> If they fail, you get paid the fine (not the state)

Source for this?

It's a lie, there is no provision whatsoever for people getting paid in GDPR.

Companies are allowed to keep data necessary for their other statutory obligations, like taxes or KYC. Otherwise it'd be a get out of jail free card for fraudsters and sanction evaders.

Yes, but they're only allowed to use the data for the (legitimate) purpose it was retained. If you ask them not to retain/use it for marketing purposes, they can still retain it for statutory purposes but they can then only use it for that (not for sending you advertising emails etc.)

You are right, I misread the gp, my bad.

Sure, but the op suggestion to delete the account should mean deleting any email marketing permissions, which are not necessary for KYC or taxes.

Do you have any evidence that this process actually works, or are you just parotting what we have been told over the last 5 years?

In my experience, there is actually quite a barrier to this, meaning most situations where you see a GDPR violation are not easy to escalate.