I have been advised of the following:
1. No you cannot offset the responsibility of KYC/AML to anyone and you are the sole responsible. What can happen is that you can enlist the services of an entity that you trust would do a good job at KYC/AML, but if they fak up then it's your ass. All you can do is chase them back for some of their fees. So you should know what your target audience is and make sure your payment processor has good experience in the countries where they accept payment from.

I agree PayPal is not seller friendly and it is the worst service on this planet and I will not use it nor do I recommend any seller use PayPal for any reason whatsoever. I was just giving an example. I am still looking for a good payment processor that does AML?KYC if you know any.

2. The laws go deep into the substance of the ICO and not the form of ownership of the token to determine whether it is a security or not, and they err on the side of the more conservative interpreation.