I. Introduction
Central Bank-backed Digital Currencies, or CBDCs, are often promoted as a safe and accessible public form of money. However, their long-term stability rests less on technical design than on sustained user trust in the currency and its regulatory guarantees. Trust, in turn, is shaped not only by macroeconomic fundamentals but also by the legal and institutional environment in which a CBDC operates. This paper argues that privacy (p), generally treated as a matter of data rights, should also be conceptualised as a regulatory variable influencing money demand, velocity and systemic stability.
Credibility and commitment devices are central in monetary economics: from Kydland and Prescott’s seminal account of time inconsistency to Rogoff’s analysis of central bank commitment strategies. These frameworks constrain discretion, anchor expectations and reduce volatility.Footnote 1 In law, scholars of money and sovereignty, such as Christine Desan and Rosa Lastra, have shown how institutional design choices shape the legitimacy and stability of monetary systems.Footnote 2 This paper builds on those traditions by proposing that privacy commitments in CBDC law function as regulatory commitment devices, comparable in systemic importance to deposit insurance or prudential liquidity rules.
The core research question is: can legally entrenched safeguards for CBDC data act as institutional commitments that stabilise monetary demand and enhance financial stability? In other words, if privacy is legally protected credibly and durably, does it sufficiently anchor public trust in CBDC to prevent disruptive swings in adoption and usage?
This contribution advances the literature in three ways. First, it extends money-demand models by introducing a privacy parameter, p, into users’ utility functions. Traditional frameworks, such as the Lagos–Wright framework and the disintermediation models of Bindseil, Brunnermeier and Niepelt, treat privacy as exogenous.Footnote 3 Here, privacy is formalised as an endogenous factor shaping CBDC demand and velocity. Second, it integrates financial regulation, capital adequacy, liquidity requirements and AML/CFT obligations with privacy and data law. Privacy safeguards are analysed not merely as rights-based protections but as stabilisers that operate alongside prudential regulation to reduce volatility and foster resilience.Footnote 4 Third, it applies this framework comparatively across four jurisdictions: the EU, where strong privacy and financial regulation overlap; the United Kingdom, which retains a statutory right to data protection and remains bound by the European Convention on Human Rights, albeit on politically contingent foundations; the United States, which lacks a general right to personal data protection and anchors its safeguards in a fragmented, privacy-centred framework; and China, where the state-centric “controllable anonymity” approach exposes the limits of commitment.
1. Methodology
The analysis is interdisciplinary, combining economic theory with doctrinal analysis of financial and privacy regulation. On the economics side, the paper draws on established CBDC and money-demand models (Bindseil’s two-tier remuneration, Brunnermeier & Niepelt’s neutrality conditions and Lagos & Wright’s search framework). It incorporates a privacy parameter, p, to test comparative statics: how does demand for CBDCs change as privacy increases? Rather than calibrating econometric estimates, which is impossible at this early stage, the method develops qualitative predictions about adoption, velocity and disintermediation under different p levels.
On the legal side, the analysis is twofold. It examines privacy and data protection doctrines (including the GDPR, CJEU case law, the German Volkszählungsurteil, the US Fourth Amendment and China’s PIPL). It maps them against financial regulatory frameworks, including Basel III liquidity rules, EU AML directives and FATF standards.Footnote 5 This dual approach recognises that CBDCs intersect with constitutional rights and prudential supervision: privacy commitments must coexist with obligations to ensure financial integrity and systemic stability.Footnote 6
The method is comparative and theory-building. It uses case law, statutes, central bank policy papers and international standards to sketch institutional variation across the EU, the United Kingdom, the United States and China. It complements these with empirical insights from BIS surveys and experimental studies, including Korean survey evidence indicating greater willingness to use a CBDC with stronger privacy protections. The approach is not empirical calibration, but conceptual hypothesis-building: a structured framework that highlights trade-offs and suggests testable propositions for future CBDC rollouts.
By bridging economics and financial regulation with privacy law, the paper reframes privacy as a policy instrument rather than a mere compliance constraint. In doing so, it positions privacy safeguards within the broader regulatory infrastructure that underpins stable monetary systems.
II. Literature review
1. Economics of CBDCs and financial stability
Economic work on CBDC design centres on financial stability: disintermediation risk, digital bank runs and monetary transmission. Bindseil’s tiered remuneration aims to discourage large-scale shifts from deposits to CBDCs; Brunnermeier and Niepelt set neutrality conditions under which CBDCs need not disrupt credit supply if policy tools offset portfolio shifts; Lagos and Wright provide the microfoundations linking monetary attributes to equilibrium holdings and velocity.Footnote 7 Yet privacy is treated as exogenous. Models assume identification (account-based) or cash-like anonymity (token-based), then study AML or interest-rate design, rather than how privacy shapes demand. That omission mis-specifies adoption drivers.Footnote 8
New evidence challenges this. A BIS survey experiment shows that stronger privacy features materially increase willingness to use CBDC.Footnote 9 It motivates the theory to make privacy endogenous. In the model below, a privacy parameter p ∈ [0,1] enters user utility; under mild conditions, ∂D CBDC/ ∂p> 0 (higher p increases CBDC demand). Because higher p can also raise substitution pressure away from deposits, the economics literature’s stability concerns connect directly to prudential policy, a bridge that the following subsection makes explicit.
2. Financial regulation and Prudential stability
Financial regulation provides the stability architecture into which CBDCs must fit. Basel III capital and liquidity standards mitigate run risk and fragility of maturity transformation; deposit insurance and resolution serve as commitment devices to anchor depositor confidence; AML/CFT frameworks (FATF standards, EU AMLDs, the US Bank Secrecy Act) require traceability to protect integrity.Footnote 10 CBDCs interact with each pillar. If higher p boosts adoption (good for maintaining the role of public money) but accelerates disintermediation, Basel liquidity backstops and central-bank facilities bear the adjustment; if p is low, uptake may stall, weakening the public money anchor and ceding ground to private or foreign rails. Meanwhile, AML/CFT pulls in the opposite direction, disciplining p downward.
This paper foregrounds an under-explored move: treat privacy as a prudential policy variable within the regulatory toolkit, alongside tiered remuneration, holding limits, capital/liquidity rules, and deposit insurance. Formally, p is a policy-controlled parameter constrained by AML/CFT and statutory privacy commitments. Comparative statics over p then translate into supervisory choices and macro-prudential trade-offs. In the following model, p is therefore treated as a regulator-set but legally constrained variable, whose feasible domain is determined by both prudential mandates and constitutional or statutory privacy guarantees.
3. Privacy and data protection law (as regulatory commitments)
Rights-based privacy regimes shape what values p are legally credible and durable. In the EU, the GDPR embeds data minimisation, purpose limitation and proportionality; the CJEU’s decisions in Digital Rights Ireland and Tele2 Sverige prohibit indiscriminate retention, insisting on necessity and targeting; Germany’s Volkszählungsurteil constitutionalises informational self-determination.Footnote 11 In the UK, post-Brexit data protection and the Bank of England’s CBDC consultations converge on privacy-by-design with statutory guarantees. In the US, privacy is fragmented: the Fourth Amendment (tempered by the third-party doctrine), the Right to Financial Privacy Act and extensive BSA reporting create a contested baseline; Carpenter v United States signals judicial sensitivity to digital-era surveillance, and congressional proposals for a retail CBDC frequently centre on “cash-like” privacy.Footnote 12 In China, the PIPL (2021) operates alongside the PBOC’s “controllable anonymity”: small-value transactions enjoy nominal anonymity but remain traceable, with weak judicial constraints.Footnote 13
In this paper’s framework, these regimes are commitment devices: they constrain and legitimise feasible p and, critically, make promises about p that are time-consistent – legally credible p reduces expectation volatility, stabilising demand.
A preliminary distinction frames the discussion that follows. In the EU legal order, the right to respect for private life (Article 7 of the Charter and Article 8 ECHR) and the right to the protection of personal data (Article 8 of the Charter, given effect by the GDPR) are related but not coextensive. The former guards a sphere of private autonomy against interference; the latter imposes a positive regime of lawful, fair and accountable processing that applies even where no intrusion into private life is alleged. The privacy parameter p deployed here is, strictly, a composite of both: it captures the confidentiality of transactional life and the data-protection guarantees, minimisation, purpose limitation and accountability that determine whether a given level of confidentiality is legally durable. The distinction is not merely taxonomic: a CBDC regime may satisfy one dimension and not the other, and, as the analysis of AML practice below suggests, it is usually the data-protection guarantees, rather than privacy in the abstract, that yield first under integrity pressure.Footnote 14
This concern is not hypothetical in the EU. Survey evidence on the proposed digital euro indicates that privacy and trust rank among the leading determinants of intended adoption, consistent with the willingness-to-use findings reported above for other jurisdictions. The European data-protection authorities have likewise pressed for stronger guarantees than the design under discussion would provide, insisting in particular on a genuine privacy threshold for low-value and offline payments. Their interventions matter for the present argument because they shape the credible upper bound of p: where the supervisory authorities charged with protecting data signal that a design falls short, users have reason to discount the durability of the privacy on offer.Footnote 15
4. Cross-disciplinary insights (code, surveillance, sovereignty)
Lessig’s “code is law” reminds us that CBDC architecture (identity separation, thresholding, cryptographic proofs) embeds regulatory choices in technical design; Zuboff warns how data extraction reshapes power, relevant if CBDC design slides toward state-scale surveillance; Desan and Lastra show that monetary legitimacy and sovereignty rest on institutional design as much as on convertibility or backing.Footnote 16 These strands underscore why p cannot be an afterthought: it mediates legitimacy, uptake and monetary sovereignty.
A parallel strand of development, largely absent from the CBDC literature, concerns decentralised digital identity. Self-sovereign identity (SSI) models allow individuals to prove attributes – such as age, nationality and verified customer status – without disclosing underlying personal data, using cryptographic techniques such as zero-knowledge proofs (ZKPs). In principle, ZKPs could enable a CBDC user to demonstrate compliance with customer due diligence requirements without transferring personal information to the payment infrastructure or the central bank, thereby preserving a high p without sacrificing regulatory verification.Footnote 17 The FATF’s 2020 Guidance on Digital Identity acknowledges the potential of technology-neutral, risk-based approaches to identity verification, and the ECB’s anonymity voucher concept approximates this logic in simplified form.Footnote 18 Yet the tension is structural: FATF Recommendations 10 and 16, and the EU AML Directives, require financial institutions not merely to verify identity but also to retain customers’ personal data for prescribed periods – typically five years after the end of a business relationship.Footnote 19 This retention obligation is fundamentally incompatible with pure SSI or ZKP designs in which no personal data changes hands or is stored beyond the moment of verification. The legal framework, as currently constituted, demands that identity data be held, not merely proven. Until AML/CFT legislation accommodates cryptographic verification as a substitute for data retention, the most privacy-preserving technical architectures will remain legally impermissible for CBDC deployment. This constraint materially limits the upper bound of feasible p.
5. The gap
A three-way blind spot persists. Economics omits privacy as an endogenous determinant of adoption and stability; financial regulation rarely treats privacy as a prudential lever; legal scholarship emphasises rights compliance but seldom traces macro-feedbacks to money demand and velocity. This paper bridges the gap by formalising privacy as a policy-constrained preference parameter and mapping how financial regulation and privacy law jointly determine the credible domain of p. The result is an integrated account in which privacy is a regulatory commitment device: it anchors expectations, stabilises CBDC demand and coexists with AML/CFT and prudential safeguards.
III. Privacy in economic models – disintermediation
Economic analysis of CBDCs has thus far prioritised disintermediation, liquidity management and monetary transmission. What has been neglected is privacy as an endogenous determinant of adoption and stability. This section formalises privacy through a parameter p ∈ [0,1], where p = 0 denotes complete transparency and p = 1 denotes anonymity equivalent to cash. By treating privacy as a policy-determined but legally constrained variable, the analysis examines how different levels of privacy (p) affect the demand for CBDCs, the velocity of circulation and the degree of substitution away from deposits.
The framework assumes a representative agent whose utility from CBDC balances can be expressed as:
$U\left( {CBDC} \right) = f\left( {liquidity,convenience,yield} \right) + \alpha p$
Where α > 0 measures the intensity of privacy preference. The comparative statics are straightforward: if privacy positively enters utility, then ∂DCBDC/∂p > 0. The more nuanced task is to analyse how this effect interacts with prudential regulation, financial integrity rules and heterogeneous user preferences.
1. Adoption and money demand
Why would rational users shift balances from insured, interest-bearing deposits into a non-interest-bearing CBDC? The answer lies in the privacy surplus αp. Adoption occurs when:
$\Delta {\rm{U}} = \;\alpha p - \left( {id - i{\rm{CBDC}}} \right) - \kappa \gt 0$
Where id is the deposit interest rate, i CBDC is the CBDC return (often zero), and κ denotes switching costs. When the privacy benefit outweighs forgone yield and frictions, demand for CBDC rises.
This surplus is not uniform across the population. Small businesses dealing with commercially sensitive payments, individuals wary of data brokerage and citizens in states with histories of surveillance are likely to have higher α. Survey evidence confirms this heterogeneity: users offered privacy-enhanced designs are more willing to adopt CBDC, even when it yields no return.Footnote 20 In practice, adoption curves are steeper for cohorts with stronger privacy preferences.
Crucially, α is state-contingent. In calm periods, privacy may be valued but not decisive; during political scandals, data breaches or financial stress, the elasticity of demand with respect to p can shift abruptly. This dynamic raises a commitment problem: if central banks cannot credibly commit to protecting privacy, expectations may destabilise, leading to unpredictable swings in demand. That time-inconsistency problem is where legal safeguards become relevant, as developed in Section IV.
Two qualifications temper the model’s behavioural predictions. The first is what the privacy literature terms the “privacy paradox”: a persistent gap between stated preferences and observed conduct. Consumers routinely accept tracking cookies, grant broad app permissions and share transactional data in exchange for marginal convenience, a pattern well documented in the empirical literature.Footnote 21 If this habitual acquiescence carries over to CBDCs, the effective α for most users may be close to zero in ordinary conditions, not because privacy is unvalued in the abstract, but because it is poorly understood, difficult to evaluate and easily traded away for immediacy. The average consumer, already accustomed to smartphones that track movement and digital payments that generate traceable records, may approach a CBDC with the same unreflective acceptance, particularly where transactions are, in most cases, neither monitored nor scrutinised in any way perceptible to the user.
Yet this complacency is not the same as indifference, and the distinction matters for stability. Privacy preferences can reprice abruptly. A breach of CBDC transaction histories, a political scandal involving state access to payment data, or a high-profile misuse case can shift α for large populations in ways that calm-period behaviour does not predict – much as government surveillance revelations have periodically reordered public attitudes toward data collection, however temporarily.Footnote 22 Moreover, where CBDCs are rolled out with few or no alternative means of transacting, whether because cash is withdrawn, private payment rails are restricted or regulatory compulsion is applied, the demand elasticity with respect to p may collapse altogether. Users may adopt CBDCs not because they trust the privacy architecture but because they have no practical exit.Footnote 23 The continued popularity of Meta’s platforms despite the Cambridge Analytica affair illustrates a structurally similar dynamic: network effects and the absence of viable alternatives can sustain adoption even where trust has been severely damaged.Footnote 24 In such conditions, weak privacy manifests not as low adoption but as suppressed political legitimacy, latent legal vulnerability, and the accumulation of grievances that surface unpredictably – for instance, when a genuine alternative finally emerges, and migration becomes abrupt.
A further distinction must be drawn between commercial data processing and centralised state surveillance. Existing digital payments generate data distributed across private institutions, each subject to commercial confidentiality obligations and sectoral regulation. A CBDC, by contrast, potentially consolidates a comprehensive, state-accessible ledger of all retail transactions. This is categorically different from a card issuer’s knowledge of individual purchase history; it is the state’s capacity to observe and query the financial conduct of an entire population.Footnote 25 Heterogeneous users may tolerate the former while assigning a substantially higher α to the latter – a divergence that existing models of payment adoption do not capture.
2. Velocity and use patterns
Privacy also influences the velocity of CBDC. Higher p reduces surveillance friction in regular times and encourages users to spend CBDC freely. Transactional velocity increases as consumers perceive everyday payments to be safe from scrutiny. By contrast, if privacy is weak, users may ration their CBDC balances, employing them only when unavoidable, thereby suppressing velocity.
In crises, however, privacy has the opposite effect. A high-p CBDC becomes a haven when banks appear fragile. Households may shift into CBDC not for transactional use but for precautionary storage. In such scenarios, velocity may fall even as adoption rises, much as cash hoarding spikes during financial turmoil.Footnote 26
This duality complicates monetary transmission. A CBDC trusted for routine payments strengthens the central bank’s control over transaction flows. However, if privacy turns CBDC into a hoarding vehicle during periods of stress, it may slow circulation, blunting the effectiveness of policy levers. Recognising this, central banks need to calibrate p with an eye to average demand and its state-contingent elasticity.
3. Substitution and disintermediation
The most direct systemic effect of privacy is on substitution away from deposits. Bank deposits today are neither fully private from regulators, due to AML/CFT reporting requirements, nor from commercial actors, who monetise transaction data. A CBDC that credibly guarantees stronger confidentiality creates an alternative. For users with high α, the comparative advantage of CBDC rises with p, accelerating substitution.
This effect has prudential consequences. In calm times, gradual outflows are manageable, but higher p increases the probability of abrupt runs into CBDC during stress. From a regulatory perspective, these risks are absorbed by the existing architecture: Basel III liquidity coverage ratios and net stable funding requirements oblige banks to hold buffers; deposit insurance and resolution frameworks reassure depositors; and central banks retain lender-of-last-resort capacity.Footnote 27 Yet these backstops were not designed with CBDC-driven substitution in mind. If p materially raises substitution risk, regulators must recalibrate these tools in tandem.
The trade-off is therefore joint. Raising p may enhance CBDC adoption and monetary sovereignty, but it can destabilise bank funding without complementary prudential measures. Conversely, holding p too low protects banks but condemns the CBDC to irrelevance. The optimal design involves simultaneous adjustment of p and prudential levers such as tiered remuneration, caps, and liquidity support.
4. The optimal privacy corridor
The preceding analysis suggests the existence of an optimal corridor for privacy. At low p, adoption is weak, trust in public money erodes, and users may migrate to foreign currencies, cryptocurrencies, or informal arrangements. At high p, adoption surges but AML/CFT integrity deteriorates, exposing the CBDC to reputational, legal, and geopolitical risks.Footnote 28 In between lies a corridor where adoption is robust, disintermediation manageable, and integrity preserved.
Central banks have begun to operationalise this corridor. The ECB’s proposal of “anonymity vouchers” for low-value transactions and the PBOC’s principle of “small anonymous, large traceable” transactions implement an intermediate level of privacy.Footnote 29 In such tiered systems, CBDC behaves like cash up to a defined threshold but becomes transparent beyond it, balancing retail trust with systemic oversight.Footnote 30
Figure 1 depicts a quasi-concave stability function S(p) in which adoption benefits and regulatory costs are endogenous to p. Stability is maximised when CBDC provides sufficient confidentiality to sustain demand without undermining AML/CFT or prudential stability, i.e. at 0.4–07. This framing transforms privacy from an add-on to a policy lever: central banks can adjust p within the range permitted by law and supervisory mandates, while legal safeguards ensure credibility over time.
Privacy parameter (p) and demand stability: the optimal corridor.
(The curve shows how very low p undermines adoption through distrust, very high p undermines integrity through illicit finance, and a mid-range corridor yields the most stable outcome. The shaded green area represents the feasible corridor of stability.)
IV. Legal frameworks as commitment devices
The economic analysis shows that privacy can stabilise CBDC demand only if users believe it will endure. Technical promises are not enough; credibility requires legal commitment devices. Financial regulation already relies on such devices: capital and liquidity rules, deposit insurance, resolution regimes, and AML/CFT duties bind future choices and anchor expectations. Treating privacy as part of this commitment, family does not collapse rights into prudential arithmetic; it recognises that credibly protecting privacy is a stability policy.
1. Financial regulation as a model of commitment
Basel III liquidity and funding standards constrain bank behaviour in good times and bad: the Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR) require ex ante buffers to prevent withdrawal shocks from becoming systemic crises.Footnote 31 Deposit insurance (EU: €100,000 under the Deposit Guarantee Schemes Directive (DGSD); US: FDIC insurance up to statutory limits) is a statutory promise that, by design, prevents panic.Footnote 32 The Bank Recovery and Resolution Directive (BRRD) provides legal choreography for resolution (Article 32), bail-in, and loss absorption (Article 44) that make “orderly failure” credible ex ante.Footnote 33 These are commitment devices: not mere policies but legal constraints that users and firms can rely on.
CBDC privacy should be read through the same lens. Suppose a digital euro or pound is legally constrained to collect only what is necessary and to separate identity from transactions. In that case, users can rationally price that constraint into their adoption decisions. If the constraint is merely technical or policy-level, they cannot. Privacy thus joins the LCR/NSFR, DGSD/FDIC, and BRRD as mechanisms that reduce expectation volatility, but only if they are legally enforceable and hard to reverse.Footnote 34
2. AML/CFT duties and the proportionality hinge
The hardest legal tension lies between AML/CFT traceability and data-protection limits. FATF Recommendations 10 and 16 impose customer due diligence and the “travel rule” for wire transfers.Footnote 35 The EU’s AML Directives transpose these duties: the Fourth Anti-Money Laundering Directive (4AMLD) requires CDD (Articles 13–15) and record-keeping (Article 40).Footnote 36 In the United States, the Bank Secrecy Act (BSA) requires extensive reporting of customer information and suspicious transactions, implemented through rules such as the Travel Rule (31 CFR section 1010.410(f)) and the Customer Identification Programme Rule (31 CFR section 1020.220).Footnote 37 These regimes push p downward by demanding identity verification and persistent records.
By contrast, the GDPR pulls in the opposite direction. Article 5(1)(b) requires purpose limitation; Article 5(1)(c) demands data minimisation; Article 25 mandates data protection by design and by default; Article 32 requires security appropriate to risk; and Article 35 requires a Data Protection Impact Assessment for high-risk processing.Footnote 38 Article 23 permits legislative restrictions based on AML/CFT only if necessary and proportionate in a democratic society. That proportionality hinge is where the commitment lies: the law may narrow privacy for the sake of integrity, but it cannot authorise dragnet surveillance.Footnote 39 The CJEU has clarified this in Digital Rights Ireland (invalidating the Data Retention Directive) and Tele2 Sverige (prohibiting general and indiscriminate retention).Footnote 40
The tension between AML obligations and data protection is not merely theoretical; a growing body of scholarship argues that it is already resolved in practice in favour of AML obligations. Milaj and Kaiser have demonstrated that data retention requirements under the Anti-Money Laundering Directive extend well beyond what a strict “need to know” standard would permit, capturing information useful for compliance purposes but difficult to justify under the GDPR’s principles of minimisation and purpose limitation.Footnote 41 Bertrand, Maxwell, and Vamparys have pressed the point further, arguing that AI-based AML transaction monitoring systems now widely deployed across the European financial sector process personal data at a scale and granularity that fails the CJEU’s proportionality test as articulated in Digital Rights Ireland and Tele2 Sverige, with implications for the right to non-discrimination and the presumption of innocence.Footnote 42 If these critiques are well-founded, and the weight of analysis increasingly suggests they are, then the baseline from which CBDC privacy is negotiated is already compromised. The financial system does not, in practice, treat GDPR and AML/CFT as coequal constraints held in proportionate balance; it treats financial integrity as the prior commitment and data protection as the residual, accommodated where convenient and overridden where not.
This has direct implications for the privacy parameter. If the existing AML architecture already sets a lower floor for p than GDPR principles would independently require and does so with limited judicial challenge, then a CBDC built atop this architecture inherits its deficiencies. Relying on the general data protection law to safeguard CBDC privacy means relying on a regime that has already yielded significant ground to financial integrity objectives. The case for CBDC-specific privacy legislation becomes correspondingly stronger: only purpose-built legal commitments, tailored to the particular surveillance risks of a state-operated payment ledger, can establish a credible p that is not dragged downward by the gravitational pull of existing AML practice. This does not mean that AML and privacy are irreconcilable; it means that the reconciliation cannot be left to the general framework, which has demonstrably tilted in one direction.
The proportionality objection sharpens once the efficacy of the AML regime is itself examined. A growing critical literature questions whether anti-money laundering controls achieve their stated aims, with one influential assessment estimating that the regime intercepts well under 1% of criminal proceeds while imposing compliance costs that far exceed the funds recovered. If that appraisal is even approximately accurate, the empirical premise on which data protection is routinely subordinated, that pervasive financial surveillance is both necessary and effective, does not hold in the form usually asserted. The implication for CBDC design is not that integrity objectives are illegitimate, but that they cannot serve as an automatic override: a measure that imposes population-scale transactional visibility while delivering marginal integrity gains is precisely the kind of disproportionate interference that the Charter’s proportionality requirement is meant to foreclose. Technical work on regulation-by-design AML schemes suggests, moreover, that the trade-off need not be strictly binary, since cryptographic approaches can in principle reconcile selective auditability with strong default confidentiality.Footnote 43
The direction of travel is not uniformly against data protection. In Sovim, the Court of Justice annulled the provision of the Fifth Anti-Money Laundering Directive granting the general public access to beneficial-ownership registers, holding that such access was a serious interference with the rights guaranteed by Articles 7 and 8 of the Charter that was neither limited to what was strictly necessary nor proportionate to the anti-money laundering objective pursued. The decision is instructive for CBDC design because it concerns an AML transparency measure struck down on data-protection grounds: it shows that financial-integrity instruments are not self-justifying, and that where a measure’s privacy cost is untethered from a demonstrated integrity gain, it will not survive proportionality review.Footnote 44
The result is not a simple hierarchy but a calibrated corridor: AML/CFT defines a floor of traceability for higher-risk flows; data protection defines a ceiling against indiscriminate monitoring; legislative technique (e.g., tiered thresholds, risk-based KYC, judicial unmasking) carves out the feasible domain of p. This corridor makes privacy time-consistent rather than a revocable convenience.
3. Payments, access, and operational resilience: PSD2, PFMI, DORA, UK rules
CBDCs will sit within a payments and market-infrastructure stack that already encodes legal duties with privacy implications. The EU’s PSD2 (Directive (EU) 2015/2366) mandates strong customer authentication (Article 97) and regulates third-party access to payment account data, subject to confidentiality obligations (Articles 66–7).Footnote 45 If CBDC intermediaries resemble payment institutions, these duties shape how identity is verified, and data can be shared. The CPMI–IOSCO Principles for Financial Market Infrastructures (PFMI) require FMI governance to balance efficiency and risk (Principles 2–3) and manage operational and data risks (Principle 17), guiding CBDC platforms toward minimal-data designs.Footnote 46
The EU’s Digital Operational Resilience Act (DORA) (Regulation (EU) 2022/2554) mandates ICT risk management, incident reporting, and oversight of critical third parties.Footnote 47 While not a privacy statute, DORA interacts with GDPR minimisation: the less personal data an FMI holds, the less it must secure. The UK’s operational-resilience framework (PRA SS1/21; FCA PS21/3) likewise obliges boards to set “impact tolerances” for essential services; CBDC rails would qualify, creating an incentive to avoid centralising data.Footnote 48
Together, these instruments support a two-tier CBDC architecture: pseudonymous processing at the core, identity held by supervised intermediaries, with controlled, reviewable pathways for unmasking. This split embodies GDPR Article 5 limits, PSD2’s SCA, PFMI governance, and DORA resilience, constraining erosion of p.
4. Deposit protection, resolution, and the substitution question
A recurrent objection is that stronger privacy could accelerate deposit substitution in times of stress. The prudential answer is that legislatures have already priced this risk into the system. The DGSD’s €100,000 guarantee stabilises retail funding; the BRRD’s resolution toolkit and bail-in hierarchy protect solvency; the ECB and national central banks provide lender-of-last-resort liquidity.Footnote 49 FDIC insurance functions similarly in the US, alongside resolution under the Orderly Liquidation Authority in Dodd–Frank.Footnote 50 The legal question is whether CBDC requires a new commitment layer, such as statutory guarantees of tiered remuneration or holding limits that activate automatically in systemic stress.Footnote 51 Codification would bound disintermediation just as deposit insurance bounds the risk of retail bank runs.Footnote 52
5. The United Kingdom and the United States: statutory credibility vs constitutional patchwork
In the United Kingdom, privacy commitments for a potential digital pound rest on a layered but increasingly uncertain legal architecture. The Bank of England and HM Treasury’s 2023 consultation pledged that neither institution would access personal data from a CBDC.Footnote 53 To be credible, these assurances must be codified into primary legislation. Parliamentary entrenchment would narrow the lawful bases for access, limiting them to court-authorised unmasking or AML-triggered disclosure. It would cohere with the Money Laundering Regulations 2017 (Regs 28, 33, 40) and the UK GDPR minimisation requirements.Footnote 54 This replicates the commitment logic of central bank independence: promises become binding obligations.Footnote 55
It should be emphasised that the UK’s post-Brexit data protection regime has not, to date, diverged from the EU GDPR in any structurally fundamental way. The UK GDPR and the Data Protection Act 2018 preserve the core principles of lawful processing, data minimisation, purpose limitation, and mandatory impact assessments. The Data (Use and Access) Act 2025, the most significant legislative intervention since Brexit, introduces targeted modifications – a new “recognised legitimate interests” lawful basis that dispenses with the balancing test for specified purposes, broadened permissions for automated decision-making, relaxed rules on research processing, and a shift in the international transfer standard from “essentially equivalent” to “not materially lower” but does not dismantle the underlying framework.Footnote 56 The Act amends the UK GDPR rather than replacing it, and its stated objective is to reduce compliance costs and encourage innovation while maintaining core protections.Footnote 57
Nevertheless, the direction of travel matters for this paper’s framework. The UK is no longer directly bound to the EU regime and is free to modify its data protection standards in line with its own policy priorities. The DUA Act 2025 represents a first step on a trajectory that may lead to further relaxation of what are, by international standards, stringent GDPR-derived obligations. Each incremental softening narrows the credible domain of p for a digital pound. If users observe a pattern of legislative loosening, they may rationally discount the durability of any privacy commitments made at the point of CBDC launch. This is precisely the time-inconsistency risk that legal entrenchment is meant to foreclose. CBDC-specific privacy legislation, distinct from the general data protection framework and insulated from the reform pressures that attend it, would provide a more robust commitment device than reliance on a regime whose trajectory points toward liberalisation.
Two additional features of the UK’s legal landscape strengthen the commitment infrastructure, though neither is without qualification. First, the United Kingdom remains bound by the European Convention on Human Rights. Article 8 of the ECHR, the right to respect for private and family life, provides a constitutional backstop for privacy that operates independently of statutory data protection law and finds its parallel in Article 7 of the EU Charter of Fundamental Rights.Footnote 58 Judicial review under the Human Rights Act 1998 means that a CBDC design permitting indiscriminate state access to transaction data could, in principle, be challenged as a disproportionate interference with Article 8 rights. Second, CJEU case law, though no longer formally binding on UK courts post-Brexit, continues to exert significant persuasive influence, particularly where the legislative texts remain substantively aligned. The reasoning in Digital Rights Ireland and Tele2 Sverige, insisting on necessity, targeting, and proportionality in data retention, is regularly cited by UK courts and would inform any judicial scrutiny of CBDC surveillance claims.Footnote 59
Against these strengths, however, stands a significant enforcement gap. Since 2022, the Information Commissioner’s Office has adopted a “public sector approach” that effectively rules out monetary penalties for government bodies and public authorities, favouring reprimands and engagement over fines.Footnote 60 The rationale that fines on public bodies are ultimately borne by taxpayers and reduce budgets for frontline services has drawn sustained criticism from privacy advocates and parliamentarians, who argue that it eviscerates the deterrent effect of data protection law precisely where it is most needed.Footnote 61 The implications for a state-operated CBDC are direct. If the regulator responsible for enforcing privacy obligations is structurally deferential to the very institutions that would operate the digital pound, the Bank of England, HM Treasury, and any designated intermediaries within the public sector, then the commitment device is weakened at its enforcement hinge. Legal entrenchment on paper means little if the supervisory authority extends institutional forbearance to the bodies it oversees. Building public trust in CBDC privacy, therefore, requires not only statutory guarantees but also a credible, demonstrably independent enforcement regime willing to act against the state when necessary.
The UK thus occupies a middle position: its legal infrastructure is credible in principle but, in practice, contingent on legislative commitment and regulatory independence, both of which are currently under strain.
The United States presents a fragmented framework. Constitutionally, the Fourth Amendment protects against unreasonable searches, but the third-party doctrine limits its application to financial records. Carpenter v United States recalibrated this, holding that continuous tracking of cell-site data required a warrant.Footnote 62 While not a financial case, it suggested that persistent CBDC monitoring could trigger Fourth Amendment scrutiny.Footnote 63
Statutorily, the Right to Financial Privacy Act 1978 grants individuals some rights against government access; the Bank Secrecy Act 1970 requires extensive customer reporting; and the Gramm–Leach–Bliley Act 1999 (GLBA) with Regulation p obliges financial institutions to issue privacy notices and limit disclosure of non-public personal information.Footnote 64 If CBDC wallets were bank-distributed, GLBA would apply. However, broad law-enforcement exemptions make it a weak commitment device: GLBA constrains commercial exploitation more than state surveillance.Footnote 65
Congress has floated bills to mandate “cash-like” privacy for CBDC, requiring warrants or subpoenas for access. These proposals implicitly acknowledge that current law is insufficient; only new federal legislation could create a robust commitment device.Footnote 66
This patchwork reveals a normative divide: should CBDC privacy be a fundamental right against the state, insulated from trade-offs, or a prudential lever within financial regulation? Treating it as a right maximises protection but risks paralysing supervisors; treating it as a lever embeds privacy in regulatory balancing but risks diluting its normative force. The US illustrates the difficulty of reconciling these logics, whereas the UK’s statutory model offers a clearer path to credibility.
6. China: policy promises without external enforcement
China exemplifies a low-commitment environment. The Personal Information Protection Law (PIPL) 2021 sets out consent (Article 13), minimisation (Article 6), purpose limitation (Article 41) and processor duties (Articles 51–54). The Cybersecurity Law 2017 (Articles 37–40) and Data Security Law 2021 (Articles 2–5) regulate localisation and cross-border transfers. The Anti-Money Laundering Law 2006 (as amended) establishes KYC and reporting requirements.Footnote 67
However, these frameworks constrain private firms, not the state. PIPL Article 13(2) permits processing “necessary for statutory duties”; Article 35 authorises restrictions for “statutory functions.” Thus, CBDC data remain accessible to authorities.
The PBOC’s e-CNY embodies “controllable anonymity”: small-value pseudonymity, full traceability for larger transactions, and administrative unmasking when suspicious activity is detected.Footnote 68 This offers privacy from commercial actors but not the state. Without an independent judiciary or a proportionality doctrine, privacy rests on policy discretion.Footnote 69 Cybersecurity and Data Security Laws further oblige data localisation and state access, compounding the deficit.Footnote 70
Adoption has lagged despite heavy promotion. Surveys indicate redundancy with existing platforms and concerns over state overreach.Footnote 71 Without a legally entrenched guarantee, p is discounted: users expect surveillance expansion. Controllable anonymity is a political assurance, not a commitment device.Footnote 72 Privacy lacks time consistency without external enforcement, courts, regulators, and supranational review. As law-and-economics teaches, promises are not priced into demand without commitment devices, weakening both uptake and stability.Footnote 73
7. Synthesis: privacy as a credibility anchor
The crucial variable is not whether a jurisdiction mentions privacy, but whether its legal system can credibly commit to it. The EU’s high-commitment regime GDPR Articles 5, 23, 25, 35; CJEU jurisprudence; Volkszählungsurteil makes privacy time-consistent. This characterisation, however, must now be qualified. In early 2025, the European Commission published its Digital Omnibus reform proposals, which contemplate significant amendments to the GDPR and related instruments. Among the most consequential is the proposed introduction of a relative definition of personal data, which would permit controllers to apply subjective judgment in determining whether information constitutes personal data from their perspective, with reference to the means reasonably available to them.Footnote 74 If adopted, this would mark a departure from the GDPR’s current objective, absolutist approach to the concept of personal data, and would narrow the scope of data protection obligations in contexts where a controller judges that it cannot reasonably identify an individual. The broader motivation behind the proposals – reducing compliance costs, encouraging innovation, and improving the competitiveness of European industry – echoes the rationale of the UK’s DUA Act 2025. The Commission maintains that high protection standards will be preserved, but the structural direction is toward relaxation rather than reinforcement of the existing regime.Footnote 75
For this paper’s analysis, the Digital Omnibus proposals introduce a credibility risk analogous to that identified in the UK context. If the EU progressively softens the general data protection framework – even while maintaining the GDPR’s formal architecture – the effective floor of p may erode. A relative definition of personal data could, for instance, allow CBDC intermediaries to classify certain transaction metadata as non-personal on the basis that they lack the means to re-identify users, thereby reducing the scope of minimisation and purpose limitation obligations. The proposals do not, by themselves, dismantle the EU’s high-commitment position, but they signal that the commitment is not static. CBDC-specific legislation – such as the provisions in the proposed digital euro regulation – may therefore need to anchor privacy at a level that is independent of, and more robust than, the general data protection baseline, precisely because that baseline is now subject to reform pressures.
The UK’s model is statutory and credible if entrenched in Parliament.Footnote 76 The US remains fragmented: Fourth Amendment curtailed by the third-party doctrine; RFPA limited; BSA surveillance-heavy; GLBA sectoral; Carpenter suggestive but inconclusive; Congress yet to legislate. China is weakest: PIPL and Cybersecurity and Data Security Laws protect data from firms but empower the state.Footnote 77
These positions are summarised in Table 1, which maps the legal instruments, enforcement machinery, and degree of entrenchment across the four jurisdictions.
Commitment devices for CBDC privacy by jurisdiction.
Table 1. Long description
The table compares commitment devices for CBDC privacy across four jurisdictions: EU, UK, USA, and China. It has four rows and five columns. The columns are labeled as follows: Jurisdiction, Legal Framework, Enforcement Agencies, Privacy Level, and Privacy Strength. The rows provide detailed information for each jurisdiction. Row 1: EU, GDPR Arts 5, 23, 25, 32, 35; 4/5/6AMLD incl. Art 40 retention; PSD2 Art 97; PFMI; DORA; DGSD (Art 6 100k); BRRD Arts 32, 44, Independent DPAs; CJEU review; prudential supervisors; SRB/NCAs, High (rights entrenched; proportionality policies AML), Strong if tiered privacy is legislated and enforced. Row 2: UK, UK GDPR; MLR 2017 (Regs 28, 33, 40); BoE/HMT statutory commitments; PRA/FCA operational resilience, ICO; courts; PRA/FCA; Parliamentary entrenchment, Medium-High (depends on statute specificity), Moderate-Strong, contingent on legislative clarity. Row 3: USA, Fourth Amendment (limited by third-party doctrine); Right to Financial Privacy Act 1978; Gramm-Leach-Bliley Act 1999 (15 USC ss 6801-09) and Regulation P (12 CFR Part 1016); Bank Secrecy Act (31 CFR 1010.410(f), 1020.220); OFAC, Courts; FinCEN; prudential agencies; FTC (GLBA/Reg P), Medium-Low (fragmented; AML predominates unless Congress legislates), Uncertain, hinges on a new federal CBDC statute enshrining privacy. Row 4: China, PIPL; PBOC controllable anonymity, Administrative enforcement; no independent constitutional review, Low (policy discretion, weak external checks), Tepid, trust discount persists.
Commitment devices stabilise expectations. Just as Basel III, DGSD/FDIC, and BRRD prevent panic, privacy safeguards prevent volatility in CBDC demand. Where commitments are firm (e.g., in the EU), adoption can build on trust. Where statutory but reversible (UK), credibility is politically contingent. Where fragmented (US), adoption is hostage to legislative inertia. Where absent (as in China), policy promises are insufficient.Footnote 78
Legal entrenchment is not absolute: AML/CFT and security exceptions remain even in the EU. In the US, new legislation may embed privacy as a prudential lever rather than a fundamental right. In China, state security dominates.Footnote 79 Across jurisdictions, the trade-off between privacy and financial integrity is unavoidable; the question is whether law can create a corridor in which both are preserved.Footnote 80
A CBDC without credible privacy commitments risks being irrelevant (due to insufficient uptake) or destabilising (due to sudden swings in demand). A CBDC with enforceable, transparent commitments can transform privacy into a monetary stabiliser. Choices about legal design are therefore not technicalities but instruments of monetary sovereignty and geopolitical competition.
V. Law–economics interplay: scenarios
This section integrates the comparative statics from Section III with the commitment-device analysis in Section IV. Varying the privacy parameter p within the legally feasible corridor produces distinct macro-institutional equilibria. What matters is not simply the nominal setting of p, but whether legal frameworks make that setting credible over time.
1. Weak-privacy CBDC (low p): fragile adoption, demand volatility
When p is set to a low value, continuous identification, centralised storage, and broad administrative access are enabled, giving the CBDC a slight advantage over existing digital rails. Users with higher privacy preferences (higher α) avoid holding balances; others transact only episodically, topping up just in time and emptying wallets afterwards. In this paper’s framework, ∂D CBDC/∂p > 0 implies that low p depresses baseline demand; velocity becomes erratic as users minimise their exposure to a traceable instrument.
The macro-consequence is a weak public-money anchor. In times of stress, rumours of targeted scrutiny can trigger a “privacy run”: usage collapses, not because the state is insolvent, but because the risk of monitoring suddenly re-prices.Footnote 81 Where authorities try to mandate use (e.g., by restricting cash), the substitution may shift outside the official perimeter to private rails, foreign currency, or informal exchange, undermining monetary sovereignty. Empirically, efforts to push adoption of the eNaira during Nigeria’s cash-scarcity episode illustrate how trust deficits and perceived surveillance risks can blunt take-up and redirect activity into alternative channels.Footnote 82 Central banks and IFIs have drawn a similar lesson from early CBDC experiences: trust and privacy are first-order determinants of use and cannot be retrofitted after rollout.Footnote 83
2. Strong-privacy CBDC (high p): steady adoption, credible safe haven within limits
Alternatively, a CBDC that maximises privacy is cash-like for most retail flows and has strong cryptographic separation of identity from transactions, and judicially controlled unmasking can generate broad, predictable adoption.Footnote 84 In this paper’s model, high p raises utility directly (αp) and, where commitments are entrenched (as in the EU via GDPR and CJEU proportionality), makes the setting time-consistent.Footnote 85 Users then treat CBDC as both a daily transaction instrument and a credible safe haven in times of stress: shifting from deposits to CBDC need not entail exposure to surveillance.Footnote 86
The prudential trade-off is familiar: higher p intensifies deposit substitution unless offset by tiered remuneration and holding limits and absorbed by bank-side liquidity standards (LCR/NSFR) and resolution backstops.Footnote 87 This is a managed risk, not a fatal flaw. Correctly anticipated, a strong-privacy CBDC preserves the monetary anchor of central bank money while the supervisory toolkit bears the adjustment. Internationally, design credibility can produce cross-border pull: a digital euro with robust privacy may attract non-resident transactional balances (mirroring cash’s role), a possibility already canvassed in Eurosystem work on cross-border implications.Footnote 88
It should be noted, however, that the EU’s position as a high-commitment jurisdiction is not immune to erosion. As discussed in Section 7, the Digital Omnibus reform proposals – including the contemplated shift to a relative definition of personal data – could narrow the effective scope of GDPR protections over time. A digital euro’s credibility advantage, therefore, depends not only on the current legal framework but also on its durability in the face of reform pressures favouring innovation and cost reduction.
3. Tiered or intermediate privacy (graded p): the corridor in practice
Most live proposals converge on tiered privacy: cash-like confidentiality for low-value payments; progressive KYC, record-keeping and “travel rule” compliance as values rise. This is the legal corridor described in Section 2: AML/CFT defines the traceability floor; data protection and constitutional limits set the ceiling; legislation and governance fix thresholds, audit trails and unmasking processes. The ECB’s “anonymity vouchers” concept and the PBOC’s “small anonymous, large traceable” rules are canonical implementations.Footnote 89
Economically, the result is segmentation. For retail flows under the privacy threshold, CBDC behaves like cash; above it, CBDC behaves like a fully identified account. With commitments entrenched in statute and enforceable oversight mechanisms (DPAs, courts, prudential supervisors), users internalise the thresholds and use CBDC with confidence for day-to-day payments.Footnote 90 The risk is credibility slippage: if thresholds are opaque, routinely lowered or bypassed by administrative practice, the perceived p falls and adoption stalls. Transparent reporting (e.g., published statistics on unmasking authorisations, audited access logs) and clear legal standing for redress are core to sustaining the corridor.Footnote 91
Comparatively, the EU is most likely to deliver such a scheme with high credibility; China implements a superficially similar architecture, but without independent oversight, its “controllable anonymity” remains a policy assurance rather than a legal commitment device; the US and UK are positioned to legislate toward the corridor if retail CBDCs proceed, because extremes (complete anonymity or full transparency) are politically and prudentially unstable.Footnote 92
The UK’s position, however, is complicated by the trajectory of the Data (Use and Access) Act 2025, which signals an incremental liberalisation of the data protection framework, and by the ICO’s deferential enforcement posture toward public-sector bodies (discussed in Section 5). These factors qualify the UK’s capacity to deliver the credible, enforceable oversight on which tiered privacy depends.
4. Mapping pilots and positioning
Building on the stability curve in Figure 1, this analysis locates existing CBDC pilots within the privacy–stability space. A digital euro designed within GDPR-bounded tiers sits right-of-centre on the x-axis (stronger privacy) and high on the y-axis (stable demand), because enforceable rights make privacy levels time-consistent.Footnote 93 China’s e-CNY, with “controllable anonymity” for small values and administrative unmasking, sits left-of-centre on privacy and mid-level on demand stability; its adoption has been tepid relative to ubiquitous private platforms, consistent with users discounting a policy-level promise.Footnote 94 Nigeria’s eNaira demonstrates the opposite risk: coercive nudges in a low-credibility environment can drive substitution onto alternative rails and entrench scepticism toward the state’s digital money.Footnote 95
The scenario logic yields a general proposition: jurisdictions that credibly entrench privacy within a prudentially compatible corridor will achieve steadier CBDC demand and greater policy traction. Where privacy is heavily compromised, or commitments lack credibility, adoption will remain marginal or display volatile “on–off” patterns sensitive to political signals.Footnote 96 In this sense, privacy is not a compliance reconsideration but a monetary policy lever, bounded by AML/CFT, that shapes both domestic stability and the international appeal of sovereign digital money.Footnote 97
These outcomes can be formalised through comparative statics. Varying the privacy parameter p alters equilibrium demand, velocity, disintermediation risk and integrity exposures. Table 2 schematically summarises the three archetypes: weak privacy depresses demand and risks privacy runs; strong privacy anchors adoption but intensifies prudential and AML challenges; and tiered privacy offers a corridor in which trust and financial stability can be reconciled. The positioning of real-world pilots illustrates how these dynamics play out in practice.Footnote 98
Comparative statics of CBDC privacy scenarios (extending the stability curve in Figure 1).
Table 2. Long description
A table comparing CBDC privacy scenarios with various parameters and outcomes. The table has five rows and seven columns. The columns are labeled Scenario, Privacy parameter (p), Adoption/Demand stability, Velocity patterns, Disintermediation risk, Financial integrity risk, and Illustrative pilots. The rows are labeled Weak privacy, Strong privacy, Tiered/ intermediate privacy, and EU digital euro. Row 1: Weak privacy, Low (p is approximately 0), Low, fickle; privacy runs possible; users avoid holding balances, Erratic: short-lived balances, just-in-time top-ups, Low (banks retain deposits), Low (surveillance ensures traceability), Nigeria’s eNaira (coercive nudges, low uptake); China’s e-CNY (tepid adoption despite pilots). Row 2: Strong privacy, High (p is approximately 1), High, steady; CBDC trusted as safe and private; credible haven, Predictable: mirrors cash for small flows, deposits for larger, High (deposit substitution in stress, unless offset by tiered remuneration or liquidity backstops), High (anonymous flows could facilitate illicit finance, FATF non-compliance), Hypothetical high-privacy digital euro or Swiss-style model. Row 3: Tiered/ intermediate privacy, Medium (0.4 is less than or equal to p is less than or equal to 0.7), intermediate, Medium, Moderate-high; credible if thresholds are clear and enforced, Stable for retail flows; identified for large values, Managed: substitution bounded by thresholds and remuneration. Row 4: EU digital euro, proposals (anonymity vouchers); PBOC e-CNY (small/large transaction tiers); prospective US/UK designs,
VI. Implications
Viewing privacy as a monetary policy lever yields several implications for CBDC design and governance. Rather than being treated as a peripheral compliance issue, privacy should be understood as a variable that can be calibrated, entrenched and communicated, much like interest rates, capital buffers or supervisory ratios.
1. Privacy as a policy instrument
Central banks have long adjusted interest rates to influence money demand and inflation, while regulators impose capital and liquidity rules to secure stability. Privacy in CBDCs should be understood in the same register: a policy dial with real behavioural consequences.Footnote 99 A CBDC designed with weak privacy will likely deter uptake and erode trust; one with strong privacy may accelerate adoption, but at the cost of greater disintermediation and AML exposure. The design choice is therefore strategic.Footnote 100 Where the overriding objective is to preserve the role of bank intermediation, privacy may be deliberately limited to make CBDC appear less attractive.Footnote 101 Where the aim is to provide a robust public alternative to bank money for resilience, inclusion or innovation, privacy protections may need to be strengthened, even at the cost of increased deposit outflows. These are not mere compliance questions; they are core decisions about the future of monetary governance.Footnote 102
2. Statutory entrenchment and judicial oversight
Credibility requires law. Technical assurances cannot substitute for statutory guarantees, and constitutional review provides a vital safety valve against surveillance creep. Legislatures can entrench thresholds, for example, mandating cash-like privacy below specific transaction values or procedural safeguards, such as warrant requirements for access to user data. Courts can then police proportionality, ensuring that the erosion of privacy remains exceptional.Footnote 103
The United Kingdom’s digital pound consultations illustrate the point: the Bank of England and HM Treasury acknowledged that only primary legislation could make privacy promises credible.Footnote 104 In the EU, the GDPR and the CJEU’s proportionality jurisprudence constrain ex ante design.Footnote 105 By contrast, where commitments remain policy-based, as in China, users rationally discount them. The implication is clear: legal entrenchment converts technical promises into durable obligations that can be priced into adoption expectations.Footnote 106
3. Supervisory design and operational governance
CBDC data governance must be structured to reflect these legal commitments. Separation principles identify data held by supervised intermediaries and pseudonymous transaction data at the core ledger, embodying GDPR’s data minimisation duty and reducing systemic risk under the EU’s Digital Operational Resilience Act (DORA) and the CPMI–IOSCO Principles for Financial Market Infrastructures (PFMI).Footnote 107 Independent custodianship of identity keys, strict audit trails, and transparency reporting can institutionalise checks and balances.Footnote 108
Offline functionality and proportionate data retention rules further reinforce credibility: low-value payments can be structured to leave no enduring trace, while higher-value flows remain subject to AML oversight.Footnote 109 Supervisory regimes should treat these safeguards not as optional extras but as integral to financial stability.
4. Geopolitical competition and monetary sovereignty
Privacy design has an international dimension. As CBDCs become embedded in cross-border payments, their credibility abroad may turn on the strength of their privacy commitments. A digital euro that guarantees cash-like confidentiality for small transactions could become attractive outside the euro area, mirroring the international circulation of euro banknotes.Footnote 110 A digital dollar lacking equivalent safeguards could struggle to reproduce the trust that underpins dollar hegemony.Footnote 111
Conversely, surveillance-oriented CBDCs may face rejection abroad. If market participants fear that their transactions would be visible to another state, they may avoid that CBDC, undermining its international role.Footnote 112 In this sense, privacy is a matter of individual rights and a dimension of monetary sovereignty and soft power. Aligning CBDC design with constitutional traditions and democratic values is, therefore, a geopolitical and domestic imperative.Footnote 113
5. International coordination
Unilateral design risks creating arbitrage. A jurisdiction offering near-total anonymity may attract illicit flows and sanctions, while one mandating pervasive surveillance may deter adoption and cede ground to rivals.Footnote 114 International bodies have already begun to frame common principles: the BIS has highlighted privacy as central to trust in digital money, and the IMF has urged members to balance integrity and confidentiality.Footnote 115 Convergence around a baseline, such as guaranteed privacy for small-value payments alongside AML safeguards for higher flows, could prevent a “race to the bottom” while preserving confidence in central bank money as a category.Footnote 116
6. Communication and public engagement
Finally, if privacy is a monetary variable, its changes require the same transparency as adjustments to interest rates or reserve ratios. ECB and Bank of England consultations show that privacy consistently ranks as the public’s top concern.Footnote 117 Public charters should include plain-language statements of what data are collected, who can access them, and what legal rights users possess.Footnote 118 Transparency reports and independent audits can reinforce trust. Without such engagement, even robust safeguards may be dismissed as empty promises, and confidence in CBDC could quickly erode.Footnote 119
VII. Conclusion
This analysis reframes privacy as both a guarantee of rights and a stabiliser of monetary demand. In the context of CBDCs, privacy is not an ethical nicety or a compliance obligation but a determinant of whether state-issued digital money succeeds as a trusted medium of exchange. Just as central bank independence and deposit insurance anchor confidence in the financial system, privacy safeguards can function as commitment devices that shape expectations and secure long-term trust.Footnote 120 When users are confident that holding and using CBDC will not expose them to disproportionate surveillance or misuse of their data, they are more willing to integrate it into their financial lives, contributing to systemic stability.Footnote 121
The research question asked whether legal safeguards for CBDC data can enhance financial stability. The interdisciplinary analysis here suggests that they can. Legal privacy guarantees, such as prudential regulation or lender-of-last-resort facilities, can serve as institutional anchors.Footnote 122 In jurisdictions like the EU, GDPR, CJEU jurisprudence and constitutional doctrines of informational self-determination provide a high baseline of commitment.Footnote 123 In the UK, the statutory entrenchment of privacy protections for the proposed digital pound would perform a similar function.Footnote 124 Where such frameworks are in place, users can reasonably expect their data not to be indiscriminately monitored or repurposed. This expectation encourages adoption, steady usage, and reliance on CBDC even in moments of stress, thereby enhancing stability.Footnote 125 In a crisis, a well-designed, privacy-respecting CBDC could act as a haven, cushioning against disorderly runs into cash or unregulated substitutes.
By contrast, a CBDC launched without credible privacy guarantees risks being built on a fragile foundation. Even if initially adopted, it may remain vulnerable to sudden trust collapses. A breach, misuse of data, or arbitrary policy shift could provoke a flight from CBDC into cash, foreign currencies or volatile crypto-assets, destabilising rather than reinforcing the monetary system. This risk underscores the point that privacy is part of the monetary transmission mechanism: it determines whether central banks can effectively use CBDC to pursue objectives such as inclusion, efficiency or even unconventional policies like digital stimulus. Without trust, these tools remain blunt.
The framework advanced here is, by design, a theoretical architecture. It identifies the channels through which privacy affects monetary stability and maps the institutional conditions under which legal commitments can anchor expectations. It does not claim that these channels are currently active at full force. Consumer privacy awareness remains low; behavioural research consistently documents a gap between stated preferences and observed behaviour, with most users accepting invasive data practices out of habit, for convenience, or because they believe they have nothing to hide. Existing financial regulation already subordinates privacy to integrity objectives in significant respects, as the analysis of AML/CFT practice in Section 2 demonstrated. And the enforcement machinery on which legal commitments depend – exemplified by the ICO’s deferential posture toward public-sector bodies – is not always up to the task. The practical force of the privacy parameter p is therefore mediated by factors – information asymmetry, habitual acquiescence, enforcement weakness and the absence of viable alternatives for users in systems where CBDCs dominate the payment landscape – that this paper has identified but cannot, at this stage, resolve empirically.
Yet the history of financial regulation counsels against dismissing theoretical vulnerabilities because they have not yet materialised in crisis. Deposit insurance was an unnecessary cost until its absence proved catastrophic. Prudential liquidity rules were a compliance burden until their inadequacy triggered systemic failure. Privacy in CBDCs may follow a similar trajectory: its importance will become apparent not in calm conditions but at the moment of breach, misuse or political exploitation – by which point, the absence of legal commitment devices will be difficult to reverse in the short term. The value of the framework lies precisely in its anticipatory character. It argues that privacy safeguards should be entrenched before they are needed, rather than retrofitted after their absence is felt.
A methodological caveat is owed to readers who will resist the framing adopted here. A substantial body of fundamental-rights scholarship objects to any law-and-economics treatment of privacy and data protection, on the view that rights are not commodities to be weighed against efficiency and that an instrumental defence concedes the very point in issue. The objection has force, and the argument advanced here does not deny it. The claim is narrower, and if anything, it supports the rights-based position: even on purely consequentialist terms, and even setting aside the intrinsic value of informational self-determination, strong and legally entrenched privacy is justified by its stabilising effect on monetary demand. Where the deontological and instrumental accounts converge on the same institutional prescription, the case for entrenchment is overdetermined rather than weakened. The economic framing is therefore offered as a second line of defence for privacy, not as a licence to trade it away.Footnote 126
Empirical evidence from pilots such as the digital euro, e-CNY, and eNaira will be critical for testing these propositions. Future research should examine whether legal entrenchment and privacy design differences produce measurable differences in uptake, velocity and stability across jurisdictions. The broader societal balancing act between privacy, financial integrity and security demands continued democratic input and sustained public engagement. The framework presented here does not imply that maximum anonymity is desirable or feasible; it argues for a calibrated approach in which privacy is legally entrenched within a corridor that sustains both trust and integrity. For policymakers and scholars alike, the implication is to break disciplinary silos. Economists must model user preferences and legal constraints; legal scholars must recognise the monetary consequences of privacy design. CBDCs intersect with technology, law and economics; privacy is a linchpin.
Ultimately, monetary history teaches that stability rests on public trust. In the digital age, where fears of surveillance replace earlier fears of debasement, privacy may be the defining currency of trust. By treating it as a deliberate design choice and embedding it within robust legal safeguards, central banks can ensure that CBDCs enhance, rather than unsettle, stability. In this light, privacy emerges as a dual safeguard: protecting individual freedom while concurrently reinforcing the resilience of money itself.
Acknowledgments
None.
Financial support
The paper is fully funded by the University of Liverpool.
Competing interests
The author declares no competing interests.
Author contributions
The primary author is responsible for the whole paper.
Open access
