When the European Central Bank (ECB) announced on Thursday that it had selected Portuguese startup Feedzai to manage fraud and risk in the future digital euro project, it marked a turning point on how central banks could implement security in the era of central bank digital currencies (CBDCs).
The four-year framework agreement, with an initial value of EUR 79.1m and a ceiling of EUR 237.3m, does not involve any disbursement by the ECB at present. The award is part of a series of strategic contracts designed to make up the core modules of what the Frankfurt-based institution calls the Digital Euro Service Platform (DESP).
Why Feedzai?
Feedzai, based in Coimbra, Portugal, has built a solid reputation in financial crime prevention through the use of machine learning and real-time analytics. According to the latest figures, the company already handles around USD 8 trillion in payments each year.
For each digital euro transaction, the system will provide the payment service provider (PSP) with a fraud risk score. The PSP will then decide whether to approve, reject or mark it, based on its own internal rules.
Feedzai will operate in collaboration with PwC, which will ensure the solution's alignment with European privacy, security and regulatory compliance requirements. As CEO Nuno Sebastião stated:
"With tens of billions of transactions expected across the Eurozone, success depends on an AI capable of adapting as fast as fraud evolves. Our job is to provide the intelligence needed to block even the most sophisticated fraud attempts."
A Wider Digital Ecosystem
The agreement with Feedzai is part of a broader call with which the ECB awarded contracts for five subsystems of the digital euro: alias lookup, risk and fraud management, app/SDK development, offline payments and secure exchange of payment information.
Winners include Sapient & Tremend, Almaviva & Fabrick, Giesecke+Devrient, Senacor and equensWorldline.
The ECB emphasises that these framework agreements do not yet involve payments or full execution; the actual implementation will depend on a subsequent decision by the Governing Council and the adoption of the Digital Euro Regulation. In other words, the building blocks are being put in place, but the digital euro is not yet operational.
In particular, the module for offline payments has been contracted to Giesecke+Devrient (G+D), which has been commissioned to develop solutions that allow users to carry out transactions even without a connection. Other contracts cover privacy protection (a.k.a. lookup), application development and the secure exchange of payment information.
Strategic Imperatives and Risks
The ECB frames this investment as part of the European quest for financial sovereignty, aimed at reducing dependence on non-European payment circuits (e.g. Visa and Mastercard) and protecting the Eurozone from external influences. However, outsourcing the anti-fraud infrastructure to a private company raises questions about trust, vendor dependency and governance.
Although the deal makes headlines, no funds will be disbursed until the ECB gives final approval and the necessary legal framework is in place.
As board member Piero Cipollone reminded us, the ECB"will not pay a penny until the project is actually started". This provides flexibility, but also introduces uncertainties related to possible delays.
Feedzai will also have to prove that it can operate on a European scale, integrating with heterogeneous national banking systems, different PSPs and different regulatory regimes. Its artificial intelligence engine will have to resist increasingly sophisticated fraudulent techniques. Errors in false positives or negatives could undermine user confidence from the outset.
Next Steps
- The ECB is now starting the planning, design and timing phase with Feedzai and other providers.
- The Digital Euro Regulation, expected by mid-2026, remains the key step before official issuance.
- The assumed launch window is 2029, although it may slip depending on technical or political obstacles.
