To a large extent when there is no rule to follow, ask yourself how often you may want to go back to these records and if there would be any possible liability to the bank for the data. If it could be subject to a lawsuit of any kind, what is the statute of limitations? Just having data is a risk because you may still have private/confidential info and with that comes a security responsibility. So you don't want it just anywhere. Then ask, are there associated accounts, was it denied, withdrawn or just incomplete? If incomplete was it replaced by an accepted and approved application that it could be retained wit, if needed at all? When you save these, if you do, how would you find a record? Ensure there is filing system if it was the record was requested.
My point is, don't keep them to keep them. Know why the bank opts to and place controls accordingly.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell