A central bank digital currency is sovereign money in digital form — a direct liability of the central bank rather than a commercial bank deposit, issued and recorded on infrastructure the state controls. The concept is not new: central banks have maintained digital reserves for commercial banks since the 1990s. What is new is the extension of that digital infrastructure to retail participants — ordinary citizens, households, merchants — creating a ledger of monetary transactions that is, for the first time in history, potentially comprehensive, real-time, and state-readable at the transaction level.
More than 130 countries are currently exploring, piloting, or deploying CBDCs, representing over 95 percent of global GDP. The motivations are varied: China's digital yuan (e-CNY) aims to maintain monetary sovereignty against private payment platforms (WeChat Pay, Alipay), extend financial inclusion in rural areas, and create a cross-border settlement rail that does not depend on SWIFT. The Bahamas' Sand Dollar and Nigeria's eNaira target financial inclusion in populations underserved by commercial banking. The European Central Bank's digital euro project positions itself as a public payment option against the dominance of American card networks and private stablecoins.
But the surveillance dimension cannot be separated from the architecture. Unlike physical cash — the one monetary instrument that is anonymous by design — any CBDC that records transactions on a state-accessible ledger is, at minimum, a potential surveillance instrument. The question is not whether this capability exists but how it is bounded: by law, by technical architecture, or by political culture.
China's e-CNY is the most advanced large-economy deployment and the most illustrative of the tension. It includes programmable expiry dates (money that ceases to exist if unspent by a deadline, enabling stimulus spending with forced velocity), geofenced spending restrictions (money that cannot be spent outside designated categories or locations), and integration with the Social Credit System in some pilot implementations. These are not bugs; they are deliberate design choices that reveal what programmable money enables when the state has both the authority and the intention to use it.
The surveillance architecture of a CBDC is determined by three design choices: whether the ledger is account-based or token-based; whether transaction data is held centrally or distributed; and what legal framework governs data access. Token-based systems with zero-knowledge proofs can provide privacy equivalent to cash while maintaining anti-money-laundering compliance — but they require genuine political commitment to privacy architecture, which the historical record of state surveillance programs does not consistently support.
The European Central Bank's proposed digital euro includes explicit privacy protections: offline capability for small payments (ensuring cash-equivalent anonymity for low-value transactions), limits on the ECB's access to individual transaction data, and prohibition of programmability for retail payments. Whether these protections survive the political pressures of national security, tax enforcement, and anti-terrorism legislation is a question that cannot be answered by technical design alone.
Law 5 — Revise / Evolution / Transparent Archive — cuts two ways in the CBDC context. Positively, it demands that monetary systems be legible, revisable, and accountable — a CBDC that is visible to its operators is a CBDC that can be audited, contested, and reformed. Negatively, it demands that the revision process itself be transparent: when the state alters the rules of programmable money — changes spending restrictions, adjusts expiry parameters, modifies access conditions — those changes must be visible to the people they govern, not silently administered. The danger of CBDCs is not merely surveillance of individuals but opacity in the governance of the surveillance architecture itself: rules changed by administrative fiat rather than by democratic revision.
The political economy of CBDCs intersects directly with financial inclusion and exclusion. A well-designed CBDC can extend access to sovereign money to the 1.4 billion unbanked adults worldwide. A poorly designed or weaponized CBDC can, conversely, become a mechanism of financial exclusion — accounts that can be suspended, frozen, or restricted based on political status, social behavior, or geographic location. The Chinese and Russian use cases illustrate that CBDCs can be designed as instruments of financial coercion as readily as instruments of financial inclusion.
The collective stakes are existential for the character of democratic monetary life. Cash is the last anonymous monetary instrument, and its disappearance — whether through CBDC displacement, merchant refusal, or deliberate state policy — removes a fundamental layer of economic privacy that liberal societies have taken for granted. The archive of economic behavior that a comprehensive CBDC creates is qualitatively different from anything that has existed before: not a partial record reconstructed from bank statements, but a complete, real-time, state-legible map of every economic transaction in the economy.