CIS-2 token accounting on full account address or canonical account address?

As the title says: should token accounting be done on the full address or the canonical address?

Example: This tx transfers a tiny EUROe token amount to (what I have labeled as) bitfinex account.

From CCDScan (here), the parsed transfer event is:

[
  {
    "amount": "100",
    "data": "",
    "from": {
      "Account": [
        "4FWx8VN59AYA9p5wcq9zHyo7E5aEP3F1qteF3M4kzaTp96vLSj"
      ]
    },
    "to": {
      "Account": [
        "3kKn2kz9YHrkrKUcBZF9NUJbg8LqGzcBbLwzH1VPBdPtktti8S"
      ]
    },
    "token_id": ""
  }
]

Now, when I view the account address in question (3kKn2kz9YHrkrKUcBZF9NUJbg8LqGzcBbLwzH1VPBdPtktti8S), I can see on CCDscan that this account holds the correct amount of EUROe token.

However, the account that CCDscan is showing, is actually the ‘main’ address (3kKn2kz9YHrkrKUcBZF9NUJbg8LqGzcBbLwzH1VPE5g2fTbY9z).

Hence, my assumption right now is that tokens should be accounted for at the canonical level instead of the full address? If this weren’t true, then the ‘main’ address above should not hold the EUROe token in this amount, which it clearly does.

Please advise.

It is always the account that holds (as in, controls or can spend tokens).

Aliases are just multiple addresses for the same account, and if I have account keys I can send transactions from any alias.

But it is meaningful to also see tokens per alias, for example exhcanges use this mechanism to distinguish users.

So as a summary it is the account that holds the tokens, but you might want a more fine-grained display distinguishing the balances further per alias.

Doesn’t this then contradict how CCDScan displays tokens for this account? As it is not distinguishing between aliases?

Anyway, in the Explorer, token accounting is done on full account address (alias) level, so I can distinguish between aliases. Only in the account view on the Explorer do I “merge” the aliases into the account, so I need to be smarter there in the display.