How do we know that these are legitimate and valid requests?

When we send a cancellation request we include the electronically signed contract, which is verified by way of the customer being signed in to their personal banking application (and having gone through the required security gateways). 

The customer is able to then digitally sign the cancellation with the parties, namely the bank and Minna Technologies, which is included in the Agency Agreement you receive.