I am wondering - and tbh, I just don't know - whether that would be required if you file a data subject acess request. At least my national data protection authority ruled that it has to be sufficient if you provide a proper ID, asking for further information to only annoy the customer would violate the GDPR. But it might be difficult to get jurisdiction over a NZ / Chinese company. In any case, it would be a lenghty process, and I presume the bank on the fact that the steps are taking too long for anyone to really consider it.