Regarding Address Changes and Red Flags: if we get a debit card returned becuase of "address" issues, and cannot locate the customer, how long are we required to retain the card before destroying it. We were keeping them 14 days, but an examiner told us we needed to change that time period to 7 days.

Are you sure it was an examiner and not an auditor? Sometimes auditors make suggestions based on what they see being done elsewhere, and those suggestions seem to have the force of law behind them because we often hold auditors in such high esteem (they know their stuff; they must be right!).

This sounds a lot like a recommendation. A sure way to find out is to suggest that you hadn't seen that requirement in your review of the regulations, and ask the auditor/examiner if he or she could provide you with a citation to the rule so you can read it for yourself.