In October 2025 the Eurosystem concluded framework agreements for five components of the digital euro: alias lookup, risk and fraud management, application and software development, secure exchange of payment information and an offline solution. Risk and fraud management was tendered at an estimated €79.1m and a maximum of €237.3m, with an initial term of four years.
The agreements do not commit the Eurosystem to spending or building anything; a decision to issue follows the regulation. But they say what has been specified closely enough to be tendered, and that is a more candid statement than most published material on the project.
Two security models
What has been specified for fraud is worth reading carefully. The central mechanism is described as providing a risk score for every transaction, peer to peer and peer to merchant, derived from deviations from a customer’s typical behaviour, interactions and history, which payment providers combine with their own assessment before deciding whether to approve a payment. Alongside it sits an ex-post capability: analysis across multiple providers of transactions that have already settled, to identify fraud after the fact from a view no single provider holds.
Both halves assume the same thing. A score built on deviation needs a stream to deviate from, and it needs to be computed before the payment completes. An ex-post analysis needs records to compare. Each requires the transaction to arrive somewhere central, either in time to influence the decision or soon enough afterwards to be worth acting on.
The offline instrument is defined by the interval in which the transaction does not arrive. That is not a defect of it; it is what offline means. Value settles locally between two devices, and the central infrastructure learns of it later, when one of the parties reconnects. During that interval there is nothing for a central mechanism to score and nothing settled for it to analyse.
So the digital euro has two security models, and only one of them has been described in any detail. The fraud layer that has been tendered, at a scale of up to a quarter of a billion euros, is specified for the instrument that is connected. The offline instrument was tendered separately, and what has been said about its safeguards, beyond the secure hardware itself, places them at the exit.
How does offline functionality work in practice?
A 2024 technical session of the Euro Retail Payments Board describes a security and integrity check when offline value is defunded to confirm that the funds returning to the system are genuine. That is detection after the fact, the digital counterpart of a banknote reaching the bank counter: it finds a copy once it has been spent, and it does not tell the next recipient to refuse it. More may well have been specified in the offline contract. What it is remains a fair question to put to a component whose whole purpose is to work when the rest of the system cannot see it.
The question is not academic, because the obvious answer does not survive inspection. The obvious answer is that offline exposure is capped, so the loss is bounded whatever happens. But a cap on what a device may spend while disconnected is enforced by the device, and in the case that matters the device is the thing that has failed. A limit is worth what the party enforcing it is worth. The cap on funding the wallet is enforced by the issuer while the device is online and it binds; the cap on spending while offline is enforced by the component under suspicion, and against someone who has compromised it that is not a constraint but a setting.
The second answer is that losses will be absorbed. That settles who pays and not what stops the episode. It is also the answer that works least well where it is most needed. Merchants are not squeamish about undetectable losses: they accept banknotes they cannot reliably authenticate and bear the entire loss when one proves false, because the rate is low and roughly known and production costs hold it there.
What a merchant will not carry is a rate they cannot bound. A compromised secure element is precisely the case where production cost no longer holds the rate down, because a technique developed once can be reapplied across devices of the same batch at little further cost. Reimbursement tells a merchant they will be repaid. It does not tell them how much of what they take tomorrow is good.
Nor has the issuer offered to absorb the loss itself. When the European Central Bank addressed liability for fraud in its 2023 stocktake of the project, it pointed to the payment provider, the merchant or, in some cases, the consumer, and not to itself. Neither the regulation nor the scheme rulebook is final, so this is a stated position rather than a rule, and the merchant who took the copy is among the parties it names.
Big questions still need answers
The holding limit, which is the other containment lever, has not been set, and who sets its ceiling is still being negotiated in the regulation. Parliament would have the Commission set it by delegated act on the ECB’s recommendation; the Council would leave it to the member states, by an implementing decision adopted by reinforced qualified majority. Whichever formula prevails, the figure is being calibrated for financial stability – to limit deposit flight from commercial banks – rather than for fraud containment, and it would be worth knowing whether the two calculations have met.
None of this argues against offline capability, which is the most defensible feature of the whole project and the one that answers a real need. But the debate on offline resilience cannot remain confined to technical papers while procurement moves ahead. In an earlier article, I asked two questions. What artefact would allow a compromise to be identified after the fact: which units, from which device, within what window? And who bears the loss when it cannot be? Both have now acquired a financial dimension.
A framework worth up to a quarter of a billion euros covers the scoring of connected transactions, while the offline instrument, so far as it has been described, checks value as it leaves rather than while it circulates. The ECB aims to be ready for a first issuance in 2029 if the regulation is adopted this year, with a pilot before then. That interval is the cheapest moment to give the offline instrument an explicit containment mechanism and a deliberate liability rule. If those choices are not made during implementation, the first compromised device will make them, and the first to learn the answer will be a merchant standing at a disconnected till.
Tzanko Golemanov is a lecturer in the Department of Computer Systems and Technologies, “Angel Kanchev” University of Ruse. The architecture referred to here is set out in full in an open preprint at Zenodo, https://doi.org/10.5281/zenodo.22163575.
Interested in this topic? Subscribe to OMFIF’s newsletter for more.