I know of no such requirement. If I'm not mistaken this is usually a contractual issue (I know a few companies still only report on a quarterly basis instead of monthly) between you and the CRA. Have the customer give you the applicable citation.
Again, IMO, you have no obligation to reveal your internal procedures to be released to the general public.
I think I'd tell this customer that his requests are now crossing the threshold into "legal territory" and request that he have his attorney contact yours, and no further information will be released without legal representation and research and since he is requesting the information he'll will be responsible for the research costs and they will have to be paid before any information is released. That usally will shut them up.