We use the push method and, yes, customers establish a password to access their statements. Most of the internal controls are managed through our vendor's software; be sure to check with your vendor as to how you will manage: establishing passwords, documenting demonstrable consent, and handling returned emails.
_________________________
Life without Jesus is like an unsharpened pencil - it has no point.