The guide aims to help central banks that have already built knowledge and now want to focus more deeply on the requirements and design choices for offline payments with CBDC. It is based on information gathered in a series of workshops conducted across May and September 2023 in collaboration with 12 solution vendors and six observing central banks.

Project Atlas provides data tailored to the needs of "central banks and financial regulators". It fuses data gathered from "crypto exchanges (off-chain data) with data from public blockchains (on-chain data) gathered from nodes." By connecting various sources, Atlas allows for "data vetting, giving users tools to evaluate these markets' economic significance more accurately."

As part of a first proof of concept, Project Atlas derives cryptoasset flows across geographical locations. The approach uses transactions attributed to crypto exchanges in the Bitcoin network, along with the location of those exchanges, as a proxy for cross-border capital flows.

The initial findings indicate that "although relatively small compared with total on-chain network traffic, identified flows between crypto exchanges are significant and substantial economically. Attributing geographical areas to exchanges (where possible) lays out the structure of cross-border flows. Project Atlas provides a starting point for structural analysis across jurisdictions."

See also: 'Project Atlas - Mapping the world of decentralised finance'.

The project tested the cross-border trading and settlement of wholesale central bank digital currencies (wCBDCs) between financial institutions, using new decentralised finance (DeFi) technology concepts on a public blockchain.

The project’s proof of concept successfully tested the cross-border trading and settlement of hypothetical euro, Singapore dollar and Swiss franc wCBDCs between simulated financial institutions. The process relied on three elements: 

• A common technical token standard provided by a public blockchain to facilitate exchange and interoperability between the different currencies.
• Bridges for the seamless transfer of wCBDCs between different networks.
• An Automated Market Maker (AMM), which is a specific type of decentralized exchange to trade and settle spot FX transactions automatically. 

According to the press release, Project Sela "demonstrated the technical feasibility of a retail central bank digital currency architecture that can promote competition and innovation in digital payments by allowing non-bank payment intermediaries to connect directly to the CBDC ledger of the central bank. Leveraging distributed ledger technology (DLT), a proof-of-concept prototype was developed to showcase how the technical implementation of the proposed architecture can incorporate strict cybersecurity, legal and policy requirements."

The report, which was submitted to the G20 Finance Ministers and Central Bank Governors, sets out three main takeaways:

(i) due to underlying economic incentives, "the crypto ecosystem is characterised by congestion and high fees, which lead to fragmentation."

(ii) despite an "original ethos of decentralisation, crypto and decentralised finance (DeFi) often feature substantial de-facto centralisation, which introduces various risks." 

(iii) while DeFi "mostly replicates services offered by the traditional financial system, it amplifies known risks". Moreover, as DeFi does not finance activity in the real economy, its growth is driven by "the speculative influx of new users, with substantial risks to investors."

The report outlines policy options to mitigate the multiple risks crypto poses to investors, the traditional financial system and the economy at large.

BIS said MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, which can be used as a foundation for the development of specific threat models and methodologies to identify and analyse adversary behaviour.

The analysis showed that "there are gaps in existing threat modelling techniques that may not adequately address the threats and associated security controls to properly protect CBDCs that make use of novel technology (eg DLT, smart contracts) from the tactics, techniques and procedures (TTPs5) used by threat actors in the DeFi space. "

Specifically, although the majority of existing TTPs could be used to model the attacks, some will require slight modification, while there exist new attack vectors that do not fit within the framework and will necessitate the creation of new TTPs.

BIS said the 'mean time to attack' (based on the DLT attacks studied in this analysis) is around a 10-month period between the launch of a DeFi implementation and the successful compromise. "This is a key point to note for central banks about to launch a CBDC," said BIS. "They must be thoroughly prepared to adequately monitor and repel both well understood and novel TTPs. Furthermore, this preliminary analysis supports the argument that an official extension of the MITRE ATT&CK framework may need to be undertaken to help properly model attacks against DLT-enabled systems."

The paper classifies policy measures into three categories and identifies different types of initiatives across jurisdictions, including bans, restrictions, clarifications, bespoke requirements, and initiatives to facilitate innovation.