What Should Be Programmable?
The central question is no longer whether digital money can be given conditional behavior. It can. The more important question is what that behavior changes: does it coordinate the transfer of ordinary money, or does it create an asset whose restrictions travel with whoever holds it? This final synthesis brings together the New York Fed’s monetary framework, Project Agorá’s wholesale platform and testing, and the IMF’s CBDC legal analysis to reach a practical judgment about where programmability belongs, what evidence is needed, and which properties must remain stable.
The answer is not that programmable payments are harmless or that programmable money is always unacceptable. The answer is more precise. Payment-level conditions can add useful coordination while allowing the recipient to receive basic money. Asset-level conditions can serve specialized purposes, but they create a different object and therefore a higher burden of explanation, authorization, and protection. The distinction is a design choice with monetary, operational, and legal consequences—not a choice between “old money” and “new technology.”
A design test, not a technology label
A reliable judgment starts with the object the recipient receives. A platform may display a balance, a token, or a certificate, but the label does not reveal the object’s rights. The first question is whether the transfer changes control of basic money, a readily convertible deposit claim, or a program-created certificate with its own conditions. The second is where the condition lives. A rule that waits for delivery confirmation, a compliance decision, or another payment leg can govern the payment process. A rule that limits later use, eligible holders, or the life of the unit governs the asset.
The remaining questions refine that first distinction. If the program-created object can pass from one holder to another, its conditions can travel. If satisfying the program releases basic money, the condition can end in a payment. Transferability and convertibility are independent, so the result may be a pure programmable payment, a pure programmable-money object, a hybrid, or neither. The category follows what happens in the transaction, not what the system is called.
This is why the New York Fed’s two-layer model remains useful after the technical details change. The asset layer records ownership; the program layer contains instructions that change control or balances. Money is the asset-layer stock. A payment is the flow that transfers it. A recurring payment can therefore use a program without changing the money in the asset layer. A restricted certificate can use the same kind of program while changing the rights that circulate.
The economic consequence is measured by the qualities of good money. No-questions-asked acceptance means a recipient need not perform costly due diligence about the value or likely acceptance of the unit. Uniformity means equal denominations have equal value. Fungibility means units and portions can substitute for one another. Convertibility helps preserve those properties when a condition is met and the recipient receives basic money. If a restriction remains attached, the recipient must ask where the asset can be used, who may hold it, and whether the next counterparty will accept it at face value.
A useful way to apply the test is to remove the condition mentally after the first transfer. If the recipient then holds ordinary money that can be used for an unrelated purpose, the condition probably controlled the payment flow. If the recipient still holds an object that cannot be spent, transferred, or redeemed without the original rule, the condition is part of the asset. The counterfactual is not a legal test by itself, but it exposes whether the payment instruction disappears at settlement or remains part of the thing received.
This approach also explains why no single technology decides the outcome. Automation means that a rule can execute without a person pressing the last button. Tokenization means that a claim is represented in a digital form. Programmability means that rules can govern behavior. A conventional database, a distributed ledger, or another platform could support all three. The decisive variable is the relationship between the rule and the monetary object.
That relationship creates a trade-off rather than a universal winner. Restrictive asset-level programming could support a specialized purpose, but it may make the asset information-sensitive and less money-like. A transferable restricted certificate can circulate without becoming accepted at par. A central bank or other authority could guarantee conversion into basic money, preserving uniformity, but that guarantee would also remove much of the reason to issue a restricted instrument. The New York Fed’s sharper policy question is therefore whether the benefit of programming the asset cannot be achieved by programming the payment instead.