On the merchant side they use dfx as service provider which requires KYC. This can easily be extended to the customer side in the future. Trojan horse imo.