The request need not be in writing to comply with the regulation. However, if it's not in writing, how can you document its existence? You need to consider that question before implementing "open enrollment" for issuing access devices, unless you will not impose any liability on the consumer for unauthorized use.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8