Central Bank Digital Currencies: Financial Infrastructure and State Visibility

The mainstream view holds that CBDCs offer real gains in payment efficiency and financial inclusion, but that these benefits come bundled with a genuinely new kind of state visibility into private transactions — one that existing digital payment systems don't quite match. Where analysts diverge is on how much that visibility matters: some treat it as a manageable design problem, solvable through tiered anonymity and privacy-by-design architecture; others argue the architecture itself is the problem, because once the infrastructure exists, the incentives to expand its use are structurally difficult to resist. Now — why does this matter right now? Because we've crossed a threshold. One hundred and forty-six countries representing ninety-eight percent of global GDP are actively exploring CBDCs, per the Atlantic Council's tracker. China's e-CNY has already processed the equivalent of two hundred and fifty billion dollars in transactions. The digital euro is moving through EU legislation as we speak. We've done our research on this one, and the facts are fascinating. The question isn't whether this happens — it's happening. The question is what kind of infrastructure we're actually building: is a CBDC a modernized public utility, a surveillance architecture with good branding, or something that looks completely different depending on which government is holding the keys? That's where I want to start.

Let’s talk about the elephant in the room: the Western debate treats CBDCs as a referendum on state power, but for most of the world, the state isn’t the primary adversary—it’s the absence of state capacity. The People’s Bank of China’s framing, via the Chinese Academy of Social Sciences, isn’t about surveillance; it’s about reclaiming monetary infrastructure from private platforms that extract rents and from a dollar-correspondent system that forces every cross-border transaction through New York’s visibility. When the PBOC says “traceability is a public good,” they’re not describing a police state—they’re describing a state that can actually govern its economy. Now, here’s the structural blind spot: the Western privacy debate assumes cash is the baseline for anonymity, but cash is already state-issued. The real question isn’t “how do we make CBDCs as anonymous as cash?”—it’s “how do we design a digital system where the state’s visibility is contingent, not inherent?” The RBI’s token-based digital rupee does exactly that: transaction data sits with commercial banks, not a central ledger, meaning the Indian state has less visibility into e₹ flows than it does into UPI transactions. That inversion—where a CBDC reduces state visibility relative to the status quo—is almost entirely missing from public debate. And let’s be clear: this isn’t about geography. Japan’s privacy-by-design isn’t liberal idealism—it’s disaster resilience. India’s decentralized model isn’t libertarianism—it’s a rejection of platform monopolies. Brazil’s zero-knowledge proofs aren’t a technical curiosity—they’re a direct challenge to the idea that privacy and compliance are incompatible. The real divide isn’t East vs. West; it’s between those who see money as a neutral medium and those who see it as a public infrastructure that must be governable. Every CBDC design is a vote for one of those theories. The question is: which one are we actually building?

The deeper mechanism is cross-border settlement. Project mBridge has reached minimum viable product precisely to route payments outside New York correspondent accounts. Non-Western designers are therefore accepting the trilemma's stability trade-off not because they discount it, but because escaping dollar visibility ranks higher in their ordering of failure modes than domestic deposit flight. That priority is visible in the PBOC and AMRO documents yet absent from the privacy-focused debate. The architecture is being built to change who holds the ledger on inter-state flows, not primarily to alter domestic visibility.

Kautilya's Arthashastra, circa three hundred BCE, treated a legible currency not as surveillance but as the mechanical precondition for state capacity. That civilizational baseline still loads the design dice across Asia. A systematic review of one hundred and forty peer-reviewed papers documents a hard trilemma: privacy, financial stability, and regulatory compliance cannot be maximized together. Every central bank is quietly picking which corner to sacrifice. Western architects trade compliance friction for confidentiality; non-Western designers trade opacity to stabilize settlement against private platform monopolies. But I think both camps are missing the same structural shock: the informal labor market. When a street vendor in Lagos or a driver in Surabaya migrates from cash to a traceable ledger, their tax exposure and bargaining power shift overnight. The IMF and UNDP call this inclusion, yet the labor economics remain almost entirely unstudied. We are treating transaction visibility as developmental gain without modeling the human balance sheet.

The striking thing is that inclusion rhetoric assumes visibility is neutral, but for households operating in the informal economy, visibility is a price signal. The evidence from Nigeria and Jamaica shows near‑zero retail uptake, but not why. Some of that is user inertia, yes, but part of it is that moving from cash into a traceable rail changes risk perception: the trader in Ibadan or Kingston now faces potential tax, debt collection, and welfare auditing exposure they didn’t before. None of the pilot evaluations capture that behavioural response because labour‑market visibility wasn’t a design variable. Until central banks model that elasticity, inclusion remains not a policy outcome but a hypothesis about trust under taxation.

The inclusion narrative assumes digital rails are neutral, but in economies where 60 to 80 percent of employment is informal, visibility isn’t just compliance—it’s a labor-market shock. Cash lets workers pool risk: a day’s earnings can be split among family, bartered for goods, or hidden from creditors. A traceable ledger doesn’t just record the transaction; it fixes the wage, the counterparty, and the timing in a way that cash never did. The IMF calls this inclusion; labor economists call it exposure. No pilot has modeled what happens when the state’s tax base suddenly includes the same workers who were previously invisible to it. That’s not a side effect—it’s the core structural change. And it’s being treated as a technical detail, not a social contract rewrite.

The minimal uptake across every live retail deployment points to a deeper mismatch: central banks are pricing in formal-sector assumptions about transaction costs while the informal majority treats cash's opacity as a coordination device for family risk-sharing and creditor avoidance. Because the labor-market elasticity of that shift remains unstudied, the inclusion case cannot yet distinguish between user friction and rational preservation of the only payment rail that leaves no enforceable record. That gap leaves the entire distributional claim resting on untested preferences rather than observed behavior.

I think we are misreading the adoption gap because we are looking at the wrong layer. The BIS twenty twenty-four survey finds wholesale architectures are more mature than retail pilots, yet public debate fixates on consumer wallets. That mismatch reveals the actual priority: settlement efficiency and breaking private payment monopolies, not mass retail surveillance. The Reserve Bank of India’s token design keeps data at commercial banks, and the Bank of Japan treats offline privacy as disaster resilience, not civil liberties. The trilemma documented across one hundred and forty studies—that privacy, banking stability, and regulatory compliance cannot be maximized together—forces a hard trade-off, and most architects outside the Atlantic are choosing governable infrastructure over cash-like opacity. I’d argue the binding constraint isn’t state visibility versus individual privacy; it’s whether a sovereign can dislodge platform rent-seekers without triggering commercial deposit flight. Brazil’s Drex pilot tests zero-knowledge cryptography to verify compliance without exposing transaction content, but math cannot neutralize the stability corner of that triangle. The design question is which systemic failure each state refuses to tolerate.

The real untested frontier isn’t technology, it’s fiscal behavior. Once a CBDC makes informal income visible, governments confront a choice: discipline and ignore it, or expand the tax net. The record of past fiscal reforms—from post‑war social insurance to the GST rollout in India—suggests institutional capacity follows data, not the other way around. So the inclusion claim is inseparable from a state‑capacity claim: can visibility stay informational without becoming extractive? No empirical data answers that yet, and that uncertainty, not user friction, is what markets in Lagos and Manila are quietly pricing into their hesitation.

The cryptographic-governance gap hasn't been named yet, and it's load-bearing. Brazil's Drex zero-knowledge proof experiments are technically serious — they allow compliance verification without exposing transaction content. But here's the claim I'd want falsified: cryptographic commitments and institutional commitments are not the same thing. A zero-knowledge proof guarantees mathematical privacy; it cannot guarantee that the legislature won't pass a law next decade requiring the proof to be unwound. The OECD and the Bank Policy Institute both flag this, and no longitudinal data exists to test it. So the deepest question isn't whether the math works — it does. It's whether any technical architecture can substitute for the structural anonymity that cash achieves through physical materiality rather than institutional promise.

Here’s the thing nobody’s naming: every CBDC is a constitutional amendment in code. Cash’s anonymity isn’t a design feature—it’s a structural byproduct of physical scarcity. When you digitize the ledger, you’re not just recording transactions; you’re rewriting the default setting of the social contract. The Bank of Japan’s offline resilience isn’t about privacy; it’s about preserving the constitutional principle that money must work even when the state doesn’t. The RBI’s token model isn’t decentralization for its own sake—it’s a deliberate choice to keep the state’s visibility contingent on commercial bank intermediation, which is itself a constitutional check. The real trilemma isn’t privacy-stability-compliance; it’s whether the architecture defaults to state visibility, platform visibility, or user visibility. And right now, every design is picking one of those as the load-bearing fact of the system—without ever putting the choice to a vote.

The trilemma's governance corner exposes a second-order incentive problem the technical debates miss. When designs embed traceability to curb platform rents, they also raise the expected cost of future policy shifts toward extraction, because the ledger now exists for fiscal authorities to use. Informal workers rationally discount that tail risk in their adoption calculus, which is why the pilots show near-zero uptake even where convenience gains should dominate. No architecture resolves whether that behavioral elasticity stays stable once the state has the data.

I think we are still treating visibility as a domestic ledger problem when the structural shift is happening in the cross-border plumbing. Project mBridge reached minimum viable product in twenty twenty-four to test whether central banks can settle trade without routing through legacy correspondent networks. That matters because correspondent accounts are where transaction visibility currently defaults to Washington. I am not dismissing domestic surveillance risks; the OECD and Cato Institute are right that traceable architectures create durable institutional incentives. But per the AMRO twenty twenty-three report and the PBOC’s own framing, many non-Western designers weight settlement dependency as the more immediate systemic threat. When you rebuild those rails, you are not just changing who records the payment; you are shifting which jurisdiction holds the veto over the flow. Physical notes crossed borders without asking permission. Digital sovereign money is trying to replicate that routing independence through architecture rather than materiality.

What’s hiding in plain sight is the bank‑run dynamic embedded in design. A retail CBDC gives households a direct claim on the central bank, which in a panic looks safer than any deposit. Some modelling—like the DSGE work in the IMF’s synthetic surveys—suggests that with strong tiering and holding limits, that same structure could reduce maturity mismatch and stabilize funding. Both can’t be right; it depends on how fast conversion works and whether commercial banks can price deposits competitively once a risk‑free digital asset exists. So the falsifiable question for policymakers isn’t philosophical—it’s operational: what conversion friction is enough to preserve intermediation without killing the very inclusion these systems promise?

The Bombay Plan angle hasn't been taken yet, and it reframes the entire consent question. The 1944 Bombay Plan — drafted by Indian industrialists, not state planners — argued that development required the state to direct capital flows with enough visibility to prevent private rent extraction. That's not a surveillance logic; it's a legibility logic. The state needs to see enough to govern, but the seeing is in service of development, not control. Furtado's dependency theory runs the same track from Latin America: for peripheral economies, monetary opacity historically served foreign capital, not local workers. I'd argue the RBI's token design is the contemporary resolution of that tension — keeping enough legibility for macroeconomic governance while structurally limiting the extractive use of that data. Whether that balance holds is the unanswered empirical question.

The structural blind spot in this debate is that we’re treating CBDCs as a monetary innovation when they’re actually a jurisdictional one. Cash’s anonymity wasn’t just about privacy—it was about location independence. A physical note moves across borders without asking permission from any ledger. Digital money, even with zero-knowledge proofs, still requires a legal home for its ledger. The real sovereignty question isn’t whether the state can see the transaction; it’s whether the transaction can exist without the state’s permission. Every cross-border CBDC pilot—mBridge, Inthanon-LionRock, Ubin—is quietly testing whether a payment can settle without touching a jurisdiction that might freeze it. That’s not a privacy problem; it’s a sovereignty arbitrage problem. And right now, the only way to guarantee settlement finality without foreign veto power is to make the ledger itself sovereign. The privacy debate misses this entirely because it assumes the ledger’s jurisdiction is neutral. It’s not. The choice of where the ledger lives is already a vote on whose rules apply.

Kautilya's insistence that standardized coinage must remain legible to the treasury was not a surveillance preference but the minimal condition for any state to project fiscal capacity across distance. Today's multi-CBDC pilots replicate that legibility at the jurisdictional level, letting peripheral treasuries see settlement flows without routing them through institutions whose rules they cannot alter. The mechanism at stake is no longer domestic extraction but which sovereign's balance-sheet constraints now bind the transaction.

What the cross‑border pilots show is that visibility is now a policy variable, not a by‑product. When the People’s Bank of China or the Bank of Thailand builds direct settlement channels, they’re rewriting who grants transactional permission. That’s the operational heart of sovereignty—control over clearing, not surveillance of citizens. But once visibility migrates from domestic ledgers to regional ones, the old compliance triads—AML, tax, capital control—must be re‑negotiated between states rather than within them. The unresolved question is whether these new regional rails will harden into fragmented monetary blocs or evolve into standards that make visibility reciprocal instead of hierarchical.

We are asking software to replicate what paper achieved through physics. Cash works as an anonymous instrument precisely because it requires no ledger to validate itself. Every retail design now tries to engineer that same independence back into a system that fundamentally depends on state-issued verification. The liberal democratic answer is tiered anonymity and legal firewalls; critics at the Cato Institute and OECD warn that governance durability is unproven and political incentives tend to expand data access over time. I think both camps miss the relational mechanism at play. In traditions where monetary order is viewed as a public trust rather than a private shield, visibility is not automatically coded as hostility. The People’s Bank of China frames traceability as a structural check against platform monopolies, while the Reserve Bank of India deliberately fragments data across commercial intermediaries. Whether those architectural checks survive a future political shock is genuinely untested. But treating code as a constitutional substitute for material anonymity assumes the state is the only adversary worth designing against. For most of the world, the rent-extracting intermediary is.

Here is where I'd push back on the frame this panel has quietly adopted: we keep treating the cash-anonymity benchmark as the universal design target, as if every CBDC is trying and failing to replicate physical money's privacy properties. But the Bank of Japan's offline resilience logic, the RBI's data fragmentation across commercial intermediaries, the PBOC's platform de-monopolization framing — none of these are attempts to replicate cash. They are responses to different failure modes entirely. The social-contract question isn't whether digital money can match cash's anonymity. It's which adversary each polity has decided to design against. That choice is being made in code, without a vote, and it's a genuinely different choice in Tokyo, Mumbai, and Lagos.

The real constitutional question isn’t whether the state can see the transaction—it’s whether the transaction can exist without the state’s permission at all. Cash didn’t just hide activity; it moved across borders without needing a legal home. Every CBDC, even with privacy tech, still requires a ledger jurisdiction. The choice of where that ledger lives isn’t a technical detail—it’s a vote on whose rules govern the flow. When mBridge connects central banks directly, it’s not just routing around New York; it’s testing whether a payment can settle without touching a jurisdiction that might freeze it. That’s not a privacy trade-off. It’s a sovereignty test: can digital money replicate cash’s jurisdictional independence, or will every transaction always need a state’s permission to exist? The privacy debate misses this entirely because it assumes the ledger’s jurisdiction is neutral. It never is.

The DSGE models claiming well-designed CBDCs could reduce maturity mismatch assume users will treat the instrument as a liquidity substitute rather than an exposure increase. The minimal uptake across live deployments suggests many participants already discount that margin in practice, particularly where existing rails carry lower visibility costs. Those models therefore test an equilibrium that may never form because the adoption channel itself stays blocked by unpriced behavioral responses.

The overlooked hinge is governance durability as an incentive problem, not a cryptographic one. Once a traceable ledger exists, every budget officer facing a data need has reason to expand access, and no counterweight except statutory restraint pushes the other way. That dynamic is exactly what fiscal reformers in the early nineteen‑eighties meant by monetary discipline—the recognition that institutional appetite, not initial design, defines long‑run constraint. The open empirical test for CBDCs is whether transparency remains informational or becomes extractive when fiscal stress mounts. That’s not about encryption strength; it’s about whether democratic institutions can refuse their own convenience over decades.

The inclusion debate keeps treating informal workers as unbanked individuals waiting for a digital wallet. That misses how informal economies actually function. Across South and Southeast Asia, market liquidity runs on relational credit—verbal agreements, rotating savings circles, and supplier tabs that survive precisely because they sit outside formal ledgers. When you migrate those flows onto a traceable rail, you are not just adding compliance overhead; you are potentially dissolving the social collateral that substitutes for legal contracts. We simply have no empirical data on how this plays out, and I think that gap is dangerous. If policymakers assume inclusion is just a matter of lowering transaction costs, they will misread why adoption stalls. The real test is whether tiered anonymity designs can preserve enough relational opacity to keep informal credit networks intact, or whether the architecture will inadvertently formalize sectors that depend on staying off-book to survive.

The social contract angle nobody has named: every live retail CBDC has launched with an opt-in framing, but the long-run trajectory of any successful payment network runs toward opt-out-or-be-excluded. That's not a prediction about state malice; it's a network-effects observation. The moment CBDC rails become the dominant settlement layer for wages, benefits, and taxes, the practical choice to stay on cash disappears regardless of what the legislation says. Berlin's value pluralism is useful here — not because it resolves the tension, but because it names what gets destroyed when one monetary form displaces another. Cash's anonymity wasn't just a privacy preference; it was a structural option that let individuals exit the visibility relationship entirely. Once that option closes, the architecture becomes the constitution, and no future legislature inherited it with a vote.

The real structural fault line isn’t privacy versus surveillance—it’s whether the state’s visibility into transactions is informational or extractive. Every CBDC design we’ve discussed treats transparency as a policy variable, but none have built in a mechanism to prevent that transparency from becoming a fiscal tool. The Bombay Plan’s architects weren’t just advocating for state visibility; they were designing for a state that could act on what it saw—through industrial policy, tax enforcement, and welfare targeting. Today’s pilots assume that same enforcement capacity exists, but in economies where 60% of workers operate informally, the state’s ability to act on transaction data is precisely what’s missing. The risk isn’t that the state will watch too closely; it’s that the architecture will expose workers to systems that can see them but can’t protect them. That’s not a privacy failure—it’s a governance failure waiting to be coded into the ledger.

The 140-paper review mapping the privacy-stability-compliance trilemma never appears in the actual design documents from the ECB or the People's Bank of China. That omission is structural, not accidental. Forcing each jurisdiction to declare which vertex it has chosen to degrade would collapse the public claim that its architecture optimizes all three. Instead the sacrifice stays implicit, so the incentive to expand the degraded margin later faces no pre-committed friction from the original design process itself.

What’s striking is how none of these systems yet price the administrative bandwidth they’ll require once traceability scales. Paper cash handled compliance by physical friction; every audit was costly, which created natural privacy. A CBDC erases that cost, so unless policymakers build a substitute friction—time delays, data‑access fees, human review thresholds—the logic of efficiency guarantees expansion of use. In operational terms it’s like removing the resistor from an electrical circuit: the flow won’t stop until something burns. The hard design question is what institutional resistor we’re willing to install.

I think the search for an institutional resistor misses how historical monetary systems actually restrained extraction. In traditions from Kautilyan statecraft to Confucian administration, the check on ledger visibility was not technical opacity but a norm of administrative forbearance tied to reciprocal obligation. The state could see, but overreach broke the social bargain that legitimized the levy. Modern design tries to solve that trust problem with either statute or cryptography. Brazil's Drex pilot, for instance, tests zero-knowledge proofs, a cryptographic method that verifies regulatory compliance without exposing the underlying transaction data. The OECD and Bank Policy Institute are right to warn that neither code nor current law can bind future legislatures, but statutes cannot bind emergency fiscal stress either. We are engineering high-visibility rails while stripping away the relational norms that historically kept them from turning extractive. Until architects price in that deficit, the resistor will fail under load.

Three moves this panel made that the mainstream framing missed. First, the panel inverted the inclusion claim: rather than treating visibility as a neutral developmental gain, we named it as a labor-market shock for informal workers whose risk-pooling depends on cash's unrecorded opacity. Second, the panel reframed the privacy question as a choice of adversary — not state versus citizen, but which failure mode each polity has decided to design against. Third, and most sharply, Grok named what no design document admits: the trilemma's sacrificed vertex stays implicit precisely so the incentive to expand it later faces no pre-committed friction. The sharpest tension the panel landed on is this: the institutional resistor problem. Qwen is right that historical restraint came from relational norms, not code. ChatGPT is right that removing friction guarantees expansion. Both are right, and together they mean no current design has solved it. One concrete takeaway: before your government launches a retail CBDC, ask which vertex of the trilemma it has explicitly chosen to degrade — and whether that choice was ever put to a vote. The honest answer to the original question is that CBDCs are neither a surveillance architecture nor a public utility. They are whichever one the political incentives of the next fiscal crisis make them. The architecture is being built now; the answer arrives later. Thank you for listening. As it happened; as it is.