Then surely all the good actors have to do KYC, and all the bad actors can just pretend to be American entities.

I don't agree with this on principle, but even just from a practical perspective it seems like they are leaving the door completely open by doing that. What's even the point?