In an ideal world, the PIN would never have to be transmitted to the user; instead, the user would choose it.
Experimentally, for banking cards, I encountered two methods:
The bank chooses the PIN and sends it as a letter, with some printing gimmicks to prevent reading the PIN with a lamp, by abusing the paper transparency.
A temporary PIN is awarded by the bank, given directly to me over the counter by the clerk, and I immediately change it through either a payment terminal (on the counter) or with the ATM (which is in the same room).
This world is not ideal so the situation often forces a remote transmission of a PIN, selected by the organization, and sent to the user. In that case, since there is no really secure channel to communicate with the user, the idea is channel separation: the PIN is transmitted in a way which is distinct from the way the complementing information is sent.
Emails are notoriously poor at security. They are, by default, unauthenticated, and may travel as plain text. They get stored on the reception server, with uncontrolled retention time, and often lots of backups. SMTP servers through which the email transits will also store a copy on some storage medium for amounts of time that are not easily measured, let alone configured. An email is a really bad storage place for a secret value.
SMS are somewhat better. When they go over the air, they get encrypted along with the normal mobile phone mechanisms. When they have been acknowledged by the receiving phone, they are removed from the distribution servers -- the SMS model is built around device-based storage, contrary to emails where the normal resting place of an email is the email server. There still will be a lot of potential for leakage, notably when the phone is synced up with some cloud-based storage system. In fact, the best thing that can be said about SMS, when compared with emails, is that phone malware is still for the moment less prevalent than desktop malware.
You could use a phone call, with an actual human, or a robot system. A voice-based transfer makes it less likely that unwanted copies will be retained on some server. It is also compatible with users who do not have a phone capable of receiving SMS (yes, there are still a few persons in that case).
Paper-based mails are not very secure at all, but intercepting such a letter requires physical presence near the recipient's home. Depending on your context, this may be distinct enough from whatever the PIN is supposed to protect to achieve good security. The bad situation is when the PIN is for a credit card, and the credit card and the PIN are sent as letters. Then, an attacker who can intercept the PIN can also intercept the card. In such a situation, banks are likely to require an explicit activation with a phone call, where the user will be authenticated through the knowledge of "secret values" (birth date, mother's maiden name... high-quality secrets, as you can imagine).
Take care that the security model may vary. Banks, for example, do not try to achieve perfect security for all users; what they want is to make money. Thus, they will strive to achieve the best compromise, i.e. the method that minimizes the overall costs. They can tolerate a bit of fraud, if other safer methods would be more expensive to operate or would alienate a non-negligible proportion of potential customers. It shall be remembered that the bank's security is about protecting the bank, not the user (regardless of what they may claim in their ads).