BIS ADVISES CENTRAL BANKS TO PLAN IN ADVANCE FOR CBDC SECURITY

Last updated: June 19, 2025, 19:12 | Written by: Fred Ehrsam

Imagine a world where your national currency exists purely as digital code, instantly transferable and programmable.This is the promise of Central Bank Digital Currencies (CBDCs), and the concept is rapidly moving from theoretical discussion to practical implementation. Issuing a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29.However, with great digital power comes great digital responsibility, particularly when it comes to security. BTCUSD Bitcoin BIS advises central banks to plan in advance for CBDC security From legal issues to hackers, launching a CBDC is fraught with risks, and BIS has a big list of them to consider.The Bank for International Settlements (BIS), the global financial institution owned by central banks, has issued a stark warning: launching a CBDC is fraught with risks, from legal loopholes to sophisticated hackers, and central banks must plan meticulously for these threats from the very beginning.In a recent report, the BIS stressed that issuing a CBDC demands adequate attention to security and that an integrated risk-management framework should be in place even during the initial research phase. Introducing a central bank digital currency (CBDC) will have far-reaching implications for the operations of the issuing central bank and the risk it faces. Both will depend mainly on the particular design adopted and on a large range of factors internal and external to the central bank.This means embedding security into the very DNA of a CBDC, not as an afterthought, but as a core design principle.But what exactly does this proactive planning entail, and what are the potential pitfalls that central banks need to navigate?

Understanding the Security Challenges of CBDCs

The introduction of a CBDC has far-reaching implications for the issuing central bank, significantly altering its operations and the risks it faces. 1. Central Bank Digital Currencies (CBDC) Security: The main focus of this article is on the advice provided by the Bank for International Settlements (BIS) regarding the security of Central Bank Digital Currencies (CBDC).These changes depend on the chosen design and factors both internal and external to the central bank.For CBDCs to function as a reliable means of payment, central banks must proactively address the risks of interruptions, disruptions, and breaches of integrity and confidentiality. From legal issues to hackers, launching a CBDC is fraught with risks, and BIS has a big list of them BIS advises central banks to plan in advance for CBDC security - XBT.Market Market Cap: $2,535,907,955,635.05This requires a deep dive into the threat landscape and the implementation of robust security measures.

Operational Risks: CBDC systems are complex and require seamless operation. Enhancing Cyber Resilience for Central Bank Digital Currencies (CBDCs) The Bank of International Settlements (BIS) introduces Project Polaris, a comprehensive security and resilience frameworkAny downtime, even brief, can erode public trust.
Cybersecurity Risks: CBDCs are attractive targets for cyberattacks, ranging from denial-of-service attacks to attempts to steal or manipulate digital currency.
Data Security and Privacy Risks: Protecting user data and ensuring privacy is paramount.CBDC systems must be designed to prevent unauthorized access to sensitive information.
Legal and Regulatory Risks: CBDCs operate in a complex legal and regulatory environment. The Bank for International Settlements (BIS) has published two papers on the legal and design considerations of central bank digital currencies (CBDCs). Jointly published with seven other central banks, the papers delve into privacy, interoperability, financial crime checks, cybersecurity, and more.Central banks must ensure compliance with all applicable laws and regulations.
Financial Crime Risks: CBDCs could potentially be used for money laundering or terrorist financing if proper controls are not in place.

The BIS's Recommendations for CBDC Security

The BIS report provides a comprehensive framework for central banks to approach CBDC security, emphasizing proactive planning and an integrated risk-management approach.Here are some key recommendations:

Integrated Risk-Management Framework: Implement a comprehensive risk-management framework from the research and development stage. Issuance of a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded centralThis framework should identify, assess, and mitigate all potential risks associated with the CBDC.
Security by Design: Embed security into the very design of the CBDC. Issuing a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29. An integratedThis means considering security implications at every stage of the development process, from the underlying technology to the user interface.
Cyber Resilience: Enhance cyber resilience through robust security controls, threat intelligence, and incident response capabilities.Regularly test and update security measures to stay ahead of evolving threats.
Data Protection and Privacy: Implement strong data protection and privacy measures to safeguard user information. For central bank digital currencies to be a reliable means of payment, central banks should address the risks of interruptions or disruptions and ensure integrity and confidentiality, according to a new report by the Bank for International Settlements.Comply with all applicable data privacy regulations.
Financial Crime Prevention: Integrate financial crime prevention controls into the CBDC system. Issuance of a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29. An integrated risk-management framework should be in place starting at the research stage, and security should be designed into a CBDC, the report said.Implement robust KYC (Know Your Customer) and AML (Anti-Money Laundering) procedures.
Interoperability and Standardization: Collaborate with other central banks and stakeholders to ensure interoperability and standardization of CBDC systems. Issuing a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29. An integrated risk-management framework should be in place starting at the research stage, and security should be desThis will facilitate cross-border payments and reduce the risk of fragmentation.

Project Polaris: A Blueprint for CBDC Security

To further assist central banks, the BIS has introduced Project Polaris, a comprehensive security and resilience framework specifically designed for CBDCs.Project Polaris offers a practical blueprint for enhancing cyber resilience, covering areas such as:

Threat Modeling: Identifying potential threats and vulnerabilities.
Security Architecture: Designing a secure CBDC system architecture.
Security Controls: Implementing appropriate security controls to mitigate identified risks.
Testing and Validation: Regularly testing and validating the security of the CBDC system.
Incident Response: Developing a comprehensive incident response plan to address security breaches.

The Importance of Collaboration and Knowledge Sharing

Developing and implementing a secure CBDC system is a complex undertaking that requires collaboration and knowledge sharing among central banks, technology providers, and other stakeholders.The BIS actively facilitates this collaboration through its various initiatives and platforms.

For example, the BIS has jointly published papers with seven other central banks, delving into crucial aspects like privacy, interoperability, financial crime checks, and cybersecurity. Issuing a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29. An integrated risk-management framework should be in place starting at the research stage, and security should be designed into a CBDC, the report said.This collaborative approach ensures that central banks can learn from each other's experiences and adopt best practices.

Specific Security Considerations for CBDC Design

The specific security considerations for a CBDC depend heavily on its design.Different design choices present different security challenges.Central banks need to carefully evaluate these trade-offs when making design decisions.

Account-Based vs.Token-Based CBDCs

CBDCs can be broadly categorized into two types: account-based and token-based.

Account-Based CBDCs: These are similar to traditional bank accounts, where the central bank maintains a ledger of balances for each user. Issuance of a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded BIS advises central banks to plan in advance for CBDC securitySecurity risks are similar to those faced by traditional banking systems, including account hacking and unauthorized transactions.
Token-Based CBDCs: These are similar to physical cash, where the digital currency is represented by a unique token that can be transferred directly between users.Security risks include token theft, double-spending, and counterfeiting.

The choice between an account-based and token-based CBDC will significantly impact the security architecture and the specific security controls required.

Permissioned vs. Issuance of a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29.Permissionless CBDCs

Another important design choice is whether the CBDC will be permissioned or permissionless.

Permissioned CBDCs: These are controlled by the central bank, which has the authority to grant or revoke access to the system.This allows the central bank to implement strict security controls and prevent unauthorized access.
Permissionless CBDCs: These are decentralized and open to anyone. 国際決済銀行（BIS）は11月29日、中央銀行デジタル通貨（CBDC）の発行には、セキュリティへの十分な配慮が必要であると、各中央銀行に報告書で警告した。While this offers greater transparency and accessibility, it also presents significant security challenges, as it is more difficult to control who participates in the system and prevent malicious activity.

Most central banks are likely to opt for a permissioned CBDC, as this provides greater control and security.

Addressing Privacy Concerns in CBDC Design

Privacy is a major concern for many users when it comes to CBDCs.Central banks need to carefully consider how to balance the need for transparency and accountability with the need to protect user privacy.

There are several approaches to addressing privacy concerns in CBDC design:

Anonymity: Allowing users to transact anonymously, similar to physical cash.However, this makes it more difficult to prevent financial crime.
Pseudonymity: Assigning users a pseudonym that is not directly linked to their identity. Issuance of a central bank digital currency (CBDC) requires adequate attention to security, the Bank for International Settlements (BIS) reminded central bankers in a report on Nov. 29. An integrated risk-management framework should be in place starting at the research stage, and security should be designed into a CBDC, the report said. Risks associated with [ ]This provides some degree of privacy while still allowing for accountability.
Differential Privacy: Adding noise to transaction data to protect individual privacy while still allowing for statistical analysis.

The choice of privacy mechanism will depend on the specific goals and priorities of the central bank.

The Legal and Regulatory Landscape for CBDCs

The legal and regulatory landscape for CBDCs is still evolving.Central banks need to work closely with policymakers and regulators to ensure that CBDCs comply with all applicable laws and regulations.

Key legal and regulatory considerations include:

Legal Tender Status: Determining whether the CBDC will be legal tender.
Data Privacy Regulations: Ensuring compliance with data privacy regulations such as GDPR (General Data Protection Regulation).
Anti-Money Laundering (AML) Regulations: Implementing AML controls to prevent the use of CBDCs for money laundering.
Tax Regulations: Developing tax regulations for CBDCs.

A clear and well-defined legal and regulatory framework is essential for the successful adoption of CBDCs.

Examples of CBDC Security Strategies in Practice

While many CBDC projects are still in the pilot phase, some countries are further along in their development and implementation, providing valuable insights into security strategies.

China's Digital Yuan (e-CNY)

China's Digital Yuan is one of the most advanced CBDC projects in the world.The e-CNY uses a two-tiered system, where the People's Bank of China (PBOC) issues the digital currency to commercial banks, which then distribute it to consumers and businesses.Security measures include:

Centralized Control: The PBOC maintains centralized control over the e-CNY system, allowing it to implement strict security controls.
Cryptography: The e-CNY uses advanced cryptography to protect transactions and prevent counterfeiting.
Real-Name Authentication: Users are required to register with their real names, which helps to prevent financial crime.

Bahamas' Sand Dollar

The Bahamas was one of the first countries to launch a CBDC, the Sand Dollar.The Sand Dollar is designed to improve financial inclusion and reduce the cost of payments.Security measures include:

Hybrid Architecture: The Sand Dollar uses a hybrid architecture that combines centralized and decentralized elements.
Digital Identity: Users are required to create a digital identity, which helps to prevent fraud.
Transaction Monitoring: Transactions are monitored for suspicious activity.

Answering Common Questions About CBDC Security

What are the biggest security threats to CBDCs?

The biggest security threats to CBDCs include cyberattacks, data breaches, financial crime, and operational disruptions.These threats can compromise the integrity, confidentiality, and availability of the CBDC system.

How can central banks mitigate these threats?

Central banks can mitigate these threats by implementing a comprehensive risk-management framework, embedding security into the CBDC design, enhancing cyber resilience, protecting user data, preventing financial crime, and collaborating with other stakeholders.

What role does cryptography play in CBDC security?

Cryptography plays a crucial role in CBDC security by protecting transactions, preventing counterfeiting, and ensuring data confidentiality.Strong cryptographic algorithms and key management practices are essential for a secure CBDC system.

How important is international collaboration for CBDC security?

International collaboration is crucial for CBDC security because it allows central banks to share knowledge, learn from each other's experiences, and develop common security standards.This is particularly important for cross-border payments and interoperability.

Actionable Advice for Central Banks

For central banks embarking on the CBDC journey, here's some actionable advice to ensure robust security:

Start early: Integrate security considerations from the very beginning of the project.
Build a strong team: Assemble a team of experts in cybersecurity, cryptography, and risk management.
Engage with stakeholders: Collaborate with technology providers, regulators, and other central banks.
Test and iterate: Regularly test and update security measures to stay ahead of evolving threats.
Communicate transparently: Be transparent with the public about the security measures in place to build trust.

Conclusion: The Future of CBDC Security

The development and implementation of Central Bank Digital Currencies (CBDCs) represents a significant evolution in the global financial landscape.However, the success of CBDCs hinges on their security.As the Bank of International Settlements (BIS) rightly advises, central banks must prioritize planning in advance for all potential security threats, embedding robust safeguards into every stage of the CBDC lifecycle.By adopting an integrated risk-management framework, embracing security by design, and fostering collaboration, central banks can create CBDC systems that are not only innovative and efficient but also secure and trustworthy.The future of finance may well be digital, but its foundation must be built on unwavering security principles.The journey towards secure CBDCs requires constant vigilance, adaptation, and a commitment to staying ahead of emerging threats.Are you ready to take on the challenge?Contact your regional BIS representative today to begin building a more secure digital financial future.