Quite frankly, there is no required retention period. The 90-day "standard" that ahou gives is based on the interim final regulations on electronic communication (for example, section
205.17 of Regulation E). Compliance with the interim final rules is not mandatory, and apparently never will be.
In its most recent proposal to amend the requirements for e-communications in Regulations B, E, M, Z and DD, the Fed would eliminate the requirement that e-statements be available at their "normal" location for any specific time period, although the language in which the Fed couched that proposal suggests that the Fed believes that most banks make e-statements available for longer than the 90-day period. The Fed also said it would revisit the period of availability if it became apparent that consumers had difficulty accessing disclosures (including e-statements) for reasonable time periods after they are posted.
In the unlikely event that your state has a standard, adhere to that or exceed it.