Regarding Regulation E - if a customer notifies us two years after an unauthorized transaction occurs, would we still be liable for the first 60 days of transactions?

Technically - Yes

Two years??? We are way out of compliance then! I thought the customer had 60 days from the date of the statement that the unauthorized transaction appeared on.

You may want to revisit 205.6 and 205.11 and the definitions of unauthorized transactions and errors.

Reg E provides that a customer's liability can be unlimited for transactions AFTER 60 calanders days from the date the FIRST transaction appeared on the statement. There is no provision that allows you to deny the claim based solely on late notice. You are, however, relieved from the requirements for provisional credit and 45/90 day investigation timeframes.