In addition to what others have said, usually they have legal experts who they seek advise. So at the beginning there are ICO which doesn't require any KYC's but when the tokens are about to distributed, other's suddenly asking for KYC's just to make sure that they are following all regulations and they need to adapt, otherwise if might have a big implications later. Its just sad though that it was not intimated at the very beginning so that investors or bounty hunters not comfortable sharing their personal data will not invest or join that ICO project.