Design a Central Bank Digital Currency (CBDC)

Problem statement

Design a central bank digital currency: digital fiat issued directly by the central bank as its own liability, distributed through regulated intermediaries, spendable by households and firms in real time, redeemable one-for-one into reserves and cash, and subject to identity, anti-money-laundering, monetary-policy, and legal-oversight constraints that no public-chain cryptocurrency accepts.

A CBDC is not a coin launch. It is a national payments utility with the correctness guarantees of a settlement system: no double-spend, no forged issuance, no lost finality, auditable supply, and lawful access to freeze, seize, or trace balances under court order. The design must simultaneously deliver retail payment convenience (tap, QR, online transfer, possibly offline device-to-device payment) and wholesale integrity (issuance against reserves, interbank settlement, reconciliation with the central bank's core books).

Why this problem is distinctive

Three tensions define the design. First, trust model: public chains substitute consensus among anonymous validators for institutional accountability; a CBDC inverts this, using a permissioned validator set (central bank plus regulated nodes) where identity enables accountability, slashing is replaced by supervision, and finality is a legal fact as much as a technical one. Second, privacy versus oversight: cash is anonymous; a CBDC must offer credible privacy for small everyday payments while remaining traceable for crime and tax enforcement, which forces tiered identity and selective-disclosure cryptography rather than a single blanket rule. Third, monetary stability: a CBDC wallet that pays interest or has no holding limits can accelerate bank disintermediation in stress, so policy instruments (holding caps, tiered remuneration, transfer velocity controls) become first-class system features, not afterthoughts.

Public operating baseline versus design assumptions

Public evidence shows the category is real. The Atlantic Council's tracker reports roughly 130+ countries representing nearly all global GDP exploring a CBDC, with the Bahamas (Sand Dollar, October 2020), Jamaica (JAM-DEX, 2022), and Nigeria (eNaira, October 2021) among launched retail systems. The People's Bank of China reported, to end-2021, about 261 million personal e-CNY wallets, 360 million transactions, and 87.6 billion yuan transacted; India's UPI, the closest real-time retail rail, processed 16.6 billion transactions in October 2024 alone. The BIS Innovation Hub's mBridge reached minimum viable product in 2024 for multi-CBDC cross-border settlement. These are cited public figures, not requirements for our fictional system.

For capacity planning this answer explicitly assumes a mature national deployment: 120 million residents, 85 million registered wallets, 42 million daily active payers, 320 million retail transactions per day average with a 4x peak, and 400,000 wholesale settlements per day. Unless a number is tied to a citation, it is a stated design assumption, target, or budget.

The four architectural planes

1. Issuance plane: central bank core that mints and burns currency against reserve accounts, owns the supply invariant, and publishes auditable attestation of outstanding stock.
2. Ledger plane: the permissioned ledger (centralized core or BFT-replicated) that records balances or tokens, enforces double-spend prevention, and delivers finality.
3. Distribution plane: banks and licensed wallet operators that onboard customers (KYC), hold customer relationships, provide apps, devices, and offline credentials, and settle their own positions with the central bank.
4. Oversight plane: AML monitoring, lawful-access tooling, monetary-policy controls, audit, and regulator reporting, all operating on derived data with strict purpose limitation.

A strong interview answer keeps these planes separate: the distribution plane may degrade (a bank's app is down) without weakening the ledger plane's invariants, and the oversight plane reads projections rather than sitting in the payment hot path.