Duplicating an Oracle Cloud Database as an On-premise Database
                    (Source: Oracle Docs)

Use the DUPLICATE command to duplicate an Oracle Cloud Database as an on-premise database. Both backup-based and active duplication are supported.

Oracle Cloud databases are always encrypted. 

When we duplicate a database from Oracle Cloud, the Oracle keystore that stores the master key must be copied to the on-premise database. This key is required to decrypt the data files that are duplicated from the Oracle Cloud database. The duplicate database may or may not use encryption.

Note:

Duplicating AS STANDBY by using AS ENCRYPTED or AS DECRYPTED is not supported.
    a. The COMPATIBLE parameter of the source and destination database must be set to 18.0.0 or higher.
    b. Ensure that the prerequisites for the selected duplication technique are met 
    c. It is recommended that we use active database duplication.
    d. Configure the Oracle Database Cloud Backup Module. 
    e. This backup module is an SBT interface that enables we to perform backup and recovery operations to Oracle Cloud.
    f. We must create the auxiliary instance as a CDB. To do so, start the instance with the following declaration in the               initialization parameter file:

        enable_pluggable_database=TRUE

    g. When instructed to create an initialization parameter file for the auxiliary instance, we must copy the file from        the source database. 
       This ensures that the auxiliary instance is also a CDB. After we copy the file, perform the following steps:

        a. Modify the DB_NAME parameter
        b. Modify the various destination/location parameters

    h. When instructed to connect to the necessary instances, start RMAN and connect to the root as a common user with        SYSDBA or SYSBACKUP privilege. 

       On both instances, the password for the user performing the duplication must be the same.

    i. Copy the Oracle keystore from Oracle Cloud to the auxiliary instance.
    j. The auxiliary instance needs to decrypt the data files from Oracle Cloud before encrypting them again by using the        Oracle keystore in the Oracle Cloud database.

    k. Configure RMAN channels.
    l. The primary task of duplication is performed by RMAN channels. 
    m. Configuring additional channels improves the duplication performance.
    n. On the auxiliary instance, open the Oracle keystore that was copied from the source Oracle Cloud database.
    o. If     the destination CDB uses a password-based software keystore, 
       then 
        we must specify the password used to open this keystore. 
       end

The following command sets the password used to open a password-based software keystore 
(replace password with wer keystore password):

SET DECRYPTION WALLET OPEN IDENTIFIED BY 'password';

Use the DUPLICATE command to duplicate the source CDB.

To create a duplicate database that does not use encryption, use the AS DECRYPTED option in the DUPLICATE command. For example:

DUPLICATE DATABASE TO my_cdb
FROM ACTIVE DATABASE
AS DECRYPTED;

Note:

Any tablespace in the PDB that was explicitly encrypted is not decrypted. 
Only tablespaces that were encrypted by a DUPLICATE AS ENCRYPTED command are decrypted.