You have not received any request or notice from any law enforcement agency yet you have confiscated the funds because maybe someone 18 months from now will request it? Can you understand how ridiculous that sounds?
You are never going to be asked to pay any fine from any law enforcement agency because you are not registered in any jurisdiction, you remain anonymous. Why are you conducting KYC on the customer of the OP if the funds are allegedly stolen and you will not return them regardless?
Anyone has the opportunity to apply to law enforcement agencies with a statement on the retention of funds. We respond to all requests from law enforcement agencies and provide a detailed answer about the reasons for the freezing of funds.
In the practice of cryptocurrency services, there are cases when even projects with mandatory KYC were recognized as accomplices to crimes and were subjected to at least fines, and at most sanctions, which in principle means the complete closure of the project. We are not interested in this, so we are ready to protect our own interests, trying to continue to provide the same level of quality services to our customers.