I get the KYC concerns for API access, but I'm sortof baffled at why they'd need all of the AML stuff, given that they're not payment processors/financial institutions.

Or does Persona provide that by default? Don't know much about their service...