You can't find anything about PCI for checks, because it doesn't cover them. PCI stands for "Payment Card Industry" - aka, credit cards (and debit cards with a cardbrand logo). The PCI Council (who set the standards) couldn't care less about securing any other form of payment (cash, checks, money orders, etc). Even credit-card-like systems (gift cards, store-issued charge cards, etc) aren't officially covered, even if they have a magstripe.
That said, it's good practice to follow PCI standards for other forms of payment, since they're designed for security. If you accidentally leak your customers' payment information, who do you think they're going to blame?
Instead of PCI, the ACH industry is covered by the NACHA Operating Rules, which you can also fund summarized here. From what I can tell, the relevant sections are 1.6 (Security Requirements) and 1.7 (Secure transmission of ACH Information via Unsecured Electronic Networks). Together, they comprise less than one page of text. I can't copy them here, but 1.6 basically says "You have to have policies in place to protect this data." without specifying any specific requirements.
All in all, the client's request may be perfectly valid in a way that it wouldn't be for card data. It doesn't make it a good idea, but it's valid.