# A Digital Currency Architecture for Privacy and Owner-Custodianship
## 3 Our Proposal
### User Engagement Lifecycle  
Figure 3 depicts a typical user engagement lifecycle with CBDC, which we anticipate would be a typical use case for our design. This user (Individual B) has a bank account and receives an ordinary payment via bank transfer into her account (with Bank B). Then, the user asks her bank (Bank B) to withdraw CBDC, which takes the form of a set of tokens that are transferred to her non-custodial wallet via unlinkable transactions. On-ledger transactions of CBDC are represented in the figure by the Pound Sterling symbol (\(\mathcal{E}\)). (If Bank B had not received the CBDC directly from Bank A along with the payment, then it might source the CBDC from its own holdings, or it might receive the CBDC from the central bank in exchange for cash or reserves.) Later, the user approaches a merchant or other service provider (Business C), either in-person or online, that has an account with a bank (Bank C) that is configured to receive CBDC. Using her non-custodial wallet, the user interacts with software that facilitates an interaction between her non-custodial wallet and the merchant's bank wherein the bank publishes a set of transactions to the ledger effecting a transfer of CBDC from the user's non-custodial wallet to the merchant's bank, credits the merchant's account, and informs the merchant that the transaction was processed successfully. The merchant's bank then has the option to return the CBDC to the central bank in exchange for cash or reserves. The privacy features of the ledger design and the non-custodial wallet software ensure that the user does not reveal anything about her identity or the history of her tokens in the course of the transaction that can be used to identify her or profile her behavior. More generally, we envision that a retail user of digital currency would receive it via one of four mechanisms:  
1. _Via an exchange of money from an account with an MSB into digital currency._ We stipulate that an individual or business with an account with an MSB could opt to _withdraw_ digital currency from the account into a non-custodial wallet. Digital currency held by a retail user in the user's non-custodial wallet would be like cash. Because it is not held by an MSB, it would not be invested and it would not earn true interest; it would be tantamount to holding cash in a physical wallet. It might be possible for governments to incentivize or penalize the asset itself, but this would not be \"true\" interest and would not serve the same purpose. Similarly, an individual or business with an MSB could opt to _deposit_ digital currency from a non-custodial wallet into an account, reversing the process, as shown in Figure 4. Retail users would be permitted to deposit funds into their own accounts, possibly subject to certain limits or additional checks in the event that such deposits are frequent or large. 2. _As a recipient of digital currency from an external source, received into an account with an MSB._ In this case, the user would be the recipient of a digital currency payment. The sender of the payment might be known, for example if it is an account with an MSB, or it might be unknown, specifically if it is a non-custodial wallet. 3. _As a recipient of digital currency from an external source, received into a non-custodial wallet._ Any transaction in which a non-custodial wallet receives digital currency from an external source must be mediated by an MSB, so the key difference between this mode of receiving digital currency and a withdrawal from the user's own account is that, in this case, the recipient does not have (or is not using) an account with the MSB. This form of transaction is illustrated in Figure 5. Retail CBDC users wishing to transact with each other via their non-custodial wallets must transact via a regulated institution or a regulated business with an account with a regulated institution.