Who/what is the final arbriter in a Reg E dispute? If he was to file a complaint with the regulators, do they decide whether we owe the money?

We have a customer who claims over $10,000 in funds have been taken from his account over the past 4 months. He has given us numerous conflicting stories about when he knew (or didn't know) his card was stolen. For example, in one conversation he says he thinks his roomate stole it. Then when he talks to our security officer he says he doesn't have a roomate. He claims he was out of the country when these took place, but yet we see checks written to local businesses written/clearing during this time. Some, but not all of the transactions appear (to us) to be consistent with his normal spending patterns.
Operations wants to deny the claim. Fortunately, they have done a good job of documenting each conversation with the customer. The customer is adament he did not authorize and says he will get a lawyer if he has to. Your thoughts would be appreciated.
