I dont see they would have to hold onto the KYC details that were verified, I really hope they would not be doing this in any case.  Maybe you are right, for the sake of proof vs some kind of tax audit they keep a copy of customers exact passport details which makes me even more uncomfortable then I was previously.    

What I expect and seems reasonable is they verify the document once only to prove you are who you say you are, if its done real time theres no need to be keeping copies at any point.  Then they would just keep a note of your name and address perhaps, its proven well enough at this point and they can say they did their due diligence  etc.
   I can understand people are apprehensive about details being duplicated to be possibly used elsewhere, there is a monetary worth for that kind of information.   I'm sure Bitrex outsourced this requirement when I dealt with them, I much prefer I dont have to passing some test like this every time I deal with a new company.   Ideally it should be done once, in a token service kind of deal and then you are verified and this can be sent forward as proof without any further risk to documents being kept online somewhere or needed to be passed onto yet another company or set of individuals.

Last KYC I did recently just for comparison with a commodities depository company required my driving license and a bank statement.   The statement I dont care about really, the license could be some trouble I guess.    So ideally I'd want all companies to using a proper system for KYC universally, it probably should have been done a long time ago.   BTW, they are taking forever to respond to me, its just a conventional based company but always KYC is a pain and Im left for months trying to get their nod Iam a valid person not a pirate or whatever despite having the same address for decades it shouldnt be that hard to check.
    All they have to really do is check the national electoral register which is public record, that imo is enough to verify and I can even send them the last postal voting document I had.  No big deal as its time limited but literally shows Im a citizen, unfortunately I have to be giving out copies of my license to people which is a liability I agree.