Most of promising ICOs require whitelist and KYC.
You can buy most of the tokens in exchanges without a KYC. For last few months most of the tokens had went below the ICO price after being listed on the exchange.
It depends where it hosted. I am sure that outside of the US there are places were they can host ICO's legally without any major KYC going on. But there is always a tradeoff in which the less KYC and regulation the highest chance of a scam but some legit projects may decide to go as less regulatory as possible to get more investors.
The hard work is done in the research of the project you intend to invest in, this is where you should spend most of the time, and not in actual exchanges buying and selling. Upon further research you still quickly start seeing the obvious scams like Bitconnect and later on you'll find out scams with a lot of technical buzzwords on top. Eventually you will find out something worth risking some money at. But remember: do not invest money you can't afford to lose, specially in this space.
But not only USA ico need Kyc but mostly now they need kyc so kyc is killing our privacy and cryptocurrency build for also that reason. As investor, we can not do anything since the Kyc information announce at the end of the ico where our money has been invested. If we dont pass Kyc then our money is loss.