Don't get me wrong, I'm not giving my personal opinion here but this is how these policies work. Regulations will only get worse from here. I wouldn't be surprised if they already reported OP's transaction(s) to local authorities (if they know what country he's from).
But that's my whole point here. I did provide them with my KYC information.
I also explained who I am and where the funds were coming from.
KuCoin has everything they need to verify the legitimacy of my claims and funds.
The data they are asking me to provide on the other hand contributes nothing to this.
Neither my phone number, my residential address, TAX number, Employer information nor annual income has anything to do with the funds they froze.
Giving them this information would not change, that they need to be contacted to get the information about where the funds went.
And if they should ever be contacted the KYC information they have is by far enough to verify my identity.
So all giving them this information does is opening myself up to a lot of possible attacks as I can not ensure they are kept safe.
Nor have I even been provided a way to submit this data securely if I wanted to.
I simply do not trust KuCoin to keep my data safe. Asking me to submit all this in plaintext in an email just proves my case.
If they clearly stated I would require to KYC before making transactions I would probably have done so.
But this is not a risk I am willing to take. And from the looks of it that is EXACTLY what they are banking on here.
All I'm asking of them at this point is to just refund my tokens to the wallet I sent them from.
Perhaps they are contacting your local authorities to report their 'suspicions' and holding your funds until they hear back from them. If the authorities are satisfied with the information you provided KuCoin can release your funds:
Their privacy policy is also very clear on why they can/will collect personal data:
(m)to prevent or investigate any fraud, unlawful activity or omission or misconduct, whether or not there is any suspicion of the aforementioned; dealing with conflict of interests; or dealing with and/or investigating complaints;
(n)complying with or as required by any applicable law, court order, order of a regulatory body, governmental or regulatory requirements, of any jurisdiction applicable to us or our affiliates/associated companies, including meeting the requirements to make disclosure under the requirements of any law binding on us or our affiliates/associated companies, and/or for the purposes of any guidelines issued by regulatory or other authorities (whether of Seychelles or elsewhere), with which we or our affiliates/associated companies are expected to comply;
(o)complying with or as required by any request or direction of any governmental authority (whether Seychelles or foreign country) which we are expected to comply with; or responding to requests for information from public agencies, ministries, statutory boards or other similar authorities (whether Seychelles or foreign country). For the avoidance of doubt, this means that we may/will disclose your personal data to such parties upon their request or direction;
Not sure where I read it but I think that, according to AMLD5, exchanges are no longer allowed to inform users in case of an investigation/inquiry.