KYC Data Retention

A firm that verifies your identity keeps the file — the identity document, the photograph, the proof of address, the answers to any source-of-funds questions — and it keeps it because anti-money-laundering rules require a record, not merely because it finds one useful. Retention periods are set by the jurisdiction and typically run for years after the relationship ends, so closing an account does not delete the documents behind it. Two consequences follow. Data-protection rights to erasure generally carve out records held under a legal obligation, which is exactly this case, so a deletion request will often be refused for the parts that matter. And the file is a concentrated target: a set of identity documents is more useful to an attacker than a password and cannot be reissued the way a password is rotated. How many venues you verify with is therefore itself a decision.