Central Bank Roles

• CBDC Admin: Manages the entire CBDC system.
• CBDC Creator: Creates CBDC tokens. After a creation request is submitted, it is sent to the CBDC approver, who either approves or rejects the request. After the minting request is approved, tokens are credited to the CBDC creator's account. The creator can then transfer these tokens to a CBDC issuer.
• CBDC Approver/CBDC Escrow: Approves or rejects requests for minting, burning, and holding CBDC tokens. Hold request approvals are used for transfers between organizations.
• CBDC Issuer: Transfers CBDC tokens to financial institution officers or to the CBDC retirer for burning. Users in this role receive tokens from the CBDC creator and financial institution officers. The CBDC approver must approve any transfers between organizations.
• CBDC Auditor: Has read-only access to all organizational data in the system.
• CBDC Retirer: Burns CBDC tokens. This role receives tokens from the CBDC issuer. After a burn request is submitted, it is sent to the CBDC approver.

Financial Institution Roles

• FI Admin: Manages their specific organization.
• FI Officer: Receives tokens from the CBDC issuer. They can transfer these tokens to users in any organization or return tokens to the CBDC issuer. All transfers between organizations must be approved by the financial institution approver.
• FI User: Receives tokens from the officers of their respective organizations. They can transfer these tokens to users and officers in any organization. All transfers between organizationsIt is essential to note that any inter-organizational transfers must be approved by the financial institution approver.
• FI Manager/FI Approver: Approves or rejects hold requests for their specific organization. Hold requests and approvals are used for all transfers between or within organizations.
• FI Auditor: Has read-only access to data that is specific to their organization.

Onboarding

After you install, configure, and stage the application, complete the following steps to access the application.

1. After the application is staged, navigate back to the home page.
2. On the application dashboard, locate the staged application. The status is shown as Stage next to the application name (for example, WholesaleCBDCVBCSPackage).
3. Click the drop-down menu under Stage and select the application name (for example, cbdcapp).
4. Copy the link or open the staged application in a new browser tab or window to test and review the application.

Invalid Account. Please Contact Admin

The first time that any user attempts to log in to the application, no user accounts have been created yet. Only users from the CBDC_ADMINS group who also have the tokenAdmin role assigned to them can log in. All other login attempts will fail. The following section includes more information about the exception for the CBDC_ADMINS persona.

CBDC_ADMINS Exception

The login process is different for users with the CBDC_ADMINS persona. Users in the CBDC_ADMINS group can log in even if their account has not yet been created, but these users must have the tokenAdmin role.

When you deploy the chaincode, ensure that users in the CBDC_ADMINS group have the tokenAdmin role. The parameters that are passed during chaincode initialization must include the CBDC admin users as having the tokenAdmin role. This allows the CBDC_ADMINS to log in to the application for the first time to create the other user accounts.

If you log in to the application as a user in the CBDC_ADMINS group, and that user was not included as an initialization parameter when the chaincode was deployed, you must manually assign the tokenAdmin role to the user. You can manually assign the tokenAdmin role by using a Postman collection.

Application Workflow

The following steps show the actions of the various roles in a complete application workflow. The first seven steps must be completed to use the application.

1. The CBDC Admin logs in.
2. The CBDC Admin initializes the CBDC token.
3. The CBDC Admin creates their own bank account and then reloads the home page to see the updated network details.
4. The CBDC Admin creates bank accounts for all CBDC personas, as shown in the following table.

   Application Group	Role
   CBDC_ADMINS	Token Admin
   CBDC_AUDITORS	Token Auditor
   CBDC_CREATORS	Minter
   CBDC_ESCROW	Escrow
   CBDC_ISSUERS	none
   CBDC_RETIRERS	Burner

5. The CBDC Admin creates FI Admin bank accounts, which have the Org Admin role.
6. The FI Admin logs in and creates accounts for users of their financial institution.
7. The CBDC Admin assigns roles to the new financial institution users, as shown in the following table.

   Application Group	Role
   FI_ADMINS	Org Admin
   FI_CBDC_USERS	none
   FI_CBDC_OFFICERS	none
   FI_CBDC_MANAGERS	Escrow
   FI_CBDC_AUDITORS	Org Auditor

8. The CBDC Creator logs in and requests that tokens be minted.
9. The CBDC Approver logs in and approves or rejects the minting request. If the request is approved, the tokens are credited to the CBDC Creator.
10. The CBDC Creator transfers the tokens to the CBDC Issuer.
11. The CBDC Issuer logs in and transfers the tokens to an FI Officer. If the transfer is approved by the CBDC Approver, the tokens are transferred. Alternately, the CBDC Issuer can transfer the tokens to the CBDC Retirer for burning.
12. The CBDC Auditor logs in, selects auditing policies, and reviews the relevant transaction data.
13. The CBDC Retirer logs in and requests that tokens be retired. If the CBDC Approver approves, the tokens are burned.
14. The CBDC Approver logs in and approves or rejects the request to issue tokens. If the transfer is approved, tokens are credited to the FI Officer, who can then transfer them to FI Users.
15. The FI Officer logs in and transfers tokens to FI Users, other FI Officers, or back to the central bank. All transfers require the approval of the FI Manager.
16. The FI Manager logs in and approves or rejects transfer requests.
17. FI Users log in and transfer tokens to other FI Users at any organization.
18. The FI Auditor logs in, selects auditing policies, and reviews the relevant transaction data.