Whenever we say "contact us" on the internet or in mail and give our e-mail address, I think we should warn customers not to include account information. I think the regulators look for this disclaimer on websites, but where can I pinpoint this requirement in the regulations.

It is a best practice, not a requirement.

Here is some sample verbiage (Thanks go to JacFSB):

"Sending standard E-Mail using the above link is not encrypted and may be intercepted and read by a person other than the intended recipient. If you wish to send personal or sensitive information, please use the secure message feature found in our Internet Banking Service."

We use disclaimers too. This is the message found with our applications and standard forms.

"Because there is a risk that non-encrypted information transmitted over the internet may be compromised, do not transmit these forms to the bank electronically. Instead, please deliver these forms to the bank. The bank will not act on these forms if received electronically."

We were 'informed' by the FDIC that it is necessary to post a disclaimer under the Privacy Act as email is not private.