I don't know if you guys are aware of this company (and I have no comment or view on the actual product) but they have some pretty good information on this subject at http://www.phishcops.com

Does this apply to telephone banking? Our customers can call our 24 hour banking line to access their account balances and perform inter bank transfers?

It is my understanding per the Chicago FDIC Regional Office that it does encompass telephone banking products.

The OCC wants all non-Internet e-banking products included. For us this is only telephone banking, which is balance inquiry only. From what I have read, internal transfers are not high risk transactions whether by IB or automated phone transfer.

Does anyone have a link to documentation that states Telephone banking should be included or excluded? I've heard verbal comments for either, but have yet to see any concrete documentation.

What is everyone doing for the customer awareness program?
How are you going about educating the customers?

What about e-statements?

Currently, our customer uses a password to open an e-statement we've e-mailed to them. Would this be considered an "Internet-based product or service" subject to the multi-factor authentication requirements?

Obviously, no transactions are being initiated, but a sizeable amount of customer information resides in the statement info and imaged checks.

Is account number considered sensitive customer information

One quick place to look is in the 8/15/2006 FAQ FFIEC Guidance on Authentication in an Internet Banking Environment. Q-2 states that it applies to all forms of e-banking, including telephone banking systems.