Are we required to retain the forms signed indicating that an account holder wanted to opt in to having ATM and one-time debit card transactions paid under our overdraft protection program (mail and in-brnach opt-ins)? Or is the notation on our core system sufficient? We also allow opt-in by phone and web site, for which there is not a paper trail, so not certain we need to retain the actual signed forms.

There is no specific record retention requirement in connection with the opt-in process.

Many institutions are creating logs (paper or electronic) for paperless decisions. My suggestion would be that you keep any paper logs and paper opt-in forms until your next on-site examination where Regulation E is reviewed.