While holding customer statements does expose the bank to risk, there are controls that can mitigate that risk such as maintaining statements under dual control; having held statement agreements, which specify that the statement will be mailed if not picked up within a certain timeframe and also specifies what will happen to other timely sensitive information, such as NSF items, 1099s, etc.; having the customer sign for pickup; documenting the identification verification process each time the statement is picked up; etc. So, if you have to hold customer statements, there are mitigating controls.