Merchant Acquirers and Acquiring Payment Card Transactions

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-1 ONLY THE HEBREW VERSION IS BINDING Merchant acquirers and acquiring payment card transactions Introduction

1. This Directive regulates the activity of corporations that provide payment card transaction acquiring services. Application
2. (a) This Directive shall apply to every acquirer and banking corporation that deals with acquiring. The Supervisor may establish specific directives that are different than the provisions herein, which will apply to certain banking corporations or will exempt, in exceptional cases, a specific corporation from certain directives, and all if the Supervisor is convinced that conditions warrant it. (b) Notwithstanding the provisions of Subsection (a), Section 5(a) of this Directive shall not apply to an acquirer that is a banking corporation. Definitions
3. “Capital”—Common Equity Tier 1 Capital, as defined in Proper Conduct of Banking Business Directive 202. “Chargeback”—a credit to a payment card holder and a debit of a merchant, based on one of the grounds established in the Debit Cards Law, 5746-1986. “Debtors’ balance”—Credit risk that is not guaranteed by banks, on a consolidated basis, per its understanding in Clarification 13 regarding “Credit risk, debtors in respect of credit card activity, and allowance for credit losses” in credit card companies’ annual reports (Reporting to the Public Directive 675). “Funds being acquired”—Funds from an acquirer or from a company or from an international credit card organization, which were received by an acquirer on

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-2 ONLY THE HEBREW VERSION IS BINDING behalf of a merchant in order to complete the payment procedure and have not yet been transferred to the merchant. “Payment card”—as defined in the Debit Cards Law, 5746-1986, except for a plate or other item for repeated use designated only for withdrawing cash via automated teller machines. “Debit card”—a bank card as defined in the Debit Cards Law, 5746-1986, in which the debit is immediate. “Smart card”—a card that supports the EMV standard. “Prepaid card”—a payment card as defined in the Debit Cards Law, 5746- 1986, in which the debit is immediate and including a plate or other item for repeated use designated for executing payments and purchasing an asset from a supplier, on which a cash value can be stored through loading in advance, provided that the debit through it is immediate. “Customer/Merchant”—a business that contracted with the acquirer in an agreement to acquire payment card transactions. “Issuer”—as defined in Section 36i of the Banking (Licensing) Law, 5741- 1981, including an issuer operating outside of Israel. “Acquirer”—as defined in Section 36i of the Banking (Licensing) Law, 5741- 1981, including a banking corporation that operates in acquiring. “Acquiring”—as defined in Section 36i of the Banking (Licensing) Law, 5741- 1981. “Immediate debit transaction”—a transaction using a debit card or prepaid card, and excluding payment in respect of withdrawing cash through automated teller machines. Proper Conduct of Banking Business Directive applicable to acquirers 4. All Proper Conduct of Banking Business Directive detailed in Appendix A apply to an acquirer, with the necessary changes derived from the type and manner of its operation.

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-3 ONLY THE HEBREW VERSION IS BINDING Capital requirements 5. The calculation of minimum capital requirements for an acquirer will be as detailed below: (a) An acquirer with Debtors Balance in its last annual financial statements that does not exceed NIS 2 billion—the capital requirement will be established as a percentage of the average monthly revenue from acquiring transactions in the preceding calendar year (hereinafter, “revenue”), and shall be a schema of the following multiples: 4.0 percent of total revenue up to NIS 25 million 2.5 percent of total revenue between NIS 25 million and NIS 50 million 1.0 percent of total revenue between NIS 50 million and NIS 500 million 0.5 percent of total revenue between NIS 500 million and NIS 1,250 million 0.25 percent of total revenue exceeding 1,250 million (b) An acquirer with Debtors Balance in its last annual financial statements that does exceed NIS 2 billion—the capital requirement shall be calculated in accordance with Proper Conduct of Banking Business Directives 201–211 (Capital Adequacy and Measurement). Notwithstanding the provisions of Section 40 of Proper Conduct of Banking Business Directive #201, the Common Equity Tier 1 Capital shall not be less than 8 percent and the overall capital adequacy ration shall not be less than 11.5 percent. (c) Notwithstanding the provisions of Subsections (a) and (b): (1) The minimum capital of an acquirer shall not be less than NIS 1 million. (2) The Supervisor of Banks has the authority to establish a higher capital requirement for a specific acquirer, taking into account the acquirer’s risk profile and quality of risk management, Protection of funds being acquired

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-4 ONLY THE HEBREW VERSION IS BINDING 6. An acquirer, whose capital requirements are calculated pursuant to Section 5(a) above, shall avoid mixing “Funds being acquired” with funds belonging to any other person or entity. The Funds being acquired shall be managed in the following manner: (a) The Funds being acquired shall be held in a separate trustee account for the benefit of the merchants, at a banking corporation in Israel. The Funds being acquired shall be held as a bank deposit or shall be invested in assets with a 0 percent risk weighting in accordance with Proper Conduct of Banking Business Directive 203. (b) The acquirer shall report to the Supervisor of Banks the details of the trustee account in which the Funds being acquired shall be held, once a year or when there is any change in such account. The trustee account shall not serve any other purpose for the acquirer, other than ensuring the Funds being acquired. (c) The agreements reached by the acquirer with various entities shall include reference to such that the funds shall be transferred to the acquirer or shall paid by him via a separate trustee account, with a definition of the groups that are beneficiaries therein. Managing the merchant’s accounts 7. Difficulty in executing a chargeback, as a result of a merchant’s bankruptcy or fraud, exposes the acquirer to various risks, including credit risk. Therefore: (a) The acquirer shall establish a policy for providing the service and procedures for approving new merchants, as well as ongoing review processes for assessing the financial and operational status of the merchants being acquired. The review processes shall include reference to aspects such as occurrences of fraud, profitability, sales volume, service level of the company, chargebacks, etc.

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-5 ONLY THE HEBREW VERSION IS BINDING (b) The acquirer shall have adequate policy, systems, and procedures for monitoring trends in chargebacks and the ability of the merchant to pay the chargebacks. (c) The acquirer shall adopt adequate means, in a case in which the merchant’s status raises concern from the aspect of credit risk (for example, repricing, requiring collateral or guarantees). (d) (1) In conditions in which an acquirer has a real concern that the merchant’s activity includes customer fraud, customer deception, or use of unfair influence on customers, it is permitted to refuse to provide acquiring services to the merchant or to carry out a specific transaction for it. The refusal shall be considered a reasonable refusal, among other things regarding the Banking (Service to Customer) Law, 5741-1981. (2) If the acquirer decided not to provide acquiring services to the merchant or not to carry out a specific transaction for it, it shall send a notice regarding that to the merchant soon afterwards, to the extent that there is nothing preventing that. (e) Without derogating from the generality of the provisions of Subsection (d), it is possible to view, among others, each of the following criteria as a basis for a real concern: (1) A high percentage of chargebacks relative to the merchant’s turnover or relative to the quantity of transactions in a given period of time. In this regard, the customers’ age shall be taken into account, to the extent that the acquirer has such information. (2) A high percentage of customer complaints against the merchant, which based on the acquirer’s experience are liable to indicate fraud, deception, or unfair influence. In this regard, the customers’ age shall be taken into account, to the extent that the acquirer has such information. (3) An activity pattern of numerous repeated attempts to charge the same payment card fixed or varying amounts relative to a specific transaction. (4) An activity pattern of attempts to charge cards of deceased customers. (f) An acquirer shall determine policy and procedures for implementing the provisions of Subsections (d)–(e).

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-6 ONLY THE HEBREW VERSION IS BINDING (g) In this section, “deception” and “unfair influence”—as defined and as used in Sections 2 and 3, respectively, of the Consumer Protection Law, 5741-1981. 8. In contracting cross-acquiring agreements, the acquirer shall reach agreement on a joint arbitration mechanism for acquirers and issuers in Israel with regard to chargebacks. Acquirer–merchant relations 9. An acquirer shall not condition the provision of acquiring services on a commitment by the merchant to receive such services for a specific period. 10. An acquirer shall not condition the provision of acquiring services on receiving acquiring equipment from the same acquirer. 11. An acquirer shall not condition his undertaking to pay the merchant, in respect of payment card transactions, on receiving the funds from the issuer. 12. Without derogating from the provisions of the Banking (Service to Customer) Law, 5741-1981, within the framework of contract documents between the acquirer and the merchant, all the material conditions regarding its content, scope, conditions, and price of the service shall be detailed, including: dates of crediting the merchant; transactions which need to be approved in advance; avoiding the crediting of a merchant for the amount of the transaction or chargebacks; the process of cancelling a transaction; terms for debiting a merchant in a case of denying a transaction or when carrying out a document￾missing transaction; a deferred-payment transaction; the means that a merchant is to take in order to prevent misuse; information and reports that shall be given to the merchant within the framework of the acquiring service; the manner of executing changes in the agreement and any other additional detail to be set by the Supervisor. Transferring funds in immediate debit transactions 13. In immediate debit transactions, the acquirer shall transfer to the merchant the funds of the transactions conducted, within a maximum of 3 business days from the date the transaction is transmitted. Use of the EMV standard

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-7 ONLY THE HEBREW VERSION IS BINDING 14. An acquirer shall acquire transactions conducted via terminals that support the EMV standard and the PCI security standard, as detailed below: (a) The acquirer is required to make it possible to acquire transactions under the EMV standard for any merchant that requests to do so, provided that the merchant has a terminal with full hardware and software specifications for the EMV standard; (b) The acquirer shall connect a terminal, whether at the time of connecting a new merchant or when setting up an additional terminal for an existing merchant, only if the terminal has full hardware and software specifications for the EMV standard, supports the execution of contactless transactions, and if it has the relevant authorizations for the PCI standard. Liability shift 15. In a case in which a smart card was debited for transactions or activities executed through misuse, as defined in Section 5 of the Debit Cards Law, 5746- 1986, not with the EMV standard, the acquirer shall be responsible for returning the debited amount to the issuer. Supply of terminals 16. An acquirer can distribute or sell or rent out end user equipment for executing payment card transactions (POS), including combined terminals and equipment for entering a secret code at computer-based payment points (PinPad). The contract agreement with the merchant shall not include terms liable to negatively impact the merchants’ transferability among acquirers, in particular: (a) The cost of the equipment shall be set separately from the price of acquiring services and shall not be conditioned on the scope of acquiring (as a benefit or addition payment vis-à-vis the price set in advance); (b) Provision of the equipment shall not be conditioned on an undertaking by the merchant to receive acquiring services from the acquirer for a predetermined period or on making exit payments or paying fine for terminating the contract.

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-8 ONLY THE HEBREW VERSION IS BINDING Appendix A Proper Conduct of Banking Business Directives that apply to an acquirer A Board of directors 301* B Remuneration policy in a banking corporation 301A* C The external auditor of a banking corporation 302* D Chief accountant 305* E Internal audit function 307* F Compliance and the compliance function in a banking corporation 308* G Handling of public complaints 308A* H Risk management 310 I Banking corporation business with related parties 312* J Distribution of dividends by banking corporations 331* K Operational risk management 350 L Fraud and embezzlement by employees and officeholders 351 M Business continuity management 355 N Removal of documents from the offices of banking corporations 356 O Information technology management 357* P Rotation and uninterrupted vacation 360 Q Cyber defense management 361* R Nonbanking benefits to customers 403 S Police investigations 405 T Management of anti-money laundering and countering financing of terrorism risks 411 U Fee procedures 415*

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-9 ONLY THE HEBREW VERSION IS BINDING V Opening of bank accounts via the Internet 418 W Retaining documents 419 X Sending notices via means of communication 420*

• During the course of 2016, leniencies and adjustments in Directives will be considered for acquirers that are not banking corporations.

Supervisor of Banks: Proper Conduct of Banking Business [2] (12/18) Merchant acquirers and acquiring payment card transactions page 472-10 ONLY THE HEBREW VERSION IS BINDING Additional Proper Conduct of Banking Business Directives that apply to an acquirer who is subject to Section 5(b) A Capital adequacy and measurement 201–211 B Communication of external auditor with those charged with governance in the banking corporation 303 C Accountant and the information accompanying financial statements 304 D The external auditor performing audits and reviews in accordance with certain US standards 304a E Controls and procedures relating to disclosure and internal control over financial reporting 309 F Credit risk management 311 G Limitations on the indebtedness of a borrower and of a group of borrowers 313 H Sound credit risk assessment and valuation for loans 314 I Liquidity risk management 342 J Interest rate reduction or increase 421 K Early repayment of a non-housing loan 454 L Correction and cancellation of entries by credit card companies 471

• During the course of 2016, leniencies and adjustments in Directives will be considered for acquirers that are not banking corporations. Updates Circular 06 Version Details Date 2498 1 Original directive May 1, 2016 2583 2 Update December 23, 2018