Since "gross negligence" is a legal term in your contract with your customer, your legal counsel should provide an opinion on whether this delay in reporting reaches that threshold.
The question does not provide adequate information to calculate liability. The $500 liability tier in 1005.6(b)(2) only applies to transactions that occur more than two business days after the customer learned of the loss or theft of the access device. The $50 tier applies to transactions that occurred during the first two business day timeframe. The $500 tier cannot be retroactively applied to the earlier transactions.
If the customer had more than $50 in unauthorized transactions during the first two business days, you owe the customer for the amount over $50 during that timeframe.