Worrying yes, but i think it's required. KYC laws in the US mandate a 5 year retention AFTER the account is closed:
https://bsaaml.ffiec.gov/manual/Appendices/17
> A bank must retain the identifying information about a customer for a period of five years after the date the account is closed, or in the case of credit card accounts, five years after the account becomes closed or dormant.
https://bsaaml.ffiec.gov/manual/Appendices/17 > A bank must retain the identifying information about a customer for a period of five years after the date the account is closed, or in the case of credit card accounts, five years after the account becomes closed or dormant.