The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.