Security and Privacy in Digital Payments: Blockchain, PIX, and Central Bank Digital Currencies (CBDCs)

Abstract Background. Digital payment systems, instant payment networks such as Brazil's PIX, public and permissioned blockchains, and Central Bank Digital Currencies (CBDCs) have become critical global financial infrastructure. Despite rapid adoption, persistent and unresolved trade-offs between security, privacy, and regulatory compliance remain inadequately addressed by existing governance frameworks, which are fragmented, system-specific, and rarely comparable across architectures. Methods. We conduct a PRISMA 2020-compliant systematic review of 50 highly relevant studies identified from 615 candidates (473 database records across Scopus, Web of Science, and Consensus AI; 142 via citation chaining) published between 2014 and 2025. Studies are thematically analysed across five governance dimensions: governance frameworks, privacy-enhancing technologies (PETs), regulatory compliance, decentralisation versus centralisation, and cryptographic mechanisms, and are positioned within a novel Digital Payment Governance Framework (DPGF) comprising three operationalisable axes. Results. PIX exemplifies a Regulatory Clarity Model (LoC-1 · PS-4 · CA-1): centralised control, low-default privacy, and a regulation-by-design compliance architecture. Public blockchains represent an Autonomy Model (LoC-5 · PS-2 · CA-5): decentralised governance, intermediate pseudonymity, and post-hoc compliance. CBDCs and permissioned blockchains exhibit a Hybrid Governance Model (LoC-2 · PS-2 · CA-2), combining central bank monetary authority with distributed execution and privacy-by-design potential. Zero-knowledge proofs and homomorphic encryption are the most adopted PETs but face unresolved scalability and metadata-privacy limitations. Hybrid governance architectures consistently demonstrate superior performance across composite governance indicators. Conclusions. The DPGF provides a structured, empirically grounded foundation for designing, evaluating, and comparing digital payment governance arrangements across architectures and jurisdictions. Five testable propositions derived from the framework constitute a research agenda for future empirical validation. Harmonised legal-technical frameworks that embed privacy-by-design at the protocol level represent the highest-priority governance innovation for next-generation payment infrastructure.