Are the banks authorized to keep plain text hard copies of full credit card data (Primary account number, CVV, Expiry code, Cardholder name)
(Some assumptions here for the lack of references)
All entities that store, process, or/and transmit cardholder data, such as merchants, service providers (e.g. payment gateways, IPSP, processors), issuers and acquirers, must comply with the PCI DSS
As such, they must keep copies of the PAN encrypted. They may store the expiration date and cardholder name unencrypted.
The DSS prohibits storage (encrypted or unencrypted) of the CVV; however, by definition the issuing bank must know the CVV in order to validate it. That means that either they store it, or they recalculate it (as per this excellent link that @WhiteWinterWolf provided in the comments). It would not surprise me if there was some exception to allow the issuing bank to store the CVV, probably encrypted (it's arguably more secure to store many derived values than it is to expose the key to constant use) but
that's pure speculation.
Update: @dave_thompson_085 pointed out in the comments that the PCI DSS explicitly permits issuers to store the CVV as per DSS section 3.2:
It is permissible for issuers and companies that support issuing services to store sensitive authentication data if:
- There is a business justification and
- The data is stored securely.
On the other hand, I think it's fair to assume that the acquiring bank is not permitted to store the CVV of cards it processes. There is no business driver for it and it would be out of line with the DSS's otherwise draconian approach to CVV handling.