I'm afraid this must be a dumb question. My banks believes they must have prior affirmative consent in order to do email marketing to our existing customers. I see things about this in previous forum posts also. But I can't find this requirement in the compliance guide on the FTC website, or in the FDIC compliance exam manual. I did find a definition of affirmative consent in the law and I did find that if you do not have affirmative consent, you have things you must do in the message(identify it as an ad, provide the opt-out, etc)

Can someone point me to where the law or the regulations say you have to have affirmative consent to send emails to customers?

When it was passed, the law was quickly nicknamed the "you-can-spam-act" because it did not prohibit spam or require prior consent from targeted recipients. I don't remember any changes or interpretations that would require you to get consent before emailing marketing messages to anyone--customers or non-customers.