Comment by adameasterling

One can only implement a HIBP check when one has access to the user's unhashed password. So, at login, registration, and password reset.