Written by Deep in the mists of time (that is to say, the early-1990s), I led the team from Consult Hyperion responsible for Mondex specification, design and development. For those not familiar with paleo-payments, it was one of a clutch of (contact) smart card based electronic cash systems, none of which survived beyond, let’s say, early adolescence. There were two main reasons for their demise, one technological and one business. The concept was ahead of the capabilities of the underlying technology. Transactions took about the same amount of time as cash plus change, which wasn’t a compelling reason for anyone to leave their wallet behind. The promoters of the schemes (retail banks and payment brands) did not target particular niches where there may have been a business case (I always thought car parking might work) but instead blanketed retail outlets in particular cities or small countries. So, mostly unused devices were put under the counter, and people forgot about the schemes after an initial blaze of publicity.
I’ve delved into the recesses of my brain recently, in search of Mondex memories(*), because I’ve been speaking with central bankers and others on the subject of Central Bank Digital Currency (CBDC). Of the 1990s electronic cash schemes, Mondex had a feature set which would most lend itself to a CBDC. I don’t say that a CDBC should be based on Mondex, but I believe it could be. Certainly it’s features are worth re-examining.
Firstly, the concept of minting new electronic currency (it was called ‘origination’) was central to Mondex. Multiple currencies (alway assumed to be national currencies, although that wasn’t a technical limitation) were baked in. A Mondex purse (an application on a smart card, or equivalent secure element, as we would say these days) could carry up to five currencies simultaneously, each in a ‘pocket’. An empty pocket could be assigned or re-assigned to any currency in the scheme. In each territory (Mondex, along with Visacash, was the most international of the schemes), an ‘originator’ was formed, being a joint venture of the Mondex banks in that territory, and regulated by the central bank. They minted new value on specially created Mondex apps, on smart cards that were, obviously, very tightly controlled; against a reserve at the central bank. The new value was sold to the member banks (at par), for onward distribution to customers; at ATMs, or via an adapted landline phone (mobile phones were still a novelty!).
It was always assumed that, in any territory, should Mondex reach significant scale, the central bank would take over the role of origination, exactly as for notes and coins. We were deliberately planning for central bank digital currency, though we didn’t call it that at the time.
Secondly, all Mondex value resided in a Mondex purse (app) on a Mondex-approved secure chip. The value in a purse (strictly, a pocket in a purse) was not a representation of funds in an account, or a spending limit based on the holders assumed creditworthiness. In other words, it was cash. The Mondex team took a rigorous, and brave, line here; alone among the electronic—so called—cash schemes of the time. The software and hardware used to store, and transmit and receive, Mondex value was the same for a consumer (banked or unbanked) as for a retailer as for a bank. Naturally, we took extreme care to assure ourselves (and central banks and other stakeholders) that the value was unforgeable. We subjected the Mondex app to the highest level of external evaluation (under the ITSEC scheme, the precursor to the Common Criteria scheme). We wanted to do the same for the underlying platform, but didn’t consider any existing product good enough; so we invented our own, which was. That became MULTOS, which is a successful product to this day, and the lasting legacy of the Mondex initiative.
Ultimately, if you lost your Mondex card down the back of a sofa, that was the same as losing bank notes or coins. But, there were various safeguards to protect against some hazards, that aren’t possible for physical cash. For example, each (potential) currency held in a purse was configured with a type, under the control of the originator of the currency. This could be used, for example, to implement a rule that a central bank purse could only send value to another central bank purse or to a commercial bank purse; but not to a retailer purse or a consumer purse. Thus, ambitious thefts could be rendered useless for practical purposes. The originator could also limit the value (of its currency) that could be stored in a purse that had been assigned a given type for that currency. Should a transaction be interrupted (say, by a power failure) at precisely the ‘right’ time, value could be suspended in the ether. The protocol was designed such that the transaction would be completed automatically whenever the two purses were brought into contact (as long as neither purse’s record of the transaction had been overwritten in its circular transaction log). Malfunctioning chips with value could be sent to a forensic service. Whether or not that occurred, an issuing bank could choose to reimburse any funds a customer claimed to have lost; which they would probably do on the first occasion, but not on the tenth.
Thirdly and finally, (I could go on, but can only hold your attention for so long), Mondex was an off-line system. That doesn’t mean to say that transactions couldn’t, or didn’t, happen over networks; just that it was immaterial to the two purses whether they were plugged into the same device (probably operating under battery power) or connected wirelessly, by phone, over the internet (or by postcards or semaphore for that matter). If they were mutually configured to allow exchange of value, they would. In those days, we were primarily concerned with replacing notes and coins in brick-and-mortar shops, so offline made sense. However, we pretty soon modified phones to be home ATMs, sent money over infra-red links between handhelds, and built Mondex (and other digital cash schemes) into a complete e-commerce service for physical and digital goods.
We still feel that an offline capability is essential for a CBDC. Even though the world is obviously much more connected now than then, networks break, whether through lack of coverage, software or hardware failure, high demand or cyberattack (or even physical attack). It’s better if the wheels of commerce can keep turning in any of these circumstances.
Life was slower back then, and we spent a lot of time thinking about these issues and experimenting with concepts and technology; followed by very careful specification, design, testing and deployment, in the UK, US, Canada and Hong Kong. Although time has moved on, certain principles have not. There’s lots that can be mined from early experiences with digital currency; and it goes back earlier than you might think!
* As someone, whose head is often to be seen on notes and coins, said recently, “recollections may differ” (on finer details, at least).
