Cyber Resilience of the Central Bank Digital Currency Ecosystem (IMF Fintech)

Summary

• Over 100 central banks around the globe are exploring central bank digital currencies to modernize payment systems.p.9
• Reportedly, over 80 percent of cyberattacks in organizations are attributed to the human element.p.11
• Practicing foundational security hygiene and organization-wide training can prevent 99 percent of cyberattacks.p.11
• Addressing quantum computing threats is urgent because the first quantum computers capable of breaking current cryptography are expected before 2030.p.22
• A survey showed that 49 percent of central banks consider offline payments with retail CBDC to be vital, while another 49 percent deemed it to be advantageous.p.29

Key insights

1. A retail central bank digital currency ecosystem introduces a complex, highly interconnected attack surface involving participants outside central bank supervision.p.9
2. Cybersecurity principles for digital money rely on maintaining confidentiality, integrity, and availability across all technical and operational layers.p.11
3. Account-based CBDC models focus security controls on user identity, whereas token-based models prioritize protecting digital tokens throughout their lifecycle.p.21
4. Distributed ledger technology offers high system availability and shared governance, but introduces trade-offs regarding scalability, network latency, and consensus attack vectors.p.25
5. Offline CBDC functionality expands financial inclusion and system resilience during network outages, but heightens risks of double spending and counterfeiting.p.29
6. Reliance on cloud service providers and third-party vendors for critical services creates vendor lock-in risks and potential single points of failure.p.31
7. Cyber resilience must be integrated from the conceptual design phase of a CBDC project to prevent costly remedial rollbacks.p.34