If you are really afraid of this, you can either :
-use a P2P service for the original purchase of your BTC, without KYC, so you don't have to worry about all that.
There is just cause for concern. What are the guarantees that when buying from others, there are bitcoin of them without a KYC (one of the past transactions) or have a connection with criminal money? A criminal trail can lead to you, a completely random person in this case, law enforcement agencies. My point is that the shadow of the activities of the previous owner of bitcoin (or one of them) can fall on you.
Probably, only a direct purchase from miners will help here.
-or use a coin mixer before sending it to your friend, but you risk to flag the coins doing that
Here, too, there are no guarantees that the service doesn't collect data about its customers and law enforcement agencies will not get access to this data, as was the case with the chipmixer.
This is another excellent reason not to use a CEX to buy your coins. There's no point in using them, as we have Bisq, Peachbitcoin and many others at our disposal (kycnot.me is your friend).
As for the substance of your question, it's complex, the real question is more: why would an agency be interested in your friend's activities ? He would need to truly exagerate to get them to look for you following a transaction he might have made with the coins you sent to him...
The question is more confusing than complex.