Digital euro, 6/6: who controls the machine?

This article closes our six-part investigation into the digital euro. The fifth part followed the bill. This final part enters the machine itself: central banks, procurement, suppliers, code, keys, phones and networks. The final question is who can take control when something breaks.

The euro displayed in a digital wallet would be a public liability.

The application displaying it would not necessarily be public.

The software producing a fraud score, the table resolving a phone number, the chip holding offline value and part of the network transporting messages could depend on private companies engaged for ten or fifteen years.

That architecture is not an anomaly. A central bank is not meant to manufacture every phone, code every application and lay every fibre connection. Sovereignty does not require the state to write every line of code.

It requires something else: the ability to see, modify, replace and rebuild the system when a supplier, network or gatekeeper is no longer available.

Status as of 15 August 2026. The final regulation has not been adopted and no issuance decision has been made. Five external components already have framework agreements. Six national central banks have been selected for the core. A separate connectivity procurement is under way. Published ceilings are not expenditure and framework agreements do not guarantee that full development has been ordered.

Seven things to remember

• Issuance, holdings and central settlement would remain inside the Eurosystem.
• Six national central banks have been selected for core components.
• Five specialist services have two ranked providers each, producing ten framework agreements.
• Their combined estimated value is €432.1 million; their ceilings total €1.164 billion.
• Alias, app and SEPI can run for up to ten years; fraud and offline for up to fifteen.
• The offline procurement publishes especially strong rights to use, modify and redistribute the solution; equivalent public evidence is not available for the other four components.
• The hardest dependency may sit outside the ECB contracts: app stores, operating systems, secure elements, HSMs and networks.

Public money inside a hybrid machine

The current design can be read through four layers.

The first is monetary. The Eurosystem would issue digital euros, record holdings and perform final settlement. Neither a commercial bank nor an IT supplier would carry the monetary liability.

The second is the Digital Euro Service Platform, or DESP. Its core should be supplied by central banks, while five specialist components are entrusted to private companies under ECB governance.

The third is distribution. Banks and other PSPs would retain the customer relationship: identity, account, support, local fraud controls, disputes, funding and defunding.

The fourth sits in the citizen’s pocket and between data centres: smartphones, operating systems, app stores, secure elements, HSMs, telecoms and network providers.

This decomposition avoids two caricatures.

The first says private companies will issue the euro. They will not carry the monetary debt and cannot create balances at will.

The second says everything will remain under direct Frankfurt control. An infrastructure can retain a public core while depending in daily operation on software, keys and devices administered elsewhere.

Sovereignty sits precisely at the interfaces between these layers.

Six central banks for the core

In July 2025 the Governing Council selected six national central banks:

• Banca d’Italia;
• Banco de España;
• Banque de France;
• Deutsche Bundesbank;
• Lietuvos bankas;
• Oesterreichische Nationalbank.

The ECB describes centralised settlement in which the Eurosystem records and verifies holdings and settlements.

That choice protects the most important element: the monetary ledger and issuance capacity remain public.

It does not yet make the public architecture fully visible.

The open corpus does not allocate precise functions among the six central banks. It does not publicly establish:

• which bank develops issuance;
• which operates the ledger;
• where active sites are located;
• how quorum works;
• who holds root keys;
• how many sites can continue in isolation;
• how another central bank would take over a component.

Some discretion can protect operational security. It also limits public verification of recovery topology.

The conclusion should remain measured: lack of public detail proves neither fragile centralisation nor weak separation of duties. It simply prevents outsiders from verifying the recovery design.

Five private components, ten framework agreements

In October 2025 the ECB published the ranked suppliers for five components.

Alias lookup

The service links the DEAN, the PSP and an alias such as a phone number in order to route a payment.

First: Sapient GmbH and Tremend Software Consulting.

Second: equensWorldline SE Germany.

Estimated value: €27.9 million. Ceiling: €55.8 million. Maximum duration: ten years.

Risk and Fraud Management

The component provides real-time risk scores, post-settlement analysis and a cross-PSP perspective.

First: Feedzai.

Second: Capgemini Deutschland.

Estimated value: €79.1 million. Ceiling: €237.3 million. Maximum duration: fifteen years.

App and SDK

The ECB plans one common app and an SDK allowing PSPs to embed digital euro services in their own interfaces.

First: Almaviva and Fabrick.

Second: Sapient and Tremend.

Estimated value: €76.8 million. Ceiling: €153.6 million. Maximum duration: ten years.

Offline solution

The component should support consecutive payments without a third party in the transaction, for P2P and point-of-sale use, with funding, defunding, maintenance, hosting and a service desk.

First: G+D advance52 and G+D Currency Technology.

Second: equensWorldline.

Estimated value: €220.7 million. Ceiling: €662.1 million. Maximum duration: fifteen years.

SEPI

The Secure Exchange of Payment Information tokenises and detokenises payment information, creates values usable in QR codes, links and NFC, and manages their lifecycle.

First: Senacor FCS.

Second: equensWorldline.

Estimated value: €27.6 million. Ceiling: €55.2 million. Maximum duration: ten years.

Quality carries 60% of the selection weight for alias, app and SEPI, and 70% for fraud and offline. Price accounts for the balance.

The five procedures received 35 tenders in total.

Competition at award time does not guarantee competition after ten years of integration, data and accumulated knowledge.

Estimated values, ceilings and orders

The combined estimated value is €432.1 million.

The combined ceiling is €1.164 billion.

The two figures require discipline.

Estimated value indicates the expected scale of the procedure.

The ceiling is the maximum amount that may be ordered over the life of the agreement.

The framework agreement itself does not automatically create expenditure. The ECB stated at the time of selection that no money becomes payable solely because the agreements were signed. Work is triggered progressively through specific requests or agreements.

The ceiling can cover:

• roughly two years of development;
• staggered roll-out;
• maintenance;
• operations;
• hosting;
• service desk;
• extensions up to ten or fifteen years.

The €1.164 billion sum therefore does not mean the ECB has paid one billion euros to the suppliers.

Nor should it be added mechanically to the €1.3 billion public development estimate discussed in part five. Scope and duration probably overlap in part.

Offline illustrates the difference.

Its estimated value is roughly 51% of the five-procedure total. Its ceiling is close to 57%.

That concentration can reflect:

• cryptographic complexity;
• secure hardware;
• double-spending protection;
• maintenance;
• hosting;
• a long operating period;
• several forms of device.

It does not establish that €662.1 million will be spent.

What the second provider actually guarantees

The ECB initially directs requests to the first-ranked provider. The second is approached if required.

That structure buys a contractual option. It can protect against:

• refusal;
• incapacity;
• disruption;
• additional demand;
• a decision to replace the first provider.

It does not demonstrate technical failover.

Active redundancy requires harder questions.

Does the second provider receive the first provider’s code?

Does it have the same data, keys and environments?

Does it retain a ready team?

Is there a common or compatible implementation?

How many days separate failure from recovery?

Can service continue during the transition?

Can the ECB operate between the two suppliers?

The public notices do not answer.

The rigorous result is therefore:

The ECB has bought contractual redundancy. Operational redundancy remains to be demonstrated.

The distinction is particularly important for the fraud engine.

Another supplier can reproduce an API. Taking over a system that has accumulated rules, statistics, models and operating procedures over several years requires more than a standby contract.

The same challenge applies to aliases. The second provider must import a complete mapping table, prove its integrity, continue lookups and preserve anti-enumeration controls.

For SEPI, tokens, keys and HSMs must move without breaking live payments.

For the app, a new team must rebuild, sign and republish a compatible version in the stores.

For offline, code, applets, keys, provisioning and hardware support all need to move.

A procurement option performs none of those operations by itself.

Corporate concentration behind the ten agreements

The ten agreements do not correspond to ten fully independent corporate groups.

Sapient and Tremend appear together for alias and app. Publicis Groupe acquired Tremend in 2022 to expand Publicis Sapient’s delivery capacity.

They remain identifiable entities in the consortium, but they are not two independent centres of control.

equensWorldline is ranked second on three components: alias, offline and SEPI.

That does not mean Worldline operates all three. It means a meaningful share of the fallback architecture sits within the same group.

The effect can be positive: pan-European payment expertise, interface knowledge and industrial capacity.

It can also create correlated risk: a legal, financial, technical or governance problem at the group could affect several fallback options.

Fabrick belongs to the Sella ecosystem. Its own communication also cites Mastercard and Reale Mutua among its shareholders or supporters.

A non-European minority investor does not establish non-European control. It does show that an “European provider” can remain embedded in global capital and technology networks.

A serious assessment must therefore examine:

• control;
• voting rights;
• subcontracting;
• software dependencies;
• data access;
• replacement capacity.

The flag over the headquarters is not enough.

The European-control clause is a real barrier

The five external procedures require candidates, consortium members and subcontractors to be established in the Union and controlled by Union nationals or entities.

Control can be assessed through:

• capital;
• voting rights;
• direct or indirect decision power.

Contractors must also prevent cooperation with third-country actors from harming security interests or the supply of critical inputs.

This goes beyond a location requirement.

It reduces the risk that a company directly controlled from a third country holds one of the selected components.

It also gives the ECB leverage over changes of control and critical subcontractors.

Its protection remains bounded by what it controls.

It does not guarantee that:

• the cloud is European;
• every library is maintained in Europe;
• the HSM is European;
• the operating system is European;
• the secure element is European;
• the build chain is independent;
• no foreign patent is required;
• support never passes through a subsidiary outside the EEA.

Legal sovereignty over the contractor is a foundation.

It is not a full technical supply-chain map.

The opaque subcontracting layer

Eight of the ten award agreements report subcontracting. Two report none.

The same notices generally omit:

• names;
• functions;
• amounts;
• percentages;
• data access;
• production access;
• operating countries.

A contractor can subcontract very different functions:

• cloud;
• SOC;
• development;
• support;
• HSM;
• TSM;
• testing;
• machine-learning models;
• connectivity.

The European-control clause should apply to relevant parties in the procedures.

The public cannot verify the actual chain.

That opacity is not enough to establish a dangerous dependency. It prevents measurement of concentration and access rights.

A sovereign payment infrastructure should be able to publish at least:

• the list of critical subcontractors;
• their function;
• their country;
• their potential access;
• the approval mechanism for replacement.

Commercial confidentiality does not require concealing the existence of a critical dependency.

Ten or fifteen years: continuity and lock-in

The maximum durations are striking.

Alias, app and SEPI can reach ten years.

Fraud and offline can reach fifteen.

The notices provide a coherent rationale:

• roughly two years of development;
• progressive roll-out;
• scaling after the initial period;
• stability during mass onboarding;
• long-term maintenance and operation.

A central bank cannot change its fraud engine or offline solution as if it were changing a communications agency.

Duration protects continuity.

It can also concentrate:

• knowledge;
• procedures;
• models;
• tools;
• teams;
• bargaining power.

A long contract is not automatically lock-in.

Lock-in begins when exit cannot be demonstrated.

The relevant questions are:

• Is the code available?
• Are formats open?
• Can data be exported?
• Can keys be migrated?
• Are builds reproducible?
• Can public teams operate the service?
• Are extensions conditional on an exit test?

A duration clause protects service.

A recovery exercise protects sovereignty.

What rights over the code?

The clearest answer concerns offline.

The procurement notice says the ECB seeks an end-to-end solution with full rights to:

• use it;
• modify it;
• redistribute it to participating intermediaries.

That is a meaningful recovery guarantee.

It does not answer every question.

The code may include:

• third-party libraries;
• proprietary firmware;
• patents;
• closed build tools;
• hardware modules;
• components with restricted redistribution.

The exact scope of the rights still matters.

The pilot offers a positive signal. Its documentation provides for selected components:

• specifications;
• APIs;
• a reference implementation;
• offline SDK source code;
• a sample application;
• test scripts.

These deliverables improve integration and auditability.

They concern a beta pilot and do not prove that the full production implementation will be published.

For alias, fraud, app and SEPI, the public notices describe development, maintenance and operation. They do not publish an IP clause as explicit as the offline clause.

The accurate statement is:

Modification and recovery rights are not publicly verifiable for four components.

That does not mean the detailed contracts omit them.

It means one essential sovereignty property remains behind the restricted e-tendering platform.

Open standards, open code and recovery

The rulebook and APIs can be public while the supplier implementation remains proprietary.

An open standard enables:

• several PSPs;
• compliance;
• interoperability;
• certification;
• alternative development.

It does not guarantee:

• repository access;
• reproducible builds;
• key control;
• production control;
• operating competence.

Open-source code helps without solving everything.

A central bank can possess a repository and still depend on:

• a closed CI chain;
• a specific cloud;
• an app store;
• an HSM;
• a supplier that alone understands the runbooks.

A more useful hierarchy is:

1. public standard;
2. complete specification;
3. accessible source;
4. modification rights;
5. reproducible build;
6. keys under control;
7. documented operations;
8. tested recovery.

Sovereignty begins with legal rights.

It is confirmed by successful operation without the incumbent supplier.

Who holds root access?

The agreements often cover more than development.

Fraud, app and offline include operation. Offline explicitly includes hosting, running and a service desk.

The public notices do not detail:

• cloud provider;
• data centres;
• administrator accounts;
• bastions;
• HSMs;
• root keys;
• backups;
• RTO and RPO;
• restoration procedures;
• emergency access;
• authorised staff.

Asking who holds root access does not imply one person has a single button capable of changing the currency.

It asks who can:

• deploy a release;
• sign a binary;
• administer production;
• restore after an incident;
• extract a log;
• run the component during a crisis.

The infrastructure can be governed by the ECB and operated daily by a supplier.

Sovereignty requires the central bank to be able to take over that operation in an extreme case, directly or through another provider.

The smartphone remains an external boundary

The digital euro app must be distributed at least through the official Android and iOS stores. It must also run on older supported versions and different devices, including wearables.

The developer can be European.

The distribution channel and part of the hardware are not.

NFC has been opened

In July 2024 the European Commission made Apple’s EEA NFC access commitments legally binding for ten years.

Third-party wallets can use Host Card Emulation, be selected by default and use Face ID or Touch ID under the agreed conditions.

That remedy reduces Apple’s ability to lock online proximity payments inside Apple Pay.

What HCE actually provides

The ECB had warned that HCE access alone does not satisfy its vision for mobile offline payments.

A secure element provides a tamper-resistant hardware environment. It can be embedded, integrated or linked to an eSIM.

The offline solution must prevent copying and double spending without consulting a server during the transaction.

Hardware therefore becomes a functional monetary component even though it does not issue the money.

Law seeks to open the hardware

Article 33 in the Council mandate requires fair, reasonable and non-discriminatory access to the hardware and software functions needed by digital euro services.

Member states must designate authorities and provide penalties.

The text can turn a commercial negotiation into a legal obligation.

Several points still require proof:

• FRAND price;
• timing;
• storage capacity;
• provisioning;
• parity with the native wallet;
• wearable support;
• support duration;
• access on devices not designated as gatekeepers.

The paradox is clear.

The transaction most similar to cash may rely on the longest private provisioning chain.

A robust design therefore needs several paths:

• multiple manufacturers;
• multiple secure elements;
• a physical card;
• a relay device;
• provisioning independent of the mobile operator;
• portable applets;
• keys under public control;
• a tested exit from one OEM.

A sixth procurement for the network

A separate procurement covers connectivity among:

• PSPs;
• national central banks;
• the DESP;
• components distributed across several sites and data centres.

The procedure contains two lots.

Its total estimated value is €162.84 million, with a €355.32 million ceiling and a maximum duration of ten years.

The same bidder may apply for both lots but cannot win both. The ECB is seeking two distinct network operators.

Lot 1 is restricted to Union entities controlled from the Union.

Lot 2 is open to European and non-European entities.

We found no official award notice in the public corpus examined as of 15 August 2026.

Opening one lot outside the Union does not mean a foreign operator would control the currency.

The network operator controls neither holdings, issuance nor settlement decisions.

It can still become critical for:

• availability;
• routing;
• DDoS protection;
• metadata;
• support;
• continuity between data centres.

The network captures the distinction between monetary control and operational dependency.

A design can preserve ledger sovereignty while exposing availability to an external chain.

A six-test sovereignty framework

A single score out of ten would be attractive and misleading.

The public core would score well. The secure element would remain uncertain. Offline rights are stronger than the published fraud rights. Connectivity remains unresolved.

An average would erase those differences.

The article therefore uses six tests.

Govern

The Eurosystem keeps issuance, settlement, the rulebook and general certification.

The main publication gap concerns the allocation of core responsibilities among the six central banks.

See

The contracts give the ECB control rights.

The public does not know the exact scope of code, log, model and subcontractor audits.

Modify

The offline guarantee is explicit.

Rights over the other four components remain publicly unverifiable.

Replace

Two providers are ranked.

Failover time, compatibility and key transfer are not demonstrated.

Continue

EU law opens NFC and seeks to open hardware access.

Continuity without a store, secure element or network operator remains untested.

Rebuild

The pilot provides specifications and selected references.

A complete rebuild by a different team is not documented.

The pilot should break something

The twelve-month pilot planned for the second half of 2027 should test P2P, point of sale, e-commerce, the app, SDK, funding, defunding and offline with 36 PSPs and 19 national central banks.

Functional success is not enough.

A sovereignty pilot should trigger controlled failures.

Remove the first supplier

The second should take over a component within a measured period.

The report should publish:

• preparation;
• transfer;
• data;
• keys;
• downtime;
• corrective action.

Rebuild from source

A new team should reconstruct a release using:

• source;
• dependencies;
• documentation;
• scripts;
• secrets managed by the Eurosystem.

Lose a gatekeeper

The test should simulate:

• app-store removal;
• unavailable secure element;
• unsupported operating system;
• manufacturer abandoning a device.

A card or relay device should preserve continuity.

Lose one network

Traffic should fail over from one NSP lot to the other, with latency, errors and metadata exposure measured.

Lose an HSM

Keys should be restored or rotated without breaking balances or instruments.

Publish the result

Useful transparency need not publish an exploitable attack plan.

It can disclose:

• scenario;
• target;
• time;
• result;
• deviation;
• correction.

The pilot should measure Europe’s ability to repair and recover the digital euro after a failure.

What the six articles established

This investigation began with an accounting question.

1. A euro that changes debtor

The first part showed that conversion leaves the number of euros unchanged. It moves the liability from a commercial bank to the Eurosystem.

2. A cap protecting a banking model

The second part reconstructed the €699 billion extreme scenario. The system survives in the model because banks replace deposits with reserves, markets or central-bank funding against collateral.

3. Privacy through separation

The third part followed the data. The ECB should not directly receive civil identity in central flows, while PSPs retain identity and common services process pseudonyms and metadata.

4. A real ban and distinct legal powers

The fourth part separated programmable money, conditional payments, fraud, sanctions and seizure. The ban protects fungibility, not the absence of every legal block.

5. A still-fragmented bill

The fifth part showed that public cost numbers cover different perimeters. The fee model will determine who finances distribution and whether Wero receives common infrastructure or suffers duplication.

6. Sovereignty proven by recovery

This final part closes the loop.

The money can be public, privacy-preserving, non-programmable and less dependent on international card schemes.

Those properties do not prove the machine can be repaired without its supplier.

Who controls the machine?

The future digital euro would take the form of a hybrid infrastructure.

Its monetary core remains public.

Specialist services are contracted to companies controlled in the Union.

Distribution relies on PSPs.

Mobile use partly depends on global platforms and hardware.

The design contains real safeguards:

• public issuance;
• six central banks;
• two agreements per component;
• European-control requirements;
• common standards;
• strong published offline rights;
• competition law and DMA intervention.

It also retains real blind spots:

• specific orders;
• subcontractors;
• clouds;
• key custody;
• code rights for four components;
• failover time;
• secure-element access;
• network award;
• core allocation among the six central banks.

Operational sovereignty rests on an exit path.

An infrastructure is sovereign when the authority accountable for it can:

• inspect;
• correct;
• migrate;
• revoke;
• fail over;
• rebuild.

The conclusion of this investigation fits in one sentence:

Operational sovereignty will be measured by the Eurosystem’s ability to take back the machine, replace its operators and continue serving citizens when a supplier, network or gatekeeper disappears.

Sources and method

This article relies primarily on:

1. ECB, selected providers.

2. ECB, preparation phase closing report.

3. Alias Lookup award notice.

4. Risk and Fraud Management award notice.

5. App and SDK award notice.

6. Offline award notice.

7. SEPI award notice.

8. NSP Connectivity procurement.

9. ECB letter on Apple, NFC and the secure element.

10. European Commission, Apple NFC commitments.

11. Council of the European Union, Article 33 and architecture.

12. ECB, pilot business architecture.

13. Publicis Groupe, acquisition of Tremend.

14. Fabrick, digital euro framework announcement.

The estimated-value and ceiling totals are l0g additions of amounts published in procurement notices. They are not expenditure and are not added to the €1.3 billion overall development estimate without reconciling scope.

Limits

• Full contracts and specific orders are not public.
• Subcontractor names and functions are generally not published.
• Code rights are explicit in the offline notice, not in the other four public notices.
• Clouds, data centres, keys, RTO, RPO and exit clauses are not public.
• No official NSP award result was identified in the corpus examined.
• The precise allocation of roles among the six central banks is not public.
• Practical and commercial access to the secure element remains to be demonstrated.