Banking Supervision Department Circular C-06-2667: Amendments to Proper Conduct of Banking Business Directive no. 367 on E-banking

בנק ישראל. ת.ד. 780 ירושלים 9100701 | טל. 03-5640520 Banking Supervision Department Policy and Regulation Division July 25, 2021 Circular no. C-06-2667 To: The banking corporations and credit card companies Re: E-banking (Proper Conduct of Banking Business Directive no. 367) Introduction

1. In Circular no. C-06-2557, dated March 22, 2018, the Banking Supervision Department permitted the use of technologies for remote identification and authentication for opening an online account in accordance with the principles detailed in the Directive. Due to the innovation of these technologies at that time and in order to protect customers and banking corporations from the risks inherent in their use, the Banking Supervision Department conditioned the providing of the permissions to banking corporations that requested to use such technologies, among other things, on a requirement to carry out an examination by a bank representative (human examination) of the accuracy and validity of the data submitted by the customer during the remote account-opening process, and comparing them to data the bank has. This examination should be done before the customer is allowed to conduct any activity in the account. In view of the importance of customer identification during the course of opening the account, this requirement was established, among other things, after consultation with enforcement entities in the State of Israel.
2. Currently, due to the experience accrued in Israel’s banking system in recent years regarding opening an account remotely, and in particular the experience accrued in using said technologies, the Banking Supervision Department decided, in consultation with enforcement entities in the State of Israel and with the relevant functions in the Ministry of Justice, to enable a banking corporation to offer its customers to carry out activities in an account that has been opened remotely and that is not classified as an account at high AML/CFT risk, immediately with its opening, so that the customer will not have to wait until a banking corporation representative carries out a human examination. Instead, the banking corporation will be required to carry out a sample examination on such accounts, as soon as possible after they are opened.
3. This action joins other steps taken by the Banking Supervision Department in recent years for complete remote access to banking services while reducing the need to arrive at the branch. This update will allow the simplification and increased efficiency of the process of opening an account remotely for the customer, and may save the customer as well as the banking corporation time and valuable resources.

2 4) After consultation with the Advisory Committee for Banking Business and with the approval of the Governor, I have decided to amend Proper Conduct of Banking Business Directive no. 367, on “E-banking”. The amendments to the Directive Technology for remote face-to-face identification and authentication Section 27a(a)(4)(b)—Technology for remote face-to-face identification and authentication 5) In a case of using technology for remote face-to-face identification and authentication via a video recording that is not in real time, a banking corporation representative is to carry out a sample examination of the accounts opened in this manner. The sample is to include all the accounts that were classified by the banking corporation as accounts at high AML/CFT risk as well as additional accounts out of all the accounts opened that will be chosen via a risk-based approach; and overall the scope of the sample shall be not less than 20 percent of all the accounts opened, in a period that the banking corporation determines in advance. Within the framework of the examination, the banking corporation representative is required to view all the digital documentation of the account that is included in the sample, verifying, among other things, the adequacy of the process implemented, including the comprehensiveness of the data submitted by the customer during the account opening process. For accounts that are classified as accounts at high AML/CFT risk, the examination will be carried out before the customer will be allowed to conduct any activity in the account. In the other accounts in the sample, the examination will be carried out as soon as possible after the account is opened, and the banking corporation may allow a customer to conduct activity in the account even before the sample examination is conducted. Beginning from the effective date of this Directive, the requirement to carry out an examination of all the accounts opened remotely before the customer is allowed to carry out any activity in the account—which was among the specific permissions for using technology for remote face-to-face identification and authentication that were granted by the Banking Supervision Department to banking corporations that requested to receive the permission—will be cancelled. Opening and Managing a Long-Term Savings Account for a Child Section 27b(b)(3)— 6) In Banking Supervision Department Circular no. C-06-2659, dated June 6, 2021, a change was made in the wording of Section 12(c) of Proper Conduct of Banking Business Directive no. 420 on “Sending Notices via Means of Communication”. Accordingly, the words “In this case, Section 12(c) of Proper Conduct of Banking Business Directive no. 420 shall not apply” shall be deleted from this section.

3 Applicability 7) The amendments to the Directive shall go into effect on the date they are published, except for the amendment to Section 27b(b)(3) of the Directive. That section will go into effect on the effective date of the amendment to Proper Conduct of Banking Business Directive no. 420 on “Sending Notices via Means of Communication”, as noted in Section 17 of Banking Supervision Department Circular no. C-06-2659, dated June 6, 2021 Updating of the file 8) Attached are the update pages to the Proper Conduct of Banking Business file. Following are the updates: Remove page Insert page (12/20) [9] 367-1-26 (07/21) [10] 367-1-27 Sincerely, Yair Avidan Supervisor of Banks