This is a good question. I don't think you are going to find a black and white answer on this as the three options listed are examples and not a hard requirement. While this requirement is provided in the "Laws and Regulation" section of the CFPB exam procedures, the actual review procedures don't include much (if any) info on what examiners should look for. My point being this: I've not heard of this being an issue in an exam, so the risk is probably fairly low as it would come down to whether your procedure is "practicable". I agree that you could adjust your procedure (for #1) to make it even less risk, but I also don't know what other ways you may be complying with the requirement (such as items 2 or 3).
Not sure if that helps, but again, this isn't black and white and is probably more of a question of your risk tolerance.
_________________________
Adam Witmer, CRCM
All statements are my opinion, not those of my employer, and should not be taken as legal advice.
www.compliancecohort.com