One ledger engine serves the central bank, commercial banks, and citizen wallets — with cryptographic role separation, not administrative trust. Every participant is a first-class tenant whose authority is defined by keys, not configuration.
The engine models the monetary hierarchy directly, so each tier operates on the same ledger under different signing authority.
The issuing authority holds the root of the tenant hierarchy and is the only tenant permitted to mint or retire base money. Its authority is expressed as a signing role, not an admin flag.
Chartered institutions operate as intermediary tenants that hold balances, onboard customers, and originate transactions under delegated authority from the central bank tier.
End-user wallets are leaf tenants that can hold and transfer value but hold no minting or delegation rights. The same protocol rules apply to them as to every tier above.
All three tiers post to one hash-chained ledger. There is no reconciliation step between tiers because there is no second copy of the truth to reconcile against.
What a tenant may do is determined by which keys sign its transactions, verified at the protocol layer rather than by an application enforcing an access-control list.
Each role carries a distinct signing capability. A commercial-bank key cannot produce a valid mint instruction because the ledger will not accept a mint signed by anything other than the issuance authority.
There is no operator account that can act across tenants. The engine has no code path that lets an administrator move another tenant's balance or impersonate its role.
When the central bank grants a commercial bank authority to operate, that grant is a signed on-ledger act with defined scope, visible in the chain and revocable by the same authority.
Every role assertion is signed with ML-DSA-65 (FIPS 204), so role separation survives the arrival of cryptographically relevant quantum computers.
Tenants share the engine and the ledger, but no tenant can observe, alter, or infer another's private state beyond what settlement requires.
A tenant can read and prove its own positions but cannot enumerate another tenant's holdings. Cross-tenant visibility is limited to the counterparties and amounts of transactions they jointly participate in.
A misbehaving or compromised commercial-bank tenant cannot corrupt the ledger for others; the worst it can do is submit transactions that the protocol refuses. Its blast radius stops at its own signed authority.
Each tenant custodies its own keys in its own environment. The engine never holds a tenant's private key, so operating the shared engine confers no ability to sign on a tenant's behalf.
Collapsing the hierarchy onto a single engine removes whole classes of integration and reconciliation work that fragment conventional CBDC stacks.
Because the central bank, banks, and wallets transact on the same ledger, there is no nightly netting between separate systems and no window in which two systems disagree about a balance.
Protocol changes are applied once to the shared core rather than negotiated across many bespoke bank integrations, shrinking the coordination cost of evolving the currency.
Admitting a new commercial bank or wallet is an on-ledger event under the issuer's authority, not a manual database provisioning step, so the participant roster is itself part of the auditable record.
The engine and its ledger run entirely within the issuing nation's environment, so multi-tenancy never implies that any tenant's data leaves sovereign jurisdiction.