Reporting of Embezzlement by Employees and Officeholders

Supervisor of Banks: Proper Conduct of Banking Business [6] (09/24) Reporting of Embezzlement by Employees and Officeholders Page 351- 1 ONLY THE HEBREW VERSION IS BINDING REPORTING OF EMBEZZLEMENT BY EMPLOYEES AND OFFICEHOLDERS Introduction

1. (a) Section 8d1 of the Banking Ordinance, 1941 (hereainfter – the “Section”) requires a banking corporation to report to the internal auditor and to the Supervisor of Banks (hereafter – the “Supervisor”) any reasonable suspicion that any of its employees or officeholders was involved in embezzlement. In view of the issue’s importance, the legislature even established in an Order that the banking corporation’s CEO is required to supervise and do whatever is necessary to fulfill the directives of Section 8d1 of the Ordinance. (b) In accordance with the Order’s directives, the Supervisor is authorized to determine the details to report, the method and timing, the minimum amount for reporting, and any other detail the Supervisor regards as appropriate. This directive implements, among other things, the Supervisor’s authorization. Application
2. (a) This directive shall apply to all the following (hereinafter, “banking corporation”): (1) Banking corporation (2) Auxiliary corporation (3) Corporation as noted in Sections 11(a)3a and 11(a)(3b) of the Banking (Licensing) Law; (4) The holder of a payment services provider license with prudential importance, and a corporation it controls. (b) The banking corporation shall also report cases of embezzlement that occurred in the banking corporation’s subsidiaries abroad, (whether branches or subsidiaries). 2a. Definitions “Embezzlement”—as defined in Section 8d1 of the Banking Ordinance, 1941;

Supervisor of Banks: Proper Conduct of Banking Business [6] (09/24) Reporting of Embezzlement by Employees and Officeholders Page 351- 2 ONLY THE HEBREW VERSION IS BINDING “Substantial embezzlement”—an embezzlement incident that complies with the conditions specified in Section 4 of the Directive; “Employee”—an employee of the banking corporation and also a person employed by the banking corporation either directly or indirectly, including via a third party. Reporting 3. (a) The management of a banking corporation shall make a preliminary report to the Banking Supervision Department about any embezzlement incident in which there is: (1) a reasonable suspicion that the amount embezzled will exceed: (b) An incident in Israel—NIS 20,000; (c) An incident abroad—US$ 20,000. (2) A substantial embezzlement incident, even if in a smaller sum than the amounts noted in Section (1). (b) The preliminary report shall be submitted as soon as there is the realization of reasonable concern of the embezzlement incident, and no later than seven days from said date. The report shall include all the particulars known to the banking corporation, as listed in subsection (e) below. If the incident is a substantial embezzlement incident, it shall be reported immediately. (c) Supplemental reporting of the embezzlement incident shall be submitted within one week after the examination of the incident is completed, soon after the examination conclusions have been reported to the banking corporation’s management, but no later than two months after the discovery of a reasonable concern that an embezzlement incident occurred. (d) Deleted. (e) The supplementary report shall include a detailed account of the embezzlement incident, including its date, method, amount or equivalent involved, the name

Supervisor of Banks: Proper Conduct of Banking Business [6] (09/24) Reporting of Embezzlement by Employees and Officeholders Page 351- 3 ONLY THE HEBREW VERSION IS BINDING of the branch or unit in which it occurred, and the name and position of the employee or officeholder suspected of embezzlement. In describing the method, the defects in internal control, if any, that enabled the incident to occur should be made clear. Likewise, the supplementary report should detail how the banking corporation handled the incident, including compensation for customers, disciplinary and administrative measures that were adopted, including reporting to enforcement and supervisory authorities, and learning of lessons in relation to internal control, and in addition, how the incident was discovered. (f) If the banking corporation lacks information at the time of the complementary reporting or if the data reported have undergone material changes, the banking corporation shall submit an updated supplementary report as soon as this is discovered. (g) Reports made in accordance with this directive shall be sent to the head of the Information and Reporting Unit of the Banking Supervision Department in Jerusalem in the format set forth in Reporting to Banking Supervision Directive No. 808 (Reporting Embezzlement by Employees and Officeholders). Substantial Embezzlement Incidents 4. The management of a banking corporation shall define a substantial embezzlement incident for the purpose of this directive, based on quantitative and qualitative components, provided that the following incidents are considered to be substantial: (1) An incident in which the amount or equivalent could exceed 2 percent of the banking corporation’s capital or NIS 10 million, whichever is lower; (2) The employee suspected in the incident has a senior position (e.g., head of department or higher); (3) One of the suspects in a conspiracy between two or more employees is an authorized signatory of the bank;

Supervisor of Banks: Proper Conduct of Banking Business [6] (09/24) Reporting of Embezzlement by Employees and Officeholders Page 351- 4 ONLY THE HEBREW VERSION IS BINDING (4) The incident occurred in a sensitive area of activity (e.g. stock-market trading, trading-room activities); (5) The incident has been reported to another authority (e.g., the Israel Securities Authority, or other supervisory or enforcement authorities), except for reporting to the Israel Money Laundering and Terror Financing Prohibition Authority or the police unless one of the other criteria for determining a substantial incident has bee/n fulfilled. 5. The report to the Supervisor of Banks pursuant to this Directive is not a substitute for other reports pursuant to Banking Supervision Department directives or a report to the Israel Police, or to any other function, as required by law or the regulations of other supervisory entities. Updates Circular 06 no. Version Details Date 1477 Original directive August 26, 1990 --- 1 Inclusion in Proper Conduct of Banking Business Directives August 1991 1750 2 Revision February 20, 1995 --- 3 New version of Proper Conduct of Banking Business Directives file December 1995 2148 4 Revision December 9, 2004 2517 5 Revision September 29, 2016 2793 6 Revision September 18, 2024