I'm sorry for any confusion; you said that a customer can reject KYC and in most cases he'll get a refund. What would cause a customer to not get a refund if he rejected KYC? What happens to the funds in that case?
Yes, customers can reject KYC, and, by current Terms of Use and everything is there, customers will get a refund.
IF AML check turns out bad, customers will be "forced" to go through KYC/AML procedure, so that is the "most" part.
If the customer fails to pass AML then crypto stays in limbo, no one will have access to it. There's also a section in Terms of Use that ChangeNOW can donate crypto to charity, but that's for countries that are prohibited by applicable law, not for illicit crypto.