At the very least, they should provide sufficient explanation why the transaction is flagged. You don't just keep the funds of customers without a detailed explanation why you're doing it, or suddenly require personal explanation without saying why. Second, if you think the transaction shouldn't proceed, reject it, but return the funds to the owner. Why do they have to keep the money to themselves?
Have you considered the following two possibilities. First, they may not be legally allowed to tell you much. Second, if they reveal all the things that flags their system then it becomes easy to bypass it?
You tell that to the people who have lost life-savings, life-changing amounts to these scam exchanges. You tell that to the clueless customers who forever wondered what happened to their hard-earned money. They got no proper explanation, no response even.
The possibilities you're talking about are the most convenient ways for these scammers to steal money. Forget about legalities. I'm sure these behaviors and alibis can't stand in a court of law. If only it's easy to bring these scumbags to court.