For example for AirBnB (well, granted some "conciergerie" service belonging to AirBnB, in France: but even if it's top-end it's still AirBnB) they wanted me to record a video of me of 20 seconds.
They're not the only ones to do that: I've seen other sites asking these vids.
The more regulated stuff, like brokers, banks, etc. shall ask what's legally required: proof of address (a utility bill), scan of the driving license, etc. but nothing more (at least in my experience).
But the non-regulated players: they invent stuff. They make up shit, apparently on the spot.
At some point they'll ask a blood and urine sample to "verify my identity".
Which would be okay'ish, I guess, if they weren't so incompetent as to invariably leak those data when a hacker shows them who can code.
I take it the KYC/AML will have to be modified to prevent anything more than what is legally required from being collected.