This is a cross post and I replied in the General area. While I think letting them know that the rules will be enforced is good, I would not provide any grace period to comply as that compounds a now known problem. In my mind, that makes it worse. You may choose to be liberal on the current counts from X date back, but that would be it.
I also wouldn't want to indicate internally that there is a problem in the transaction limitations, only that the bank wasn't monitoring them ex-post, as it should have been. The difference is that one way may lead you to believe that accounts were used as DDAs and no one cared. The other is that rules were in place, but not monitored for compliance.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell