The emails to these customers MIGHT be covered, but the actual message is not. CAN-SPAM only applies to "electronic mail messages", and defines that term to include ONLY messages sent through the internet to a person's public email address, ex- "GoodCustomer@yourdomain.com." Messages flowing within a closed private system are not "electronic mail messages", and so they are categorically excluded from coverage, regardless of content.
The "you've got mail" alert messages fit with the definition of an "electronic mail message", so you have to look at their content and decide whether they are "commercial" or "transaction/relationship." If part of your online banking service involves notifications of important service events and options, that sounds a lot like "relationship."
_________________________
...gone fishing.