Foreword .............................................................................................................................................................................................1
Executive Summary ...................................................................................................................................................................2
Background: How the United States Currently Secures Its Payment Systems ........................ 5
Payments Overview ...................................................................................................................................................... 5
Looking Ahead to CBDCs ........................................................................................................................................... 6
Chapter 1: Cybersecurity of CBDCs—Threats and Design Options .................................................. 7
Roles and Trust Assumptions ............................................................................................................................................ 7
Threat Model ............................................................................................................................................................................9
CBDC Design Variants .......................................................................................................................................................13
Additional Key Design Choices .....................................................................................................................................26
Chapter 2: Policy Recommendations—
Principles for Future Legislation and Regulation ........................................................................................... 32
Principle 1: Where possible, use existing risk management frameworks and regulations ...................... 32
Principle 2: Privacy can strengthen security ............................................................................................................. 33
Principle 3: Test, test, and test some more................................................................................................................35
Principle 4: Ensure accountability ................................................................................................................................. 36
Principle 5: Promote interoperability ........................................................................................................................... 37
Principle 6: When new legislation is appropriate, make it technology neutral............................................38
Conclusion .....................................................................................................................................................................................40
Appendix: Lessons from the Federal Reserve’s
Current Cybersecurity Measures for Deploying CBDCs ...........................................................................41
Public Wholesale Layers ....................................................................................................................41
Private Wholesale Layers .................................................................................................................. 43
Retail Payments ................................................................................................................................. 44
About the Authors ...................................................................................................................................................................46
Table of Contents
