Many websites have a way for customers to send an email to the bank if they suspect they have received a phishing email or suspicious text. Is this a requirement? Best practice? If it is required, where might I find it? Thank you.

There is no requirement to have such a feature.

Thank you.

It can be a way for a bank to be made aware of an "attack" which could allow the bank to put a verification plan in place, notify customers of the threat, and remind them of what the bank does, and does not do to help prevent these from turning into losses.