Regulators require ongoing audits to make certain email address details are fair