My service bureau is stating that the FACT Act "requires" a financial institution to notify a customer of any change to a customer email address on file - an enhancement was created to provide for a system-generated email to both the new & old email address of record regarding the change. I have not seen any suggestion that address changes incorporated into this regulation include email addresses. Before I challenge my service bureau, has anyone else included email addresses into their ID Theft Prevention program for address change purposes and can you tell me where in the regulation this is "required"? Thanks.

I don't believe we addressed email addys in our RA.

For the debit/cr card address chg rule - It seems that the purpose of the notification is to ensure that the card actually gets to the customer and not the crook. I think the intent is a physical address change.

As for the address discrepancy rule (address discrepancy in cr rept), that seems to also be a physical address.