Data Residency is the set of issues and practices related to the location of data and metadata, the movement of (meta)data across geographies and jurisdictions, and the protection of that (meta)data against unintended access and other location-related risks³⁾

Data Sovereignty is the concept that information which has been converted and stored in binary digital form is subject to the laws of the country in which it is located.

Data Localization is the act of storing data on any device that is physically present within the borders of a specific country where the data was generated.

There is a lot of promise coming from the Blockchain world vis-a-vis decentralization and transactions per second, To a large extent this is driving the Stablecoin Desirements such as: B0016, B0017, P0015, P0016, R0022. These promises of a a global and international game changer has performance and cost issues.

For now, any time a new blockchain starts making promises about “beating Visa’s 24,000 tps”, be skeptical and examine the fine print. IOTA’s meant to be fast and scalable, but like a kid who’s terrified of removing the stabilizers from their bike, it still doesn’t function without its coordinator. Hashgraph is also meant to be fast, but it comes with threats to sue anyone who tries to fork it and any blockchain that can be sued isn’t a decentralized network. Come to think of it, it’s more like Visa.⁵⁾

In addition to the speed issues, there are huge costs associated with consensus. See the OMG DIDO-RA discussion on Consensus Platforms.

Note: However, this does not mean the Federal Reserve should not continue to have Research Development Test & Evaluation (RDT&E) Funding into Blockchains or Stablecoin.

Note: See: B0041.

The U.S. Dollar is already an international global currency.

According to the International Monetary Fund, the U.S. dollar is the most popular [currency]. As of the fourth quarter of 2019, it makes up over 60% of all known central bank foreign exchange reserves. That makes it the de facto global currency, even though it doesn't hold an official title. ⁶⁾

However, even though the U.S. Dollar is the de facto world currency, that it is partially because it is perceived as a neutral, unbiased, well-managed, and transparent commodity. If the CBDC were to change the rules to make it less well managed, neutral, unbiased, and transparent there will be serious challenges to the U.S. Dollar. Part of the explanation for Bitcoins' adoption was that transactions were perceived to be beyond the purview of the U.S. government, in specific, but other governments as well.

Despite trillions of dollars in foreign debt and continuous large deficit spending, the United States still holds global trust and confidence in its ability to pay its obligations. For this reason, the U.S. dollar remains the strongest world currency. It may continue to be the top global currency in the years to come.

The dollar’s current number one status is under contention though. Countries such as China and Russia feel a new one-world currency, one not backed by any one nation, is overdue in this increasingly integrated global economy.(

Kimberly Amadeo, Why the US Dollar Is the Global Currency, The Balance 16 March 2022, Accessed: 10 April 2022, https://www.thebalance.com/world-currency-3305931 ))

Part of the reservation about the U.S. Dollar is also attributable to the Snowden revelation. See: Data Sovereignty and MacAskill and Dance.⁷⁾

See B0015.

See B0015.

The Bank for International Settlements (BIS) has produced a paper for the G20 on Central bank digital currencies for cross-border payments⁸⁾

Cross-border payments with CBDCs can be envisioned in two fundamentally different ways:

1. A retail CBDC of a given jurisdiction becomes available to anybody inside and outside of that jurisdiction, with no specific coordination between the issuing central banks
2. Access and settlement arrangements are established among different retail and/or wholesale CBDCs, built on strong cooperation among central banks

In the first scenario of international use, the CBDC, being digital, could be designed so that it faces no constraints on where and by whom it is used. If the design allows for anonymous payments like cash, it would by default be accessible to foreign residents. In practice, however, relatively few central banks are considering fully anonymous systems (Auer, Cornelli, and Frost (2020)). Alternatively, and in contrast to cash, a CBDC could be designed so as to be subject to certain restrictions on cross-border use imposed by the issuing central bank.

In the second scenario, coordination and cooperation among central banks would favor less disruptive approaches. This could happen either by allowing foreigners from partnering jurisdictions to access the domestic CBDC solution or by means of multi-CBDC (CBD) arrangements.12 These are coordinated design frameworks including technological, market structure, and legal aspects, aiming to facilitate cross-border interoperability of multiple CBDCs from different jurisdictions.

See B0015.

There is already a rich legal framework in place to cope with Money Laundering within the U.S.; many of these can help prevent money laundering across U.S. borders. One example is the US Patriot Act, Title III: Anti-money-laundering to prevent terrorism of 2001, especially the

• The First Subtitle deals primarily with strengthening banking rules against money laundering, especially on the international stage
• The Third Subtitle deals with currency smuggling and counterfeiting, including quadrupling the maximum penalty for counterfeiting foreign currency.

Also, 18 U.S. Code § 1956 - Laundering of monetary instruments has provisions for international situations:

• Unlawful activity, certain offenses against foreign nations
• The defendant knew that the property involved was the proceeds of any felony under State, Federal or foreign law
• Defines “financial transactions” to include interstate or foreign commerce

Note: These laws and regulations need to be reviewed when a U.S. CBDC design is finally ready for testing to ensure the framework is still adequate to protect criminal activities and that CBDC does not open loopholes and backdoors.

Internationally, a major method of protecting consumer privacy is referred to as Data Localization. This section includes examples from Russia, China, India, European Union, and Brazil.

Data Localization policies classification ⁹⁾ is summarized below:

Local-only Storing, Transmission, and Processing: This generally means an obligation to locally manage data or a prohibition of international data transfers. This is the strictest type of localization policy and is more likely to be descriptive of nations seeking broader control over citizen activities.

Local Copy Required: Companies are required to keep a copy of data in local servers or data centers. This allows for easier access to this data for regulation and law enforcement purposes, i.e., it is generally easier for local law enforcement agencies to access data stored locally than it is for them to access data stored in another jurisdiction.

Narrower, conditional restrictions: Transfers of data outside the country are only permitted if certain conditions are met by the transferee and/or by the recipient country.

There is already a rich legal framework within the U.S. to protect against criminal activity, which includes international activities (see the Details of National Security Considerations). Many of these laws and regulations are already well established and operational on the international level.

Some examples:

Note: These laws and regulations need to be reviewed when a U.S. CBDC design is finally ready for testing to ensure the framework is still adequate to protect criminal activities and that CBDC does not open loopholes and backdoors

See 05_stakeholder. The primary international stakeholders in the CBDC effort are identified in non-U.S. Federal Government Oversight Authorities. This is a minimum set and could include more countries and specific agencies within these countries.

This is highly dependent on the Currency Model or mix of currency models chosen to implement the U.S. CBDC.

Existing intermediaries must already follow:

• Know Your Customer (KYC)
• Customer Due Diligence

As well as take steps to prevent Money Laundering, such as:

1. Deposit of illicit funds into the financial system
2. Transactions designed to conceal the illicit origin of the funds, known as “layering”
3. Use of laundered funds to acquire real estate, financial instruments or commercial investments

U.S. Federal law requires a person to report cash transactions of more than \$10,000 by filing IRS Form 8300 PDF, Report of Cash Payments Over \$10,000 received in a Trade or Business. ¹⁰⁾

Note: These laws and regulations need to be reviewed when a U.S. CBDC design is finally ready for testing to ensure the framework is still adequate to protect criminal activities and that CBDC does not open loopholes and backdoors. This means that all new intermediaries are subject to the same rules.

This requires international agreement on the details of what constitutes a transfer, the rules of the transfers, limits or restrictions on the transfers, etc. Although there are already agreements using the existing systems, these are often too slow for modern expectations.

Even though streamlining transfer processing using technologies such as Blockchain is promising (in order to reduce the time it takes to do a transfer) this should in no way mean that the rules can be ignored.

Most of the international agrements have to do with detection and prevention of National Security which is a broad, extensive topic that requires an understanding of the U.S. Laws and Regulations, as well as, international treaties and agreements. Within the context of the CBDC, criminal activity can be one or more of the following:

• Human Trafficking
• Drug Trafficking
• Corruption
• Money Laundering

1. Common Standards: There are lots of “common standards” that apply to Blockchains and Blockchain technology. The following provides (and describes) standards or lists of standards that apply:

• DIDO RA - Technical Standard Bodies
• DIDO RA - de facto Standards Bodies

Unfortunately, within the “blockchain” world, there is confusion about what constitutes a standard. Often, if something is Open Source, it is considered a standard. However, often these projects lack the rigor needed to be considered a “standard”. Also, see the discussion in the DIDO RA on Talk Openly Develop Openly (TODO). As a contrast, look at the DIDO RA definition of a Standards Developing Organization (SDO).

2. Infrastructure: The CBDC Infrastructure needs to be considered Mission Critical since any loss of functionality could be considered a threat to survival. This is why the Desirements: B0053, D0015, D0016, D0017 are in the White paper.

3. Types of Intermediaries able to access any new infrastructure:

B0026 specifies bridges between legacy and new payment services and will require new infrastructure.

D0012 specifies leveraging existing tools already in use by intermediaries

4. Legal Frameworks: There are already legal frameworks in place to handle:

• National Privacy Considerations
• National Security Considerations

Although these frameworks were developed without a CBDC, they already “comply with the United States are subject to robust rules” and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than creating new frameworks.

5. Preventing Illicit Transactions: There are two areas within the existing legal frameworks covering Illicit transactions:

• Money Laundering
• Corruption

Although these frameworks were developed without a CBDC, they already “comply with the United States are subject to robust rules” and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than create new frameworks.

6. Cost and Timing of Implementation: The CBDC is a complex issue that, once released, could have a life expectancy of many, many years. Only through extensive Systems Analysis, Engineering, Design, and Testing will CBDC have the stability it needs to instill confidence in the public (B0020).

This has to be accomplished understanding international treaties, laws and regulations on

• Criminal Activity.
• Data Residency
• Data Localization
• Data Sovereignty

The U.S. CBDC would need to work within the confines of the individual country's laws and regulations on:

• Data Residency
• Data Localization
• Data Sovereignty

See: q16 The U.S. CBDC would need to work within the confines of the individual country's laws and regulations on:

• Data Residency
• Data Localization
• Data Sovereignty

The U.S. CBDC would need to work within the confines of the individual country's laws and regulations on:

• Data Residency
• Data Localization
• Data Sovereignty

This depends on the Currency Model used for the CBDC. For

• Digital Cash Model, it would follow all the same rules as the current physical Dollar models work today.

Criminal Activity is a broad, extensive topic that requires an understanding of the U.S. Laws and Regulations as well as international treaties and agreements. Within the context of the CBDC, criminal activity can be one more of the following:

• Human Trafficking
• Drug Trafficking
• Corruption
• Money Laundering

Customer due diligence and record keeping need to take into account:

• Data Residency
• Data Localization
• Data Sovereignty

Often, threats and operational disruptions are not limited to the geographic location of a particular country or jurisdiction. Some recent international attacks on communications ¹¹⁾ listed below:

March 2022: An attack on a satellite broadband service run by the American company Viasat disrupted internet services across Europe, including Ukrainian military communications at the start of the Russian invasion. The attackers hacked satellite modems belonging to thousands of Europeans to disrupt the company’s service.

March 2022: Hackers penetrated the websites belonging to multiple Russian agencies including the Energy Ministry, the Federal State Statistics Service, the Federal Penitentiary Service, and the Federal Bailiff Service. The websites displayed several anti-government and anti-invasion images and messages before the agencies were able to expel the attackers.

March 2022: Hackers linked to the Chinese government penetrated the networks belonging to government agencies of at least 6 different U.S. states in an espionage operation. Hackers took advantage of the Log4j vulnerability to access the networks, in addition to several other vulnerable internet-facing web applications.

February 2022: Researchers identified campaigns by two North Korean government-backed groups targeting employees across numerous media, fintech, and software companies. The hackers used phishing emails advertising fake job opportunities and exploited a vulnerability in Google Chrome to compromise the companies’ websites and spread malware.

February 2022: A Beijing-based cybersecurity company accused the U.S. National Security Agency of engineering a backdoor to monitor companies and governments in over 45 countries around the world. A Foreign Ministry spokesman said that operations like this may threaten the security of China’s critical infrastructure and compromise trade secrets.

See: D0015

See: D0015 See: https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:04_doc:20_comments:dsn:q18, List of Internet outages provided by Wikipedia.