Direct vs Indirect CBDC Models: How Central Banks Distribute Digital Currency

Direct vs Indirect CBDC Models define one of the most important design choices in central bank digital currency: should the central bank serve every retail user directly, or should banks and payment firms distribute digital money through a two-tier system? The answer shapes privacy, bank funding, resilience, compliance, and how quickly a CBDC can move from pilot to production. If you want the broader design and policy context behind this choice, the Certified Central Bank Digital Currency (CBDC) Expert program is a reasonable place to start.

Retail CBDC is digital central bank money available to households and businesses. That makes it different from wholesale CBDC, which is built mainly for settlement among banks and financial institutions. The distribution model decides who holds the customer relationship, who runs the ledger, and where the legal claim sits.

What Are Direct vs Indirect CBDC Models?

CBDC architecture is not just a technical diagram. It is a decision about institutional responsibility. The Bank for International Settlements, Payments Canada, the World Bank, and the ITU Digital Currency Global Initiative all frame CBDC distribution around single-tier and multi-tier models.

Direct CBDC model

In a direct CBDC model, the central bank issues CBDC and manages retail accounts or wallets for the public. Every user holds a direct claim on the central bank, similar in legal quality to cash. The central bank also operates the core retail ledger and processes payments.

Private firms may still provide wallet apps or front-end services, but the central bank remains the main account operator. Think of it as a national payment wallet where the central bank controls the balance sheet and the core payment rails.

Indirect CBDC model

In an indirect CBDC model, commercial banks, payment service providers, or licensed intermediaries serve end users. The central bank maintains wholesale accounts for those intermediaries, while the intermediaries maintain retail ledgers and customer wallets.

Here, the user usually has a claim on the intermediary, and that liability is fully backed by central bank money. This keeps the structure close to existing banking, where the central bank deals with regulated institutions and those institutions deal with the public.

How a Direct CBDC Works

Since this architecture question increasingly overlaps with tokenized deposits and other digital asset design choices, it is worth pairing this reading with a Certified Digital Assets Expert credential to cover that adjacent ground.

A direct CBDC is the cleanest model on paper. The central bank issues the digital currency, opens accounts or wallets for citizens and businesses, updates balances, and settles transactions in real time or near real time.

The main features are:

• Legal claim: Users hold a direct claim on the central bank.

• Ledger control: The central bank runs the retail ledger.

• Payments: The central bank processes transfers between end users.

• Intermediary role: Banks and fintech firms may provide apps, but not the core ledger.

This model gives the central bank maximum control. It can define settlement rules, apply limits, set remuneration, and preserve access to risk-free public money in a digital economy.

Benefits of a direct CBDC

• Safety of money: A direct claim on the central bank removes commercial bank credit risk for CBDC balances.

• Policy control: Interest, holding limits, tiered remuneration, and emergency transfers can be applied without routing through banks.

• System clarity: One operator means fewer parties in the core settlement chain.

• Crisis utility: In a banking stress event, the central bank could deliver payments directly to the public.

That sounds attractive. Still, direct CBDC is the hardest model to operate at national scale.

Risks of a direct CBDC

The first problem is operational. Central banks are built for monetary policy, reserves, settlement systems, supervision, and financial stability. They are not usually built to run call centers for forgotten passwords, disputed merchant payments, wallet recovery, phishing complaints, or retail onboarding.

Anyone who has worked on payment ledgers knows the ugly details arrive fast. A timeout at the wallet layer can cause a client to retry the same payment instruction. If the ledger does not enforce an idempotency key, the transfer may post twice. That is not a theoretical issue. It is one of the first bugs you test for in any real payment sandbox.

Then comes privacy. The European Data Protection Supervisor has warned that direct architectures can concentrate detailed payment data at the central bank. Even if a democratic central bank has no intent to surveil users, the design can create a tempting database for future governments, law enforcement overreach, or attackers.

There is also the banking impact. If users can move large deposits into risk-free CBDC instantly, banks may lose a stable funding base. That can affect lending, liquidity management, and financial stability. Holding limits can reduce the risk, but they add design complexity.

How an Indirect CBDC Works

An indirect CBDC keeps the familiar two-tier model. The central bank issues and settles at the wholesale layer. Regulated intermediaries distribute CBDC or CBDC-backed balances to the public.

The setup usually looks like this:

• Central bank layer: Issues CBDC or reserve-backed settlement balances to intermediaries.

• Intermediary layer: Handles wallets, onboarding, KYC, AML checks, user support, and transaction interfaces.

• Retail user layer: Individuals and firms transact through banks, fintech apps, or payment providers.

Payments Canada describes this as a model where intermediaries run the retail ledger while the central bank maintains a wholesale ledger. The ITU reference architecture also distinguishes multi-tier models where intermediaries perform core lifecycle functions for general-purpose CBDC.

Benefits of an indirect CBDC

• Scalability: Banks and payment providers already handle millions of retail customers.

• Continuity: The model preserves the role of commercial banks in financial intermediation.

• Privacy by design: The central bank does not need to see every retail transaction.

• Competition: Different providers can compete on wallet design, merchant tools, analytics, and accessibility.

• Compliance fit: KYC, AML, fraud monitoring, and customer due diligence stay with regulated entities that already perform them.

For large economies, this is the practical choice. To be blunt, a pure direct CBDC may be elegant in a policy paper, but an indirect CBDC is much closer to how national payment systems actually work.

Risks of an indirect CBDC

The weakness is that users depend on intermediaries. If a wallet provider fails, mishandles funds, or suffers a cyberattack, users can face disruption. Full backing with central bank money helps, but legal segregation, supervision, operational resilience, and recovery planning still matter.

Another issue is fragmentation. If each bank or payment provider builds its own wallet standard, payments can become messy. Interoperability has to be specified early. This includes message formats, identity checks, offline payment rules, fraud reporting, and settlement finality. ISO 20022 messaging may help at the payment layer, but it does not solve wallet governance by itself.

Hybrid CBDC: The Middle Path

A hybrid CBDC combines both models. Intermediaries manage customers and process most payments, while the central bank maintains a backup record of balances or has a clear legal and technical path to step in if an intermediary fails.

This model tries to answer a hard question: how do you keep private-sector distribution without letting a failed intermediary break public confidence in CBDC? Building and maintaining that kind of backup ledger and failover capability is a serious systems challenge, which is why architects working on hybrid designs often round out their skills with a general Tech Certification, since the underlying infrastructure and resilience knowledge applies well beyond any single CBDC project.

Hybrid architecture can support:

• Payment continuity if a provider exits the market.

• Limited central bank visibility into balances without full transaction surveillance.

• Clearer recovery procedures during outages.

• A stronger public guarantee than a fully indirect model.

Many current policy discussions lean toward indirect or hybrid CBDC because they preserve the two-tier banking system while giving the central bank more control than ordinary private payment instruments.

Synthetic CBDC and Stablecoin Links

Synthetic CBDC is often discussed alongside indirect models, but it is not always treated as true CBDC. In this setup, a private issuer offers a stablecoin or payment token fully backed by central bank reserves or similar high-quality assets. Users hold a claim on the issuer, not directly on the central bank.

This can support private innovation while anchoring value in central bank money. It also raises familiar stablecoin questions: who supervises the issuer, where are reserves held, how are customer assets segregated, and what happens during redemption stress?

As stablecoin regulation matures, synthetic CBDC may become an important bridge between private digital money and public money. But it should not be confused with a direct retail CBDC.

Direct vs Indirect CBDC Models: Side-by-Side Comparison

What Are Central Banks Choosing?

The direction is clear. Most major retail CBDC work favors indirect or hybrid distribution. The euro area, the United Kingdom, India, and Canada have all explored models where private intermediaries play a meaningful front-end role. BIS research also notes that CBDC design choices are being shaped by financial stability, payment resilience, and the need to preserve the two-tier system.

Direct CBDC remains useful as a reference design. It may suit smaller jurisdictions, narrow public payment use cases, emergency disbursement systems, or environments with weak payment infrastructure. For a large advanced economy, though, the operational and political cost is hard to justify.

Privacy, Cross-Border Access, and Future Design

Privacy will decide much of the architecture. A CBDC that gives the state full retail transaction visibility will face public resistance, even if the technology works. Indirect and hybrid CBDC models allow stronger data minimization because intermediaries can perform compliance checks without sending every detail to the central bank.

Cross-border CBDC adds another layer. Foreign users or foreign payment providers may access CBDC directly, or they may be routed through domestic intermediaries. BIS and IMF work on cross-border CBDC points to the same trade-off seen domestically: direct access can improve reach, while indirect access helps manage compliance, foreign exchange, and jurisdictional risk.

Programmability matters too. Conditional payments, wallet limits, merchant restrictions, and offline transactions all depend on who controls execution rules. If you are designing CBDC systems, keep policy logic separate from wallet interface code. Hard-coding policy into client apps is a mistake you will regret at the first rule change.

Which CBDC Model Is the Better Choice?

For most central banks, indirect or hybrid CBDC is the better default. It fits existing financial infrastructure, protects the role of banks, reduces central bank operational load, and leaves more room for privacy-preserving design.

Direct CBDC is not useless. It offers the strongest public-money claim and the clearest central bank control. But it turns the central bank into a retail payments operator, with all the support, cybersecurity, privacy, and political risks that come with that job.

If you work in policy, payments, or digital assets, build your CBDC knowledge around architecture, legal claims, ledger design, interoperability, and privacy engineering. For structured learning, look at Blockchain Council's Certified Blockchain Expert™, Certified Blockchain Developer™, and Certified Cryptocurrency Expert™ programs. Then map one CBDC use case yourself: define the claim, choose the ledger model, set privacy boundaries, and test what happens when an intermediary fails. And if your role also involves explaining these architecture trade-offs to the public or to non-technical stakeholders, a Marketing Certification is worth adding to that toolkit, since public trust in any CBDC model depends as much on clear communication as it does on sound design.

FAQs

1. What are direct and indirect CBDC models?

Direct and indirect CBDC models describe different ways a central bank digital currency (CBDC) can be issued, distributed, and administered.

In a direct CBDC model, the central bank has a direct operational relationship with end users and maintains the core records of their CBDC holdings or transactions.

In an indirect or intermediated model, private institutions such as commercial banks and payment service providers handle much of the customer-facing activity while the central bank remains responsible for the underlying central bank money.

The distinction is basically about who does what between the central bank and the person trying to buy groceries with digital money.

2. What is a direct CBDC model?

Under a direct CBDC architecture, the central bank assumes a substantial role in providing CBDC services directly to individuals and businesses.

Depending on the design, the central bank could be responsible for:

• Maintaining CBDC accounts or balances

• Processing transactions

• Managing the core ledger

• Providing payment infrastructure

• Handling aspects of customer administration

This creates a relatively direct relationship between the public and the central bank.

3. How would a direct CBDC transaction work?

A simplified transaction could look like:

Consumer → Central Bank CBDC System → Merchant

Suppose Alice pays Bob 50 units of CBDC.

The central bank's system verifies the transaction and updates the relevant CBDC records:

Alice: −50

Bob: +50

The central bank therefore plays the central operational role rather than relying primarily on commercial banks to maintain customer-level CBDC records.

4. What are the advantages of a direct CBDC?

Potential advantages include:

• Clear central-bank responsibility

• Direct settlement in central bank money

• Reduced dependence on private intermediaries

• Potentially standardized payment services

• Strong central oversight of the system

• Potentially straightforward implementation of certain policy requirements

A direct model could also ensure that users have direct access to a public form of digital money.

5. What are the disadvantages of a direct CBDC?

A direct model could place enormous operational responsibilities on the central bank.

The central bank might need infrastructure capable of supporting:

• Millions of users

• High transaction volumes

• Customer authentication

• Fraud detection

• Cybersecurity

• Account or wallet recovery

• Customer support

• Compliance processes

• Continuous availability

Central banks are very good at monetary policy. Running something resembling a nationwide retail payments platform is a rather different hobby.

6. What is an indirect CBDC model?

In an indirect or intermediated architecture, the central bank relies on regulated private-sector intermediaries to provide many CBDC services to users.

These intermediaries could include:

• Commercial banks

• Payment institutions

• Fintech companies

• Licensed wallet providers

• Other regulated payment service providers

Users interact primarily with these institutions rather than directly with the central bank.

7. How would an indirect CBDC transaction work?

A simplified architecture might look like:

Consumer → Wallet Provider/Bank → CBDC Infrastructure → Merchant Provider → Merchant

The private intermediaries manage customer-facing services, while settlement ultimately involves central bank money according to the particular CBDC design.

The precise allocation of ledger, settlement, and verification responsibilities varies considerably between proposed systems.

8. What responsibilities could intermediaries have?

Depending on the CBDC architecture, intermediaries might handle:

• Customer onboarding

• Know Your Customer (KYC) checks

• Wallet applications

• Payment initiation

• Authentication

• Transaction screening

• Fraud monitoring

• Customer support

• Wallet recovery

• Compliance reporting

This allows existing financial institutions to reuse infrastructure and expertise already developed for digital payments.

9. What is a two-tier CBDC model?

A two-tier CBDC model divides responsibilities between the central bank and private intermediaries.

Conceptually:

Tier 1: Central Bank

Issues CBDC and operates or oversees critical monetary and settlement infrastructure.

Tier 2: Banks and Payment Providers

Distribute CBDC and provide customer-facing services.

Many CBDC discussions favor some form of two-tier or intermediated architecture because it preserves a role for existing financial institutions.

10. Is an indirect CBDC the same as commercial bank money?

No.

Commercial bank deposits are generally liabilities of commercial banks.

CBDC is intended to represent a liability of the central bank, even when private intermediaries distribute or service it.

That distinction is fundamental.

An intermediary handling the wallet does not necessarily mean the money itself becomes that intermediary's liability.

11. What is a hybrid CBDC model?

A hybrid model combines elements of direct and intermediated approaches.

For example, private institutions might manage customer relationships and payments while the central bank maintains authoritative records or provides infrastructure that allows balances to be reconstructed if an intermediary fails.

Hybrid structures attempt to combine:

Central-bank monetary credibility + private-sector operational capacity

Naturally, combining responsibilities also means somebody has to spend considerable time deciding exactly where each responsibility ends.

12. How do direct and indirect CBDCs affect commercial banks?

A direct retail CBDC could create greater competition with commercial banks for customer deposits and payment relationships.

An intermediated CBDC preserves a larger role for banks by allowing them to provide:

• CBDC wallets

• Payment services

• Identity services

• Customer support

• Related financial products

However, either model could affect bank deposits if consumers move substantial funds from bank accounts into CBDC.

13. Could CBDCs cause bank disintermediation?

Potentially.

If consumers view CBDC as safer or more convenient than commercial bank deposits, they might transfer significant balances into CBDC.

That could reduce bank deposit funding and potentially affect lending or funding costs.

Possible design responses include:

• CBDC holding limits

• Tiered remuneration

• Non-interest-bearing retail CBDCs

• Transfer restrictions in particular circumstances

• Intermediated distribution structures

The appropriate safeguards depend on the policy objectives and financial system.

14. Which CBDC model offers better privacy?

Neither architecture automatically guarantees greater privacy.

Privacy depends on design choices including:

• What transaction information is collected

• Who stores personal information

• Whether identity and transaction data are separated

• Access-control rules

• Legal protections

• Data-retention periods

• AML/CFT requirements

• Cryptographic techniques

An intermediated model may allow customer-identifying information to remain primarily with regulated intermediaries, while the central bank receives only the information required for settlement or oversight, depending on the design.

15. Which model is more resilient?

Both have different resilience risks.

A highly centralized direct model could simplify governance but create greater dependence on central infrastructure.

An intermediated model can distribute customer-facing operations across multiple providers, potentially reducing some concentration risks.

However, more participants also create additional interfaces, dependencies, and cybersecurity surfaces.

There is no magical architecture where complexity politely disappears.

16. How does cybersecurity differ between the models?

A direct model concentrates substantial operational responsibility within central-bank systems. Security must therefore address risks such as:

• Infrastructure attacks

• Account compromise

• Denial-of-service attacks

• Insider threats

• Fraud

• Data breaches

An indirect model distributes some risks across intermediaries but introduces others, including:

• Weak intermediary security

• API vulnerabilities

• Supply-chain attacks

• Inconsistent security controls

• Compromised wallet providers

Security standards and supervision become critical in either architecture.

17. Which model is better for innovation?

An intermediated or two-tier model may provide greater scope for private-sector innovation.

Banks and fintech companies could potentially compete on:

• Wallet design

• Merchant services

• Payment interfaces

• Accessibility features

• Financial-management tools

• Cross-border services

The central bank could concentrate on the monetary core while regulated providers build services around it.

18. How could offline payments work in either model?

Offline CBDC payments could potentially operate under direct, indirect, or hybrid architectures.

Devices might temporarily exchange value without continuous access to the central ledger and synchronize transactions when connectivity returns.

The system would need mechanisms for:

• Preventing double spending

• Limiting offline balances

• Securing devices

• Managing lost devices

• Resolving conflicting transactions

• Synchronizing records

Offline capability is therefore more a technical design feature than a defining characteristic of direct versus indirect distribution.

19. What are the major differences between direct and indirect CBDCs?

Actual CBDC systems can sit anywhere between these categories rather than fitting neatly into one box.

20. Which CBDC distribution model is most practical?

For large retail systems, intermediated, two-tier, or hybrid approaches can reduce the need for central banks to become full-service retail financial institutions.

A useful way to remember the architectures is:

Direct CBDC → Central bank interacts more directly with users

Indirect/intermediated CBDC → Private providers handle much of the user relationship

Hybrid/two-tier CBDC → Responsibilities are deliberately divided

The choice ultimately involves trade-offs among financial stability, privacy, resilience, competition, innovation, cybersecurity, inclusion, and operational complexity.

CBDC architecture is therefore not merely a technical decision about where a ledger lives. It determines how central banks, commercial banks, fintech companies, merchants, and citizens divide responsibility for digital public money, which is precisely the sort of simple idea institutions can turn into several thousand pages of policy documentation.