Does anyone know if there a timeframe (i.e. 60 or 90 days) when we must prompt the customer to change their password when trying to log in to their account online? Is this a requirement or a recommendation from an Interagency standpoint. Thanks for your help!

Neither Reg. H nor Reg. Y nor even the FFIEC IT booklets get that specific, and a discussion at http://ask.metafilter.com/33434/Password-expiration-best-practices suggests that there is no mandatory time for any industry.

Banks have internal requirements and you are reviewed on this. There is no requirement that you impose a similar requirement on your customers. Some banks do. Personally I prefer a requirement for a strong password up front and that it not be required to be changed at an interval.