We are also a small bank, and what we would do would be to collect the one key, sign off on the contract (ours asks how many keys were returned) and close out the box, collect a lost key fee, and open a new box with a new contract. We would then not re-issue that box until the locks had been rotated and it had a new set of keys made. We don't make too big of a deal about it when they only have one key - we are just glad that they have at least one. The drilling process is not fun, and it takes up a lot of time for both us and the customer, and the cost is not fun either, although we make the customer pay for it.