I have reviewed the Token of Trust plugin and it does indeed look like a good fit. It assigns user Roles depending on whether a user is verified.
It is possible to use the Wallets → Capabilities menu to control which Role can do what.
Therefore, an admin can disallow withdrawals or trades for people who are not verified.
Thank you @casperdre, this is a good solution. From now on, Token of Trust what I recommend admins use when they need KYC for legal compliance.