KYC isn't required for users. You can download Brave, opt-in to Rewards, earn BAT, and support content creators across the Web, and all without KYC. But if you wish to deposit/withdraw, then KYC is required (by relevant AML laws/regulations). Brave can't break the law if we wish to reform the Web into a privacy-preserving medium for communication and more. It's not up to us whether KYC is part of the equation; we have to follow the law.