Examples of access devices are debit cards and personal identification numbers. Financial institutions can issue access cards only in response to consumer requests, either written or oral, and they can renew cards automatically without a consumer request if the device had previously been requested and accepted. Exceptions to this rule are that access devices must have been issued in unvalidated form, certain disclosures must have been made with issuance, and the device must have been later validated by the bank after the consumers' requests were made and their identity verified. The financial institution carries the burden of verifying the identity of the consumer. The examiner must determine whether the bank is in compliance with these exceptions. A bank can renew or issue a substitute device if the unaccepted card was issued prior to February 8, 1978 (It was legal to issue unsolicited access devices before this date.), and the substitute device must be covered by certain disclosures. Examiners must be aware of when regulation E and Z apply to access card issuance. Regulation E applies if electronic fund transfer features are issued with the card and if cards with both electronic fund transfer and credit features are issued (if the only credit privilege is a preexisting overdraft). Regulation Z generally applies when a combination credit/electronic fund transfer card is issued and when an access card (with no credit features) is issued.