To be honest this is nothing out of the ordinary for financial institutions. Paypal does something similar. I got a letter recently stating because I'd withdrawn over 1k euroes over x amount of months I had to send them ID or some other bullshit.