# A Digital Currency Architecture for Privacy and Owner-Custodianship
## 4 Analysis
### Comparison to Alternative Approaches  
Table 1 offers a comparison of the main design features. The features of our design that contrast with many of the prevailing CBDC design proposals include, but are not limited to, the following:  
1. _Retail users can hold digital assets outside accounts._ Most of the existing proposals assume that digital assets would be always held by intermediaries. In contrast, our proposal empowers retail users with the ability to truly control the assets they hold and choose custodians, when applicable, on their own terms.
2. _No central bank accounts for individuals and non-financial businesses._ In our view, requiring central bank accounts would introduce new costs, weaknesses, and security vulnerabilities. It would result in the central bank taking responsibility for actions commonly performed by the private sector in many countries, and it would negate the benefits of using tokens rather than accounts. A team led by [PERSON] observed that many proponents of CBDC, such as [PERSON] and [PERSON] [45], assume that central banks would disintermediate commercial intermediaries and that in many cases this possibility is touted as a benefit of CBDC [60]. However, their analysis formalizes a trade-off between avoiding bank runs and delivering optimal allocation of capital [60], underscoring a key role of commercial banks in bearing risk that, in our view, should not be undermined.
3. _A purpose-built domestic, retail payment system._ The requirement to support cross-border or wholesale payments is intentionally not included in our design. Our proposal is designed specifically to meet the requirements for a domestic, retail payment system, which we believe differ significantly from the requirements for a cross-border or wholesale payment system.
4. _True, verifiable privacy for retail users._ Data protection is not the same as privacy, and our proposal does not rely upon third-party trust or data protection for their transaction metadata. Some proposals include \"anonymity vouchers\" that would be usable for a limited time in accounts-based digital currency systems [22; 23]. We do not believe that such approaches would be effective, not only because of the dangers associated with reducing the anonymity set to specific intervals but also because of the attacks on anonymity that will always be possible if value is to be transferred from one regulated account directly to another.
5. _No new digital identity systems._ Our system does not require any special identity systems beyond those that are already used by MSBs and private-sector banks. In particular, it does not require a system-wide identity infrastructure of any kind, and it also explicitly allows individuals to make payments from their non-custodial wallets without revealing their identities.
6. _No new real-time operational infrastructure managed by central authorities._ Our proposed system can be operated exclusively by private, independent actors without relying upon a central actor to operate any specific part of the infrastructure. The distributed ledger makes it possible to assign responsibility for most transactions to the MSBs, not the central bank. An MSB is responsible for each transaction that it writes to the ledger, and the DLT can be used to create a (potentially) immutable record binding every transaction to the corresponding MSB that submitted it. We understand that the central bank is not responsible for individual transactions.