Check Theft and Forgery

The bank will be responsible! Anything under $500 will be paid without even looking for a thief, it's not worth it to the bank.
If the check is higher than $500 it is up to the bank to contact the account holder to verify the payee and the amount. If they neglect to do so, it's their loss.

Happened to us: check was forged for a larger amount and the bank called us to verify. We told them to call the police which they did. Unfortunately, the thief took off after the bank teller told him that they need to verify the check amount.

Is there a law or regulation that states that?

If so, which one?

Yes, it's a federal law . Look here...

"Under the Uniform Commercial Code (UCC), an alteration is a change to the terms of a check that is made after the check is issued that modifies an obligation of a party by, for example, changing the payee's name or the amount of the check.[2]

By contrast, a forgery is a check on which the signature of the drawer (i.e., the account-holder at the paying bank) was made without authorization at the time of the check's issuance.[3]

In general, under UCC 4-401, the paying bank may charge the drawer's account only for checks that are properly payable.[4]

Neither altered checks nor forged checks are properly payable. In the case of an altered check under the UCC, the banks that received the check during forward collection, including the paying bank, have warranty claims against the banks that transferred the check (e.g., a collecting bank or the depositary bank). In the case of a forged check, however, the UCC places the responsibility on the paying bank for identifying the forgery.[5]

Therefore, the depositary bank typically bears the loss related to an altered check, whereas the paying bank bears the loss related to a forged check."

https://www.federalregister.gov/documents/2018/09/17/2018-20029/availability-of-funds-and-collection-of-checks