Two-tier CBDC architecture is the model most central banks are studying for retail digital currency. The central bank issues the money and runs the core settlement layer. Banks and payment service providers handle wallets, onboarding, compliance, and customer service. That split matters. It keeps public money at the center but avoids turning the central bank into a retail bank for millions of users.

The Bank for International Settlements, the World Bank, and several central bank pilots have all pointed toward intermediated or hybrid CBDC designs. The reason is practical, not ideological. Banks and PSPs already know how to onboard customers, run payment operations, screen transactions, and support merchants at scale. Central banks are built for monetary issuance, settlement, and oversight. If you are trying to build a working understanding of this design space, a structured Certified Central Bank Digital Currency (CBDC) Expert foundation covers most of the architecture patterns discussed below.

What Is Two-Tier CBDC Architecture?

A two-tier CBDC architecture divides the system into two operating layers:

Tier 1 - Central bank layer: issuance, redemption, monetary policy rules, core ledger, settlement, and system oversight.
Tier 2 - Intermediary layer: banks, PSPs, fintechs, mobile money operators, and other licensed providers that serve end users.

In a pure two-tier model, retail users do not hold accounts directly with the central bank. You would access CBDC through a regulated bank app, wallet provider, or payment platform. The claim may still be on central bank money, depending on the legal design, but your day-to-day interaction is with an intermediary. Because Tier 2 wallets and instruments increasingly blend CBDC with tokenized deposits and other digital assets, many professionals pair this study with a Certified Digital Assets Expert background to cover both layers properly.

A hybrid CBDC model goes one step further. Intermediaries still run onboarding and payments, but the central bank keeps enough replicated transaction or balance data to restore service if a major provider fails. BIS research has treated this as a useful resilience feature, because retail payment systems cannot simply stop when an intermediary has an outage.

Why Central Banks Prefer an Intermediated Model

A direct retail CBDC sounds simple on paper: everyone opens a wallet with the central bank. In practice, it creates awkward questions. Who answers password reset calls? Who handles suspicious activity reports? Who maintains merchant terminals? Who explains a failed payment to a taxi driver at 11 p.m.?

That is why the two-tier CBDC architecture looks closer to the current financial system. Central banks provide final settlement and trusted money. Commercial banks and PSPs provide retail services. This division reduces disruption to bank funding, credit creation, and compliance operations.

To be blunt, a direct CBDC account system would force central banks into work they are not designed to do. Retail payment operations are messy. Failed reversals, duplicate transaction references, chargeback disputes, expired device certificates, and sanctions false positives are daily problems. In real payment integrations, a retry without an idempotency key can create duplicate wallet funding, while many APIs return an HTTP 409 Conflict when the same transaction reference is reused. These are Tier 2 problems, and experienced PSPs are better placed to manage them.

Role of the Central Bank in Tier 1

In a two-tier CBDC system, the central bank usually performs five core functions.

Issuance and redemption: It creates and withdraws CBDC, defines monetary characteristics, and manages conversion with cash or reserves.
Core ledger operation: It operates or oversees the central settlement ledger, whether centralized or based on distributed ledger technology.
Wholesale settlement: It manages positions among banks and other approved intermediaries.
Rule setting: It defines access rules, technical standards, wallet limits, privacy requirements, and interoperability expectations.
Supervision and resilience: It licenses intermediaries, monitors systemic risk, and ensures the core infrastructure can withstand outages or attacks.

The Banque de France and Eurosystem digital euro experiments are a useful example. Their hierarchical model places a centralized ledger at Tier 1, operated by the Eurosystem, while supervised intermediaries connect through existing payment infrastructure such as TARGET services and instant payment rails.

Role of Banks and Payment Providers in Tier 2

Tier 2 is where CBDC becomes usable for the public. Banks and PSPs would provide the interfaces, compliance controls, and operational support that people and businesses actually touch.

Customer Onboarding and Compliance

Intermediaries perform Know Your Customer checks, anti-money laundering monitoring, sanctions screening, suspicious activity reporting, and, where applicable, travel rule compliance. These obligations are already embedded in bank and PSP workflows. Rebuilding them inside a central bank would be inefficient and risky.

Wallets, Apps, Cards, and APIs

Banks and PSPs may offer mobile wallets, merchant tools, cards, API access, QR code payment flows, and offline payment devices. Some intermediaries may focus on consumer wallets. Others may build treasury tools for businesses or programmable payment interfaces for platforms.

Retail Payment Execution

Intermediaries initiate, validate, and record retail transfers. Depending on the design, they may settle directly on the central bank ledger, through batched settlement, or through a hybrid setup where the central bank receives replicated records. In distributed ledger designs, banks may also operate nodes and maintain token accounts.

Customer Support and Post-Transaction Services

This part is often underestimated. End users need statements, receipts, dispute support, merchant reconciliation, notifications, and billing tools. A central bank ledger can confirm that value moved. It will not automatically solve merchant refunds or help a user recover access to a wallet on a lost phone.

Pure Two-Tier vs Hybrid CBDC

The terms are sometimes used loosely, so the distinction is worth making.

Pure two-tier CBDC: The central bank maintains wholesale positions and settlement infrastructure. Intermediaries maintain retail customer records and provide payment services.
Hybrid CBDC: Users may have a direct claim on the central bank, while intermediaries still handle payments and accounts. The central bank keeps a backup record or replicated view so it can restore balances if an intermediary fails.

For large economies, the hybrid model is attractive because it balances user protection with private sector service delivery. It also reduces single-provider failure risk without making the central bank the front desk for every payment issue.

Real-World CBDC Architecture Examples

Project Aurum in Hong Kong

Project Aurum, developed by the Hong Kong Monetary Authority and the BIS Innovation Hub, built a two-tier retail CBDC prototype with a wholesale interbank system and a retail e-wallet layer. It tested two instruments: intermediated CBDC and CBDC-backed stablecoins. The important lesson is that a single architecture can support different digital money instruments while keeping wholesale balances anchored at the central bank.

Digital Euro Experiments

Digital euro experiments led by Banque de France and Eurosystem partners used a hierarchical structure. Tier 1 issued digital euros and provided central bank money to supervised intermediaries. Tier 2 systems, run by those intermediaries, managed wallets or accounts for citizens, firms, and merchants. This model shows how CBDC can connect to existing European settlement and instant payment systems rather than replacing them outright.

China's e-CNY Functional Split

The People's Bank of China has described a model where the central bank handles issuance, registration, ownership verification, liquidity management, risk controls, audit, and data analysis. Commercial banks and wallet providers manage deposit and withdrawal, user services, payments, and wallet operations. The details are jurisdiction-specific, but the split is recognizably two-tier.

Key Benefits of Two-Tier CBDC Architecture

Continuity with the existing financial system: Banks and PSPs keep their role in customer relationships, payments, and compliance.
Lower operational burden for central banks: The central bank focuses on issuance, settlement, and oversight.
Competition at the service layer: Multiple providers can build better wallets, merchant tools, and APIs.
Better compliance coverage: Regulated intermediaries already have AML, KYC, sanctions, and monitoring teams.
Resilience options: Hybrid designs allow central banks to reconstruct retail balances if an intermediary fails.

Risks and Design Trade-Offs

Two-tier CBDC architecture is not risk-free. It shifts major responsibilities to intermediaries, which creates third-party risk. A weak wallet provider can become a national payment vulnerability. Poor API standards can fragment the market. Overly strict wallet limits may reduce usefulness, while loose limits may accelerate deposit outflows from banks during stress.

Privacy is another hard problem. Central banks want financial crime controls. Citizens want payment privacy. Intermediaries need enough data to comply with law, but not unlimited visibility into every transaction. The right answer is likely tiered access, privacy-by-design controls, and strict audit rules. Blanket surveillance would damage trust. Full anonymity at scale is unlikely to pass regulatory scrutiny.

What This Means for Professionals and Developers

If you work in banking, fintech, compliance, or blockchain infrastructure, two-tier CBDC systems will create demand for practical skills in payment architecture, wallet security, identity verification, API design, transaction monitoring, and settlement integration.

Developers should understand both traditional payment messaging and digital asset design. ISO 20022 concepts, ledger reconciliation, hardware security modules, secure key storage, and wallet recovery flows matter as much as smart contracts. If your goal is to build regulated digital asset systems, Blockchain Council's Certified Blockchain Developer™ and Certified Blockchain Architect™ are natural learning paths. For policy, business, and implementation roles, Certified Blockchain Expert™ can help connect CBDC design with broader digital asset infrastructure. Developers coming from a general infrastructure background may also want to browse the wider Tech Certification catalog, since the API design, identity, and resilience work above draws as much on general systems engineering as it does on CBDC-specific training.

The Practical Future of CBDC Will Be Two-Tier

The most credible retail CBDC plans are not trying to remove banks and PSPs. They are trying to define a cleaner division of labor. Central banks issue trusted digital money and run the settlement foundation. Licensed intermediaries compete on access, service, compliance, and user experience.

If you want to prepare for this shift, start by mapping the full CBDC payment flow: onboarding, wallet creation, funding, transaction authorization, settlement, reconciliation, fraud monitoring, and recovery. Then study one live architecture, such as Project Aurum or the digital euro experiments, and compare it with your current payment stack. That exercise will teach you more than any abstract CBDC debate. And if your role involves explaining this division of labor to bank partners or regulators, a Marketing Certification can help you present the case clearly to an audience that cares about the outcome, not the architecture diagram.

FAQs

1. What is a two-tier CBDC architecture?

A two-tier CBDC architecture is a digital currency model in which responsibilities are divided between the central bank and regulated private-sector intermediaries such as commercial banks and payment service providers (PSPs).

Typically:

Tier 1 → Central bank issues the CBDC and operates or governs core infrastructure

Tier 2 → Banks and PSPs distribute CBDC and provide services to individuals and businesses

The central bank supplies the monetary foundation while intermediaries handle much of the retail machinery.

2. Why use a two-tier CBDC model?

A two-tier structure allows central banks to introduce digital central bank money without necessarily becoming nationwide retail banks.

It can preserve existing roles for banks and payment companies while combining:

Central bank money
Existing customer relationships
Private-sector payment infrastructure
Regulatory oversight
Competition and innovation

Apparently central bankers have concluded that operating millions of forgotten-password requests is not essential to monetary sovereignty.

3. What does the central bank do in Tier 1?

Depending on the design, the central bank may be responsible for:

Issuing and redeeming CBDC
Defining monetary characteristics
Operating or supervising the core ledger
Providing settlement infrastructure
Establishing participation requirements
Maintaining system-wide security standards
Managing CBDC supply
Supporting system resilience

The exact division of responsibilities varies between CBDC designs.

4. What do banks and PSPs do in Tier 2?

Banks and PSPs can provide the customer-facing layer.

Their responsibilities might include:

Opening CBDC wallets
Customer onboarding
Identity verification
KYC procedures
Payment initiation
Authentication
Fraud detection
AML/CFT controls
Merchant services
Customer support
Wallet recovery

Users therefore interact with familiar financial providers rather than routinely dealing with the central bank itself.

5. How does money flow through a two-tier CBDC system?

A simplified structure is:

Central Bank → Bank/PSP → User

For payments:

Payer Wallet → Payer PSP → Core CBDC Infrastructure → Merchant PSP → Merchant Wallet

The precise transaction path depends on whether the architecture uses accounts, tokens, centralized ledgers, distributed systems, or some combination.

6. Who actually issues the CBDC?

The central bank issues the CBDC.

This is crucial because CBDC is intended to represent central bank money, even when a commercial bank or PSP provides the user's wallet.

The intermediary distributes and services the CBDC but does not ordinarily transform it into its own commercial-bank liability merely by doing so.

7. Is CBDC stored at the commercial bank?

That depends on the architecture.

Possible designs include:

Centralized central-bank records
Intermediary-maintained records
Central-bank mirror or backup records
Token-based value stored in wallets
Hybrid ledger arrangements

So “where the CBDC is stored” cannot be answered solely from the phrase two-tier CBDC. That term describes institutional roles more than one mandatory database design.

8. How is two-tier CBDC different from bank deposits?

A commercial bank deposit is generally a liability of the commercial bank.

CBDC is a liability of the central bank.

Conceptually:

Bank deposit → claim on commercial bank

CBDC → claim on central bank

A bank may provide the interface for both, but the underlying issuer and risk characteristics differ.

9. Can users choose different CBDC providers?

Potentially, yes.

A two-tier system could allow multiple authorized banks and PSPs to offer compatible CBDC wallets.

Providers could compete on:

User experience
Merchant services
Payment tools
Accessibility
Security features
Financial-management services

Interoperability becomes important so users do not end up trapped inside isolated payment ecosystems, humanity having already conducted that experiment often enough.

10. What happens when someone pays another person?

Suppose Alice uses PSP A and Bob uses Bank B.

A simplified transaction might be:

Alice → PSP A → CBDC infrastructure → Bank B → Bob

The systems authenticate the parties, validate the payment, update the relevant records, and provide final settlement according to the CBDC architecture.

From the user's perspective, this could happen almost instantly even though several institutional layers participate behind the screen.

11. What role does identity play?

Identity management may be concentrated largely at the intermediary layer.

Banks and PSPs could perform:

Identity verification
KYC
Credential management
Sanctions screening
Account recovery
Risk assessment

Depending on the privacy design, the central bank might not need routine access to complete customer-identifying information for every transaction.

12. Can a two-tier CBDC provide privacy?

Potentially, but privacy depends on deliberate system design and law.

Possible approaches include:

Separating identity from transaction information
Data minimization
Tiered identification requirements
Encryption
Tokenization or pseudonymous identifiers
Strict access controls
Defined retention periods
Legal restrictions on data use

A two-tier architecture can distribute information among participants rather than automatically giving every institution access to everything.

13. How are AML and fraud controls handled?

Banks and PSPs may handle much of the customer-level monitoring because they already operate compliance systems.

Controls could include:

Identity verification → transaction screening → behavioral monitoring → sanctions checks → fraud detection → suspicious-activity investigation

The central bank or other authorities may establish system-wide standards and receive legally required information.

The challenge is preventing abuse without turning the payment system into an unnecessarily comprehensive surveillance database.

14. How does a two-tier model affect commercial banks?

It preserves an important role for commercial banks in digital payments, but it can still affect their business models.

Banks could gain opportunities to provide:

CBDC wallets
Merchant services
Identity services
Payment applications
Value-added financial products

At the same time, customers might move some money from bank deposits into CBDC, potentially affecting deposit funding.

15. Could two-tier CBDCs still cause bank disintermediation?

Yes.

Two-tier distribution does not eliminate the possibility that customers transfer deposits into CBDC.

Potential safeguards include:

Individual holding limits
Transaction limits
Tiered remuneration
Non-interest-bearing CBDC
Conversion controls under exceptional conditions
Liquidity facilities for banks

Designers must balance CBDC usefulness against financial-stability risks.

16. How does the architecture improve resilience?

A two-tier system can distribute some operational functions across multiple regulated providers.

If one wallet provider experiences an outage, other providers may remain available, depending on system design.

Resilience can also be strengthened through:

Redundant core infrastructure
Multiple communication channels
Provider portability
Backup records
Disaster recovery
Offline-payment capabilities

Decentralizing service delivery, however, does not magically remove failure points. It merely gives architects more failure points to manage intelligently.

17. What are the main cybersecurity risks?

A two-tier CBDC creates several potential attack surfaces:

Central infrastructure
Bank systems
PSP platforms
APIs
Mobile wallets
User devices
Identity systems
Third-party technology providers

Security therefore requires layered controls such as strong authentication, encryption, hardware security, transaction monitoring, secure APIs, penetration testing, incident response, and coordinated security standards.

18. How does interoperability work?

Interoperability allows CBDC users to transact across different providers and potentially with other payment systems.

A common standards layer could support:

Bank A ↔ PSP B ↔ Bank C ↔ Merchant Platform D

Interoperability might also connect CBDC with bank deposits, instant-payment networks, ATMs, point-of-sale systems, and eventually compatible cross-border infrastructures.

Without interoperability, a national digital currency risks becoming an impressive collection of incompatible wallets.

19. What are the advantages and risks of a two-tier CBDC?

Area	Potential advantage	Potential challenge
Central bank	Retains monetary control	Must govern complex infrastructure
Banks	Remain part of payment ecosystem	Possible deposit migration
PSPs	New services and competition	Compliance and security costs
Users	More provider choice	Different service quality
Privacy	Data can potentially be separated	Multiple entities process information
Innovation	Private firms build services	Standards are needed
Resilience	Distributed service layer	More interfaces create attack surfaces
Inclusion	Multiple access channels possible	Digital-access barriers remain

20. What is the easiest way to understand two-tier CBDC architecture?

Think of it as three functional layers:

Central Bank Layer

Issue CBDC → maintain monetary integrity → provide or govern core settlement → establish system rules

↓

Bank and PSP Layer

Distribute CBDC → verify customers → operate wallets → process payments → manage compliance and fraud controls

↓

User Layer

Individuals → businesses → merchants → government agencies

The key principle is division of responsibility.

The central bank does not need to become everyone's retail bank, while private institutions do not issue the sovereign digital currency themselves.

A well-designed two-tier CBDC therefore attempts to combine the trust and settlement finality of central bank money with the distribution capacity, customer relationships, and innovation of private payment providers. The hard part, naturally, is making all those institutions cooperate securely, interoperably, and cheaply, which is where the elegant three-layer diagram encounters civilization.