are excluded by architecture.
“What can be programmed can be recalled. What can be recalled is not, in the old sense, yours.”
And there is the stake that does not fit in a whitepaper: the slow erosion of the commons of ignorance. It is useful, individually and collectively, that the state does not know everything. It is useful that the ledger forgets. A society in which every transaction is legible is not only less free; it is also, in ways we are only beginning to map, less resilient. The future it rehearses is not the one its designers claim to want.2
None of this argues against a CBDC. It argues for a CBDC that is honest about what it is: a new instrument, with new affordances, whose shape is still up for drafting. The drafting is happening now, in rooms most citizens have never been invited into. To care about the shape is not alarmism. It is citizenship.
This essay is typeset in EB Garamond for display, Source Serif 4 for text, and Libre Franklin for marginal notes. It was composed in a single column, 680 pixels wide, the way a book would be.
Printed to the screen, no ink. Last revised the morning of publication.
Further Reading
- Bank for International Settlements. Central bank digital currencies: foundational principles and core features. Report No. 1, 2020.
- Auer, R. & Böhme, R. The technology of retail central bank digital currency. BIS Quarterly Review, March 2020.
- Brunnermeier, M. & Landau, J.-P. The digital euro: policy implications and perspectives. Princeton, 2022.
- Zuboff, S. The Age of Surveillance Capitalism. PublicAffairs, 2019.
- Narula, N. Digital currency and the architecture of freedom. MIT DCI Working Papers, 2023.
cbdc.study — an independent reading, unaffiliated with any central bank or commercial issuer. — MMXXVI —