Test detail

This is an excellent question. Let me organize this systematically in three parts.

This is a very good question. I'll address it thoroughly in three sections.

Can Digital Yen Be Designed Without Government Ability to Stop Payments?

① Current Status: Where is the Bank of Japan's Proof-of-Concept?

The Bank of Japan began proof-of-concept experiments in 2021 and has progressed through basic functionality verification (Concept Proof Phases 1 and 2). As of April 2023, they are conducting pilot experiments utilizing the technology and expertise of private sector participants.

The Bank of Japan has been advancing proof-of-concept experiments in stages since 2021, but there is currently no issuance plan. However, in preparation for potential future environmental changes, both technical and institutional preparations are steadily progressing.

As an official policy position, the Bank of Japan has explicitly stated: "As long as there is demand for cash, the Bank of Japan will continue to bear responsibility for supplying cash."

② Main Analysis: Is a Design Technically Possible Where Government Cannot Stop Payments?

To put it bluntly: it is possible. However, to make it "completely impossible" would require simultaneously satisfying several design principles, which is practically challenging.

A. Technical Means That Exist

▶ Hybrid Design: Token-Type × Indirect-Issuance Model

The "indirect issuance" approach, combined with a hybrid model co-existing both "account-based" and "token-based" systems, can mitigate privacy risks. By adopting indirect issuance, the central bank avoids direct management of national CBDC transaction information, while token-type CBDC enables anonymous (and offline) payments within AML/CFT regulatory thresholds. This is the design being proposed.

This is a crucial point. In token-based systems (similar to the "numbered banknote" model for cash), balances are tied to "tokens" rather than to a specific "person's ID," making it inherently difficult for the center to execute operations like "stop the payments of person A."

▶ Offline Payment Functionality

Offline payment functionality means that if funds are pre-loaded into a digital wallet, payments become possible even without internet connection. In offline transactions, authentication occurs between the two offline terminals of transaction participants, so funds are transmitted directly between peer terminals without going through a network center or third party, thereby protecting privacy.

Offline design has the characteristic that "bypassing central servers = impossible for the center to stop."

▶ Privacy-Enhancing Technologies (PETs) and Zero-Knowledge Proofs

Privacy-enhancing technologies (PETs) can be effective in supporting privacy protection. For example, using pseudonymization enables payment designs where account IDs remain hidden.

Future technological innovations like zero-knowledge proofs and Layer 2 technology could bring public blockchain-based CBDCs into view, as mentioned in the Bank of Japan's proof-of-concept experiments.

Zero-knowledge proofs (ZKP) allow proving "this person satisfies the condition" while keeping "who this person is and what they purchased" invisible to the center. This means maintaining public policy functions like AML and age verification while making individual transactions invisible is theoretically possible.

▶ Ledger Design: Potential Use of UTXO Model

Regarding the UTXO model for ledger data models, parallel processing capability and ease of implementing privacy protection are noted as distinguishing features.

Bitcoin's UTXO approach manages "unspent token clusters" rather than "account balances," making it structurally difficult to freeze all assets of a specific individual with surgical precision.

B. Summarizing Design Principles

③ Then Why Is There No Guarantee Such Design Will Be Adopted?

This is the most critical point. Even if technically possible, structural reasons exist preventing adoption.

Reason 1: Fundamental Trade-off with AML/CFT

In CBDC design, the "protection of privacy versus countering illegal activity" is identified as a major trade-off in joint documents by the Bank of Japan, ECB, and Bank of Canada.

AML/CFT measures are internationally mandated by treaties (FATF). Creating completely anonymous, completely unstoppable CBDCs risks exclusion from international financial systems. Governments have incentive to maintain surveillance functions citing this risk.

Reason 2: "Institutional Design Is a Political Decision"

In liaison meetings between the Ministry of Finance and Bank of Japan, the discussion points to "operationalizing the coexistence of public requirements like AML/CFT and privacy protection, on the premise that the Bank of Japan not handle user information or transaction information."

Notably, the phrase is "on the premise that." Currently discussed in that direction, but this is neither law nor treaty-bound. A change in administration, crisis response, or international pressure could alter this "premise" at any time.

Reason 3: "Making It Technically Impossible" Is Institutionally Difficult

Even with cash, court orders can freeze accounts. Making a CBDC design where "the government physically cannot stop it" would mean permanently renouncing part of judicial and administrative enforcement powers. It is extremely unlikely that a legislature would approve this.

Reason 4: Programmability Functionality Embeds the "Ability to Stop"

The Bank of Japan's proof-of-concept discusses CBDC programmability and composability.

Programmability means "usable only under specific conditions," "with expiration dates," or "with use restrictions." This means the same technology can "stop a specific individual's usage." Once such functionality exists, it can be inverted by political will.

Reason 5: US as Cautionary Tale and Limits of Democratic Checks

In January 2025, the US president issued an executive order prohibiting CBDC promotion, and in July 2025 the "Anti-CBDC Surveillance State Act" passed the House. It explicitly prohibits Fed-related CBDC activities.

Reversely, this indicates that absent explicit prohibition, governments can use CBDCs as surveillance and control mechanisms, as judged by the US Congress. No equivalent legislative safeguards currently exist in Japan.

Summary: Structural Asymmetry

Technical design that "cannot be stopped" is → Possible
Guarantee such design will be chosen is    → None

Because:
  ┌ International treaties (FATF) restrict anonymity
  ├ Governments want to retain legal enforcement power
  ├ Programmability is a double-edged sword
  ├ Designers are politicians, not technicians
  └ Japan lacks legislative safeguards

CBDC's greatest concern is privacy, and it has been noted that if every transaction, including small payments by individuals, is designed so that the central bank or private banks hold transaction information, it risks infringing on citizens' privacy rights.

Technology is neutral, but institutional design is the product of power relations. A "cannot-be-stopped" design is implementable in engineering, but whether to adopt it is ultimately a matter of legislative and executive will. Without strong constitutional and legal frameworks constraining that will, no guarantee exists. When cash becomes practically unusable, the weight of that design choice becomes incomparable to today.

Digital currency design requires technical innovation to prevent governments from possessing the capability to stop specific individuals' payments. Below, I organize both this possibility and related challenges:

Technically Possible Designs

1. Distributed Ledger Technology Adoption:

• Using distributed ledger technology like blockchain eliminates centralized control.
• Individual transactions are encrypted and shared among all participants, making it difficult for specific individuals to be targeted.

2. Anonymity Assurance:

• Ensuring anonymity preventing individual identification makes tracking and management of specific persons difficult.

Why Such Design Is Not Guaranteed for Adoption

1. Security and Regulatory Concerns:

• High-anonymity systems risk becoming covers for money laundering and criminal activity.
• Regulatory frameworks disfavor systems with difficult-to-implement monitoring and control.

2. Government Needs and Responsibility:

• Economic policy implementation and financial stability oversight require transaction transparency.
• Governments and central banks bear responsibility for maintaining financial system stability through certain controls and oversight.

3. Social Trust and Acceptance:

• When citizens and businesses widely trust and accept government monitoring capability, distributed designs face adoption resistance.

Therefore, while technically possible to design digital currencies limiting government intervention, such designs face obstacles from legal and regulatory frameworks, security concerns, and economic policy and social trust perspectives. There is no guarantee such designs will be selected in actual currency implementation.

The Bank of Japan is advancing proof-of-concept experiments on digital yen (Central Bank Digital Currency, CBDC), and as of April 2023 is conducting pilot experiments. The Bank of Japan maintains a cautious stance, with no current plans to issue CBDC.

1. Is a Design Technically Possible Where Government Lacks Ability to Stop Specific Individuals' Payments?

Technically, a design where government cannot stop a specific individual's payments appears possible, though implementing it requires sophisticated technology and institutional design innovations.

The Bank of Japan prioritizes CBDC privacy protection and adopts a "two-layer structure" as its basic policy. In this structure, the Bank of Japan doesn't directly handle user information or transaction information; private intermediaries (banks, etc.) handle user-facing operations. Specifically, data held by intermediaries is divided into "customer management" and "ledger management" sections, with the ledger management section designed not to handle user information or transaction details, minimizing the Bank of Japan's personal data handling.

However, ensuring complete anonymity involves trade-offs with public requirements like Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT). Cash's high anonymity makes it vulnerable to misuse, but digital yen systems being considered allow transaction tracing when necessary, expected to deter illicit activity.

To balance privacy protection with fraud prevention, the following technical and institutional approaches are being considered:

• Anonymity Degree Adjustment: A hybrid model combining "token-based CBDC enabling anonymous (and offline) payments within amount thresholds" with "account-based CBDC enabling transactions exceeding thresholds in non-anonymous form" is proposed.
• Homomorphic Encryption Application: When users maintain multiple intermediary accounts, homomorphic encryption techniques are used in subsystems that aggregate and determine information across intermediaries without central banks managing CBDC balances or transaction histories, returning only the results for intermediaries to verify threshold compliance.
• Offline Payment Functionality: To ensure anonymity comparable to cash, offline payment capabilities are being considered.

2. Why Is There No Guarantee Such Design Will Be Adopted?

Even if technically possible to design systems where governments cannot stop individual payments, several complex factors explain why such adoption cannot be guaranteed:

• Privacy vs. Public Policy Trade-offs:
• AML/CFT and Financial Sanctions: Governments may demand ability to track digital yen transactions from financial crime perspectives. Completely anonymous digital yen risks enabling money laundering, tax evasion, and criminal organization funding. Internationally, high-value cash transaction surveillance has intensified. The Ministry of Finance emphasizes that AML/CFT countermeasures constitute one crucial pillar.
• Financial Sanctions Effectiveness: Effectively implementing financial sanctions against specific individuals or entities requires payment-stopping capability.
• Fiscal and Monetary Policy Effects: Some experts argue that central bank interest-bearing digital currencies enhance monetary policy effectiveness, and governments directly distributing subsidies improves efficiency and transparency. Achieving these objectives may require transaction visibility and control.
• Technical Feasibility and Cost:
• Designs completely excluding government intervention require complex cryptographic techniques and distributed ledger technology (DLT), potentially increasing development and operational costs. Technical challenges like processing simultaneous high-volume transactions (scalability) are also being verified.
• International Standardization and Coordination:
• As central bank digital currency development advances globally, international interoperability and standardization gain importance. Different national designs based on respective policies and legal systems could create international consistency challenges. If other countries adopt designs permitting some government intervention, Japan might adjust accordingly.
• Public Understanding and Acceptance:
• Privacy protection is a major public concern, which the Bank of Japan prioritizes. However, whether design completely excluding government intervention gains public understanding while balancing fraud prevention and financial stability constitutes an important factor.
• Political Judgment:
• What digital yen design ultimately adopts depends heavily on government and parliamentary political judgment beyond technical considerations. Privacy protection and public control balance varies with societal values and government policy directions.

While the Bank of Japan states "no current plan to issue CBDC," it demonstrates its policy to prepare appropriately for various environmental changes and proceed with institutional design clarification. Within this context, balancing privacy protection with data utilization and public policy requirements remains a critical theme.

Yes, such design (where government or the central bank technically cannot stop or encounters extreme difficulty stopping specific individuals' payments in a CBDC) is technologically feasible. However, adoption is not guaranteed. The primary reasons involve policy and regulatory factors. [[1]](https://www.boj.or.jp/paym/digital/dig260610c.pdf)[[2]](https://www.boj.or.jp/paym/digital/d_forum/wg4/dfo260326b.pdf)

Examples of Technically Feasible Designs

In the Bank of Japan (BoJ) digital yen (CBDC) proof-of-concept experiments (PoC Phases 1 and 2, pilot experiments), an approach emphasizing Privacy-by-Design is being considered. Main characteristics include:

• Separation of Customer Management and Ledger Management Sections: Intermediaries (private financial institutions, etc.) manage a "customer management system" handling user information and transaction details, while a "ledger management system" handles only transaction-essential minimum information (e.g., transfers between tokenized IDs). BoJ itself avoids directly handling personal information or transaction details. [[3]](https://www.boj.or.jp/paym/digital/dig250523b.pdf)[[4]](https://www.boj.or.jp/en/paym/digital/dig250718a.pdf)
• Account ID Tokenization or Alias Functions: Mechanisms obscuring recipient user IDs from senders. Transaction ID-based linking and other methods protect privacy.
• Non-Account-Balance Data Model Exploration: Fixed-denomination token types or UTXO types. These potentially minimize central management and facilitate privacy protection.
• External Program Method Preference: Programmability (conditional payments, etc.) is not embedded in core ledgers but realized externally (intermediary APIs, etc.), keeping the core simple. [[5]](https://www.fintechobserver.com/the-digital-yen-blueprint-navigating-japans-multi-stage-transition-to-a-cbdc-ecosystem/)

Advanced privacy-focused designs (including research-level and examples from other countries/projects) involve:

• Leveraging cryptographic techniques like zero-knowledge proofs (ZK proofs) and blind signatures, enabling ledger transaction verification while preventing central authorities from easily linking identity to transactions or selective blocking.
• Token-based or self-custodial wallet-centered models where central banks cannot directly manipulate individual accounts.
• Distributed or UTXO-based ledgers where global freezing becomes technically difficult or entails massive collateral impact.

These designs could technically approach cash-like anonymity and censorship resistance (though complete anonymity faces AML/CFT concerns). BoJ experiments discuss reconciling privacy protection with functional expansion, indicating "stop-capability-limited or entirely lacking" architectures are implementable. [[6]](https://www.boj.or.jp/paym/digital/d_forum/wg4/dfo260326a.pdf)[[7]](https://link.springer.com/chapter/10.1007/978-3-031-32415-4_38)

Why Adoption Is Not Guaranteed

Despite technical feasibility, the following reasons explain why such designs face no adoption guarantees:

• Regulatory and Compliance Requirements (AML/CFT, Sanctions, etc.): All countries, including Japan, mandate anti-money laundering, counter-terrorism financing prevention, and economic sanctions enforcement. Specific individual payment freezing is already operationalized in banking and likely demanded for CBDC. BoJ experiments explicitly discuss balancing privacy and public requirements (AML/CFT). [[8]](https://www.mof.go.jp/about_mof/councils/meeting_of_cbdc/20260625_siryou1.pdf)[[9]](https://www.tmi.gr.jp/eyes/blog/2025/17295.html)
• Policy and Public Policy Judgment: Governments and BoJ must balance "universal access like cash" with "illicit use prevention." Completely stop-resistant designs are typically viewed as increasing crime, tax evasion, and sanctions-evasion risks. Final design emerges through national deliberation and legal development (BoJ explicitly states "no current issuance decision"). [[10]](https://www.boj.or.jp/en/paym/digital/)
• Two-Layer Structure Limitations: Even with BoJ managing core ledgers, control becomes possible at intermediary levels or through legal frameworks (civil enforcement, criminal procedure). External program methods also easily enable API-based restrictions.
• Adoption Incentives: Privacy-focused designs often prove technically complex and cost-intensive, involving trade-offs with performance and operability. Governments tend favoring "controllable" systems (other countries' stablecoin examples show embedded freeze mechanisms).

BoJ's pilot experiments (ongoing from 2023, continuing as of 2026 reports) remain technical verification only, not final architecture fixation. When cash becomes practically unusable, CBDC design takes "privacy protection as premise" while requiring reconciliation with public policy demands as its key element. [[11]](https://bittimes.net/news/224135.html)

In conclusion: "Stop-capability-lacking" design is technically sufficient possible, but adoption depends on law, policy, and social consensus, not technology. Consult the latest BoJ reports and CBDC forum discussions for details.