It is a very bad practice and I think that sites that are using that strategy of KYC only in the customer wins and only if the customer wishes to withdraw and only when that happens are liable for legal claims from all fronts - from the client as this practice seems to be destined to deprive from earnings and the taxman, as the KYC is not required when loosing.
The problem with that is that most crypto casinos, if they are licensed, are licensed in a country like Curaçao. Since the user generally does not live in Curaçao, he must have lost enough money so that it can be potentially profitable for him if he wins to hire a lawyer to file a lawsuit there. And then wait for the lawsuit to be resolved favorably, I do not know how justice works there but knowing how important casinos are for the economy of Curaçao I would not be surprised if the legislation and the courts tend to be more in favor of casinos.
The actual fact is that I think gamblers have gotten comfortable and are already used to this what seems like a tradition in terms of asking a gambler to submit his or her personal documents for kyc verification only when the gambler wins a good amount of money and request a withdrawal of the funds, or some of the funds.
Many gamblers have issues with kyc and this is what the casinos are already riding on to manipulate gamblers, gamblers don't have issues playing all day on a casino where they can freely deposit and play without being asked for account verification which requires them submitting their private and personal information, while on the other hand, some casinos are riding on this to manipulate gamblers as they usually will allow gamblers deposit, play and lose without them asking the gambler to pass kyc verification, but immediately the gambler wins a significant amount of money and places a withdrawal request, the casino hits back on the gambler with a mandatory account verification before his or her withdrawal will be processed, and this they do in a bid to see if the gambler will get angry, prefer to keep their personal information private, and thereby, forfeit their winning back to the casino since they won't be able to withdraw without going to the process of kyc.
To me though, this is a criminality in disguise, but I do not know how possible it is to sue a casino for such behavior, since they may still use what is written in their terms of service (can ask a user to pass kyc verification at any time and for whatever reason) to win the case.