In my opinion number one would be questionable since the customer would not be consenting electronically. Number two sounds more in line with the requirements. I have heard some banks include a code or information within the initially emailed document that the customer must retrieve and email back to the bank in order to prove they can open and read the document.
Here’s a link to information from the FDIC’s exam manual: https://www.fdic.gov/regulations/compliance/manual/pdf/X-3.1.pdf.
