marketing

NOTES.md (23978B)

---

 # Sources and caveats for the DG FISMA deck
 
 Every factual claim on a slide is listed here with its source. Items marked
 **CHECK** should be verified before the deck is presented. Items marked
 **DO NOT SAY** are claims that circulate in our own material but that do not
 survive checking — they are listed so nobody reintroduces them.
 
 ---
 
 ## Slide 2 — Five disputes, one root cause
 
 - Council: the Council's own document ST 16695/25 is headed "Mandate for
   negotiations with the European Parliament", December 2025. The ECB calls it
   a "General Approach". Both are in circulation; the Council's wording is the
   accurate one.
 - **Parliament has NOT adopted a first-reading position.** OEIL still records
   "Awaiting Parliament's position in 1st reading". The 9 July 2026 plenary
   vote was a **Rule 72 confirmation of the committee's negotiating mandate**.
   The ECB's FAQ loosely says Parliament "adopted its position" — do not copy
   that; this audience will know. **Say "Parliament confirmed its negotiating
   mandate on 9 July 2026."** The 416-169-22 figures relate to that Rule 72
   vote and are **UNCONFIRMED** — the EP does not publish them. Do not quote
   a vote count.
 - Trilogue opened mid-July 2026. Latest public four-column table is
   WK 13561/2026 of 4 September 2026; the outcome of the 30 September 2026
   trilogue is not public. ECB pilot: **second half of 2027, 12 months**
   (three different ECB formulations circulate — "mid-2027", "H2 2027",
   "September 2027"; use H2 2027). First issuance targeted 2029.
 - **The Rulebook evidence on the slide.** ECB, "Digital euro scheme
   rulebook", version 0.91, DRAFT, 2 July 2026, glossary: *"User Alias — A
   unique pseudonymous identifier used to protect user's identity when
   processing digital euro payments that can only be attributable to an
   identifiable natural or legal person by the payment service provider
   distributing the digital euro or by the digital euro user."* Across the
   full extracted text of that draft there is no occurrence of "anonymity",
   "anonymous" or "blind signature". **CHECK** against the current published
   version — it is an interim draft and its own cover notice says so.
 - The claim that the Rulebook fixed the architecture before the privacy
   question was settled: Gütschow & Lucke, "The proposed design of the digital
   euro: A critical analysis", *Digital Finance*, December 2025,
   doi:10.1007/s42521-025-00171-2 (peer-reviewed, open access); and
   Cannataci, Fehrensen, Gütschow, Kesim, Lucke, "Digital Euro: Frequently
   Asked Questions Revisited", arXiv:2601.18644 v2, 8 July 2026.
 
 ## Slide 3 — "Cash-like" and pseudonymous are not the same thing
 
 - The de-anonymisation-by-correlation argument and the "no procedure to
   obtain a new identifier" point: fqa.t-euro.eu Q9; Jurjen Bos, "Digital
   Euro: a missed opportunity for privacy", Medium, 16 October 2026.
 - The ECB wording change from "would not **be able to** identify" to "would
   not identify": fqa.t-euro.eu Q3, with an Internet Archive citation.
   **CHECK** before using it out loud — it is a strong rhetorical point and
   will be challenged.
 - **"Only PSPs will be able to identify the end user and link that identity
   to individual transactions."** ECB, Third progress report on the digital
   euro, 16 July 2025, section on technical input on privacy and data
   sharing. This is the ECB's own wording and is the strongest single quote
   in the deck — read it verbatim.
 - Per the ECB's own FAQ, for online transactions the Eurosystem would not
   identify users "but PSPs would be able to identify users for the purpose of
   compliance with anti-money laundering rules". Privacy is tiered by actor,
   not global.
 
 ## Slide 4 — The demand is already on the record
 
 - 43% ranked privacy first: ECB public consultation on a digital euro,
   reported in the Eurosystem report, April 2021. Quoted in the
   epicenter.works open letter.
 - 94% / 59%: Deutsche Bundesbank study on payment behaviour, 2020, as cited
   by Ballaschk & Paulick (below). Say "the Bundesbank's 2020 payment
   behaviour study" — it is a national figure, not euro-area.
 - **BIS:** Auer & Böhme, "Central bank digital currency: the quest for
   minimally invasive technology", BIS Working Papers No 948, June 2021:
   *"All this brings us back to David Chaum ... the time finally seems ripe
   for computer scientists and central bankers to join forces and bring to
   light a true electronic complement to cash."* Footnote 25 cites Chaum,
   Grothoff & Moser (2021). This is the strongest institutional endorsement
   available and it is worth quoting.
 - **Banca d'Italia:** Urbinati et al., "A digital euro: a contribution to
   the discussion on technical design choices", *Mercati, infrastrutture,
   sistemi di pagamento*, Questioni istituzionali No. 10, July 2021, §2.6
   specifies an eCash component using blind signatures and cites the SNB
   paper. **The ECB republished it on its own site** as Eurosystem
   experimentation documentation (listed 11 October 2021) — that republication
   is the point, so have the ECB URL to hand.
 - **Bundesbank staff:** Ballaschk & Paulick, "The public, the private and
   the secret: Thoughts on privacy in central bank digital currencies",
   *Journal of Payments Strategy & Systems* 15(3), 2021, 277–286, hosted on
   bundesbank.de. Describes the Chaum–Grothoff–Moser framework accurately,
   then says whether it would "sufficiently and effectively ensure regulatory
   compliance is open to debate". Cite as a **staff publication**, not a
   Bundesbank position.
 - Rapporteur Fernando Navarrete Rojas (EPP) initially proposed a
   token-based/offline-first instrument; the June 2026 ECON position moved to
   parallel offline plus account-based online. Source: heise, 9 July 2026.
   **CHECK** — this is the single most useful fact in the deck for this
   audience, and the wording on the slide ("initially proposed a token-based
   instrument") should be confirmed against the draft report itself.
 - 14 civil-society organisations: "A Call to EU Co-Legislators: The Digital
   Euro as an Opportunity for European Privacy", Brussels, 17 June 2026,
   organised by epicenter.works, signed by EDRi, Homo Digitalis, Access Now,
   Bits of Freedom, Digitalcourage and others — **including Taler Operations
   AG and Taler Systems SA**. Declare that interest if the letter is cited.
 - The Austrian central bank: Summer & Hermanky, "A digital euro and the
   future of cash", OeNB *Monetary Policy & the Economy* Q1-Q2/22. The OeNB
   text says GNU Taler **"could be an ideal template"**; the BFH press release
   says "recommends". The slide says "has described ... as a possible
   template", which matches the OeNB wording. **Do not upgrade this to
   "recommends".**
 - Related and stronger for this audience because it is a central bank's own
   working paper: Martin Summer, "Privacy by design for public digital money",
   OeNB Working Paper 278 — the technical authority cited in the open letter.
 
 ## Slide 5 — The other way to build it
 
 - Mechanics are as in Dold, "The GNU Taler system: practical and provably
   secure electronic payments", PhD thesis, Université de Rennes, 2019.
 - **The exchange, not the merchant, detects double-spending.** The draft deck
   had this wrong. The merchant deposits the coins and the operator performs
   the check.
 
 ## Slide 6 — Architecture
 
 - `images/operations.png`, the project's canonical diagram. It labels the
   escrow node "Central Bank or Exchange's Bank", which carries the two-tier /
   sCBDC story, and it shows the independent Auditor.
 
 ## Slide 7 — Asymmetric privacy answers AML
 
 - Welfare-optimality: Katrin Tinn, "A Theory Model of Digital Currency with
   Asymmetric Privacy", *Management Science*, 2025,
   doi:10.1287/mnsc.2024.06830. Peer-reviewed; this is the strongest
   third-party card in the deck and is worth naming out loud.
 - Income transparency and KYC at the perimeter: taler.net/en/governments.html
   and Dold 2019.
 
 ## Slides 8–9 — Offline
 
 - CAP theorem: Gilbert & Lynch, SIGACT News 33(2), 2002. Applied to payments
   in Grothoff & Dold, "Why a Digital Euro should be Online-first and
   Bearer-based", 26 March 2021 — "There is no third choice."
 - Chaum, Fiat & Naor, "Untraceable Electronic Cash", CRYPTO '88: fully
   offline anonymous cash cannot *prevent* double-spending.
 - Damage scales with transaction volume, not stored balance, and an attacker
   can provoke the outage: Grothoff & Dold 2021.
 - No European manufacturer of smartphone secure elements: Gross, Sedlmeir,
   Babel, Bechtel & Schellinger, SSRN 3891121, 2021.
 - The timeline figure is lifted from `2026-dielinke`. Vendors and dates are
   rendered in the figure itself; the `\cite` keys were stripped, so no
   bibliography is needed. If a reference list is wanted, `extra.bib` is in
   this directory and taler.net/en/news/2021-03.html keeps a rolling list of
   later breaks (TPM 2.0, Intel SGX/Downfall/Wiretap, AMD SEV-SNP, EUCLEAK on
   Infineon/YubiKey).
 
 ## Slide 10 — Holding limits
 
 - €3,000 retail / zero for business: Grothoff, Gütschow & Seehausen, "Taler as
   a synthetic Central Bank Digital Currency", Springer 2026,
   doi:10.1007/978-3-032-22946-5_9, §6.2. ECB analysis of limits up to €3,000
   is also in the ECB's own progress reporting; published academic range is
   €500–10,000.
 - **Banca d'Italia on eCash:** *"anonymity is of an asymmetric type and is
   guaranteed only in the phase of using tokens for the payer. During the
   withdrawal phase, the system is able to apply all the limits and controls
   typical of an account-based system."* (MISP Questioni istituzionali No. 10,
   July 2021.) This is the best answer to the holding-limit objection in the
   whole pack, because it comes from a Eurosystem national central bank and
   sits on the ECB's own website.
 - The four levers: Dold, "Taler as the Foundation for a European Retail
   Centrally Banked Digital Currency", response to the ECB InnovationLab
   expert group, ~2018, requirement V2.
 - "Replicates cash rather than deposits, so monetary policy and financial
   stability are not materially affected" is a close paraphrase of **Chaum,
   Grothoff & Moser, "How to Issue a Central Bank Digital Currency", SNB
   Working Paper 3/2021**. Attribute it — a Swiss National Bank working paper
   carries more weight here than we do.
 
 ## Slide 11 — Cost and competition
 
 - **€1.3bn is cumulative to first issuance in 2029** and covers internal and
   external components; **€320m a year from 2029**, which the ECB expects
   seigniorage to offset. (Cipollone reportedly said ~€300m/year to an Italian
   committee in February 2026 — use the published €320m.)
 - **Do not say €1.16bn is "committed".** The five framework agreements of
   2 October 2025 have an *estimated* value of €432.1m and a *ceiling* of
   €1.164bn; **no payments have been made** and the ECB says scope can be
   adjusted if the legislation changes. A sixth procurement (network
   connectivity, ceiling €355.3m) has no award notice yet. Ceilings must not
   be added to the €1.3bn.
 - **The cost of bank adaptation is contested by a factor of three to four,
   and that is the honest framing.** PwC *Digital Euro Cost Study*, June 2025,
   commissioned by the EBF/ESBG/EACB, 19 banks in nine markets on rulebook
   v0.8a: euro-area total **€18bn**, rising to as much as €30bn; average bank
   €124m (€110m is the figure excluding offline, multiple accounts and
   merchant acquiring). The ECB's rebuttal — "A view on recent assessments of
   digital euro investment costs", 10 October 2025, with Roland Berger —
   gives **€4bn–€5.77bn**, against the Commission's own 2023 impact assessment
   of €2.8bn–€5.4bn. Presenting only the industry number would be one-sided
   and this audience will know both.
 - Tender turnover thresholds: ECB tender PRO-007480 required average annual
   net turnover of €100m overall and €10m in comparable services.
 - Reported component costs: up to €55.8m for alias lookup, up to €661m for
   offline token development (heise, 9 July 2026). The NGI Taler expert
   statement names tender PRO009485 and the €56m figure.
   **CHECK before using a number out loud.** The slide deliberately leads with
   the *thresholds* (the structural point, and squarely DG FISMA's domain)
   rather than with the waste allegation, which reads as sour grapes if it
   leads. Saying plainly that we could not bid is what defuses that.
 
 ## Slide 12 — Sovereignty
 
 - "Non-discriminatory standard adoptable by any country": the formulation is
   from the 2022 Taler CBDC brochure. **DO NOT SAY "without patents"** — a
   patent application has since been filed on the offline payment design.
 - "What happened with e-mail can happen with payments" and the CLOUD Act
   point: epicenter.works open letter, 17 June 2026.
 - SuperStack / Open Internet Stack: €32m Horizon Europe to end-2029 under
   DG CONNECT, 3 consortia, 70 partners; grant agreements 101298715 (ELFA),
   101342483 (SuperFOSS), 101342489 (SuperAPPS), 101342989 (SuperSAFE); €3.8m
   passed to third parties as cascade funding. Taler sits in the platform
   services layer. Read off the draft deck's own slide 5 at high resolution —
   **CHECK against the project pages.** This is an internal-Commission
   coherence argument and is worth getting exactly right.
 
 ## Slide 13 — Inclusion
 
 - Children cannot open bank accounts; >5 million in the EU aged 10–18
   (Eurostat), from "Central Bank Accounts are Dangerous and Unnecessary",
   4 March 2022.
 - Field testing: the Freetown oral-information-management trial, 21
   participants, 6 local languages, only 4 with completed primary school and 6
   able to read a five-digit number. After a 24-hour gap, 16 completed all 8
   tasks with no errors and 4 completed with two tries and no help — hence
   "20 of 21 completed every payment task unaided". 1 failed.
   **Say the sample size.** It is 21 people, and overstating it would be the
   easiest thing in the deck to discredit.
 - Browser and terminal support: the comparison table at fqa.t-euro.eu scores
   the digital euro ✗ on browser and terminal.
 - COM(2023) 367 (PSR proposal) Art. 88 would forbid making strong
   authentication depend on possessing a smartphone — useful in discussion,
   but it is a proposal, not in force.
 
 ## Slide 14 — Where the software actually is
 
 This slide exists so that the rest of the deck is credible. Keep it honest.
 
 - Live in Switzerland: Taler Operations AG, Biel. Operating under the **FINMA
   sandbox exception** (Banking Ordinance Art. 6 para. 2) with supervision
   delegated to **VQF** as the self-regulatory organisation under GwG Art. 14.
   **DO NOT SAY "regulated by FINMA" or "audited by the Swiss regulator".**
   The operator's own legal notice states it is *not* supervised by FINMA and
   that escrowed assets are not covered by deposit insurance.
 - CHF 1m ceiling on total public deposits — that is the binding constraint,
   and stating it ourselves is what makes the rest believable.
   Source: NGI TALER deliverable D2.1, "Swiss Sandbox Report",
   Ares(2025)4305905, 28 May 2025.
 - Operator limits: withdraw ≤ CHF 2,500/month or 15,000/year; ≤ CHF 1,000 per
   transaction. These are *risk-based operator* limits, not a statutory cap on
   what citizens may hold — that contrast with the €3,000 ceiling is the point.
 - 28,500 transactions/s: Boss, "GNU Taler Scalability", BFH bachelor thesis,
   2022, measured on Grid'5000. The euro-area requirement of ~100,000 TPS and
   the ~2,000 TPS figure for Switzerland are from the same thesis, attributed
   to Giesecke+Devrient. **DO NOT SAY "100,000 TPS capability"** — that is the
   requirement, not a measured result, and it appears as a capability claim in
   some of our own marketing.
 - Hungary: MagNet Bank is a consortium partner and is in internal alpha. One
   internal deck says Q2 2027. The slide says "2027 at the earliest", which is
   the defensible form. **DO NOT SAY Hungary is live or imminent.**
 - Fully offline (both sides) is unsolved. What works is an offline *merchant*
   with an online wallet, via one-time passcodes (Huang, Benoist, Grothoff &
   Marchano, SUERF Policy Brief 622, June 2023).
 - Direct debit / pull payments: structurally impossible for a bearer design —
   if the payer holds the value, nothing can be pulled from them. Must be
   emulated with a standing instruction in the wallet. Roughly 75% of
   euro-area recurring payments are direct debit, so expect this question.
 - No user or merchant numbers exist anywhere in our material. **Do not invent
   one.** The TOPS merchant map is JavaScript-populated and served empty.
 
 ## Slide 15 — The objections, and the answers
 
 This slide exists because DG FISMA will already have read these. The three
 quotes are real and should be attributed precisely:
 
 - **ECB:** "Digital euro — Privacy options", presentation to the Eurogroup,
   ECB-PUBLIC, 4 April 2022, slide 4: *"User anonymity is not a desirable
   feature, as this would make it impossible to control the amount in
   circulation and to prevent money laundering."* Earlier in the same
   register: Report on a digital euro, October 2020, §5.1.2 — *"Anonymity may
   have to be ruled out"*.
 - **BIS:** Annual Economic Report 2021, Chapter III: a token-based CBDC with
   full anonymity *"could facilitate illegal activity, and is therefore
   unlikely to serve the public interest"*. Note the same chapter concedes
   that *"preventing the erosion of privacy warrants a cautious approach to
   digital identity"*.
 - **Riksbank:** Armelius, Claussen & Hull, "On the possibility of a cash-like
   CBDC", staff memo, February 2021: token designs *"appear not to have a
   greater capacity"* than account-based ones, and the perception that they do
   is *"misguided"*. The opening is that the memo argues a ledger defeats
   privacy **by definition** while never engaging a blind-signature design —
   it contains no mention of Chaum, blind signatures or Taler. Say that
   carefully and without sneering; the authors are serious people.
 
 Also worth knowing if it comes up: Fabio Panetta told ECON on 14 April 2021
 that *"the identity of users could be kept separate from payment data,
 allowing only financial intelligence units to obtain this information"* —
 which is closer to our model than the ECB's later positions.
 
 One useful negative: Bindseil & Pantelopoulos, "Towards the holy grail of
 cross-border payments", ECB Working Paper No 2693, August 2022, evaluates six
 candidate architectures and mentions privacy once, as a drawback bullet on
 BigTech stablecoins. Blind signatures, Chaum and anonymity appear nowhere.
 Use it only if the conversation turns to cross-border.
 
 ## Slides 16–18 — The asks
 
 The four text asks and the pilot ask are ours; items 1 and 3 overlap
 deliberately with demands 1 and 3 of the epicenter.works letter, so there is
 already a civil-society coalition behind them.
 
 **Judgement call flagged for you:** cryptographic agility was cut from the
 ask slide, per the steer that post-quantum work is ready in theory but not in
 implementation. There is no PQC claim anywhere in the deck. If you want it
 back, the honest framing is "require that the design be able to replace its
 primitives", not "require post-quantum readiness".
 
 ---
 
 ## Q&A preparation — the questions that will actually come
 
 **"Is Taler post-quantum?"**
 No, and neither is anything else in production. NGI TALER deliverable D5.3
 (Lange & Levin, 28 November 2024) states plainly that Taler's protocols use
 only factoring- and discrete-log-based public-key cryptography and are
 susceptible to quantum attack. What exists is cipher-agility in the protocol
 (RSA and Clause Blind Schnorr are both supported) and a completed design
 study. Outstanding: roughly 18–24 months and ~€750k. Note also that
 Chaum-style blind signatures are one round trip while the best lattice-based
 blind signature proposals need two, so this is not a drop-in substitution.
 **Do not let "quantum-proof" marketing from taler-ops.ch or paivana.ai be
 attributed to the project** — it contradicts our own published deliverable.
 
 **"Have you put this to the ECB or the Commission formally?"**
 Honest answer: not through the formal channels. There is no Taler submission
 on record in the Commission's feedback on COM(2023) 369, Taler is not in the
 ECB's Rulebook Development Group as of September 2026, and no Taler
 representative has appeared before ECON. The engagement that exists is
 academic publication, a 2020 EP written question and our published reply, the
 CNIL-organised CPDP panel in May 2026, and the co-signed open letter. This
 asymmetry is worth naming before someone else does — and it is an argument
 for the meeting, not against it.
 
 **"Why didn't you bid?"**
 The turnover thresholds. Say it plainly and without grievance.
 
 **"Isn't this just a vendor pitch?"**
 The asks are deliberately architecture-neutral and none of them awards
 anything to us. Ask 2 explicitly tells the legislator *not* to put the
 token choice in the Regulation.
 
 **Paivana:** the draft deck leaned on it. It is not an NGI TALER partner, it
 is not mentioned on taler.net, and its public claims ("quantum-proof",
 "audited by Swiss Regulator", "~100,000 TPS", "150,000 users", a "$3–5T"
 market) are variously unsourced or contradicted by the project's own
 documents. It is deliberately absent from this deck. If agentic payments come
 up, the defensible points are that Taler's merchant API already returns HTTP
 402 normatively, and that the 402 standardisation space is live and currently
 dominated by non-European actors (Nottingham's IETF draft of August 2026; the
 x402 Foundation under the Linux Foundation since July 2026 with Google,
 Visa, Mastercard, Stripe and Cloudflare as premier members). **Do not quote a
 market-size figure** — no independent authority has sized it.
 
 ---
 
 ## Build
 
 `make` (two pdflatex passes; the second is required for the title-page and
 header wedge, which use TikZ `remember picture`).
 
 Style is `taler-macros.tex` as used by 2026-pqc / 2026-rbi / 2026-dielinke.
 `\SUB` appears in the footer of every slide and must fit on one line.
 
 ---
 
 # Corrections applied October 2026 (after the deck was first drafted)
 
 - **"Live in Switzerland in regulated CHF, under the FINMA sandbox regime"**
   → **"Live in Switzerland in CHF under the FINMA sandbox exemption — not
   FINMA-supervised; AML through a recognised SRO".**  The old wording
   contradicted the "do not say" note already in this file.  The operator's own
   legal notice reads: *"Taler Operations is not supervised by the Swiss
   Financial Market Supervisory Authority (FINMA)."*  FINMA confirmed in
   December 2022 that the business model falls *outside* licensing under BankV
   Art. 6 ¶2 — the opposite of a clearance.  SRO (VQF) membership since
   7 March 2024.
 - **"v1.5"** → **v1.6**, which is the current release.
 - **"28,500 transactions/s measured"** → **"measured at reduced key sizes"**.
   The Grid'5000 experiments (Boss & Grothoff, BFH 2022) ran 1024-bit RSA; the
   thesis says production would want ≥2048 and argues the gap is recoverable by
   switching Libgcrypt→OpenSSL, but that is an argument, not a measurement.  If
   pressed on production key sizes, the honest answer is unverified.
 - **"Hungary 2027 at the earliest"** → **"Hungary in internal alpha, with no
   launch date announced"**.  Our own decks carry launch dates from Q3'2025 to
   Q2'2027; Magnet Bank has published none, and its project page gives no
   timeline.  Note the EU grant period ends 30 November 2026.
 - Layout: on the "Asymmetric privacy answers AML" slide the two closing
   bullets were being typeset inside the right-hand column, so they read as a
   continuation of the "Payee" list.  They are now a full-width paragraph.
 
 See NOTES-alt.md for the full sourcing behind these, and for the further
 "do not say" items that came out of the same round of checking.