Skittles is right. Your policy can only govern non-electronic items as Reg E trumps any agreement/contract you make. In other words, you cannot have a policy or contract that violated a law. The Electronic Funds Transfer Act (Reg E) is a law that says there is no statute of limitations on making a claim on unauthorized electronic funds transfers.
Now to your question Sam: As I stated above, there is no statute of limitations on making a claim. However, there is a limit to the amount of money that you have to give based on when the first statement, showing the first error, occurred.
Read section 1005.6(b) and section 1005.11(b) very carefully. To answer your question, we'll need to know what type of error(s) occurred (card based, ACH), when the customer discovered their card was lost/stolen (if card based) or if they never had their card stolen and it was only from the statements they learned of the loss.