It's still a bad idea and will probably cause additional problems and doubts about your service.
I'll try one more time. Some services, for example CEX's, casinos etc... use different wallets/addresses for deposits and withdrawals of their users. For example, the deposit goes to the cold wallet and address A (connected with the user account), while the withdrawal is made from the hot wallet and address B. So, in case the user going to withdraw and send BTC directly from his casino account to your exchange, it comes from address B. If you judge that the coins do not pass your AML control, you will return them to address B, which is not exclusively connected to a specific user account.
Everything is automated and not reversible.
The epilogue is that you sent a donation to the casino, and you will claim that you acted fairly, but the user was left without his funds.
The casino in this case is just an example, although coins from there often have an AML problem. Also, sending directly from the casino (or other services) to the exchange is not a good practice, but it happens quite often, so I would not rule out this possibility.
Once a mistake like this happens, you'll be left with negative feedback forever, or you'll be paying out of pocket to cover it up.
You misunderstood me, or perhaps I didn't explain myself clearly. Let me try to explain again. What I meant is that the funds are returned from the deposit address to which the payment was made, not from any other address. Therefore, this is not a problem because, for the refund, the client will need to specify the required address for the refund and confirm it by clicking the "Submit" button to process the refund. Thus, such an error will not occur. I apologize if I misled you.