From the very start ask your bounty manager if the rules are already firm and final.
But the sad thing is before you are going to ask them, you'll see one rule that allowed them to change any rule as they wish.
Agree, it's the final rule!
But on the other hand, why need KYC for a bounty program? I cannot see the point.