The code that stops an offline euro being spent twice is the ECB's, and the liability is not.
Between a payment firm and its central bank the pilot agreement answers only for wilful misconduct or gross negligence, and what an end user is owed is whatever their own provider's terms happen to say.
Thirty-six payment service providers were told at the end of June that they were in. The development phase started this quarter, which means that somewhere in nineteen countries people are now writing code against a specification for a currency that does not legally exist.
The sequence is published and worth having in order. A call for expression of interest went out on 5 March 2026 and closed on 14 May. Selection was notified at the end of June. From the third quarter of 2026 the chosen firms build: pilot payment services, onboarding to the Eurosystem's digital euro service platform, back-end certification, user onboarding. The operational phase starts in the second half of 2027 and runs for twelve months, which the contracting national central bank may extend, at its discretion, by up to six.
What runs on it is not money. The pilot uses a "beta digital euro", which the ECB is careful to say is "different from the digital euro foreseen in the legislation" — a Eurosystem liability, scriptural money under the revised Payment Services Directive, not a banknote, not a coin, and not an account held with a central bank. The people spending it are staff of the participating central banks. One of the ECB's own illustrations is a staff member paying for lunch in the ECB canteen.
So the thing being validated is the plumbing, with colleagues as the water. That is a reasonable way to test plumbing. It does mean the pilot cannot produce evidence about the question everyone outside the building is asking, which is what happens to a bank's funding when the public can hold these at scale — and that question has a number attached to it that appears in neither of the two ECB documents read for this piece.
The offline path, and where it is written
Four use cases are in scope. Three of them are online. The fourth is offline person-to-person over NFC: two phones tap, and the transfer is "settled instantly between the participating devices" with neither needing a connection.
An offline transfer that settles on the devices themselves has exactly one hard problem, which is stopping the same unit being spent twice while nothing can check. The ECB has solved it by writing the software itself. The service that runs in the phone's secure element is provided by the Eurosystem, and the FAQ is explicit about why that is convenient:
This removes the need for pilot PSPs to have expertise in developing secure element applications or to implement specific security measures, such as protection against double-spending.
Read as engineering, that is obviously correct. Thirty-six firms writing thirty-six double-spend defences would produce, at a minimum, one bad one.
Read as a question about who is short when it fails, it moves the code away from the party that has the customer.
What the agreement answers for
Liability comes in two layers and they are not the same shape.
Towards end users, pilot PSPs remain responsible. Their exposure is "governed by the pilot PSPs' own terms and conditions and by the applicable legal and regulatory framework" — PSD2, GDPR, the Anti-Money Laundering Regulation. The terms and conditions are the PSPs' own: they draft them, and the FAQ says they may use their existing customer documents and adapt them as necessary.
Between the PSP and its national central bank, the position is this:
the PSP participation agreement establishes a liability regime under which each party is liable only for losses resulting from its wilful misconduct (including fraud) or gross negligence. As provided for in the agreement, if liability-related issues arise, the initial approach is to engage in dialogue with the aim of finding an amicable solution.
Put the two layers together and follow a failure through them. The anti-double-spend service is the Eurosystem's, running on a user's handset. The user's counterparty is a commercial firm, under terms that firm wrote. If the service misbehaves, the firm answers to its customer on its own paper, and its route back to the central bank requires establishing wilful misconduct or gross negligence by a central bank — before which the agreement provides for a dialogue aimed at an amicable solution.
Gross negligence is a high bar. It is meant to be. The effect of putting it between the party that wrote the code and the party that carries the customer is that ordinary failure — the kind that is nobody's misconduct, which is most of it — stops at the firm.
This is not a scandal and it is not unusual; it is how most infrastructure agreements are drawn, and anyone who has read a scheme rulebook will recognise the architecture immediately. It is worth saying out loud only because the technical documentation is very clear about where the code lives and entirely silent about where the loss lands, and those are the two halves of the same sentence.
The condition on the front page
The ECB's own project page carries this:
We aim to be ready for a potential first issuance of the digital euro during 2029, assuming the necessary EU legislation is adopted in the course of 2026.
Three months of that year remain. The ECB has also said, in the pilot FAQ, that preparing for the pilot does not pre-empt any decision to issue, and that it will decide only once the co-legislators adopt the Regulation.
Both things are true at once, and holding them together is the whole posture: build the system now, decide later whether there is one. Thirty-six firms have signed an agreement this desk has not read, to build against a specification for an instrument whose enabling law is still being negotiated, with an option for their central bank to keep them at it six months longer.
The thing to watch is not the launch date. It is which of the thirty-six quietly exercises its termination right during the development phase, and what its national central bank says about why.
Written from
Primary The document itself. Claims in this piece rest only on these.
- FAQs on the digital euro pilot, updated 15 September 2026Read in full for this piece, on the ECB's own site, including the sections on roles and responsibilities and on technical aspects. Source for: the three phases and their dates at Q4, including the call published 5 March 2026, closed 14 May 2026, and selection notified at the end of June 2026; the NCB's discretion to extend by up to six months at Q5; the 19 participating national central banks at Q6; the four use cases at Q8 and the description of offline P2P as settled instantly between devices with no internet connection; the beta digital euro at Q3, including that it is 'different from the digital euro foreseen in the legislation', that it is a liability, that the online version is scriptural money falling under the PSD2 definition of funds, that it is not a banknote or coin and not an account held with a Eurosystem central bank, and that participants hold a commercial bank account with a pilot PSP; the individual end users being staff of participating Eurosystem central banks at Q12; the applicable law at Q13; the liability regime at Q14, quoted here in full; the allocation of terms and conditions to PSPs at Q15; and the offline architecture at Q66, including the sentence that the Eurosystem-provided secure element service removes the need for PSPs to implement protection against double-spending.
- Digital euro, project overview pageRead for this piece in the browser rather than through a summary, because one sentence on it is quoted: 'We aim to be ready for a potential first issuance of the digital euro during 2029, assuming the necessary EU legislation is adopted in the course of 2026.' Also checked, and this is a negative finding rather than an omission: the phrase 'holding limit' does not appear anywhere on this page.
- The holding limit: who sets it, by what procedure, and at what figureNot established by this desk, and the piece says so rather than filling it. What is verified is narrow and is stated as such in the body: the number appears in neither of the two ECB documents read here. That is a fact about two documents. It is not evidence that no figure has been settled elsewhere, and reporting of a 3,000 euro ceiling exists which this desk has not traced to any instrument and therefore does not print. The procedure for fixing the limit sits in the draft digital euro Regulation, which is still before the co-legislators and was not opened for this piece. Anyone acting on the deposit question needs that text, not this article.
- Regulation on the establishment of the digital euro, and the PSP participation agreementNeither opened. The Regulation is not adopted, which is the ECB's own stated reason for not having decided to issue, and its current drafting is not characterised anywhere in this piece. The PSP participation agreement is not public: everything attributed to it here — the liability regime, the extension discretion, the communication guidelines, the fee prohibition — is attributed as the ECB's FAQ describes it, and the agreement itself may qualify all of it. Thirty-six firms have read a document this desk has not.