Analysts flag broken compliance controls in Anchorpoint's live HKDAP stablecoin

A review published by security analyst Yajin Zhou says HKDAP runs on an Ethereum contract that is not production-ready, and has Know-Your-Customer (KYC) and revocation controls that do not work as coded.

HKDAP is a Hong Kong dollar stablecoin that Standard Chartered-backed Anchorpoint launched on August 12.

What’s wrong with HKDAP’s rules?

The security analyst Yajin Zhou and his team have published a review on HKDAP. In it, they lean on the fact that because HKDAP settles on Ethereum mainnet and its source is verified on Etherscan, the token is directly inspectable.

The analysts checked whether the code is correct and ready for real-world use, and whether its on-chain behavior follows the HKMA’s official rules for stablecoin issuers. The answer to both questions was no.

The contract, as of the time of writing, has several functional flaws, one of which is that its governance is too centralized.

A single key can carry out high-risk actions, including minting new tokens, freezing accounts, pausing the system, and forced burning. The contract also lacks a time-lock, which is a common feature that delays actions for review. The review also said the contract “clashes with specific clauses” in the HKMA regulations.

The review found that the compliance controls meant to block unauthorized users do not work as coded. The KYC module, which should stop users who are no longer approved, has a broken revocation function.

In simple terms, if a KYC provider is de-registered, the wallets they approved can still transact. Analysts also found that KYC proofs are not validated on-chain, and deregistered verifiers can still approve new users.

The report noted the contract rebuilds basic security features instead of using well-tested code. Most of the bugs were found in this custom code, with analysts saying the “Beta Access” label does not close this gap.

Why is the launch of HKDAP a big deal for Hong Kong?

HKDAP launched with the heavy institutional backing of Anchorpoint Financial, a subsidiary of Standard Chartered Bank (Hong Kong) and a joint venture with telecom operator HKT and Web3 firm Animoca Brands.

In April, it became one of the first two firms, alongside HSBC, to win a stablecoin issuer license from the HKMA, which the regulator granted out of 36 applications under the Stablecoins Ordinance that took effect on August 1, 2025. Anchorpoint holds license number FRS01.

The company started its HKDAP rollout on August 12, 2026, but the product is currently in a beta phase, offered to institutional distributors and professional investors. HashKey Exchange was the first authorized distributor to mint and redeem HKDAP.

Anchorpoint’s CEO Dominic Maffei said the rollout is “prudent and structured.” The company also has plans to offer retail access “as early as end-2026,” but that decision is subject to market conditions.

If you're reading this, you’re already ahead. Stay there with our newsletter.