It's worth noting that it's not necessarily specific to bank payments, depending on your jurisdiction it may be that general accounting laws that require every company to store payment history for at least 5 years, for example.

To add on that, for some types of transaction the regulatory requirements are much, much longer - I was working in a jurisdiction where data of housing loan repayments had to be stored, by law, for 70 years after the end of the loan; so for a 30-year mortgage you'd have to be prepared to store every repayment for 100 years; and information on salaries calculated and paid has to be stored for 75 years (IMHO to resolve retirement-related disputes where it matters where you worked decades ago), passing on to national archive if the company is dissolved.

Just to add to this: GDPR does not apply here.

That's a bad way of putting it: GDPR obviously applies, but it permits storing data that needs to be stored due to other legal obligations. If "GDPR didn't apply", it would also loose all the other protections GDPR provides, which it doesn't.

Yups, that's correct