Mechanism Design for Permissioned Distributed Ledgers: Lessons from the Brazilian DREX Pilot

Abstract

In late 2025 the Central Bank of Brazil (BCB) discontinued the Hyperledger Besu pilot platform of its DREX permissioned-CBDC programme and signalled a redesign of the next phase, while the broader DREX initiative remained under development. Throughout the documented pilot, consensus authority stayed within six BCB-operated nodes running QBFT, while the sixteen institutional participants operated non-validating nodes. We therefore approach the DREX experience not as a failed governance experiment by institutional validators but as a motivating case for a broader question: under what conditions could institutional participants of heterogeneous type be safely promoted to validators in a future distributed phase of a permissioned CBDC? We develop an action-incentive-compatibility condition for the permissioned-CBDC setting under parametric type heterogeneity (BAIC): an incentive condition stated on validators' actions rather than on reported types, designed against the regulator's distributional knowledge of validator types. (We retain the Bayesian label for the design-against-distribution object; under the present calibration the expectation over other validators' types is degenerate, a point we make explicit in Section 5.3.) A four-archetype typology of candidate validators systemic banks, mid-tier banks and cooperatives, authorised ntechs, and registry institutions characterises the heterogeneity any future distributed phase would need to discipline. Privacy law enters as a lower bound on the false-positive rate of any admissible monitoring signal, generating a privacysustainability frontier we characterise analytically. A Quadruple Alignment result gives sucient conditions for systemic integrity on four levels consensus protocol, individual BAIC, validator-list composition, and regulatory feasibility of the required monitoring with explicit hypotheses for necessity. The composition condition is stated in a synchronised form consistent with the timing of the coalitional game: a coalition of eective per-member gain at most G max is deterred for archetype k when G max ≤ D k , where D k is the discounted per-member deterrence threshold that accounts for both detection and the honest path's own false-positive exposure. Under a parametrisation disciplined by institutional facts, only systemic banks satisfy the synchronised composition certicate; mid-tier banks fail it by a non-trivial margin under pilot monitoring, and are not jointly admissible with systemic banks at the legal privacy oor; ntechs and registry institutions exhibit a decit that persists under any isolated reduction in the false-positive rate within the maintained parameterisation it is not closed by better monitoring alone. The reported centralised reorientation of DREX, which the model represents as a counterfactual low-false-positive benchmark for a distributed network, leaves the ntech and registry decit untouched, because it lies in the archetypes' utility fundamentals rather than in monitoring precision; closing it would require changing those fundamentals (mandate, reputational stake, accessible gains, or voting rights), not merely the signal.