You have a point, but as much as I hate what I'm about to say, I don't think there's a need for BSP to explicitly mention "how" they should gather those data.

I've never used Abra, but it seems to be a "custodial wallet now" and the fact that the "recovery phrases only work in their platform", it's just a false sense of security!
^{- Nothing stops them from imposing similar restrictions.}