Architecting Inclusion in e-CNY: Settlement-Upon-Payment, Domestic Interoperability, and User Control

Definition

This entry explains how China’s e-CNY, the retail form of its Central Bank Digital Currency, translates three design choices into improved access, affordability, and reliability: (1) enabling wallet-to-wallet payments on the CBDC ledger with settlement upon payment (SUP); (2) ensuring seamless integration at checkout with existing QR-code systems and popular payment apps; and (3) providing users with practical control through credentials stored on their devices and managed by licensed operators. With payment finality clarified in law and a two-tier structure in place, offline payments can shift to a hybrid architecture. It blends account- and token-based functionality across online and offline settings, incorporates tiered identity verification, and supports low-cost solutions. In essence, e-CNY demonstrates that strategic decisions regarding settlement, interoperability, and user control can expand financial inclusion while maintaining robust regulatory safeguards.

1. Introduction

Central bank digital currencies (CBDCs) have moved from largely theoretical debate to concrete policy choices with material welfare implications. Statistics from the Atlantic Council indicate that more than 100 countries are exploring CBDCs, each within its own regulatory and legislative context. Yet most jurisdictions continue to iterate on design and implementation. The European Central Bank (ECB), for example, entered a formal preparation phase for a digital euro in 2023 and has since issued three progress reports (e.g., [1,2,3]). Across these initiatives, central banks increasingly frame CBDCs as instruments to promote financial inclusion, where programs remain in development and limited deployment has begun (e.g., [4,5,6]).

Law and regulation are foundational to CBDC design and implementation, as technical architectures must ultimately conform to statutory and regulatory constraints. Some jurisdictions have advanced pilots under existing frameworks. In China, the e-CNY pilot has proceeded largely without major legislative changes because the existing mobile-payments framework provides an accommodating scaffold. If the pilot moves to full issuance, however, formal confirmation of the e-CNY’s legal status would likely require statutory amendments, often discussed in connection with Article 5 of the Law of the People’s Bank of China. Other jurisdictions adopt a “law-first” approach in which legislation precedes currency rollout. For the digital euro, key design parameters are expected to be determined primarily by forthcoming EU legislation [7]. By contrast, the United States has not committed to a retail CBDC: in July 2025 Congress enacted the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act, the first federal framework for payment stablecoins, and the House passed the Anti-CBDC Surveillance State Act, collectively signaling a shift toward regulating private, dollar-denominated tokens rather than building a direct-to-consumer CBDC (e.g., [8,9,10]). Irrespective of the specific digital currency frameworks nations implement, the digital currency era is upon us and promises to improve aggregate social efficiency [11].

China’s financial-inclusion strategy emphasizes equality of opportunity and commercial sustainability, with explicit attention to rural–urban gaps and underserved groups. The State Council’s Plan for Advancing the Development of Financial Inclusion (2016 to 2020) codified these priorities and positioned payment modernization as a central lever (e.g., [12,13]). The result has been widespread adoption of digital payments. By June 2024, China had 969 million online-payment users, or 88.1 percent of internet users, which creates a large user base for inclusive retail payments [14].

For end users, perceptions of control and ease of use often matter more than architectural nuance. The e-CNY incorporates hardware “value wallets” such as IC or NFC cards, SIM-based devices, and wearables, together with dual-offline functions for small transactions. These features lower learning and adoption costs for seniors and for people without smartphones (e.g., [15,16]). In a global context where 2.6 billion people remain offline [17] and 750 million lack electricity [18], offline and hardware options are prerequisites for inclusion. Recent proposals advocate for complete settlement without internet connectivity, achievable through randomness-verifiable hardware wallets that may substantially advance financial inclusion [19].

China also benefits from extensive e-payment penetration, with about one billion online-payment users by 2024, within a digital economy valued at USD 7.5 trillion [20]. The People’s Bank of China (PBOC) strengthens trust by keeping transaction fees at or below prevailing mobile-payment rates, often at zero for retail users [15]. It also relies on Internet Courts and online dispute-resolution (ODR) platforms to provide accessible remedies for small-value disputes. China established the world’s first Internet Court, which adjudicates cases arising from online commerce and copyright. Parties can file claims, submit evidence, and attend hearings remotely through secure digital portals [21].

Taken together, these institutional and infrastructural features translate the settlement-upon-payment advantage of the e-CNY into tangible inclusion gains. They reduce onboarding frictions, lower user fees, and preserve access under weak or intermittent connectivity.

Against this backdrop, China’s e-CNY offers a distinctive case. The large-scale pilot integrates the CBDC with the country’s dominant mobile payment platforms, WeChat Pay and Alipay (e.g., [22,23]) and has reportedly reached cumulative transactions exceeding USD 1 trillion [24]. The design incorporates advanced technical features while aligning with financial-inclusion objectives. For example, users can open entry-level wallets with minimal credentials (a local mobile number), subject to tiered limits on balances and transaction amounts; at the lowest tier, the permitted balance is roughly USD 700, with enhanced privacy relative to higher-KYC (Know Your Customer) tiers.

China’s e-CNY, operating at unprecedented scale, offers instructive lessons for other jurisdictions. This entry analyzes the e-CNY through a financial-inclusion lens, highlighting concrete design choices that lower barriers to access, reduce transaction costs, and enable offline functionality. Crucially, these technical features are accompanied by regulatory adjustments that align legal frameworks with new payment technologies. Such practices are of first-order importance in contexts that combine deep mobile-payment penetration with persistent access constraints: in 2023, an estimated 2.6 billion people remained offline and roughly 750 million lacked electricity, even as China reported 969 million online-payment users by June 2024 (e.g., [14,17,18]).

To standardize terminology, this entry adopts three working definitions. Settlement upon payment (SUP) denotes an instant transfer in which funds move directly from the payer’s digital wallet to the payee’s wallet and the CBDC ledger simultaneously authorizes and records the transaction. Domestic interoperability refers to the ability to transact seamlessly across wallets, QR-code schemes, and bank-account rails already used in everyday commerce; in China, this includes QR standardization, NUCC-based online clearing, and the integration of e-CNY within mobile applications (e.g., [6,25,26]). Self-custody in the e-CNY context means device-resident, operator-governed credentials (secure-element/HSM-backed on cards, phones, or wearables), which differs from user-held “cold wallets” and seed phrases common in cryptocurrency systems [6].

This entry proposes a unified evaluative framework that links three design dimensions: the locus of settlement, domestic interoperability, and device resident self-custody, to three inclusion outcomes: access, affordability, and reliability. It then offers an institutional reading of China’s two-tier architecture, highlighting flexibility in key areas, including tiered KYC, a hybrid model that avoids the token-based versus account-based dichotomy, and deep integration with central payment channels that enables broad acceptance across domestic mobile applications. This entry examines online and offline finality under Chinese private law, assessing the alignment between technical design and legal doctrine. The analysis examines three offline transfer patterns: (i) device crediting (receive-side hold), (ii) freeze until synchronization, and (iii) free spend until synchronization. It shows that, under realistic risk constraints and within the current legal framework, only the first is consistent with SUP. Building on this result, the analysis outlines a feasible path for broader use within the CBDC financial inclusion agenda, including tiered management, low-value accessibility, and secure offline transactions. The remainder of the entry is organized as follows: Section 2 sets the policy frame and details e-CNY design choices and domestic interoperability; Section 3 examines self-custody, including device-resident credentials, hardware and offline access, insolvency protection, and redress; Section 4 operationalizes SUP in both online and offline settings, specifies finality and liability across offline patterns, and addresses double-spending controls.

2. e-CNY Architecture and Inclusion Channels

China’s e-CNY is a retail CBDC implemented through a two-tier architecture. The central bank issues and redeems the liability, while authorized operators, principally designated commercial banks and licensed non-bank payment institutions, distribute wallets and provide front-end services. The PBOC describes the e-CNY as a digital form of M0 intended to circulate alongside cash and to support wallet-to-wallet transfers on dedicated CBDC rails, separate from bank-account and real-time gross settlement (RTGS) infrastructures. Regarding the token- versus account-based dichotomy in CBDC design, s ome authors maintain that the dichotomy is a useful organizing framework [27], and related debates continue [28]; others, however, contend that it has largely lost relevance (e.g., [29,30]). In practice, the e-CNY adopts a hybrid design that combines account-based settlement with token-like features. Strictly speaking, it is predominantly account-based: each user maintains a wallet that functions as an account, and everyday transactions are executed through that wallet much as they would be through a conventional bank account. Token-like properties are most evident in a subset of “prepaid-card” wallets subject to tight balance caps. Although these instruments are technically classified as accounts [29], the Chinese implementation permits a relatively high degree of anonymity. Transactions can often be completed with minimal personal information, in many cases only a mobile phone number. A further architectural feature of the e-CNY is its account-level alignment with the banking system. Users can link bank accounts to their e-CNY wallets. Regulators describe this arrangement as “loose coupling,” designed to broaden financial inclusion while leveraging existing payment rails [6,31]. The CBDC transaction rail parallels legacy bank-account and real-time gross settlement systems. To meet anti-money-laundering and related compliance objectives, wallet functionality is tiered by the level of real-name verification. Basic wallets can be opened with only a mobile phone number and are subject to balance caps and daily and annual transaction ceilings. These limits do not apply to users who complete full real-name verification and link their wallets to existing bank accounts. Data governance relies on general legislation rather than a bespoke e-CNY statute. The Personal Information Protection Law (PIPL) provides the primary framework, and the PBOC issues implementing rules and technical standards. The guiding principle is “anonymity for small value and traceability for high value.”

CBDCs can lower transaction costs and other trade frictions. In the case of the e-CNY, a low-friction fee policy is intended to broaden end-user appeal. The PBOC sets rules and standards, operates core wallet infrastructure for designated operators and sub-entities, and treats basic retail use as a public service. It does not charge operators or individuals for exchange services, providers do not levy fees on individuals for exchange, and wallet-to-wallet transfers are processed almost instantaneously [31]. Within this institutional arrangement, domestic interoperability has a strong foundation. Central bank governance helps reduce trust issues between third-party e-payment platforms and the legal problems that come with them. As a result, technical and legal connectivity between e-CNY rails, bank-account rails, and other electronic payment systems is feasible. This division of responsibilities combines central bank guarantees with market-tested distribution to enhance efficiency and accessibility, particularly for underserved groups, without displacing existing private payment ecosystems [6,31].

2.1. Inclusion Frame: Frictions and Design Constraints

A CBDC inclusion framework should align with international practice: access to appropriate, affordable, and safe financial services for all population segments, with particular attention to low-income households, persons with disabilities, older adults, and micro and small enterprises [32,33]. Opening a transaction account is typically the gateway to broader use of savings, payments, and credit; the same logic applies to CBDC, where a wallet can serve as the entry-level transaction account. Digital payment rails can substantially reduce onboarding frictions compared with traditional approaches, creating significant potential for inclusion. Recurring challenges persist where infrastructure gaps remain binding constraints, including limited connectivity, unreliable electricity, and inadequate device access [17,18,34].

Against this backdrop, the e-CNY design targets three friction points. First, it implements a tiered, risk-based KYC regime. As the degree of identity verification increases, balance and transaction ceilings are progressively relaxed. At the same time, low-threshold entry remains available for users who can provide only minimal personal information. Basic wallets can be opened with a mobile phone number and operate under predefined caps, while preserving pathways to fully verified access. This approach is especially relevant where uneven documentation or SIM-registration requirements would otherwise exclude viable users, and it supports digitally vulnerable groups by enabling access to basic functionality while maintaining compliance with AML/CFT obligations [6,31,35].

Second, the e-CNY is treated as a public good, and the PBOC participates directly in its operation, which helps keep transaction costs controllable. A public-money pricing orientation, combined with operator-level cost discipline, aims to keep small-value transactions at or below prevailing mobile-payment rates. This supports everyday use by low-margin merchants and budget-constrained households [15].

Third, the e-CNY is designed to be resilient under weak connectivity through offline settlement, which sustains low-value transactions during periods of intermittent network coverage or power outages. The PBOC supports hardware carriers for offline use, including IC or NFC cards, SIM-based devices, and wearables. Regulators often face legal challenges with dual-offline functionality. In China, these challenges are addressed through a combination of legal and technical measures, including transaction limits, post-synchronization reconciliation, and liability allocation rules [15,16].

China’s large-scale adoption of digital payments provides the demand-side foundation for e-CNY. By June 2024, there were 969 million online-payment users, or 88.1 percent of internet users, which underpins a broad retail base [14]. At the same time, global connectivity and power gaps remain substantial. About 2.6 billion people are offline and roughly 750 million lack electricity, which makes offline and hardware options prerequisites for inclusion [17,18].

In this context, pricing and processing are organized for everyday use. The PBOC does not charge operators or individuals for exchange services, and operators do not charge individuals for wallet-to-wallet transfers. Wallet-to-wallet transfers settle almost instantly [31].

Redress mechanisms complement these operational features. The existing legal framework for small-value disputes provides a basis for resolving alleged double-spending in offline contexts. Internet Courts and online dispute-resolution platforms offer accessible remedies, which reinforce technical finality in offline double-spending cases. Together, these features lower user costs, reduce access frictions, and support broad uptake while maintaining compliance.

2.2. Two-Tier Architecture and Governance

The e-CNY uses a two-tier model. The PBOC issues, redeems the instrument, and sets technical, operational, and data-governance standards. Authorized operators, principally commercial banks and licensed payment institutions, distribute wallets, conduct know-your-customer and anti-money-laundering compliance, operate wallet infrastructure, and connect e-CNY to bank-account rails and other electronic payment systems [6,15,31]. Draft revisions to the PBOC Law envisage explicit legal-tender status for the digital renminbi, clarifying acceptance obligations in public and private settings [36]. Access is organized through a tiered wallet design that links functionality and limits to the level of identification. Three main types are used: fully verified, account-linked software wallets with the highest ceilings; simplified mobile-number wallets with calibrated caps that reduce onboarding frictions; and hardware wallets (IC or NFC cards, SIM or secure-element devices, and wearables) that enable offline payments within limits [5,31].

These modalities implement the principles of small-value anonymity and high-value traceability and keep e-CNY “loosely coupled” to bank accounts. The Hong Kong cross-boundary pilot follows the approach used in mainland China. Residents can open a wallet with only a local mobile number, subject to low balances, daily caps, and limited functions, while higher tiers require real-name verification [37].

In PBOC’s white paper, “value-based” refers to device-resident stored value and offline transfer. It should not be conflated with the standard token-based versus account-based classification. Functionally, e-CNY is a hybrid. It retains predominantly account-based characteristics while incorporating token-like features for specific scenarios such as offline payments [6,27,38].

2.3. Domestic Interoperability: Standards, Clearing, and Acceptance

For retail CBDCs, the core interoperability issue is domestic coexistence with incumbent systems. Policy guidance suggests three complementary approaches: compatibility through shared standards, interlinking via connectors, and single-system solutions. The goal is to “not harm” existing markets while expanding access [39]. China’s payments landscape is platform-dominated. Alipay and WeChat Pay handle most intra-platform transfers, while cross-platform payments typically traverse bank-account rails. The establishment of NetsUnion Clearing Corporation (NUCC) centralized third-party online clearing and strengthened oversight. At the same time, segmentation between front-end wallets and account-rail infrastructure still creates switching costs for consumers and merchants [40].

Within this setting, the e-CNY is positioned as a neutral public facility that complements rather than displaces private wallets. Consumers’ and merchants’ participation is voluntary, which reduces competitive tension with incumbent providers. This stance has facilitated integration: Alipay and WeChat Pay now support e-CNY, lowering adoption frictions for users and merchants [22,23]. Promotion efforts for the e-CNY are designed to align with prevailing payment habits. In China, QR codes are the standard interface for retail payments. Consumers routinely scan merchant-presented QR codes to pay for retail purchases and household bills, with acceptance extending from supermarkets to government e-payment portals for taxes and fees. In practice, promoting e-CNY often means updating the QR code format so that a single code can route payments to the e-CNY wallet alongside Alipay, WeChat Pay, and UnionPay QuickPass, which reduces fragmentation and switching costs [41,42].

Some observers worry that legal-tender status could be used to mandate acceptance and penalize refusal. Policy documents, however, position e-CNY as an additional option, since the renminbi continues to circulate in other forms. Clear legal-tender rules and targeted enforcement against cash refusals can operate as complementary acceptance regimes, expanding the venues in which a platform-neutral instrument such as e-CNY can circulate [36].

To connect design choices to inclusion outcomes, regulators can monitor a concise set of indicators grounded in e-CNY practice. Measure point-of-sale routing at each QR-code scan, that is, the share of payments directed to the CBDC wallet versus incumbent wallets such as Alipay and WeChat Pay. Record the proportion of cross-platform transactions that settle on CBDC rails rather than bank-account rails. Track how often the e-CNY option is invoked within major payment applications. Quantify the share of transactions completed offline and the rate at which they reconcile successfully after synchronization. Monitor the incidence and adequate level of fees on small-value payments. Finally, compile dispute and redress metrics, including dispute rates, median time to resolution, and user success rates. Taken together, these measures provide an operational dashboard for assessing whether a retail CBDC is accessible, affordable, and reliable, and they identify where targeted design adjustments could deliver additional inclusion gains.

3. User Control in e-CNY: Device-Based Credentials, Access, and Safeguards

CBDCs are commonly distinguished as retail and wholesale. This entry focuses on retail CBDCs because both China and the European Union are pursuing retail designs that align more closely with financial-inclusion objectives for central banks and end users. For retail CBDC, a central obstacle in many developing countries concerns custodianship and safety, which can be framed along two dimensions: where the monetary liability resides and is recorded, and who exercises effective control over the asset, including control of the transfer credentials and authentication materials that move value. In the e-CNY, balances are direct central-bank liabilities recorded on the CBDC ledger, while transfer credentials are generated and stored within secure elements under operator governance [6]. Debate about private-key possession, which is salient in cryptocurrency contexts and featured in bankruptcy disputes such as FTX, has shaped public perceptions of control and ownership of digital assets [43]. Although this heuristic does not map cleanly onto an intermediated CBDC like the e-CNY, concerns about effective user control remain relevant. From an inclusion perspective, many communities value the tangibility and self-control associated with cash, and fully virtual money can dampen adoption; immediate settlement feedback and card-like hardware carriers help mitigate these concerns [44,45].

In practice, the e-CNY operationalizes practical self-custody through device-resident, operator-governed credentials that allow users to transact within defined limits without continuous connectivity while preserving compliance. User-managed cryptographic keys are not merely conceptual; they are permitted and implemented within the current e-CNY design. By combining direct central-bank liability with tangible access options, the e-CNY’s user-control strategy can ease resistance to cashless transition in settings where trust and infrastructure are uneven.

3.1. Inclusion Rationale: User Control, Pricing, and Basic Service Access

Retail CBDCs must be devoid of risk: a direct claim on the central bank shielded from private balance-sheet risk, ensuring customers are not exposed to greater risk than cash [44]. Research on CBDC inclusion reveals three consistent user preferences: immediacy, widespread acceptability, and a storage method that conveys a sense of personal ownership [45]. Card-like carriers and low-friction wallets that do not necessitate constant connectivity implement these desires, especially for vulnerable populations such as elderly people, individuals with disabilities, and non-smartphone users [16].

Pricing is a second cornerstone of inclusion. Transaction fees are a well-documented barrier, and the United Nations’ 2030 Agenda sets a policy benchmark of remittance costs at or below five percent, with a three percent target where feasible [46]. Experience during the pandemic showed that rising merchant and provider fees can push users back toward cash. In China, bank fees are constrained by regulatory guidance [47,48], and the PBOC reports that it does not charge operators or individuals for exchange or redemption. Operators likewise do not charge individuals for these services, while merchant pricing remains market-based within existing rules [6]. Comparative practice underscores the role of pricing and ecosystem integration: the Bahamas requires providers to offer a free basic wallet for the Sand Dollar, whereas Nigeria’s e-Naira permits certain fees and has faced adoption frictions (e.g., [49,50,51,52,53]). Together, these experiences suggest that low, transparent pricing and seamless integration with existing payment habits are critical to sustained CBDC uptake among households and small merchants.

Although central banks issue CBDCs, private intermediaries typically onboard users and operate wallets. Operators should meet baseline standards of non-discrimination and basic service expected of financial services providers [44,54]. In China, the Measures for the Administration of Electronic Banking specify requirements for digital services, including risk management, internal controls, and infrastructure readiness, and these requirements apply to e-CNY operations [55]. More broadly, inclusion can be framed as a mandatory duty for operators. Regulators can codify this through guidance on accessibility, inclusiveness, and redress, backed by licensing conditions that embed inclusion commitments and enable enforcement through audits, penalties, or the revocation of eligibility where necessary [50,52].

3.2. Hardware/Offline Operation, Insolvency Segregation, and User Safety

At the technical layer, the e-CNY is engineered for inclusive access and operational resilience. It supports secure-element devices such as wearables and SIM cards, and it accommodates IC or NFC prepaid cards alongside dual-offline functionality for low-value transfers. These features lower entry barriers and preserve transaction continuity when either party is temporarily offline [6]. International guidance indicates that combining device-resident value with short-range transfer can maintain availability under limited connectivity or power, provided that policy controls are in place, including low-value caps, expiry windows, and retry limits [16]. User-centered research further shows that card-like interactions reduce learning costs and behavioral frictions, particularly for late adopters and other vulnerable groups [45].

From an institutional perspective, the e-CNY is a direct liability of the central bank, recorded on the CBDC ledger rather than a deposit at a commercial bank. Accordingly, end-user balances should be insulated from an authorized operator’s insolvency estate, since CBDC holdings are not assets of intermediaries [6]. China’s Enterprise Bankruptcy Law provides the general framework for avoidance and clawback of debtor-owned assets. Still, CBDC-specific rules on settlement finality and asset segregation would benefit from more explicit statutory articulation. By contrast, the European Union’s Settlement Finality Directive establishes express safe harbors for designated systems (e.g., [56,57,58]).

CBDC implementation should not introduce additional consumer risk; protections should be at least as strong as those that govern e-money and payment accounts [53,54]. The main operational dangers resemble those in card systems, including loss or theft of devices and compromise of credentials. These risks can be mitigated through PIN- or biometric-based authentication, differentiated per-transaction and balance limits, prompt blocking of lost credentials or devices with remote deactivation, and clear, accessible channels for reporting issues and obtaining assistance. In China, Internet Courts and online dispute-resolution platforms offer easy ways to settle small digital disputes, which work alongside wallet-side protections and operator compliance programs.

3.3. Governance Outlook: Access Conditions and Enforcement

China’s existing payment-services framework, which includes the Commercial Bank Law, the PBOC Law, and the Measures for the Administration of Electronic Banking [55], provides a legal basis for applying baseline safeguards to CBDC operations. The PBOC has authorized multiple operators to distribute the e-CNY, but a comprehensive and permanent regulation that codifies inclusion requirements has not yet been finalized. In the interim, regulators can rely on the current framework while forthcoming legislation further specifies responsibilities for accessibility benchmarks, inclusion-metrics reporting, pricing posture, privacy protections, and offline-risk limits [6,54].

Access regulation should both screen out unqualified providers and guarantee a minimum service bundle at reasonable prices. Comparative models are instructive: the Bahamas mandates a free basic-wallet offering and periodic disclosures, and uses tiered pricing and limits to match heterogeneous user needs; Indonesia’s Project Garuda explores a hybrid of one-tier and two-tier distribution to align resilience with inclusion [49,50,59]. For China, a comparable approach would require operators to provide both software and hardware wallets to all residents, make wallet opening and core functions free of charge, maintain zero fees for individuals, and cap merchant costs within the bounds of current bank card fee guidance [6,47,48].

Enforcement should address both conduct obligations and system-level duties. Conduct obligations include transparent pricing with no hidden costs and nondiscriminatory onboarding. System-level duties include operational resilience, timely remediation and redress, and regular reporting. Comparative practice provides useful templates: the Bahamas’ CBDC framework authorizes fines and the suspension or revocation of eligibility for violations, a deterrent that could be adapted to the e-CNY to reduce access barriers. Global design playbooks likewise recommend embedding inclusion commitments into licensing and supervisory regimes so that provider incentives align with public policy objectives and the responsible use of public resources [50,52,53].

4. Operationalizing Settlement: SUP and Offline Capability

This section examines how design choices shape inclusion outcomes in retail CBDCs. It first defines and operationalizes settlement upon payment (SUP), understood as the simultaneous authorization and ledger update on a continuously active CBDC infrastructure, which delivers immediate finality. It then considers how integration with some third-party payment platforms like WeChat Pay and Alipay can lower search and switching costs at scale by meeting users within their familiar payment flows. Finally, it assesses how offline-capable modalities, including device-resident wallets and short-range transfers, preserve availability when weak connectivity or power is limited.

4.1. SUP at the Point of Sale: Wallet-to-Wallet Flows, Integration, and Offline Transfers

Settlement upon payment (SUP) refers to a wallet-to-wallet flow on CBDC rails in which authorization and ledger posting occur simultaneously on a continuously available infrastructure. Such flows give the payee near-immediate access to funds and avoid multi-hop routing through bank and real-time gross settlement (RTGS) systems. Household surveys highlight cash-like attributes that users value, including spending transparency, broad acceptance, and speed. A retail CBDC intended as a point-of-sale substitute should therefore deliver simultaneous debit and credit with 24/7 availability [44,60,61]. In China’s pilots, the e-CNY uses SUP for wallet-to-wallet transfers, whereas payments that originate from or terminate in bank accounts re-enter RTGS and incur additional latency. Accordingly, wallet penetration on both sides of a transaction and end-to-end latency are key operational indicators of cash-substitution performance [6,53].

Authorities and operators use an “embed-in-existing-apps” approach to minimize switching costs and scale adoption. In practice, e-CNY appears as a payment option inside familiar third-party platforms such as WeChat Pay and Alipay ecosystem, so users keep the same checkout screens while settlement occurs on CBDC rails. This design enables settlement upon payment (SUP) within current consumer journeys instead of forcing a move to a new channel [22,23]. To reduce merchant integration costs and encourage platform-neutral uptake, the approach is paired with domestic interoperability measures, especially standardized QR codes [25].

For analytic clarity, an offline retail CBDC is a transfer of value between two devices when neither the payer nor the payee has an internet or network connection [16,62]. When properly implemented, offline capability enhances operational resilience during outages, enables emergency disbursements, and extends access in areas with intermittent connectivity [16,63]. Two common architectural patterns are device-resident stored value in a secure element (for example, SIM or NFC/SE wallets) and deferred-posting schemes; each entails distinct controls for fraud prevention and double-spending [16,64]. China’s pilots illustrate a hardware-first approach: SIM or secure-element wallets support tap-to-pay and “no network/no power” features on some Android devices, allowing transactions even when the handset is powered off, with later synchronization to the primary ledger. Card-like carriers such as IC or NFC cards, SIMs, and wearables reduce learning costs for seniors and late adopters and align with barcode and QR standards for interoperable point-of-sale acceptance [6,25,65]. For evaluating resilience under bounded risk, useful operational metrics include demonstrated user benefits, the share of transactions conducted offline by value band, and reconciliation latency.

In most cases, a CBDC does not require a bespoke legal regime for transaction reversals. Baseline rules for fraud, mistake, duress, and related harms are already supplied by private and criminal law, so special legislation is not automatically necessary to allocate losses or provide remedies [66,67]. Governments can, however, complement general law with operational requirements and liability frameworks tailored to the specific risks of offline use. Consistent with the Bank of England’s technical work and the BIS Project Polaris guidance, key offline design choices are ultimately policy choices rather than purely technical matters. They include caps on balance and trade frequency, upfront risk allocation between users and providers, and clear dispute-resolution arrangements. These choices should be specified in advance to align incentives and protect consumers [16,64].

4.2. Finality Across Online and Offline Pathways

In online flows, an authorized operator carries out the payer’s instruction by debiting the payer’s e-CNY wallet and crediting the payee’s wallet on the CBDC system. Because value transfer and ledger posting occur within the same infrastructure, technical finality and debtor discharge typically coincide, which delivers near-instant settlement [44,61]. The mechanism is a direct wallet-to-wallet transfer with minimal intermediation, so it avoids the multi-step routing common in real-time gross settlement systems where infrastructure faults or network congestion can introduce delay. According to the PBOC, the e-CNY platform operates continuously and can process about 10,000 transactions per second, which supports low latency under heavy load [31]. Legally, the operator acts as a technical agent that executes the transfer on behalf of the parties rather than as the owner of the value; in civil-law terms, the role is analogous to a “possession servant” (Besitzdiener in German law; cf. the Dutch concept of houder).

To situate offline finality, it helps to outline the online transaction flow first. In the e-CNY system, payments are executed as direct wallet-to-wallet transfers on CBDC rails, which reduces intermediation relative to conventional account-to-account CNY payments and accelerates settlement. The payer authorizes a transfer to the payee’s wallet identifier; an authorized operator validates the instruction and posts the debit and credit to the primary CBDC ledger. Because authorization and ledger posting occur within the same infrastructure, technical finality and debtor discharge are effectively simultaneous. Once the entry is recorded, the recipient can use the funds immediately. In practice, the exchange of signed transfer messages and the corresponding ledger update occur nearly at the same time on the standard online e-CNY platform, providing a reference point for evaluating offline finality.

“Single-party offline” denotes transactions in which either the payer or the payee lacks connectivity while the counterparty remains online. The e-CNY builds on mature technologies for such scenarios [25,65]. Earlier implementations relied on point-of-sale terminals and prepaid IC-card applications; more recently, QR codes and near-field communication (NFC) have enabled payment completion despite intermittent connectivity. The e-CNY supports QR-code payments, IC/NFC prepaid cards, and NFC tap-to-pay in single-party offline settings, and it extends this toolkit with secure-element methods such as SIM-based wallets that can authorize small-value transfers even when a handset is out of power, followed by synchronization once connectivity resumes. These designs lower barriers for users with unreliable access and are particularly helpful for older adults and other at-risk groups, thereby narrowing the digital divide.

Single-party offline e-CNY transactions closely resemble familiar digital-payment flows, so the legal analysis can follow existing practice. Take the “display-to-pay” pattern. If one party lacks connectivity, that party presents a wallet QR code. The counterparty scans the code, the operator validates the request, and the system debits the payer’s wallet and credits the recipient. CBDC technology can create the same user experience, including with NFC-enabled devices and e-CNY apps that allow transactions even when the payer is temporarily offline.

The transfer consists of signed payment messages that the authorized operator verifies and posts to the primary CBDC ledger. Wallet balances update accordingly, either in real time or, if connectivity is intermittent, after brief synchronization. As in mainstream Chinese private-law practice, discharge of the payer’s obligation is tied to effective transfer initiation and operator authorization, not to the recipient’s subsequent use of funds. If a post-transaction failure prevents ledger posting or credit to the recipient, standard reversal and redress processes apply under the applicable consumer-protection and payment rules.

Single-party offline e-CNY transactions closely mirror established digital-payment flows so that the legal analysis can track existing practice. Consider the “display-to-pay” pattern: when one party lacks connectivity, it presents a wallet QR code; the counterparty scans it, the authorized operator validates the request, and the system debits the payer’s wallet and credits the recipient [25]. The same flow can run on CBDC rails through e-CNY apps and NFC-enabled devices that permit completion without live internet access. Operationally, value moves via signed transfer messages that the operator verifies and then posts to the primary CBDC ledger, with wallet balances updating in real time or after brief synchronization. In line with Chinese private-law practice, discharge of the payer’s obligation attaches to valid initiation and operator authorization of the transfer rather than the recipient’s subsequent use of funds. If a post-transaction failure later prevents posting or credit to the recipient, standard reversal and redress procedures apply under the relevant consumer-protection and payments rules; the payer is not required to pay a second time.

A key design feature of the e-CNY is support for offline transactions, which reduces reliance on connectivity in settings such as parking, public transport, and disaster response [6]. In practice, offline use is available only on devices that support contactless payments via NFC or IC cards, since the mechanism depends on short-range communication and secure-element hardware. Settlement finality differs by mode. In single-party offline transactions, the connected counterparty can synchronize the transfer with the primary CBDC ledger to confirm finality soon after the exchange. In dual-party offline transactions, both parties are disconnected, and posting is deferred until reconnection, which means finality remains provisional until the ledger is updated. PBOC publications to date do not fully specify how settlement upon payment functions when both transacting parties are offline. To assess offline finality for e-CNY, it is useful to distinguish three stylized designs and then evaluate each against settlement upon payment (SUP) and general private-law principles.

Scenario A: device-crediting with credit pending synchronization.

The payer initiates a transfer, and the recipient’s device records a credit, but the amount is embargoed until the operator can synchronize the record with the primary CBDC ledger. During the outage, the payee cannot re-spend the credited amount; once connectivity is restored, posting occurs, and the embargo is lifted. Many transit and fare-collection systems globally employ analogous “tap now, sync later” patterns. Under widely used contract principles, such as PICC art. 6.1.8(2), a debtor’s obligation is discharged when payment is remitted to the creditor’s financial institution [68]. By analogy, once the payer’s instruction is validly accepted by the authorized e-CNY operator and the credit is provisioned to the payee’s wallet (even if embargoed), the payer has performed; later synchronization affects the payee’s availability of funds, not the debtor’s discharge. Two policy reasons support this allocation: first, tying discharge to the recipient’s immediate use would give the recipient’s operator undue control over completion; second, external freezes for fraud, AML, or sanctions would otherwise shift risks back to the payer. Scenario A is therefore consistent with SUP: authorization and posting occur within the CBDC system, and the payer’s discharge is contemporaneous with the accepted instruction, subject to later ledger sync for the payee’s use.

Scenario B: freeze until sync.

Upon initiation, the “value record” is frozen on the payer side, and no credit is provisioned to the payee until synchronization. All related functions are locked and only unlock after the ledger posts. PBOC patent filings have described this pattern [69]. Because neither party receives an effective, usable credit until posting, debtor discharge does not coincide with the payment instruction. Finality is deferred to synchronization, so this design does not deliver SUP.

Scenario C: free spend until sync.

The payer initiates an offline transfer, and the payee receives an immediate, spendable credit, with no embargo, before synchronization. While operationally convenient, this creates unbounded double-spend risk and makes legal finality contingent on later reconciliation. As with Scenario B, ledger posting is determinative, so discharge does not occur at initiation. This design is therefore inconsistent with SUP. Mainstream view holds that quantitative risk controls, including per-transaction, daily, and cumulative caps and defined time windows, should be paired with explicit liability and redress rules calibrated to offline limits [16,64]. Doctrinally, Scenario A aligns most closely with the meaning of settlement upon payment at the point of debtor discharge, although it may not always match the payee’s perception of immediate spendability. By contrast, Scenarios B and C defer finality or permit pre-synchronization spending and therefore require ex ante allocation of risk and liability.

4.3. Double-Spending Risk: Layered Technical and Legal Controls

Double-spending occurs when the same unit of value is spent more than once. The risk is most salient in dual-offline situations, where neither party connects and the recipient may worry that the value credited locally still resides with the payer until synchronization, which can dampen adoption and constrain promotion. The key question is whether offline functionality in a CBDC necessarily creates widespread double-spending. In practice, two generic failure modes underpin such risk: data tampering and delayed or replayed transactions that either inflate balances or prevent debits from taking effect. These vulnerabilities are not unique to CBDCs; long-standing physical-carrier systems such as transit IC cards face similar exposure because transactions are often completed without live connectivity [16,53]. When evaluated against the three offline designs, Scenario A (device credit with provisional availability) and Scenario B (freeze until sync) significantly limit exposure [16]. In Scenario A, the payer’s first transfer becomes binding and cannot be re-sent, while in Scenario B, the value is locked at the time of initiation. By contrast, Scenario C (free spend until sync) permits spending before ledger posting and can allow outlays that exceed the payer’s balance. For illustration, a payer with 200 e-CNY cannot reuse those funds after completing the first payment in Scenario A. In contrast, the absence of controls in Scenario C can enable multiple expenditures before reconciliation. Accordingly, if a jurisdiction avoids Scenario C and implements standard synchronization, double-spending can be precluded by design rather than being an inherent consequence of offline access.

Designing an offline CBDC under Scenario C requires a comprehensive countermeasure framework to contain double-spending risk. A mainstream approach combines private-law and public-law tools. On the private-law side, discharge attaches to valid receipt: once the recipient acquires the CBDC value, the payer’s obligation to that recipient is satisfied, with any conflicting transfers during the offline window addressed through restitution and contractual remedies against the payer, and through operator terms that authorize reversal after reconciliation. On the public-law side, authorities set quantitative tolerances that bound exposure, including per-transaction, daily, and cumulative caps, time-window validity, frequency limits, per-device counters, and context restrictions. In practice, e-CNY pilots already curb dual-offline use; reports on the NFC-SIM internal beta note a validity window of up to 24 h and a cap of about ten dual-offline payments before resynchronization. Comparative regimes such as the Bahamas’ Sand Dollar codify tiered limits, disclosure, and supervisory powers and are often cited in retail–CBDC offline policy [49,50]. BIS Project Polaris and central-bank experiments likewise recommend calibrated caps and clear redress pathways [16,64]. These constraints are consistent with a retail focus on small-value payments and can be targeted to contexts where one party is effectively risk-neutral, for example, public transport or utilities. Limiting dual-offline availability to such settings helps distribute losses across many low-value transactions, contain severity, and preserve inclusion benefits.

5. Conclusions and Prospects

China’s e-CNY shows how retail CBDC architecture and governance can turn point-to-point settlement into meaningful financial inclusion. China’s two-tier hybrid system, with tiered KYC requirements, illustrates how regulators can fulfill inclusion commitments through technical and legal measures. These measures include device-based hardware and offline options, small-value, low-friction pricing, and integration with leading payment interfaces, and they should be treated as public goods. This architecture improves access, affordability, and reliability by lowering onboarding thresholds, disciplining fees, and maintaining continuity under weak connectivity. Drawing from e-CNY’s implementation, we can conclude that CBDC operating licenses should mandate universal access to basic software and hardware wallets, establish transparent and capped merchant pricing, and define clear integration pathways with existing financial infrastructure at both technological and regulatory levels. Additionally, CBDC-related data governance should support inclusion goals by balancing small-value anonymity with high-value traceability.

To avoid disrupting existing financial systems, jurisdictions may issue CBDCs with a narrow initial scope, for example, by launching a retail instrument structured as a digital form of M0. Framing CBDC as part of M0 mitigates intermediation risk, although deposit competition and market structure still matter. Inclusion benefits are most likely to materialize where on-ledger wallet-to-wallet settlement is genuine, acceptance infrastructure is unified and widely deployed, and seniors, individuals with disabilities, and low-connectivity communities have access to hardware and offline options.

These expectations yield three testable predictions. First, unified acceptance and third-party payment platform integration should increase wallet-to-wallet transaction shares and merchant coverage for low-value payments. Second, prudently capped device-based offline transfers should disproportionately benefit seniors and low-connectivity neighborhoods. Third, zero-price basic services should reduce cash reversion during fee shock events.

Two crucial qualifications remain. First, the argument is conceptual and institutional rather than welfare complete, so full validation requires microdata on households, small firms, merchants, and substitution patterns. Second, the political economy of platform integration merits closer examination, including competition neutrality, lock-in effects, and incentives at the interface between the state and large platforms. In conclusion, retail CBDCs advance financial inclusion when the following conditions are met: credible settlement upon payment, domestic interoperability at the point of sale, and device-based user control with offline availability. These features must be appropriately priced and governed for small-value transactions. Institutional design and enforcement are as critical as the underlying technology.