Did he use the coins for gray market services like proxies or captcha solves or no-KYC exchanges? I hear exchanges are basically being forced to invest heavily in on chain monitoring software like Elliptic and Chainalysis. If he sent coins to an address that some other bad address even indirectly sent coins to, some braindead compliance employee will probably think they've uncovered a sophisticated money laundering scheme.