I never seen anything like web.config file in layouts folder, so I would assume its simply not best practice neither counted as recommended way of doing it and you might end up with several problems no one know about.
Anyway your basic requirement is that you need to add a web.config because your client (bank) needs to change password periodically, so why don't you keep password or settings in a database and use a utility class to fetch it as if your client will have permissions to edit web.config on WFEs then I think they should have given permission to a custom database with custom permissions on it.
Another way I can think of is create a simple xml file with tags for user and password and then in your feature activated code as provided by rjcup3 in this answer Custom SharePoint 2010 WebService inside /_vti_bin and web.config , you can get easily values using XmlTextReader.
Make sure XML file will have appropriate permissions. Using XML file for storing credentials you won't need to recompile your project as with web.config, if you make changes to web.config "in your case only as web.config will reside within assembly".
For the second part you can read application configuration using this code line,
textBox1.Text = ConfigurationManager.AppSettings["OracleDataSource"];
textBox2.Text = ConfigurationManager.AppSettings["UserID"];
textBox3.Text = ConfigurationManager.AppSettings["Password"];
But you will need to make sure your project has reference to
if you want to read more check the following links out,
MSDN article on reading app settings
Edited for Comment
You can have credentials saved in a XML file which can be placed anywhere on your server's drive I would personally create a new folder in drive which is used for applications and put file in a root directory then in 12 hive for ease to edit, and then in web method you can call it, but make sure only right people will have permissions on file for viewing and then editing respectively. Deployments I worked on always kept credentials in a separate utility class for security purposes but they didn't wanted to change it that often and if they change it, they had to re-doply changes which means downtime.
In short by using a XML file you will not require any downtime if you will update credentials.