KYC/AML for retail crypto exchanges - the moving goalposts

Anyone else feeling like the KYC/AML landscape for retail crypto exchanges is shifting under their feet almost weekly? We've gone from basic email verification to full-blown photo ID, proof of address, source of funds, and now some jurisdictions are even asking for transaction purpose breakdowns on larger withdrawals. It's a compliance nightmare, especially with a global user base. How are smaller to medium-sized exchanges keeping up with the varying requirements across different countries? It feels like we're constantly playing catch-up, and the cost of maintaining robust compliance teams is just astronomical.