You can have any KYC rules as you wish.
But it should be at the beginning. Not additional KYC when a verified customer ask for a withdraw.
What about he don't have a second ID when you ask? How long will he need to apply one? His money will be pending for that long. Is it not suspicious at current post MTGOX atmosphere?
This is the point and this is not acceptable.
I suggest you at least publish your entire KYC rules. Inform customer they may be asked for additional KYC documents at the time you need. That is how the things should be.