Thanks for replying.
There seems to be some KYC in the form of, they mainly take Bank Transfers, which means they have a registry of who bought when.
This can happens in DEXs too, except in DEXs there's a layer of decentralisation in private info. In the case of a CEX like Relai, it's all centralised and accessible by whoever has access. Unfortunate.
Will keep looking into it.