On October 19, 2020, during a virtual panel hosted by the International Monetary Fund on the future of cross-border payments, Agustín Carstens — the Mexican economist who runs the Bank for International Settlements, the Basel-based institution that functions as the central bank of central banks — was asked to explain how a central bank digital currency would differ from the physical cash already in circulation. His answer was unusually candid, and it has been replayed ever since by people who found it chilling. "We don't know, for example, who's using a hundred-dollar bill today," Carstens said. "We don't know who is using a thousand-peso bill today. A key difference with the CBDC is that the central bank will have absolute control on the rules and regulations that will determine the use of that expression of central bank liability, and also we will have the technology to enforce that." He was not warning against this capability. He was describing it as a feature. The remark, roughly twenty-two minutes into the recorded session, was meant to reassure regulators that a digital currency could be governed responsibly. To the millions who later watched the clip stripped of its context, it sounded like the most powerful financial official on earth confirming, in plain language, the thing they had been told was paranoid to suspect: that the money of the future would arrive with a control surface built in, and that the people designing it knew exactly what that meant.
This is the node where two long-running anxieties — the surveillance state mapped in Mass Surveillance and the institutional restructuring described in The Great Reset — fuse into a single instrument. A central bank digital currency is, in the most neutral possible description, a digital form of sovereign money: a direct liability of the central bank, like a banknote, but existing as an entry in a ledger rather than as paper or metal. That neutral description conceals the entire controversy. Because a ledger entry, unlike a banknote, can carry rules. It can be watched. It can be switched off. The argument over CBDCs is, at bottom, an argument over whether the most basic technology of human exchange — the token you hand to a stranger to settle a debt — should become, for the first time in history, something a state can read in full and program at will. Everything else is detail.
What makes the subject so hard to argue calmly is that it sits exactly on the seam between a mundane infrastructure upgrade and a civilizational hinge, and which one you see depends almost entirely on how much you trust the institutions holding the key. The same set of facts supports both readings. A digital pound or digital euro is, on its face, no more sinister than the modernization of a postal service. And yet the capabilities it would create are precisely the ones that, in every previous century, rulers could only have dreamed of: to see every exchange, to attach conditions to every coin, to exclude any person from the economy with a keystroke. The history below is an attempt to hold both of those truths at once, because anyone who can only see one of them has not understood the problem.
For most of the modern era there have been two kinds of money in ordinary use, and almost no one notices the difference. There is central-bank money — physical cash, the only form of state money the public can hold directly — and there is commercial-bank money, the digits in your checking account, which are not state money at all but a private bank's promise to pay you cash on demand. When you tap a card or send a transfer, no banknote moves. One bank's promise is reconciled against another's, and the central bank settles the net at the end of the day. The system is layered, and the layers are the point: the commercial banks stand between the citizen and the monetary authority, and have done so since modern banking began.
A retail CBDC dissolves that layering. It would give the public a digital claim directly on the central bank, bypassing the commercial banks entirely. This is why the design question is never merely technical; it is constitutional. It re-routes the plumbing of Money as Debt & Fractional-Reserve Banking — the system in which private banks create most of the money supply when they issue loans — and threatens, in its more radical forms, to pull credit and the payment system into the state's own balance sheet. Economists call the danger "disintermediation." If a central-bank wallet is safer than any commercial bank, then in a panic everyone empties their bank accounts into it at once, and the bank run becomes instantaneous and total. To prevent this, nearly every serious proposal caps how much CBDC a person may hold — the European Central Bank has floated figures around three thousand euros — which is a quiet admission that the instrument is powerful enough to break the banking system it sits beside.
Most of the world's CBDC work is in fact "wholesale" rather than retail — plumbing for settlement between banks, invisible to the public and largely uncontroversial. It is the retail CBDC, the one ordinary people would actually spend, that carries the entire weight of the debate, and it is the retail version that officials keep insisting they have not yet decided to build. The distinction matters because defenders of the project often answer fears about programmable money by pointing to the boring wholesale experiments, while critics are worried about the retail wallet in your pocket. They are frequently talking past each other on purpose.
The proximate motive for any of it is the death of cash. In Sweden, cash fell below ten percent of point-of-sale transactions by the late 2010s, and the Riksbank — the world's oldest central bank — began developing an e-krona partly out of fear that a fully privatized payment system would leave the public with no sovereign money at all, no fallback if the card networks failed. In China, the duopoly of Alipay and WeChat Pay had so thoroughly displaced both cash and cards that the People's Bank of China watched the nation's payment rails pass into the hands of two technology firms answerable to no monetary authority. Across the wealthy world the same pattern recurred: every year fewer transactions in notes and coins, more inside the closed systems of private platforms. Central bankers concluded that if money was going digital regardless, the state could either issue the digital money itself or cede the monetary base to corporations.
The Bank for International Settlements turned this scattered worry into an official consensus. In an October 2020 report co-authored with seven major central banks — the Federal Reserve, the European Central Bank, the Bank of England, the Bank of Japan, the Bank of Canada, the Riksbank, and the Swiss National Bank — the BIS laid out "foundational principles and core features" for CBDCs. In its 2021 Annual Economic Report it devoted a full chapter to declaring digital currencies "an opportunity for the monetary system," and its innovation hub spun up cross-border pilots on three continents. By the BIS's own surveys, roughly nine in ten of the world's central banks were, by 2022, actively exploring one. What had begun as a handful of national experiments had become a coordinated international program, drafted in Basel and propagating outward — which is precisely the configuration that makes critics treat it as something other than a series of independent domestic policy choices.
The argument over CBDCs is not purely speculative, because one already runs at national scale. The Chinese project, the e-CNY — the digital yuan, formally the Digital Currency Electronic Payment system, or DCEP — had been in research since 2014, but it accelerated sharply in 2019, when Facebook announced Libra, a corporate stablecoin that threatened to mint a private global currency backed by a basket of sovereign money. Beijing read Libra as a strategic threat to monetary sovereignty and moved. In August 2019 Mu Changchun, then deputy director of the PBoC's payments department and soon head of its Digital Currency Research Institute, gave a public lecture describing a digital yuan that was "almost ready." The Libra threat collapsed under regulatory pressure and never launched; the Chinese response it provoked did.
In April 2020 the People's Bank of China began live pilots in Shenzhen, Suzhou, Chengdu, and the planned city of Xiong'an. The rollout was deliberate and incremental. Municipal lotteries distributed millions of yuan in digital "red packets" to seed adoption, the e-CNY app appeared in domestic stores, and the pilot zones widened city by city. By the February 2022 Beijing Winter Olympics, foreign visitors could load wallets to spend inside the bubble — a showcase deployment timed for a global audience. By the mid-2020s, cumulative e-CNY transactions ran into the trillions of yuan, even as it remained a sliver of total Chinese payments, dwarfed still by the private apps it was built to challenge.
The design principle is the part worth dwelling on. Mu described it as "controllable anonymity": small payments are shielded from ordinary view, while larger flows are fully transparent to the state, and the central bank holds the master key to the entire ledger. The phrase is admirably precise about where the control sits. Anonymity is a permission the issuer grants and can revoke, not a property of the money. Cash is anonymous because physics makes it so; e-CNY is anonymous only to the extent, and for exactly as long, as the People's Bank decides it should be.
It is the pilot's other features, more than any Western white paper, that made the programmability fear concrete. Some of the digital-yuan giveaways carried expiration dates: the money had to be spent within a set window or it would simply cease to exist — a built-in incentive to consume that no banknote could ever impose. That single design choice, money with a clock, is the clearest demonstration that a CBDC is not cash made digital but a new kind of object, one whose behavior can be written and rewritten by whoever issues it. Money that expires, money that can only be spent in one district, money that is valid for one category of goods: none of these are difficult engineering problems once the unit of account is software.
China presents all of this as monetary efficiency and as a defense of sovereignty against the private payment giants and the dollar, and there is genuine substance to the claim. The e-CNY lowers transaction costs, reaches rural users, and gives Beijing an instrument to settle trade outside the dollar-clearing system that Washington can sanction. The cross-border ambition is explicit: through BIS-hosted pilots and bilateral arrangements, the digital yuan is part of a long campaign to build payment rails that do not pass through New York. Critics see the same object from the other side and find the working prototype of what Carstens described — a currency the state can watch in full, shape by rule, and revoke at will. Both descriptions are accurate. That is what makes the e-CNY the indispensable case study rather than a caricature: it is simultaneously a real improvement in payments and a real expansion of the state's reach into them.
Strip away the jargon and "programmability" means a simple, vertiginous thing: the money knows what it is allowed to do. A banknote is a bearer instrument — whoever holds it can spend it on anything, and it carries no memory of where it has been. A CBDC, in nearly every architecture, is account-based and rule-bound: every unit is an entry in a ledger governed by code, and code can attach conditions. The shift from bearer to account is the whole transformation. Once money is a programmable record rather than a physical token, a long menu of controls becomes not merely possible but trivial to implement, because they are just lines in the software.
The menu is worth naming in full, because the alarm depends on the specifics. Money can be given an expiry date, forcing spending by a deadline, as the e-CNY pilots already demonstrated. It can be geofenced, spendable only within a defined region — useful for a regional stimulus, equally useful for confining a person's economic life to a zone. It can be purpose-restricted, usable for food but not fuel, for approved goods but not disapproved ones, with the categories defined by whoever controls the rules. Welfare payments could be made unspendable on alcohol; they could equally be made unspendable on bus tickets out of town.
Then there is the macroeconomic lever that monetary economists have wanted for a decade: negative interest rates that actually bite. Today a central bank cannot push rates deeply negative, because savers escape by withdrawing physical cash, which always yields zero. This is the "zero lower bound," and the economist Kenneth Rogoff argued in The Curse of Cash (2016) that eliminating large-denomination notes would remove the escape hatch and let central banks tax savings into circulation during a slump. A CBDC makes this effortless: programmed money can simply shrink at a set rate, evaporating from accounts to force spending in a downturn. What is presented as a tool to fight recessions is, viewed from the citizen's side, the ability to impose a decay rate on savings that cannot be evaded.
The most consequential capability is the simplest: instant freezing and seizure, by the issuer, without a court, a bailiff, or a bank intermediary who might refuse. Critics are routinely told this is dystopian fantasy, but the capability is already demonstrably in use without a CBDC. In February 2022 the Canadian government invoked the Emergencies Act to freeze, without warrants or judicial orders, the bank accounts of people who had donated to the trucker convoy protests — including small donors who had broken no law at the time they gave. The episode proved that instant financial exclusion is now an ordinary instrument of the state. A retail CBDC would not invent that power. It would make it native, frictionless, and total: not a series of orders dispatched to reluctant private banks, but a setting toggled on the central ledger itself, exercisable on any account, for any reason, at the speed of a database write.
These are not extrapolations invented by alarmists; they are capabilities described approvingly by officials. In October 2022, at a CBDC seminar hosted by the Atlantic Council, Bo Li — a Deputy Managing Director of the IMF and former deputy governor of the People's Bank of China — explained that CBDCs could advance "financial inclusion through programmability," and offered as an illustration that money could be programmed so that "this money can only be used for food," or for a specific purpose, or by a specific person, allowing governments to "precisely target what people can own and what kind of use this money can be utilized" for. He meant it as a benefit: welfare delivered with no leakage, subsidies that cannot be misspent. But the mechanism that guarantees a food voucher is spent on food is identical to the mechanism that guarantees a dissident's money is spent on nothing at all. The technology does not distinguish between the two uses. Only the intent of whoever holds the master key does — and intent is exactly the thing a citizen cannot audit.
A programmable currency is dangerous in proportion to what it is married to, and the marriage the critics fear is with identity. A banknote is anonymous; a CBDC account, in virtually every proposed design, is tied to a verified identity, because know-your-customer and anti-money-laundering law requires it. That tie is the hinge on which the whole danger turns. Once every transaction is bound to a named, authenticated person and recorded on a state-readable ledger, the payment system becomes, in effect, the most complete behavioral dossier ever compiled — a continuous, timestamped record of where a person was, what they consumed, whom they paid, what they read, which doctor they saw, and which causes they funded.
This is the precise extension of the apparatus documented in Mass Surveillance. The intelligence agencies spent the digital age building the capacity to read the metadata of communications — who called whom, when, from where. A retail CBDC hands the state the equivalent map of the economy, and arguably a more intimate one, because what a person buys is often a truer record of their life than what they say. The panopticon moves from the phone to the wallet. Nothing is invisible, because nothing is anonymous, and the record is permanent and centralized rather than scattered across thousands of private banks and processors.
China makes the convergence explicit, which is why it functions as the cautionary archetype rather than a hypothetical. The same state that pilots the e-CNY operates the patchwork of programs known as the Social Credit System, blacklists that have blocked millions of "discredited" citizens from buying airline and high-speed-rail tickets, and a network of hundreds of millions of surveillance cameras knit to facial recognition. Hold those systems separate and each is merely intrusive. Integrate them — low social standing translating directly into restricted spending on a currency the state can watch and switch off — and you have the financial equivalent of being unpersoned, executed not by a knock on the door but by a declined transaction at a turnstile. The components already exist in China. A fully deployed retail e-CNY is the connective tissue that would let them act as one machine.
Western critics argue that this is the destination, not a detour unique to authoritarian states. The European Union is building a Digital Identity Wallet for every citizen; the pandemic normalized health-status passes and QR-code check-ins as conditions of movement; proposals for personal carbon budgets imagine tracking and capping individual consumption. None of these is a CBDC. But each is a component, and a programmable currency is the engine that would make their enforcement automatic rather than advisory. This is where the fear connects to The Great Reset — the worry that programmable money is the rail on which a "you'll own nothing" restructuring would actually run, the layer that turns policy aspirations into spending rules the money obeys on its own — and to Technocracy, the older dream of governance by rule rather than negotiation, in which a regulation is not argued in a legislature and enforced by courts but compiled into the currency and executed without appeal or delay.
It is worth noting that the most advanced real-world version of this stack is not a CBDC and is not Chinese. India built, over the 2010s, the Aadhaar biometric identity system covering more than a billion people and layered on top of it the Unified Payments Interface, a public digital-payment rail that now processes more transactions than any comparable system on earth. The combination delivered welfare to the poor with remarkable efficiency and pulled hundreds of millions into the formal economy — and simultaneously created a centralized identity-and-payment substrate whose civil-liberties implications Indian courts and activists have fought over for a decade. The Indian stack is the honest middle of this whole debate made concrete: it is both the strongest evidence that these systems do real good and the strongest evidence that, once built, they concentrate a power over individuals that no prior government possessed.
The alarm is genuine, but the strongest counterargument is not weak, and intellectual honesty requires stating it at full strength rather than as a foil. The first move is to notice that the dystopia is a story about intent, not about technology, and the technology itself solves real and serious problems. A hammer drives nails and breaks skulls; the question is who swings it and under what law. The features that frighten critics in the abstract are, in the deployments that actually exist, aimed at problems that physical cash handles badly or not at all.
Financial inclusion is the headline case, and it is not a marketing slogan. By the World Bank's 2021 Global Findex, roughly 1.4 billion adults remained unbanked, locked out of digital commerce, formal credit, and safe savings, vulnerable to theft and to predatory informal lenders. A CBDC accessible from a basic phone, costing almost nothing to use, could bank them at a stroke — which is precisely why the developing world, not the authoritarian world, produced the first live deployments. The technology's earliest adopters were not surveillance states but small, poor, cash-dependent economies trying to solve a logistics problem.
The Central Bank of The Bahamas launched the Sand Dollar in October 2020 — the first fully deployed nationwide retail CBDC anywhere on earth — to knit together an archipelago where physically distributing cash and banking services across hundreds of scattered islands was genuinely difficult and expensive, and where hurricanes routinely severed the physical infrastructure of money. For a citizen on a remote cay, a digital sovereign currency that works on a phone is not an instrument of control; it is the first reliable access to the financial system they have ever had.
Nigeria followed in October 2021 with the eNaira, the first CBDC in Africa, aimed at the same inclusion goal in a country where a large share of the population is unbanked and remittances are a pillar of the economy. Cross-border payments — which today crawl through chains of correspondent banks that are slow, opaque, and brutal for small remittances, skimming high single-digit percentages from the wages migrant workers send home — could settle in seconds at trivial cost. The BIS's own Project mBridge, linking the central banks of China, Hong Kong, Thailand, and the United Arab Emirates, exists specifically to demonstrate multi-CBDC cross-border settlement that bypasses the correspondent maze. The efficiency gains are real money in real pockets.
The second and sharper rejoinder is that the surveillance the critics fear largely exists already — and is presently in private, unaccountable hands. Your card issuer, your bank, and the payment platforms already log every electronic purchase you make, build profiles from them, and sell the resulting data. Cash was not killed by central banks plotting control; it was killed by Visa, by Alipay, by the smartphone, and its decline was well underway before a single CBDC existed. From this angle a sovereign digital currency is not the arrival of financial surveillance — that arrived years ago — but a question about who controls infrastructure that is being built regardless, and whether it should answer to a public institution bound by law or to corporations bound by terms of service no one reads.
And nothing in the technology compels the panopticon design. Privacy-preserving architectures are demonstrably buildable. Tiered systems can keep small transactions anonymous while flagging only large ones, mirroring the way cash law already treats a five-dollar purchase differently from a fifty-thousand-dollar one. Offline functionality can let two phones exchange value directly, like handing over a coin, with no central record at all. Designs exist in which the central bank sees only aggregate flows while regulated intermediaries, not the state, hold the identities. The Boston Federal Reserve's Project Hamilton, run with MIT's Digital Currency Initiative, built and open-sourced a high-throughput CBDC core specifically to study these trade-offs, and the European Central Bank has repeatedly insisted that any digital euro must offer cash-like privacy for low-value payments and must not become a tool for the ECB to see what citizens buy. The surveillance features, in other words, are choices, not necessities — and the difference between an instrument of liberation and an instrument of control is, in this reading, a matter of governance, law, and design, not of the ledger as such.
There is a final possibility, deflating to the most apocalyptic forecasts, that deserves equal weight: the Western retail CBDC may simply never ship. The contrast with China is instructive precisely because the Chinese case is so often treated as the inevitable global future. It is not obviously even the Chinese present — the e-CNY remains marginal against the private apps — and outside an authoritarian state with the means to push adoption, the citizen's enthusiasm for a government wallet has been close to nonexistent.
The eNaira is the cautionary tale. Despite a hard government push, it was used by well under one percent of Nigerians in its first years; the IMF's own review of the project was politely scathing about its near-total lack of uptake. When Nigeria's central bank tried in 2023 to force the issue with a chaotic cash-redesign that created acute shortages of physical naira, the result was not mass migration to the eNaira but public fury and street protests. People, given any working alternative, did not want the state wallet. Voluntary adoption of a retail CBDC in a free society has so far proven to be a product almost no one is asking for.
In the United States the political immune system has, if anything, hardened against it. The Federal Reserve's January 2022 discussion paper, Money and Payments: The U.S. Dollar in the Age of Digital Transformation, was studiously noncommittal and stressed that the Fed would not proceed without explicit authorization from both Congress and the executive — a posture closer to reluctance than ambition. That authorization moved in the opposite direction. Representative Tom Emmer's CBDC Anti-Surveillance State Act passed the House; Florida amended its commercial code to bar a federal CBDC from counting as money; and in January 2025 an executive order prohibited the establishment of a retail digital dollar outright. Whatever the global trend, the American political system has so far rejected the transplant, and rejected it on explicitly anti-surveillance grounds. The European Central Bank, for its part, grinds through a multi-year preparation phase against persistent privacy objections and proposed holding caps deliberately designed to keep any digital euro small and non-threatening to the banks. Coordinated from Basel as the broader project is, it is not inevitable in any particular country, and the democratic resistance to it is not theater.
The strongest counter to the "never" thesis is that the field will not stay empty. If sovereign states decline to issue digital money, private actors will fill the vacuum, and they already are: dollar-pegged stablecoins issued by lightly regulated firms now move enormous volumes, and the same Libra logic that frightened Beijing in 2019 has not gone away so much as fragmented into a dozen corporate successors. A government that refuses to build a CBDC may simply be choosing to let Tether, or Visa, or whatever comes next, own the rails instead — which returns the whole question to its starting point. The choice is rarely between a programmable currency and the comfortable anonymity of cash. Cash is dying regardless. The choice is over who builds and governs the digital money that replaces it, and under what constraints.
So the question the Carstens clip posed is left genuinely open, and that is the honest place to end it. The capability he described is real and is being built; the e-CNY proves the alarming features are not hypothetical but already piloted; the convergence with digital identity is the default outcome unless privacy is deliberately and stubbornly engineered in. And yet the very same technology could bank the world's poor, gut the cost of remittances, defend monetary sovereignty against corporate currencies, and wrest the payment system back from the platforms that quietly captured it — and in the democracies it faces resistance fierce enough that it may stall for a generation or never arrive at all. What is not in dispute is the size of the stake. Money is the most general claim a person holds on the world: on food, shelter, movement, association, and dissent. To make it programmable is to make every one of those things, in principle, conditional on rules that someone else writes. Whether those rules are set by an accountable public process, visible and contestable, or compiled quietly into the currency by the institutions that issue it is — as with every system mapped in this graph — not a question the technology answers. It is a question about who holds the master key, and whether the rest of us are ever permitted to read the code.