How do you handle the ICANN requirement to keep contact records (incl. email) updated, on file, even if they're not published (whois privacy used)?
They can't handle it
In this case I would recommend them NOT to advertise the fact that the domains are being managed by them (in the Whois).
Any company may report them to ICANN just to make sure the domain they want is deleted.