What I see with HitBTC is extremely shady. And that's reflected through their forum rep as well.
In the past they have done extremely similar stuff with asking for KYC when people try to withdraw, and going to lengths of even asking for proof of funds even though these requirements were never mentioned when you deposit. Only when you go and try to withdraw do you find out that these are all needed.
P.S : they wrote to a man this :
After the registration, the withdrawal limit for unverified accounts will be 1 BTC per day (and it's equivalent in other currencies), and 5 BTC per month.
If you verify your account, you will be able to withdraw 100 BTC per day and 30,000 BTC per month.
And me it's... 0.87 BTC.
They will most likely again cite their ToS, which likely includes sections that states if they have suspicion over what your account is used for, they are entitled to ask for KYC info. But I do believe that a lot of these are unwarranted and completely unbased, which definitely raises the question of whether they are doing this for the sake of keeping customer funds.