How long should we retain customer acknowledgements showing the demonstratable consent and application for the customer to receive E-Statements? Under the same lines what is a good retention period of Online Banking applications?

If you ever plan to defend yourself if something goes wrong, I would suggest you keep them as long as you do any other contract, as that is what they are.

What are you retaining as evidence of demonstrable consent?

For users that are the 1st name line on the account the system automatically logs an event on an audit report indicating the online banking user changing the code on there account to reflect E-Statements. These are applications for users that are the 2nd name or 3rd name on the account that the system does not automatically allow the customer to change that value, therefore we have to manually go in and change that value. In both scenarios the customer has to check mark a box indicating that they have read the terms and conditions of the E-Statement disclosure, which is in a pdf format (the same format that customers download their e-statement from).