Security and Privacy in Digital Payments: Blockchain, PIX, and Central Bank Digital Currencies (CBDCs) (Research Square)

Summary

• The systematic review synthesises 50 highly relevant studies selected from a total pool of 615 candidate records published between 2014 and 2025.p.2
• Brazil's PIX was launched by Banco Central do Brasil in November 2020 and processes over three billion transactions monthly.p.3
• Over 130 jurisdictions are in active exploration or pilot phase for Central Bank Digital Currencies as of 2025.p.3
• Technical and empirical studies comprise 64% (32 of 50 included papers) of the corpus, while governance and legal analyses account for 36% (18 studies).p.9
• Zero-knowledge proofs are the most widely adopted cryptographic primitive in the reviewed governance literature, appearing in 18 of the 50 studies.p.10

Key insights

1. The Digital Payment Governance Framework (DPGF) conceptualises digital payment governance across three independent axes: Locus of Control, Privacy Spectrum, and Compliance Architecture.p.4
2. Hybrid governance architectures consistently demonstrate superior performance on composite governance indicators by balancing regulatory oversight with operational decentralisation.p.2
3. Zero-knowledge proofs and homomorphic encryption face unresolved scalability ceiling constraints and metadata-privacy limitations when scaled to national payment volumes.p.2
4. Cross-chain bridge protocols represent a critical security vulnerability due to governance gaps in upgrade procedures and key management.p.11
5. Mass surveillance risk is identified as the central privacy challenge specific to Central Bank Digital Currencies.p.11
6. Evaluated offline CBDC mechanisms fail to solve double-spending at scale without either a central trust anchor or periodic synchronisation.p.11
7. Smart contract compliance architectures in CBDCs can enforce real-time regulatory rules at throughputs up to 10,000 transactions per second.p.16