Probably a dumb question but here goes. If a customer requests confidential information on their account we should follow the e-sign steps prior to sending, correct? How do others document/prove that this was done? Any advise is appreciated!

Don't confuse privacy concerns with E-SIGN. You have to have taken care of E-SIGN permission before sending electronically a statement, notice, disclosure or other record that is required by law or regulation to be in writing. If all you are sending is information, you can send it without E-SIGN approval.

That said, sending confidential info via email is not recommended unless you can encrypt it and the customer can decrypt it.

This is where you sell your e-banking product as these often have a way to converse via private message within your closed system. While it may be accessed via browser, you aren't sending email and inviting the customer to later trust a spoofed email and compromise their account.