We are an exchange ourselves, and we think exchanges shall never collect KYC info from customers because, hey guys, let's face the uncomfortable reality:
We, as small-to-medium size businesses ( let's admit it guys, even the largest exchanges shall be considered mid-size business by real world standard), are not as sound as government agencies in terms of cyber security and the short history of crypto we have lived through has already proven this point hundreds of times. And, if a hack does occur, we don't have the kind of resources nor the legal authority to track down and arrest hackers and retrieve the lost KYC info.
Collecting KYC info jeopardizes our customers' privacy, and also infringes the original spirits of cryptocurrency. That's why we as a team decide we will never make KYC requirements. Period.
Sadly, some government agencies are making these inconsiderate requests that equally jeopardize their citizens' privacy.