Your AML/KYC rules changed after the User was an existing customer. When he became aware of it he was told by your CTO that he did not have to send ID otherwise he would have moved his crypto out earlier.
The user accepted the new TOS. Still, since 2011, if we are not positive about the identity, we do have to check for security issues. Believe me, we have seen any kind of examples in the past 8 years....
I want to believe he/she is the owner. In this case, I'm positive he/she will provide to us, or to the authorities, what we need in order to promptly release funds. As simple as that
Thank you!
PS: The CTO is not the Compliance officer.