A common legal requirement for record keeping is 7 years in the US, as they noted in the quote, although some types of records may need to be kept longer. We are not 7 years out from 2018, so still within that standard window.

I have no idea if there is a way around it, and a lawyer would be the right person to provide advice.

As for changing 2fa when you no longer have the phone, the best you can do without a lawyer is contact their support and escalate to a supervisor if they don't have a way to update that ready to go. First level support will generally not be able to handle that kind of thing, so be ready to escalate. No need tonstart off with any legal threats, just plainly state what the situation is and hownimportant it is to you and there is a high chance of getting the 2fa updated even if you can't get the account closed.

If they aren't cooperating with recovering access to your accounts, report them to the CFPB. They are legally required to give a real response instead of a form letter. I assume it costs them time and money, which is a side benefit.

If the federal government requires 7 years, they probably will not budge on that at all. They should have a strong incentive to not leak that data, but they don't. That is a failing of the US government. We need a HIPAA but covering any personal data instead of only health.

The answer depends on the country. In the US, review the Bank Secrecy Act and anti-money laundering (AML) regulations. In Canada, there is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) regulations and also the CRA requiring the individuals and businesses retain their records for up to six years.

if there’s some sort of way around this either with a lawyer or federal form or something.

Very unlikely.

Presumably it's the same reason that I couldn't find a way to close my bank account (in person, at the fucking bank) in 1998. And presumably it's the same reason that my elderly parents can't get their Medicare supplemental insurance agent to close out their account prior to their move to another state, where that insurance won't be accepted.

You're a customer. They love you. Reasons.

Laws probably

Best you can do is remove all funds from those accounts and have them lock them so they can't recieve deposits or issue withdrawals. THAT, they can absolutely do.

Any data deletion will probably happen automatically or not at all, but there's no incentive for them to retain any detailed transaction information beyond federal requirements, and yes, its seven or more years, depending on criterai like amounts and location.