One of our business customers has several individuals on his account, and he wants to add another. Do we need to have the new person and all the others come in to do a new signature card, or can we simply have the new person sign the existing card?

For what it is worth - we make all signers sign a new card. If that isn't reasonable, we would do an additional (new) card for the additional signer with the date on it showing when they became an authorized signer. I don't believe this is a regulatory requirement, but it will be part of your procedures for how you keep things clear in your documentation.

We have all the signers sign a new signature card

We also have all signers sign a new card. We have the person authorized to make changes submit a letter stating the request, so we have documentation of who authorized this change.

We never alter an existing signature card allowing someone to simply sign somewhere on the card. Our new signature cards have the wording, "this document (dated xx/xx/xxxx) superceeds any previous signature cards."

We have the person authorized to make changes submit a letter stating the request.

A person has that authority, I thought it had to be in a form of a resolution from the entity?

We require Meeting Minutes (or whatever applies to the type of business) and require a new signature card.

We are not allowed to alter the signature card in ANY way.

Assuming the customer is an entity, you need a resolution from the entity to add or remove signatories. A letter from [insert any individual] does not provide you with adequate evidence of authority.

A signature card is a dated contract; it is not a fluid document which should be edited as signatories are added and removed. If your bank uses signature cards and would like to successfully offer them as evidence in the event of a legal dispute, it will require a new card be executed by all signatories whenever a signatory is added or removed.

There are no universal statutes or regulations to cite in support of the above, only the observation that the failure to do either assumes an amount of risk that a knowledgeable bank would not take.