Reg E does not provide a statute of limitations for a member to dispute a transaction. 1005.6 imposes liability on the CU and on the member based on how soon after they learn of the loss or theft of the access device they report it to the institution.
1005.11(b) notes that for the notice to be 'timely' the dispute must be provided within 60 days of the transmittal of the statement on which the first unauthorized charge appears. However, even if notice is not timely, the commentary to 1005.11(b) notes that we must still comply with the liability schedule in 1005.6.
VISA/MC impose a 120 day time limit for filing a chargeback, but Reg E does not care whether or not you have chargeback rights. So the answer to your question is, "An unlimited length of time."
1005.6(b)(3) will hold the institution liable for unauthorized charges between the date of the first charge and 60 days after the transmittal of the statement on which that charge appears and the member liable for everything after that. So suppose we have an example where the member attended a New Year's party on January 1, loses the card while in a drunken state, has fraud between January 2 and today and they finally notice the fraud today.
The institution is liable for all charges between January 2nd and the transmittal of that statement (Let's say January 31st) and 60 days after January 31st (which would be April 1st.) The member is liable for everything between April 2nd and October 4th. 1005.6(b)(3) does not allow us to deny a claim because the member waited too long to report the fraud. (Note that for non-fraud claims we can tell the member they are out of luck.)
I encourage you to check up my upcoming webinars where we tackle some of the tough Reg E topics like this one.VISA and Reg E Error ResolutionMastercard and Reg E Error Resolution
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!www.tcaregs.com