My point is that privacy doesn't need to do KYC because there is no possibility of the customer evading regulators. Assuming that privacy answers subpoenas, they would be able to give the government detailed transaction info and a bank account which would identify the customer. KYC at this level of abstraction doesn't seem to solve any kind of legal problem. I'm glad to be educated by an expert, though.

Edit: A sibling explains a good liability reason for this, which makes sense but would not imply any legal reason.

How do you validate that they own the bank accounts if you don't know who the user is?

They only verify control. They do the method of making two small deposits and asking what they were.

Which is why KYC is required. Two small deposits just means you have access to someone's bank account, not that you're actually them. Money launderers will pay mules to use their bank account to move money around.