The Bank of Canada recently published a note (Staff Analytical Note 2022-14) on what they call the archetypes for a retail CBDC in which they point out that a direct model — in which transacting parties directly provide their own oversight and communicate between themselves to exchange and record settlement information — is the only model that deliver cash-like person-to-person transactions, where counterparties can settle a transaction without involving a third party.
The direct model that they refer is the maximally distributed model: Each participant (well, each participant’s device) can store digital assets and exchange them with other devices. offline. The Bank of Canada definition of offline refers to the ability of counterparties to transact when connected only to each other and no other party. This means that they can connect over a local interface (eg, Bluetooth) and execute transactions in the absence of mobile connectivity, the internet or even electricity. The Bank of Canada suggest two forms of offline capability: extended offline (i.e., offline clearing and settlement) and intermittent offline (offline clearing only). In an intermittent offline system, transactions clear instantly, but funds do not settle until the payee resumes connectivity with a remote service. In extended offline, the funds transfer completes so that the payee can spend the funds received right away without connectivity to a network service.
There are three main reasons why this “direct” model makes the most sense: inclusion, scale and resilience.
The reach of a cash alternative must be universal. Every nook and cranny. Citizens
The scale of a cash alternative must greatly exceed the scale of either cash or any current electronic alternatives. Why? Well because in addition to having every citizen using the system at the same time, it is highly likely that machines and bots will be executing vast numbers of transactions at the same time.
The resilience of a cash alternative is greatly enhanced by offline device-to-device transfer. There is no central system to take down, no switches to knock out, no network to paralyse. Look at what has happened to the Shetland Islands, north of Scotland. There were two undersea cables connecting the islands to the world. Both are out of action, having either been dredged up by fishermen, bitten through by sharks or blown up by specially-trained dolphins acting on behalf of a foreign power. Now, no-one can buy anything in the shops.
Hardened
This lack of third-party oversight has obvious security implications, though. The Bank of Canada say (and I agree) that such a model would need secure, tamper-resistant hardware to maintain and update the state of the decentralised ledger. As they go on to note, such solutions have been deployed at a relatively small scale and they then says that it is “unknown whether their security can be hardened sufficiently to support a general-use fiat currency system” at the scale of a national population. The clear danger is that should such hardware be compromised then a device could to issue CBDC fraudulently at scale.
Now, I have to say I am more optimistic about the ability of technology to deliver here. Too explain why, let me begin by picking up something that John Kiff pointed out on the International Monetary Fund blog recently. John observed that as most of the world’s central banks rush to develop digital currencies, almost all the research and trials focus on internet-based technology, whether it be Hyperledger Fabric in Nigeria or R3’s Corda in Sweden. He then goes on to ask the obvious question: What will happen when the web goes down in a war? What if there is a natural disaster? And what about the three-quarters of the world’s adult low-income population that doesn’t even have internet access?
He concludes, as the Bank of Canada did, that for a digital currency to be useful, it must work offline. And here, John says, the future of offline CBDCs may lie in the technological past. That’s where his nod to a distant past and a push to develop offline digital payment systems (eg, Mondex) comes in. Some of the very valuable work done in this space goes back a generation, to that long ago time before smartphones, but it remains valid and it is important that the lessons learned then are not forgotten.
Mondex, for one, did think that the tamper-resistant hardware, when combined with intelligent audit, was adequate to support population-scale electronic cash. And when their provably-secure design is transplanted to today’s hardware (particularly secure elements), I think it can indeed deliver.
In other words, a retail CBDC that is going to function as a viable cash alternative must function offline and the technology to deliver this at population scale already exists. Let’s do it.