Users create an account, go through KYC, and add funds via a debit card.
When a user creates an account they provide a seed phrase, and this can be used to generate a hierarchical deterministic (HD) wallet.
Why would they provide a seed phrase that's pretty risky to share a seed online or to any exchange users should only provide a public key address not the seed phrase only the owner should knows the seed phrase because if someone knows it they also have full control of their wallets. So it's not safe.