At least they are telling you that is the case. The wrong way to do this would be to "sell" bitcoins as requested, expect them to drop in value from some exchange, buy them, and then pass them to the user. If it doesn't drop in value, then after some time send a reply to the customer saying their super advanced machine learning algorithms flagged you as a fraudster.