A mobile site that is an extension of our current online Banking platform, using the same login information for each...

Is accessing a mobilized website a new access device? Or not? I mean to me the argument goes both ways...

It is not an access device because its not an app or anything like that, just a mobilized web page with paired down functionality... but in that it is a scaled down version of online banking it is not the "same" device?

Yet the mobile device is not in and of itself an access device unless the customer goes to our webpage and uses their login credentials?

So what do I need to disclose if anything under Reg E?

Any thoughts? Solutions? or Regulatory guidance to my problem?

The credentials issued to the customer (or adopted by the customer and approved by the bank) constitute the access device. The fact that the credentials are used in two different conduits does not add an access device; it adds a means of access.

Thank you John-

The helpful folks of the ABA provided a lot of insight for me on this matter. The real crux was access device vs. EFT service point. AS you pointed out it isn't a new access device, but the mobile device does count as an alternative EFT service point so there could be a need to redisclose depending on the functionality and what was in your original disclosure.

Our mobile product is pared down, no adding payees of any sort, which would be a concern if our initial disclosure had described that feature as a specific function of the online banking service (since bill pay and transfers are EFT's). Fortunately we didn't get that specific in the initial disclosre so based on my unique circumstances a summary of their feelings is that redisclosure to existing customers isn't exactly needed, but new disclosures are.

In any event once we finalize our "new" disclosures I will probably spend the postage and redisclose to current online banking users. We live to fight another day...