If they are willing to return the coins, then why do they need his data? Understandably, they do not want to process the order, so just let them return the coins to the sender and end the drama.
I am unsure which law states that the exchanger holds the funds until it receives information about the owner.
These are standard rules followed by the vast majority of exchangers. They often accept tokens directly into custodial wallets (exchanges, payment gateways, EPS, etc.), which block deposits without the option to withdraw until identity verification and proof of fund legality are provided.
So by your logic, if a service was certain that the funds came from drug trafficking or theft, they should just return the money to the criminal and do nothing? Unfortunately, the financial world operates a bit differently than abstract logic in an ideal universe.