Let's first separate this question from any suggestion that Regulation E applies. Since the account is for business, the Electronic Fund Transfer Act and Regulation E aren't in play.
The customer in this case is the business, and the debit card agreement is with the business, not the individuals carrying the cards. It will be the business that files any claims under the debit card agreement, although one or the other of the individuals identified as an authorized signer is likely to act for the business in the filing. It could also be someone who's not a signer on the deposit account, if that individual has authority from the business to act on its behalf.