I know DUSK token is utility but STO might not be count as utility token. Is STO transfer to other platform or exchange require KYC? is there any white listing feature will be who already done KYC once?
To help third parties to meet the legal requirements of their ownership transfer use-case, the Dusk protocol provides optional on-chain operations of white-listing (using Zero-Knowledge Cryptographic Accumulators). In the sensitive case of securities, we are also developing a Confidential Security Token Standard that allows third parties to issue security tokens on top of the Dusk Network (the XST standard). Security tokens implementing the XST will have both privacy (i.e. investment and market positions are not openly broadcasted on the ledger) and Regulatory Compliance data (transfer of these tokens can happen only if purchasers add to the transaction KYC data satisfying regulatory requirements) embedded directly in the transaction protocol.
Dusk decouples the (centralized) KYC/AML vendor process from the (decentralized) security issuance and transaction arbitration with the aid of time-locked accumulators. Cryptographic accumulators are ideal for implementing zero-knowledge white/black listing accreditation of (un-)compliant investors and automated accreditation. Also, expiry mechanism can be added for forcing rechecks. It roughly works in the following way: as soon as the KYC/AML process completes, the transactor identifier (basically his/her registered wallet address, but it can also be something else, i.e. biometric data, etc) is committed to the accumulator, which remains opaque and discloses nothing of its set. A witness (called compliance witness) is thus generated and returned to the applicant. Such witness is the proof of set inclusion. From that point on, all transactions related to that particular asset class (token) must include the compliance witness.
I hope this answers your question