Answer:
Your privacy policy is not required to be on your web site at all, unless that is one of your means of proper disclosure. I'm not sure what security statement you mean, but there isn't any requirement for something like this either, that I know of. That doesn't mean it isn't a good thing to do, but it isn't a violation not to, unless that is your means of disclosure.
First published on BankersOnline.com 11/12/07