Central banks should design CBDC to preserve the core functions of cash while limiting deposit substitution. That means keeping it usable for everyday payments, ensuring it can work offline, and using safeguards such as no interest or holding limits if needed. The goal is to prevent large-scale disintermediation of bank deposits, which would reduce lending capacity and make credit more expensive.
Why cash-like CBDC needs payment utility without becoming a deposit substitute
The design tension is straightforward: if CBDC feels too different from cash, people will not use it for everyday payments; if it feels too much like a bank deposit, it can pull balances out of commercial banks. Central banks therefore need to optimise for transactional usefulness, not for store-of-value competition. That means stable value, simple payment access, and a design that does not reward large-scale balance migration.
A practical design starts with the payment role. Cash-like CBDC should be easy to use for small purchases, peer-to-peer transfers, and routine retail payments, because that is where the cash analogy matters most. If the instrument is built mainly as a high-yield holding asset or a broad savings product, it stops behaving like cash and starts competing directly with bank funding.
Offline functionality matters because cash is resilient when connectivity fails, but the offline feature must be bounded and operationally controlled. In practice, the cash-like benefit comes from availability in everyday conditions, while the banking-risk problem comes from unlimited, always-on conversion between bank deposits and CBDC. A usable design keeps the payment function strong while making wholesale substitution unattractive or frictional.
How design choices affect commercial bank lending capacity
Commercial bank lending depends heavily on stable deposit funding. If CBDC absorbs large volumes of retail deposits, banks may need to replace that funding with more expensive sources, which can tighten credit conditions and raise loan pricing. The policy objective is not to eliminate competition, but to avoid a design that triggers rapid disintermediation under normal use, stress, or crisis conditions.
Holding limits and non-interest-bearing balances are the usual stabilisers because they reduce the incentive to move savings out of bank accounts at scale. A tiered remuneration structure can also help, but only if it preserves cash-like utility for small balances while making larger holdings less attractive. The central bank should test the design against both normal adoption and flight-to-safety scenarios, because the lending impact is often largest when users seek a safer parking place for funds.
Interoperability is another material issue. If CBDC is too easy to sweep between bank accounts and central bank money, it can amplify deposit volatility. If it is too restricted, adoption suffers. The correct balance is to make routine spending simple while keeping large-scale portfolio reallocation from becoming the default behavior.
What central banks should prioritise in the design trade-off
Central banks should start from the use case, then set controls around the balance sheet effect. The core question is not whether CBDC can mimic every feature of cash or every convenience of a bank account, but which features are necessary to support payment inclusion, resilience, and public confidence without creating an attractive new funding alternative to deposits.
That trade-off is easiest to manage when the CBDC proposition is narrow and clearly communicated. Users should understand it as a payment instrument, not a savings product. Commercial banks should also know the boundary conditions early, because uncertainty about future CBDC generosity can itself change deposit behaviour before launch.
The most effective design choices are usually the least dramatic ones: preserve retail payment usefulness, limit large balances, avoid interest unless there is a compelling policy reason, and keep the operational model simple enough to be credible at scale. Those controls work best when they are set before launch, not added after adoption patterns have already shifted.
Risk and Threat Considerations
If CBDC is designed to look and behave like a superior bank deposit, users may move funds quickly during stress or even in normal market conditions. That creates a funding shock for banks, which can transmit into tighter lending, higher credit costs, and greater reliance on emergency liquidity support. The risk is not only a sudden run scenario, but also a slow structural drain on deposit franchises.
Failure mechanism: Unbounded convertibility, interest-bearing balances, or weak holding constraints make CBDC a more attractive place to store value than commercial bank deposits, so retail money migrates out of the banking system.
Impact: Banks lose a stable funding source, lending capacity weakens, and the cost of credit can rise for households and businesses, especially under stress.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | CBDC design must balance payment utility against bank-funding risk. |
| Recommendation — Define CBDC limits to reduce deposit substitution and preserve credit supply. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Holding limits and constrained functionality reflect least-necessary exposure of central bank money. |
| SC-7 — Boundary Protection | CBDC must control conversion and access pathways that could amplify balance migration. | |
| Recommendation — Restrict CBDC features to the minimum needed for retail payments. Constrain transfer pathways that could trigger rapid deposit flight. | ||
| ISO/IEC 27001:2022 | A.5.30 — ICT readiness for business continuity | Offline and resilient payment operation is central to cash-like CBDC design. |
| Recommendation — Build offline-capable CBDC operations that remain usable during outages. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | CBDC policy controls such as limits and remuneration tiers are configuration choices that shape risk. |
| Recommendation — Set CBDC defaults to preserve payment use while limiting large-value accumulation. | ||
Practitioner Guidance
What to verify: Test the CBDC design against three separate questions: whether it still works like cash for ordinary payments, whether it remains unattractive as a large-scale store of value, and whether conversion rules would behave safely in a stress event. A design that passes only the first test is not enough.
Decision rule: If the CBDC would be usable for payments but could also become a convenient migration point for deposits, apply friction such as holding caps, tiered remuneration, or other balance controls before launch. If those controls would undermine the payment use case, narrow the scope rather than widening the balance sheet risk.
Practitioner takeaway: The right CBDC design preserves payment utility first and treats deposit substitution as the primary systemic constraint, because once the instrument competes too directly with bank funding, the lending impact becomes a structural policy problem rather than an implementation detail.
Related resources from NHI Mgmt Group
- What happens when banks use AI in lending and underwriting without proper guardrails?
- How should banks use AI and automation to improve SME lending without increasing operational risk?
- How should banks and fintech teams use bank-as-a-service partnerships without losing control of compliance and customer risk?
- How should security teams use IAST and RASP in NHI governance?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org