Our hands are tied as long as we cannot establish the identity of the user.
The user aborted the KYC procedure when we asked for a simple proof that this documents were authentic. Instead of getting a webcam, smartphone or simple camera to produce the proof the user aborted the KYC procedure and went on spending dozens of hours discrediting us.
You do not want to pay the coins. Coins leaving your hot wallet is treated as revenue lost.
That excuse about money laundering won't easily convince people here to take your side. If you are genuinely concerned about money laundering, then you should have required KYC documents during the account opening or joining phase. Why was depositing coins perfectly OK but then you criminalized withdrawing them? If you are genuinely KYC/AML compliant as you claim, you would be applying the rules ahead of any deposit or even during the account opening stage and not when only when coins are to be withdrawn.
The verdict is simple: you are using every dirty excuse on the face of this planet to keep the coins. This is not fair play.
Fraudsters.