12 CFR §205.5

1. (a)Solicited issuance. Except as provided in paragraph (b) of this section, a financial institution may issue an access device to a consumer only:
   1. (1)In response to an oral or written request for the device; or
   2. (2)As a renewal of, or in substitution for, an accepted access device whether issued by the institution or a successor.
2. (b)Unsolicited issuance. A financial institution may distribute an access device to a consumer on an unsolicited basis if the access device is:
   1. (1)Not validated, meaning that the institution has not yet performed all the procedures that would enable a consumer to initiate an electronic fund transfer using the access device;
   2. (2)Accompanied by a clear explanation that the access device is not validated and how the consumer may dispose of it if validation is not desired;
   3. (3)Accompanied by the disclosures required by § 205.7, of the consumer's rights and liabilities that will apply if the access device is validated; and
   4. (4)Validated only in response to the consumer's oral or written request for validation, after the institution has verified the consumer's identity by a reasonable means.