bis -可供广泛使用及安全的零售层面央行数字货币生态系统 Project Sela - an accessible and secure retail CBDC ecosystem

ProjectSela

AnaccessibleandsecureretailCBDCecosystem

September2023

1

2

3

4

5

6

Contents

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

Acronymsandabbreviations

4

Introduction

5

Ecosystemdesign

8

Policyconsiderations

13

3.1UnbundlingandefficientdistributionofactivitiesinanrCBDCecosystem

13

3.2Lowerbarrierstoentrytoincludeawiderrangeofintermediariestofosteran

innovativepaymentecosystem

13

3.3Singlenessofmoney,accessandfinancialinclusion

16

3.4Enhancedcustomerexperienceandprogrammability

18

3.5Regulationandcounteringillicitactivity

21

3.6Properdatamanagementandprivacytoensuretrustandcybersecurity

21

Legalconsiderations

23

4.1Definitionofcontrol

23

4.2WhocontrolstherCBDCincirculation?

25

4.3PrudentialframeworkconsiderationsforAEs

26

Cyberconsiderations

28

5.1Authentication,2FA,TLSandmTLS

30

5.2Authorisation,HSMs,enclavesandTEEs

32

5.2.1HSMs

32

5.2.2Enclaves

33

5.2.3TEEs

34

5.3Datamanagementandencryption

35

5.3.1Datamanagement

35

5.3.2Keycryptography

36

5.4Programmabilityandcybersecurity

37

5.5Generalconsiderations

39

Technology:PoCimplementation

40

6.1rCBDCecosystemparticipantsandcomponents

40

6.1.1Centralbank:rCBDCplatformandRTGSsystem

41

6.1.2FIs:depositaccountsandATMs

43

6.1.3AEs:backandfront-endrCBDCservices

44

6.1.4Endusers:userdevices

45

2

6.2Usecaseflows

45

6.2.1FIloadingrCBDCagainstreserves

45

6.2.2UserconvertingdepositstorCBDC

46

6.2.3UserconvertingcashtorCBDC

48

6.2.4rCBDCpaymenttransfer

49

6.2.5Top-up

50

6.2.6Waterfall

51

6.2.7RTP

53

7Conclusion

55

References

57

Appendix:Projectparticipantsandacknowledgements

59

BISInnovationHub

59

BankofIsrael

59

HongKongMonetaryAuthority

59

Acknowledgements

60

3

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

Acronymsandabbreviations

4

AE

accessenabler

AML

antimoneylaundering

API

applicationprogramminginterface

ATM

automatedtellermachine

AWS

Amazonwebservices

A2A

account-to-account

BIS

BankforInternationalSettlements

BoE

BankofEngland

BoI

BankofIsrael

CA

certificateauthority

CPMI

CommitteeonPaymentsandMarketInfrastructures

CFT

counteringfinancingofterrorism

CNAAT

cloud-nativeapplicationprotectionplatforms

DeFi

decentralisedfinance

DLT

distributedledgertechnology

ECB

EuropeanCentralBank

e-HKD

HongKongdollarCBDC

FI

fundinginstitution

FMI

financialmarketinfrastructure

gRPC

general-purposeremoteprocedurecalls

HKMA

HongKongMonetaryAuthority

HSM

hardwaresecuritymodule

IP

Internetprotocol

KMaaS

keymanagementasaservice

KYB

knowyourbusiness

KYC

knowyourcustomer

mTLS

mutualtransportlayersecurity

NIST

NationalInstituteofStandardsandTechnology

PC

personalcomputer

PII

personallyidentifiableinformation

PoC

proofofconcept

RBAC

roles-basedaccesscontrol

rCBDC

retailcentralbankdigitalcurrency

RTGS

real-timegrosssettlement

RTP

request-to-pay

SDK

softwaredevelopmentkit

SOC

securityoperationscentre

SME

smallandmedium-sizedenterprises

SSL

securesocketslayer

TEE

trustedexecutionenvironment

TLS

transportlayersecurity

UI

userinterface

UNIDROIT

InternationalInstitutefortheUnificationofPrivateLaw

2FA

two-factorauthentication

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

1.Introduction

5

Centralbankmoneyformsthecoreoftheglobalmonetarysystem,providinga

foundationofsafety,neutrality,accessibilityandintegrityunderpinnedbythe

paymentfinalityachievedviasettlementonthecentralbank’sbalancesheet.1

Currently,thepublichasaccesstoonlyoneformofcentralbankmoney–physicalcashintheformofnotesandcoins.However,thereisclearevidenceofadeclineintheuseofphysicalmeansofpaymentasconsumersshifttodigitalpaymentsthatareheavilyreliantonprivateproviders.Aseconomiesbecomeincreasinglydigital,moreandmorecentralbanksareexploringretailcentralbankdigitalcurrency,or

rCBDC,andevaluatingdifferentdesigns.2AnrCBDCrepresentsanew,additional

formofpublicmoney.Dependingonitsarchitecture,itcanbeaccompaniedbyacentralbank-operatedpaymentsystemthatshouldprovideboththeunique

advantagesofcentralbankmoneyandsupportdigitalpaymentsasapublicgood.

DesigningafunctionalrCBDCplatformpresentsseveralchallengesfor

centralbanks.Thecentralbankcanplayacriticalroleinoperatingthecoreofthe

systemandensuringsoundmoney,liquidityandoverallsecurity.Asretailpaymentneedsarediverseandconstantlyevolving,onewaytomeetthisdemandisthroughavibrantcommunityofintermediariesthatcanfostercompetition,innovationandaccess.Intheirexplorations,centralbanksarethereforecontemplatingmany

alternativedesignsforanrCBDCsystem.Thequestionsthatmustbeconsideredintheseeffortsinclude,notably,whatisthemostefficientdivisionoftasksbetweentheprivateandpublicsectorsintheprovisionoftherCBDCplatformandservices?HowcananrCBDCsystempromoteaccessandcompetition,andfosterinnovationinpaymentservices?Doesincreasedaccesscomeatthecostofgreatercyber

securityrisks?And,lastly,canawelldesignedrCBDCsystemretainthedesirableattributesofcashwhilealsocreatinguserexperiencesfunctioningaswellas,or

betterthan,today’spaymentsystems?ThesearequestionsthatProjectSelaseekstoanswer.

ProjectSelaisajointexperimentbetweentheBISInnovationHubHong

KongCentre,theBankofIsrael(BoI)andtheHongKongMonetaryAuthority

(HKMA).SelaleveragestheBol’songoingworkonitsdigitalshekelproject3anditscybersecurityexpertiseandtheHKMA’slearningsfromProjectAurumandits

ongoingworkonProjecte-HKD.4,5Itisalsosupportedbyprivatesectorservice

providersFISandM10Networksonthetechnologyandcoreproduct,Clifford

ChanceonthelegalanalysisandCheckPointSoftwareTechnologiesoncybersecurity.

1.BIS(2022).

2.ArecentBISsurveyof86centralbanksfoundthat93%areactivelyexploringrCBDCs,withworkonretailrCBDCmoreadvancedthanonwholesale-CBDC.SeeKosseandMattei(2023).

3.See.il/en/economic-roles/payment-systems/future-payment-methods/digital-shekel-cbdc/.

4.SeeBISIH(2022)and.hk/eng/key-functions/international-financial-centre/fintech/research-and-applications/central-bank-digital-currency/.

5.ProjectSeladoesnotreflectanypolicydecisionsbytheHKMAaboutapotentiale-HKDorbytheBoIaboutapotentialdigitalshekel.

6

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

SelateststhefeasibilityofanaccessibleandcybersecurerCBDCproofof

concept(PoC).Indoingso,itassumesthatcompetition,innovation,accessand

cybersecurityaredesirablepropertiesofanrCBDCpaymentsplatform,andthat

thesepropertiescanbeachievedthroughapublic-privatepartnershipthatsupportsavibrantecosystemofprivatesectorintermediaries.Forthispurpose,anrCBDC

architecturewaschosenwherethecentralbankoperatestheretailledgerandprovidesrCBDCaccountsforendusers,whileprivateintermediarieshandleallcustomer-facingrCBDCservicesandobligations.

ThebuildingandevaluationoftheSelaecosystemwasconductedthrough

thelensoffourkeypillars–policy,legal,cybersecurityandtechnology(Graph1).

Thepolicyworkstreamproposedthatloweringthebarrierstoentryfor

intermediaries,withaviewtodiversifyingtherangeofserviceproviders,couldserveasacatalystforanaccessible,competitiveandinnovativerCBDCecosystem.One

waythiscouldbeachievedisbytheunbundlingandefficientredistributionof

rCBDCprocessesamongdifferentpublicandprivateactorsintheecosystem.IntheSelaarchitecture,thecentralbankoperatestherCBDCplatform,providinginstant

settlementforallrCBDCtransactions,andprovides(viatheplatform)pseudo-

anonymousaccountsforendusers.Privateintermediaryserviceprovidersperformallcustomer-facingservicesandcomplianceobligations,andenduserscontroltheirrCBDCfundsthroughself-generatedprivatecryptographickeys.

Graph1–Projectobjectivesandworkstreams

POLICY

LEGAL

CYBER

SECURITY

TECHNOLOGY

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

Thesedesignfeatureswerethenvalidatedbythelegalworkstream.The

unbundlingofrCBDCprocessesandservicesinSelagivesrisetoanewcategoryof

rCBDCpaymentserviceproviderscalledaccessenablers(AEs).AEsprovideallcustomer-facingrCBDCservicesbutnevertakeholdof,orcontrol,thecustomer’srCBDCitself,nordotheyneedtoholdliquidityontheirownbalancesheetstoproviderCBDCservices.

rCBDCpaymentsarethussettleddirectlyonthecentralbank’sbalancesheet,freefromcreditrisk.ThiscouldjustifyalowerfinancialregulatorystandardforAEsandleadtoareducedentrybarriertoprovidingrCBDC-basedservices,openingthedoorsto

paymentserviceprovidersdistinctfromthoseparticipatingintheexistingpayments

ecosystem.6This,inturn,couldencouragecompetition,enablingmorerCBDCusecasestobedevelopedandprovidingthefoundationuponwhichinnovationcanflourish.

Whenconsideringthecybersecurityofsuchacriticalinfrastructure,itis

importanttoensurethatthisenhancedaccessdoesnotcomeatthecostof

increasedcybersecurityrisks.Inthisregard,thecybersecurityworkstreamprovidedinputonpreventativemeasuresthatcouldbeusedintheSeladesigntomitigate

cybersecuritythreatswhilenotlimitingoverallaccesstotherCBDCplatform.Theoutcomesofthepolicy,legalandcyberworkstreamsthenfedintothetechnologyworkstream,whichoversawthebuildingofthePoC.

Specifically,theSelaPoCaimedto:

1.Maximiseaccessforendusersandserviceprovidersbyloweringthebarrierstoentryforintermediariesandfostercompetitionandinnovationinthe

privatesector;

2.Mitigatecybersecuritythreatsbypreventativesoftwaredesign;

3.Preservethedesirableattributesofcash,includingabsenceofcreditrisk,

wideaccessibility,safetyasameansofpaymentandstoreofvalue,provisionofinstantsettlement,lowcostoperationandanappropriatelevelofprivacyforendusersvis-à-visthecentralbank;and

4.Capturethebenefitsofdigitalisation,suchasprovidingfrictionlessandlocation-independentpayment,instantliquidity,andprogrammability.

Otherdesigncriteriasuchasperformance,scalability,offlineandcross-

bordertransactionsarebeyondtheproject’sdirectscope.Nodesigndecisionsweremadethatpreventthesefunctionsfrombeingsupported.7

ThenextsectiondescribestheSelaecosystemdesign.Sections3,4and5

outlinethemainpolicy,legalandcybersecurityconsiderationsunderpinningthe

SelaPoCbuild.Section6providesanoverviewofthePoCtechnicalimplementationarchitecture,includingtheecosystemparticipants,componentsandtheusecase

flows.Thelastsectionconcludeswithlessonslearnedandsuggestednextsteps.

6.Whilealowerfinancialregulatorystandardcouldbejustified,therecouldbeotherrequirementsplacedonAEs(egsecurity,governanceetc)aspartofabroaderregulatoryframework.

7.Furthermore,thepolicyandlegalanalysesfocusedonconsiderationsrelatedtotheprojectobjectives.Other

considerations,suchasrCBDCremuneration,bankdisintermediation,monetarypolicytransmissionetc,wereall

outofscopeoftheproject.

7

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

2.Ecosystemdesign

8

TheSelaPoCimplementedanrCBDCecosystem(Graph2)wheretheactivities

relatedtorCBDCaccountsareunbundledandredistributedamongthedifferentparticipants,namely:

i.AcentralbankthatissuesandredeemstherCBDC,operatestherCBDC

ledgerprovidinginstantsettlementforrCBDCtransactions,providespseudo-anonymousrCBDCaccountsforendusersandoperatesthereal-timegrosssettlement(RTGS)system;

ii.Fundinginstitutions(FIs)thatmanageendusers’depositaccountsofprivatemoneyandcashATMs,andenabletheconversionofrCBDCtoandfrom

bankdepositsandcash;

iii.Anewtypeofintermediarycalledanaccessenabler(AE)thatfacilitatesall

customer-facingrCBDCservices(egonboardingandknow-your-customer

(KYC)andknow-your-business(KYB)checks,providinguseraccesstothe

rCBDCsystem,endorsingandroutingofuserpaymentrequests,complianceobligations,andimplementationofanyadditionalrequirementsmandatedundertherCBDCplatformrules)without“holding”endusers’rCBDCor

needingtoholdliquidityonitsownbalancesheet;and

iv.EnduserswhocontroltheirownrCBDCfundsinwalletapplicationsontheirelectronicdevices(suchasmobilephones),throughsoleauthorityovertheircryptographicprivatekeys.

Sela’sPoCisafull-stacksolutionoftheoverallrCBDCecosystem,includingtherCBDCledgeranditsconnectedinfrastructuresandparticipants.ThecoreoftheSelaPoCisanrCBDCledgerrunbythecentralbank,whichisaprivate,

permissionedandaccount-baseddistributedledgertechnology(DLT)system

storingpseudo-anonymousanduniquerepresentationsofeachenduserregisteredonthenetworkandthecorrespondingaccountbalances.8TherCBDCledgeris

accompaniedbyacentralbank-hostedrCBDCapplicationoutsidetheledger

providingbusinesslogicfortheplatform,suchascoordinatingwithother

componentsoperatedbythecentralbank.ThePoCwasalsodesignedtobe

modularandtointegrateintotraditionalpaymentinfrastructures,suchasacentralbank-operatedRTGSsystem,FIdepositaccountsandATMstosupportthe

conversionofrCBDCtoandfrombankdepositsandcash.Thesetraditional

infrastructuresareconnectedtotherCBDCledgerandformpartoftheoverallecosystem,alongsidenewrCBDCcomponentssuchasenduserwalletsandAEbackendsystemsthattogethersupportbaselinerCBDCfunctionality.

8.AlthoughbasedonDLT,theDLTisassumedtoberunbythecentralbanksasasingleoperator.Thisleaves

futurescopetoexplorehowtheoperationsoftheplatformcouldbedistributedamongadditionalecosystemparticipantsifdesirable.

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

9

Graph2–Projectecosystem

FUNDING

INSTITUTIONS

ATM

APP

DEPOSIT

APP

CENTRALBANK

RTGS

CBDC

LEDGER

ACCESS

ENABLERS

CBDC

BACKEND

USERS

CBDC

WALLET

Sela’saccessibleandcybersecurerCBDCecosystemPoCcontributestothe

workdonebythecentralbankinganddigitalpaymentscommunity.Theprojectis

inspiredbyopenbankinganddecentralisedfinance(DeFi)protocolsasthey

supportopenaccesstofinancialdata,endusersholdingtheirownfundsandthe

unbundlingoffinancialservices.Thiswillhelptoremovebarriersandenableamorediverseandinnovativeecosystemofserviceproviders.9

9.AgrowingnumberofcountriesareintroducingOpenBankinginitiatives(suchastheEU’sPSD2DirectiveandIsrael’sOpenBankingStandard)thatgivethird-partyprovidersaccesstocustomers’bankaccountinformationtoofferservicesbasedonthisaccess.UnderOpenBanking,financialserviceswhichwerepreviouslycentralisedandcontrolledbyasingleentitycannowbedecomposedandofferedbydifferentserviceproviders.Seewww.ecb.europa.eu/paym/intro/mip-online/2018/html/1803_revisedpsd.en.htmland.il/en/economic-

roles/supervision-and-regulation/2527/implementation-of-an-open-banking-standard-in-israel/.

10

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

Theprojectalsobuildsonglobalcentralbanks’CBDCexplorations,suchastheBoI’sdigitalshekel,theBankofEngland’s(BoE)digitalpound,andtheEuropeanCentralBank’s(ECB)digitaleuro,whereprivatesectorinvolvementintherCBDC

ecosystemishighlightedaskeytosupportinginnovation,andwheretherolesandresponsibilitiesaredistributedamongstthecentralbankandsupervisedprivate

sectorintermediariesintheformofapublic-privatepartnership.Forexample,thedigitalpoundanddigitaleuroinitiativesoutlineanrCBDCecosystemwherethe

centralbankissuestherCBDC,operatesthecentralinfrastructureandretainsfull

controloversettlementofretailtransactions,whiletheprivatesectorisresponsibleforallenduser-facingtasks,playingacrucialroleinofferinginnovativeanduser-friendlyservices.Thisensuresthat“holding[therCBDC]wouldmeanholdinga

directliabilityofacentralbank”10atalltimes,asisthecasewithcashtoday,withtheaddedbenefitofprivate-sectorpaymentservices.TheBoEdeemedthisrCBDC“platform”model“themostefficientmechanismtodeliverthedigitalpound,”11

withthegoalto“toenableadiverserangeoforganisationstojointhedigital

poundecosystemtoprovideinnovativeservicestoconsumersandhouseholds.”12

IntheBoI’sdigitalshekeldraftmodel,paymentservicesproviders“willnot

developabalance-sheetexposure”,allowingawiderangeofentitiestoprovide

rCBDCservices,including“banks,creditcardcompanies,fintechfirms,or

internationalordomestictechnologyand/orfinancialfirms,providedthattheymeetthelegalandregulatoryrequirementsthattheBankofIsraelandotherauthorities

putinplace.”13SimilarlyintheSelarCBDCarchitecture,whileAEsprovideall

customer-facingoperations,theynever“hold”endusers’rCBDCasendusersholdtheirownrCBDCfunds,FIshandlerCBDCconversion14andthecentralbank

operatestheretailledger.SelaalsobuildsonRail215oftheHKMA’sProjecte-HKD,whichexaminesdifferentrCBDCdesignandarchitecturalissues,andsupportsthe

HKMA’seffortsinpromotingopenbanking,ontopoftherecentintroductionoftheOpenAPIFrameworkfortheHongKongBankingSectorin2018.16

10.SeeECB(2022).

11.SeeBoE(2023a).

12.SeeBoE(2023b).

13.SeeBoI(2021).

14.AdistinctionbetweenFIsandothertypesofintermediaryintherCBDCecosystemisalsoenvisionedaspartofthegovernancemodelcurrentlybeingdevelopedinthedigitalshekelproject.

15.Projecte-HKD,HongKong’srCBDCexploration,adoptsa“three-railapproach”inpavingthewayforthe

possibleissuanceofane-HKDinthefuture.See.hk/eng/key-functions/international-financial-

centre/fintech/research-and-applications/central-bank-digital-currency/.

16.SeeHKMA(2018).

11

Project

Rosalind

BoEdigitalpound

Atlantic

Council

cyber

CBDC

Project

Aurum

HKMAe-HKD

UNIDROITdigital

assets

BISCBDC

design

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

Inaddition,SelacomplementsotherBISInnovationHubprojectsonrCBDCs.Forexample,itbuildsonthelearningsfromProjectAurum,atechnicalrCBDCstudyconductedincollaborationwiththeHKMAthatexaminedanarchitecturewherethe

centralbankoperatesonlythewholesaleledgerandcommercialbanksoperatetheretailledger.17ProjectSelainsteadteststhefeasibilityofanarchitecturewherethecentralbankoperatestheretailledgerandaimstoreducetheentrybarriersfor

rCBDCtocatalysecompetition,innovationanduseraccess.Theprojectisalso

inspiredbytheinnovativerCBDCusecasesoutlinedinProjectRosalind,which

focusesonanrCBDCapplicationprogramminginterface(API)layer.18Inaddition,

SelaaimstoextendtheCBDCsecurityandresilienceframeworkofProjectPolaristopracticallearnings.19,20

Selaisalsoinformedbylegalandcyberliteratureon,forexample,thelegalprinciplesondigitalassetsfromtheInternationalInstitutefortheUnificationof

PrivateLaw(UNIDROIT),andcybersecurityandresilienceframeworksforFMIsandCBDCs(egfromtheCommitteeonPaymentsandMarketInfrastructures(CPMI),TheNationalInstituteofStandardsandTechnology(NIST),theAtlanticCounciland

WoodsandBöhme(2021))–seeGraph3.

Graph3–Foundationofexistingworkandliterature

Quantifying

cyberrisk

(Woods/

Bohme)

BoI

digitalshekel

CPMIFMI-

cyber

resilience

NIST

Cybersecurity

ECB

digitaleuro

Framework

Project

Polaris

BIS

Legend:

CentralBank

Cyber

Legal

17.SeeBISIH(2022).

18.SeeBISIH(2023a).

19.SeeBISIH(2023b).

20.ForarecentreviewoftheInnovationHub’sCBDCwork,seeBISIH(2023c).

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

TheSelaecosystemdesignisconductedthroughthelensoffourkeypillars

–policy,legal,cybersecurityandtechnology/PoCimplementation.Toleveragethe

expertiseofprojectparticipants,membersweredividedintofourcorresponding

workstreams.Eachworkstreamfollowedanagileprocessovertheproject’ssix-

monthtimespan.Thefirstworkstreamledbypolicyexpertsfromtheparticipating

centralbanksdefinedthefunctionalitiesandattributesthatshouldcharacterisethe

rCBDCecosystemPoC.Thelegalworkstreamthenprovidedlegalvalidationofthe

definedfunctionalitiesandattributes,focusingonaspectsthatarenovelas

comparedwithexistingpaymentsystems.ThisfedintothePoCtechnology

implementation,whichwasconsultedbythecybersecurityworkstreamtoensure

thatthedesignincorporatedrelevantcyberriskmitigationbestpractices.

12

ProjectSela–AnaccessibleandsecureretailCBDCecosystem

3.Policyconsiderations

Guidedbyanoverarchingsetofpolicygoals,thepolicyworkstreamidentifiedthe

attributesthatshouldcharacterisetherCBDCecosystem.Thesehigh-levelattributesfedintotherequirementsoftherCBDCarchitectureandsubsequentlythePoCbuild.

3.1UnbundlingandefficientdistributionofactivitiesinanrCBDCecosystem

Centralbanks’rCBDCexplorationsaimtoprovideapublic,trusted,accessibleandsecuremonetaryandpaymentinfrastructurethatcansupportusers’increasinglydigitalpaymentneeds.Atthesametime,retailcustomer-facingpaymentserviceshavelongbeenthepurviewoftheprivatesector,whichhascomeupwith

innovativeandcreativesolutionstomeetusers’differingpaymentneeds.Continued

involvementoftheprivatesectorwould