When applying for a credit card in the US, is it normal to be asked for verifying documents? Should I redact nonessential information?

It is a legal requirement for financial institutions in most countries to abide by a number of rules in their dealings with customers, including

• AML (Anti-Money Laundering)
• CTF (Counter Terrorism Financing)
• KYC (Know Your Customer)
• Dealing with PEPs (Politically Exposed Persons)
• Etc.

Also:

• They are lending you money, so they would rather know who exactly they should go after if you spend a lot and then never pay them back;
• They may have to apply different rules (or altogether reject you) based on where you reside;
• It’s not just for the government or for them: you want to be protected as much as possible against someone pretending to be you and getting credit cards and spending money and letting you foot the bill.

So yes, they need to know who you are (and a few other details), and they need some good evidence for it.

How they do it exactly varies, and there are also a number of situations when they can defer checks (e.g. up to a certain total amount of transactions they don’t ask for anything — or very little — but they’ll ask for more documents once you reach that threshold or come close to it).

So nothing surprising in them asking. If they are serious they should even request some form of “live” check (in person, or via video or some similar means), to prevent someone else using your stolen documents (identity theft).

In some cases they can on the other hand rely on existing checks (e.g, if you already have a checking account with the same institution, or if you use some form of payment means that allows them to rely on the checks performed by the issuer of those means).

Now, it does not mean you should give your details to just about anybody. Make sure the card issuer is well known (and they are actually who they say they are), that they are properly registered with the appropriate authorities, that the domain is legitimate, etc. You don’t want to fall into a phishing scam.

Yes, these are standard identity verification requests. You have only need to supply one from each category, your choice, so if you don't want to give them the bank statement pick one of the others.