External Auditor Performing Audits and Reviews in Accordance with Certain US Standards

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-1 ONLY THE HEBREW VERSION IS BINDING The External Auditor Performing Audits and Reviews in Accordance with Certain US Standards Introduction

1. The procedure of auditing of a banking corporation and credit card company by an external auditor (in this Directive, the term banking corporations will also include credit card companies) is an integral component of both the control and supervision processes of the supervisory authorities, and of market forces, because on its completion, the corporation's audited financial statements are published.
2. This Directive specifies that a banking corporation's external auditor shall implement at least certain standards set in the US regarding the preparation and publishing of a banking corporation's annual financial statements, and in preparing and publishing the external auditor's review of the banking corporation's quarterly financial statements.
3. Supervisor of Banks Circulars no. 2175-06 of December 5, 2005 and 2223-06 of January 20, 2008 specified the requirements relating to the implementation of Section 404 of the Sarbanes–Oxley Act (henceforth, Section 404) in a banking corporation. These requirements include: 3.1 The financial statements of a banking corporation for the year ending December 31, 2008 shall include certification that the signing officers are responsible for internal control over financial reporting. 3.2 The above financial statements shall include an opinion by the external auditor regarding the internal control over financial reporting.
4. This directive specifies that, consistent with the circulars mentioned above, the external auditor who prepares and publishes an opinion of the banking corporation's financial statements shall attach an attestation report on the internal control over its financial reporting, and that the report shall be formulated in accordance with the auditing standards set in the US.

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-2 ONLY THE HEBREW VERSION IS BINDING 5. Fulfilling this directive does not absolve external auditors from fulfilling the other requirements of other auditing standards specified by the law that apply to the function of the external auditor in a banking authority, such as "Generally accepted auditing standards, including those prescribed by the Israeli Auditors (Mode of Performance) Regulations, 1973." External auditor's report––the financial statements of a banking corporation 6. In auditing the annual financial statements of a banking corporation, the external auditor shall implement at least the US audit standards specified in the appendix to this Directive. In reviewing the quarterly financial statements of a banking corporation, the external auditor shall implement at least the relevant US audit standards specified in the appendix to this Directive. These certain US audit standards include the audit standards of the Public Company Accounting Oversight Board (PCAOB) (USA), which incorporate the Statements on Auditing Standards published by the American Institute of Certified Public Accountants (AICPA), and the Audit and Accounting Guides published by the AICPA. 7. If changes are made to the certain US audit standards, detailed in this directive or in the appendix, after this directive has been issued, those changes must be implemented concurrently with their becoming effective in the US. Attestation report––internal control over financial reporting 8. Every external auditor who prepares and publishes an opinion of the financial statements of a banking corporation shall attach an attestation report on the internal control over the banking corporation’s financial reporting. The report shall be formulated according to the standards relating to such attestation reports adopted by the PCAOB. 9. The above report shall not be under a different engagement from that of the opinion of the financial statements. 10. In performing audits, external auditors of banking corporations shall implement Auditing Standard No. 5 of the PCAOB, "An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements," with the adjustments required by the

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-3 ONLY THE HEBREW VERSION IS BINDING law and the standards applicable to a banking corporation and the auditing of a banking corporation. Moreover, in the event that clarifications and/or additional auditing standards are introduced in the US in the future regarding the implementation of Section 404, external auditors of banking corporations in Israel shall act in accordance with those clarifications and/or standards. Attestation report––whether a previously reported material weakness continues to exist 11. There might be situations where an external auditor who prepares and publishes an opinion of the financial statements of a banking corporation, as well as a report on the internal control over financial reporting by the banking corporation, shall be required to prepare an attestation report on whether material weaknesses previously reported in the report of internal control over financial reporting continue to exist. 12. In the above case: a. The above report shall be under a different engagement from that of the opinion of the financial statements. b. In performing audits, external auditors of banking corporations shall implement Auditing Standard No. 4 of the PCAOB, "Reporting on Whether a previously Reported Material Weakness Continues to Exist" with the adjustments required by the law and the standards applicable to a banking corporation and the auditing of a banking corporation.

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-4 ONLY THE HEBREW VERSION IS BINDING Appendix – Certain US Auditing Standards to be Implemented in Audits of Financial Statements of Banking Corporations

1. AICPA Auditing Standards applied by the PCAOB Note: Reference is made to the AU section in the integrated version on the PCAOB website in ascending order. (a) AU 150 – Generally Accepted Auditing Standards (a1) AU 230 – Due Professional Care in the Performance of Work (b) AU 230.12, 316– Consideration of Fraud in a Financial Statement Audit (c) Deleted. (d) Deleted. (e) Deleted. (f) AU 317 – Illegal Acts by Clients (g) Deleted (h) AU 322 - The Auditor's Consideration of the Internal Audit Function in an Audit of Financial Statements (i) AU 324 – Service Organizations (j) AU 325–Communication About Control Deficiencies in an Audit of Financial Statements (k) Deleted. (l) AU 328 – Auditing Fair Value Measurements and Disclosures (m) AU 329–Analytical Procedures (n) AU 330 – The Confirmation Process (o) AU 332 – Auditing Derivative Instruments, Hedging Activities, and Investments in Securities

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-5 ONLY THE HEBREW VERSION IS BINDING (p) AU 333 - Management Representation (q) AU 337, AU 560.12 – Inquiry of a Client’s Lawyer Concerning Litigation, Claims, and Assessments (r) AU 342 - Auditing Accounting Estimates (s) AU 350 - Audit Sampling (t) Deleted. (u) AU 390 – Consideration of Omitted Procedures after the Report Date (v) AU 411 – The Meaning of Present Fairly in Conformity with Generally Accepted Accounting Principles (w) AU 420.07-.11 – Consistency of Application of Generally Accepted Accounting Principles – Change in the Reporting Entity (x) Deleted. (y) AU 560 – Subsequent Events (z) AU 561 – Subsequent Discovery of Facts Existing at the Date of the Auditor’s Report (aa) AU 625 – Reports on the Application of Accounting Principles (bb) AU 722 – Interim Financial Information 2. PCAOB Audit Standards: (a) AS3 - Audit Documentation (b) AS7 – Engagement Quality Review and Conforming Amendment to the Board's Interim Quality Control Standards (c) AS8 – Audit Risk (d) AS9 – Audit Planning (e) AS10 – Supervision on Audit Engagement (f) AS11 – Consideration of Materiality in Planning and Performing an Audit

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-6 ONLY THE HEBREW VERSION IS BINDING (g) AS 12 – Identifying and Assessing Risks of Material Misstatements (h) AS13 – The Auditor’s Responses to the Risks of Material Misstatement (i) AS14 – Evaluating Audit Results (j) AS15 – Audit Evidence (k) AS16 – Communications with Audit Committees (l) AS18 – Related Parties 3. AICPA audit guides applied by the PCAOB: (a) AICPA Audit and Accounting Guides, Industry Guides – Banks and Savings Institutions (b) AICPA Audit and Accounting Guides – General Guides - Auditing Derivative Instruments, Hedging Activities and Investments in Securities (c) AICPA Audit and Accounting Guides – General Guides: Analytical Procedures (d) AICPA Audit and Accounting Guides – General Guides: Audit Sampling (e) AICPA Audit and Accounting Guides – General Guides: Consideration of Internal Control in a Financial Statement Audit 4. Practice Alerts by the PCAOB staff: (a) Alert No. 2 – Matters Related to Auditing Fair Value Measurements of Financial Instruments and the Use of Specialists (b) Alert No. 3 – Audit Considerations in the Current Economic Environment (c) Alert No. 4 – Auditor Considerations Regarding Fair Value Measurements, Disclosures, and Other-Than-Temporary Impairments

Supervisor of Banks: Proper Conduct of Banking Business [6] (10/16) The External Auditor—performing audits and reviews in accordance with certain US standards page 304A-7 ONLY THE HEBREW VERSION IS BINDING (d) Alert No. 5 – Auditor Considerations Regarding Significant Unusual Transactions (e) Alert No. 6 – Auditor Considerations Regarding Using the Work of Other Auditors and Engaging Assistants from Outside the Firm (f) Alert No. 7 – Auditor Considerations of Litigation and Other Contingencies Arising from Mortgage and Other Loan Activities (g) Alert No. 8 – Audit Risks in Certain Emerging Markets (h) Alert No. 9 – Assessing and Responding to Risk in the Current Economic Environment (i) Alert No. 10 – Maintaining and Applying Professional Skepticism in Audits (j) Alert No. 11–Considerations for Audits of Internal Control over Financial Reporting

---

Revisions Circular 06 number Version Details Date 2242 1 Original directive 11/02/09 2272 2 Revision 8/7/10 2298 3 Revision 3/4/2011 2370 4 Revision 17/2/2013 2410 5 Revision 28/1/2014 2512 6 Revision 13/10/2016