They get information from blockchain analysis companies and other parties that deal with AML checks. There are certain services that trigger higher risk scores than others. For example, if you use a mixer and then deposit into a CEX, chances are you will trigger some of their alarms and they will want to you know more information about you and your money. Similar things can happen if the money originates from addresses from sanctioned individuals, services or entire countries. Even crypto from gambling and online casinos can be considered "dirty" by certain parties.