It looks like going for PCI compliance is what's necessary for credit card information storage - any idea whether there are similar regulations around bank routing / account information?
There are, but I personally have no experience of them. I'd be surprised tho' if you were PCI compliant and not compliant with whatever that is.