Discussions about stablecoin regulation in Hong Kong have been heating up recently. Many interpretations have emerged online, suggesting that all stablecoin holders must undergo real-name verification (KYC), sparking widespread controversy.

“How can it be decentralized if KYC is required for all on-chain transfers?”

“Is regulation too conservative and detrimental to financial innovation?”

These claims are not without merit, but do they truly accurately reflect the regulatory intentions of the Hong Kong Monetary Authority (HKMA)? After an in-depth study of two key documents—the "Guidelines on the Supervision of Stablecoin Issuers" and the "Guidelines on Anti-Money Laundering and Counter-Terrorist Financing"—we have arrived at a more technically nuanced and legally definitive answer:

???? Not all coin holders need KYC, provided that the issuer can prove that its risk control mechanism is sufficiently effective.

This article will start from the division of customers vs. non-customers, and primary vs. secondary markets, sort out the applicable logic of stablecoin KYC, clarify the true bottom line of supervision, and provide a judgment framework applicable to both project parties and compliance teams.

Who is a customer and who is not a customer?

First of all, we must make it clear that in the HKMA’s regulatory framework, “stablecoin holders” are not the same as “customers of stablecoin issuers.”

According to the definition in Chapter 4 of the Anti-Money Laundering and Counter-Terrorist Financing Guidelines, users are considered "customers" (customer stablecoin holders) only when they directly request the issuance or redemption of stablecoins from the issuer or establish a business relationship. Such users are required to strictly implement the KYC/KYB process.

Users who receive, transfer, and trade stablecoins on the chain but never interact directly with the issuer (for example, users who obtain stablecoins through DEX purchases or transfers between wallets) are classified as "non-customer stablecoin holders" and in principle do not require KYC.

As shown in the figure below, only institutional users in the Primary Market are considered customers, while participants in the Secondary Market are not customers as defined in the HKMA regulatory framework.

However, this does not mean that they are completely out of the regulatory field. Chapter 5 of the Guidelines clearly states that issuers have an obligation to continuously monitor all stablecoins in circulation, including those held by customers and non-customers.

KYC is not the only way, but it is the regulatory bottom line

Many interpretations that lead to misunderstandings often overlook an important premise of the HKMA:

???? “Non-client stablecoin holders can avoid KYC, but the prerequisite is that the issuer must establish an effective on-chain risk control mechanism and can prove to regulators that it is sufficient to prevent money laundering and terrorist financing risks.”

In other words, KYC is not the only means, but it is the last line of defense.

If the issuer uses methods such as blockchain analysis tools, address blacklists, transaction risk scoring, wallet profiling and freezing mechanisms (5.10) to monitor the flow and use of coins, and can satisfy the HKMA's satisfaction (5.11), then these technical risk control measures can be used as an alternative to mandatory KYC for all coin holders.

However, if this cannot be achieved, or if these measures prove insufficient in practice to mitigate risks, regulatory expectations will automatically revert to the most conservative option—identification of all coin holders, regardless of whether they are customers or not. It is important to note that even if KYC is required for coin holders, stablecoin issuers can delegate the KYC process to VASPs and trusted third parties.

For publishers, it is a multiple-choice question of "choose one of two"

For stablecoin issuers, this is actually a "choose one or the other" compliance decision:

• Either establish a complete risk monitoring system covering the entire chain, including real-time address profiling, suspicious transaction identification, blacklist interception, freezing mechanism and STR reporting process;
• Or accept a more direct but costly solution: perform KYC on all coin holders, even if they have only received a stablecoin on the chain.

From a regulatory perspective, this design isn't conservative at all, but rather aligns technical capabilities with regulatory obligations: you can avoid having to verify every user's real name, but you must be able to manage risk. Otherwise, you'll have to revert to the most basic approach—KYC.

This is also the key point that this article hopes to clarify:

"Do stablecoin holders need KYC": This is not a one-size-fits-all question, but depends on whether the issuer's risk control capabilities are trustworthy.

Conclusion: The supervision is clear, and it’s time for technology to be ready

The regulation of stablecoins is not about blocking technology, but about setting a clear red line:

You can choose technical solutions to replace real-name authentication, but you cannot evade the responsibility of risk control.

For issuers, the most critical question is not whether to do KYC, but whether they have the ability to convince HKMA that they do not need to do it.

Under the principle of "same activity, same risk, same regulation," stablecoins, as a quasi-payment tool, are moving toward the same compliance requirements as traditional finance. For Web3 projects, this isn't the end, but a new starting point: With regulations clarified, it's time to put the technology to the test.

Finally, a quick overview table is provided to facilitate quick query of regulatory requirements.