Depositing and withdrawing funds, without making trades, is a huge AML red flag. Exchanges are basically huge mixers. If you deposit funds into an exchange and withdraw those funds there is no way to trace where the funds are going.
Not a valid excuse to hold somebody's funds without any sort of way to get them back. Exchanges are only decent mixers if they are completely anonymous, like a DEX, and even then there's ways to see who got what, where its been, and where its going. Exchanges that ask for KYC are the exact opposite of mixers.
And of course there's a way to trace where the funds are going, its called blockchain analytics.
It is a valid excuse to hold the funds (according to AML/CFT policies). Chain analysis can't link deposits and withdrawals on exchanges without contacting the exchanges and having them provide the information. This is why similar actions (depositing and withdrawing without making trades) are flagged and will result in having to provide KYC information, as it is a money laundering indication. Exchanges have no other option than to follow the AML/CFT regimes.