The wallet is where sovereign money meets the person holding it. Keys can live with the citizen or with a hosted guardian, but the currency is central-bank money either way.
Every wallet resolves to a signing identity, whether that identity is held on the device or by a regulated guardian.
The private signing key is generated and stored on the citizen's device and never leaves it. The central bank issues and validates value, but cannot move a self-custodied balance without a signature from the holder.
Citizens who prefer not to manage keys can hold value through a regulated wallet provider acting as guardian. The guardian signs on the holder's behalf under a mandate recorded on the ledger, so the delegation itself is auditable.
A hosted wallet can be upgraded to self-custody, and a self-custodied wallet can appoint a guardian, without reissuing the underlying balance. Custody is an attribute of the account, not a property of the money.
Wallet keys use ML-DSA-65 under FIPS 204, so authorizations remain verifiable against a signature scheme chosen to survive quantum-capable adversaries rather than one retrofitted later.
Identity binding is tiered so a wallet can exist before full verification and expand as evidence accumulates.
A new wallet can be created and funded to a low ceiling with no identity documents, giving unbanked citizens an on-ramp. The tier is enforced by the ledger, not by the app, so limits cannot be bypassed client-side.
Presenting national identity, biometric enrolment, or an accredited credential lifts the wallet to a higher tier. Each verification event is recorded as a state transition rather than a flag that can be silently edited.
Identity attributes are bound to the wallet as verifiable credentials, so the wallet can prove it satisfies a policy — over-eighteen, resident, sanctioned-list-clear — without exposing the underlying document.
A lost self-custodied wallet is recovered through a citizen-nominated recovery set or a national-identity re-bind, and a compromised credential is revoked at the issuer without invalidating the citizen's balance.
Offline capability treats the disconnected case as a first-class settlement path with its own integrity guarantees.
Two devices in physical proximity exchange value over local links without a network round-trip. The payer's device signs and hands over a value token that the payee's device verifies against the issuer's public key.
Offline balances are held in a hardware-isolated purse with a monotonic counter, so the same value cannot be presented twice. On reconnection the chain of offline transfers reconciles against the ledger and any conflict is surfaced.
The offline purse carries a policy-set ceiling and a maximum hop count before a transfer must touch the ledger, so the systemic risk of disconnected value is deliberately capped rather than open-ended.
When connectivity returns, queued offline transfers settle atomically in order, each one anchored into the hash-chained ledger so the offline period leaves a complete, tamper-evident record.
Monetary policy and consumer protection live in the account state, not in an app that can be sideloaded around.
Each tier carries a maximum balance the central bank can set to shape adoption or manage disintermediation. An inbound transfer that would breach the ceiling is rejected or routed to a linked deposit account by rule.
Per-day and per-transaction limits are evaluated at settlement, so a wallet cannot exceed its tier's throughput regardless of how many devices or sessions it runs in parallel.
Citizens can bind their own limits — spending caps, merchant categories, cool-down windows — to a wallet, giving self-directed protection that the ledger enforces rather than the app suggests.
Any limit change, whether by the citizen or a supervisory authority, is written as a signed state transition, so the reason a payment was allowed or blocked is reconstructable after the fact.