The offline digital euro: renting space on a chip

The ECB has found its killer argument for selling the digital euro to skeptics: offline mode. No network, no server, no bank in the loop. You hold your phone near a merchant’s or a friend’s, and the money changes hands, “just like cash.” This is the official answer to everyone who, like me, has spent years warning about the surveillance and programmability built into this project. Worried about being tracked? Here is your digital banknote, anonymous and resilient.

Except that a banknote does not need permission to circulate. The offline digital euro does. And that is exactly where the mask slips.

Cash that needs a chip in order to exist

For “digital cash” to work without a network, you have to solve a problem paper never faced: copying. A file duplicates endlessly; a banknote does not. The only known defense is to lock the funds inside a tamper-proof hardware zone on the phone, walled off from the operating system.

The ECB’s closing report on the preparation phase, published in late October 2025, lays out the three candidates for that role: the embedded secure element, the dedicated chip that already holds your cards in Apple Pay, its variant integrated into the processor, and the eSIM. Software-based secure zones on the main processor, the much-touted TEEs, are explicitly ruled out as too vulnerable. What is required is tamper-proof silicon, certified to the same standard as payment cards and passports.

In practice, the Eurosystem has its applet installed inside that enclave. The applet stores your offline balance, validates NFC transactions, and guarantees that no euro is spent twice. Without a compatible, certified secure element or eSIM, there is no offline digital euro. Full stop.

Read that again. Europe’s public money, presented as the successor to the banknote, cannot exist offline outside a proprietary component whose access is controlled by a handful of manufacturers. A banknote works in a pocket with a hole in it. Digital cash requires a certification chain.

The ECB even names its favorite among the three options: the eSIM, given its growing adoption in smartphones and connected devices. And it slips in an admission along the way. Standards will be needed to ensure your offline wallet survives a change of mobile carrier. Your offline money, in other words, will also depend on telecom standardization. Hold onto that detail.

Article 33, or the legislative confession

The delicious part is that European lawmakers have identified the problem perfectly. Article 33 of the draft regulation requires equipment manufacturers and providers of electronic communications services to grant “effective access” to the secure element installed in users’ devices. Translation: Brussels knows that without a statute compelling Apple, Samsung, and Google to open their enclaves, the offline digital euro is dead on arrival.

Some will say the EU knows how to apply pressure, and they have a point. The DMA already forced Apple to open the iPhone’s NFC to third-party apps, and Article 33 belongs to that same tradition. But compelling access to a chip is not the same as controlling its manufacture, its certification, or its firmware updates. The day an OEM drags its feet, degrades the integration, or conditions access on its own commercial terms, the circulation of Europe’s public money will be settled in court. So we have invented a currency whose circulation depends, as a matter of law, on the goodwill of three American and Korean companies, extracted by regulation. It is the same pattern as Wero running on Amazon’s servers: European monetary sovereignty proclaimed in speeches, resting in practice on infrastructure we do not control. Yesterday Bezos’s servers, today Cupertino’s chips. You do not build independence on someone else’s silicon.

The ECB, to its credit, anticipates the sovereignty objection. The offline solution has had its supplier since October 2025: Germany’s Giesecke+Devrient, a historic banknote printer reinvented for digital money, with equensWorldline as runner-up. And the closing report is emphatic that every provider on the project is a European entity under European control. Fine. But that sovereignty stops at the software layer. The applet will be European, the rulebook will be European, and all of it will run inside an enclave etched by non-European foundries, soldered into a phone designed in Cupertino or Suwon, updated on its manufacturer’s schedule. We have Europeanized the tenant, not the building.

And for anyone without a compatible smartphone, the ECB is working on smart cards, either battery-powered or paired with a “bridge device.” Which is to say: more certified hardware, another approval chain, more gatekeepers.

Renting your own money

Here is the conceptual reversal nobody wants to name. With a banknote, you own a bearer object. With the offline digital euro, you are renting memory space on a chip to which you hold neither the keys nor the lease. The manufacturer controls physical access to the enclave. The Eurosystem controls the applet running inside it. You get to use the balance for as long as those two gatekeepers agree.

And they keep their grip over time. The offline wallet is capped, just like the online one: the amount you may hold offline will be set by the authorities, with Parliament’s position giving the Commission the leading role in calibrating those ceilings. The wallet is updated by software. And every reconnection, every top-up, every unloading is a point of contact with the system, which is precisely when the applet can be restricted, refreshed, or switched off. The banknote in your drawer does not receive firmware updates. It cannot be revoked remotely the next time you reach a checkout.

I will be told this is the price of security, that double spending has to be prevented somehow. True. But that is exactly my point: “cash” that structurally requires a hardware trusted third party is not cash. It is a conditional balance.

Privacy in dotted lines

That leaves the privacy argument, the one thing that gives offline mode a genuine whiff of freedom. And on paper it holds up: in an offline payment, the transaction details are known only to payer and payee, invisible to payment service providers and to the Eurosystem alike. Parliament’s ECON committee reinforced the point in June 2026, ensuring that offline payments would not settle on the ECB’s ledger, the better to imitate the anonymity of cash.

But look at where that bubble begins and ends. It covers the transaction itself and nothing more. To load your offline wallet, you go through your bank, which means identification and anti-money-laundering checks. To convert offline euros back into ordinary ones, same thing again. The anonymity of digital cash is a tunnel with both ends lit by AML and KYC floodlights.

Let me be precise about what the ECB actually promises. Its closing report states that transaction details remain on the devices and are shared neither during nor after the payment. That is the official position, and I quote it as it stands. But independent cryptographers who have studied the problem point to a structural tension: since no chip is truly unbreakable, any serious offline system must provide for after-the-fact detection of double spending, which means some flow of information at reconciliation, however minimal and pseudonymized. Either the ECB accepts that detection channel, in which case total anonymity is a marketing promise, or it genuinely forgoes it, in which case the first broken secure element becomes a printing press. A choice will have to be made, and the history of payment systems rarely suggests anonymity wins.

With a banknote, anonymity is not a feature configured by a rulebook. It is a physical property of the object.

The timeline advances, the debate recedes

While we argue about everything except the essentials, the machine rolls on. The Governing Council moved to the next phase in late October 2025, the Council adopted its position in December 2025, the ECON committee adopted its own in June 2026, rulebook version 0.91 was published in July 2026, and 36 institutions were selected last month for a pilot beginning in the second half of 2027, with a possible first issuance in 2029 if the regulation is adopted by year’s end. I described the same method when writing about the interbank version: lay the rails quietly, and when the political question finally gets asked, answer that the infrastructure already exists.

Offline mode plays a precise role in that strategy. It serves as a lightning rod. Every time surveillance comes up, the ECB brandishes the offline mode that works “just like cash.” It is the argument that makes everything else palatable. Yet that lightning rod, as we have just seen, is itself an instrument of oversight: certified hardware, a controlled applet, remotely calibrated ceilings, logged entries and exits. Offline does not limit the Eurosystem’s power over your money. It extends that power into the one pocket it could not previously reach.

What the banknote never asked for

I stand by everything I have written about this project and why it should be refused: a pharaonic price tag for reinventing a square wheel, creeping programmability, a Trojan horse for centralized control. But offline mode deserves its own trial, because it is the cleverest of the false reassurances.

Physical cash is not an absolute, I know that. Denominations have been demonetized, the 500-euro note was withdrawn from issuance, counterfeiting is hunted down. But those interventions are rare, general, public, and debated. They never target one particular holder. The banknote, by contrast, has never needed a chip’s permission, an OEM certification, an Article 33, or a software update in order to circulate. It knows no holding limit, no reconnection window, no remote revocation. It works during a blackout, in a broken phone, in a child’s hand, in the hand of an old man who has never owned a smartphone. It is yours, plainly, physically, with no license agreement attached.

The offline digital euro turns your phone into a monetary terminal under Eurosystem supervision, and turns you into the holder of a right of use. That is the whole difference between money you own and a balance you are allowed to spend. As long as banknotes exist, that difference has a name: the freedom to pay without asking. Let us defend cash, the real thing, the kind that does not need access to a secure enclave granted before it is worth anything. Because money that asks permission is no longer quite yours.