Sure they do: Take your business elsewhere.
Yeah, I mean after you've made an account and deposited money. You can't say "Hey, I changed my mind, give my 'tainted' coins back". They confiscate your property and you either give it up, or give them what they want, that is personal data. They're blackmailing you straight. If they didn't, you could have the option to provide your UTXO on some /taint_check, and see yourself if your money is "tainted", without handing it over to some third party.
...if they find you suspicious to a certain level they run an investigation. if it encroaches to a certain threshold, they can limit your access to certain features in their service. but you still have the ability to withdraw your funds and close your account....