I guess one way this could be implemented is by requiring CEXes to only allow withdrawals to one address as the user's own address (which they already kind-of limit withdrawals to, to make it easier to comply with the travel rule).