My company is KYC'ed with changenow, their license allows them to exchange crypto. you are correct at some point it might raise questions, however, im planning to switch to 1inch solution which is DEX.
I do not think it will raise questions, but what you are trying to present is closer to a money laundering service. It is better for you to hire or ask a legal advice office before continuing to provide such a service.
It may also lead to size your company and thus force you to disclose all user data and transfers that they have made, or they will force Changenow to do it, so in all cases you and the users may be harmed.
To avoid all of this, set the condition that KYC cannot be requested for transactions below $2,000.