Regarding doing KYC before letting people invest, there are pros/cons to either option but I don't think they are breaking any current or future laws here, but I am not a legal expert so I'm only voicing an opinion. Remember that all funds invested are in limbo until KYC is complete. UTRUST is not allowed to touch it.
Technically, who is there to tell them what to do with the funds, to touch them or not? Do you read anything specific and binding in this regard in the whitepaper?
Remember - ICOs are unregulated.
Either way, there is a big difference between doing KYC before or after accepting someone's money. If you broker a financial transaction, which you do when you set up an address for receiving BTC or ETH, and if you want to be on the same level of compliance as a financial intermediary, then you better know who you are dealing with beforehand.
I don't see anything legally binding in regards to the escrow of the funds in the WP. But as you said, ICOs are unregulated at the moment. There is a certain level of trust required when investing in an ICO -- you have to trust that the company is going to do what they say they're going to do.
Personally, whether their funds are in a locked escrow, or the funds are unlocked but I have their word they won't touch the funds until after KYC, is not a big deal to me. But I have personally spoken to the team members and I believe in their vision and the team behind that vision. For those with less trust, I would recommend staying away from ICOs and buying later on an Exchange. But I want to see UTRUST succeed, so I'd prefer they get my money directly instead of some guy on the Exchange getting it.
I do partially agree with you, KYC before accepting funds is the most secure and compliant way to do it. But since their KYC is so manually intensive (i.e. a video chat required for over 14,000 participants with a human operator), I guess they decided it was more important to focus on KYC security (making the KYC process itself more secure than any other KYC process in the industry), instead of paying potentially up to a million dollars (I got that figure from the team) to do the same manual process on 50,000+ participants. So ideally, they would do the intensive KYC AND do it before the ICO, but they chose a middle of the road option with a focus on a strict KYC process. It's still better than 99% of other ICOs, and the KYC process itself, while a hassle, is VERY difficult to fake (which you can do with other KYC processes pretty easily). Sure, I could go grab my brother's passport or friend's passport for the video chat and just use their address/name/information, but you have to agree that it's more secure overall.