They hold the money as long as they want. They can make requests for the customers to upload various types of documents and proof until they come to an obstacle that they can't overcome or they refuse to participate in the charade any longer. The exchange will then say that the money will be kept until the user does what is asked of them.
That is basically selective scamming taking place on an industrial scale. Imagine the amount of funds they will have available at their disposal after they frustrate customers with endless requirements of documents that they never intended to accept in the first place.
Who can you complain to if the exchange is registered and regulated by an entity in the Seychelles or the Bahamas?! Good luck with that!
That certainly does not help the customer/victim in any capacity. People really should become more vigilant and conduct some research before sending their funds to these exchanges.