Supervisor of Banks Directive on Payment Cards

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 1 ONLY THE HEBREW VERSION IS BINDING PAYMENT CARDS Introduction

1. The credit card companies that operate today are auxiliary corporations of banking corporations as this term is defined in the Banking (Licensing) Law, 5741–1981. This Directive regulates the activities of credit card companies and of banking corporations in respect to operation of the payment card system. Definitions
2. “Bank” As understood in the Banking (Licensing) Law, 5741-1981; “Rights” The rights to benefits offered by an issuer to its customers in respect of using or holding a payment card; “Credit card company” An auxiliary corporation as per Section 11(b) of the Banking (Licensing) Law, 5741–1981; “Enhancing Competition Law” The Enhancing Competition and Reducing Concentration in the Banking Sector in Israel (Legislative Amendments) Law, 5777-2017; “Payment card” “Stored value card” “Asset”- “Customer”- As defined in the Debit Cards Law, 5746–1986; “Debit card” A bank card as defined in the Debit Cards Law, for which a debit via it is immediate; “Extended transaction” A transaction between a customer and a merchant, which the merchant reported to the issuer, upon the transaction’s execution, that payment for it will be collected via authorization to charge the account with a payment card; “Prepaid card” A payment card as defined in the Debit Cards Law, for which a debit via it is immediate, and includes a plate or other item for repeat use, intended for executing payments and purchasing an asset from a merchant, on which a monetary value can be stored by loading in advance, and provided that the debit via it is immediate; “Immediate debit transaction” A transaction using a debit card or prepaid card, and excluding payment in respect of cash withdrawals using an automated teller machine (ATM);

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 2 ONLY THE HEBREW VERSION IS BINDING “Issuing processor” A payment card company, as defined in Section 6 of the Enhancing Competition Law, which deals with the processing of an issue, as defined in Section 1 of this Law; “Issuer” “Merchant” As these terms are understood in the Debit Cards Law, 5746– 1986; “Issuing bank” An issuer that is a bank; “Acquirer” As defined in Section 36i of the Banking (Licensing) Law. Proper Conduct of Banking Business Directives that Apply to Credit Card Companies 3. The Appendix to this Directive includes a list of all Proper Conduct of Banking Business Directives that apply to credit card companies. Issue of a Payment Card 4. With the exception of the renewal or replacement of an existing card, an issuer shall not put a payment card in the name of a customer into effect except after having received a documented application from said customer. For this purpose, an application signed by the customer, written documentation of a conversation, recorded documentation of a conversation in which a customer requests the issue of a card, or a request by means of an Interactive Voice Response (IVR) and/or online system shall be considered documentation. 5. A credit card company may issue payment cards in Israel and have customers sign an authorization to debit their account by sending the contract to the customer and receiving it signed by the customer, or by signing customers to the contract in the presence of a representative of the company in various locations (hereinafter: temporary branches), as the credit card company chooses, provided that the following conditions are met: (a) The payment card contract shall enshrine the customer’s right to cancel the contract without any fee within thirty days of the date that the card was received, provided that no use of the card was made; (b) The company’s contact information shall be provided to the customer for purposes of enquiries. Enquiries related to the issue of the card shall be documented all together; (c) Approval of an application for a payment card, with the exception of a stored value card, shall be made at the center; (d) A temporary branch shall be located at a designated area where the identity of the company is appropriately marked. Activity vis-à-vis customers shall take place only on the premises of the temporary branch. Delivery of Payment Card

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 3 ONLY THE HEBREW VERSION IS BINDING 6. The issuer shall, in its procedures, establish precautions to verify that the card is in fact delivered to the customer. Mailing and Advertising 7. A credit card company may attach to a monthly statement of transactions made with the payment card (hereinafter: “monthly statement”) an advertising booklet that offers its customers assets of merchants who advertise in the booklet (hereinafter: “advertising booklet”). 8. The revenues that the credit card company receives from the sale of advertising space in the advertising booklet shall not exceed the operating cost of mailing the monthly statement to customers (net of the cost of producing the monthly statement) and production expenses for the advertising booklet enclosed in the same mailing. Marketing of Assets 9. (a) Apart from distributing the advertising booklet, a credit card company may not be involved in the process of selling and marketing assets (taking orders, distribution of assets, ownership of assets, etc.) that are offered in the advertising booklet. (b) Notwithstanding the provisions of Subsection (a) above, the management, mailing, and distribution of assets awarded to customers solely for rights may be carried out by the credit card company. Contact due to Material Change in Economic Situation 9a. Should a bank contact a customer regarding a payment card, due to a material change in the customer’s economic situation, in accordance with Section 9(a)(2)(b)(1) of the Enhancing Competition and Reducing Concentration in the Banking Sector in Israel (Legislative Amendments) Law, 5777-2017 (hereinafter, “the Enhancing Competition Law”), the bank shall document said contact in its systems, in a restorable manner. The documentation is to include the date of the contact, and the detailed reasons for the contact. The banking corporation is to establish in its procedures the various material changes in the customer’s economic situation that necessitate contacting the customer, and the manner of contact. Contact to Reduce Credit Facility 9b. Should a bank contact a customer to reduce the customer’s credit facility in a payment card, in accordance with Section 9(a)(2)(b)(3) of the Enhancing Competition Law, the contact shall be in writing via the accepted method between the sides for sending notifications. The contact shall be made a reasonable amount of time in advance, without derogating from the provisions of any law. In its contact, the bank is to note the amount of

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 4 ONLY THE HEBREW VERSION IS BINDING the existing credit facility in the payment card, the amount of the new credit facility, the date of the expected change, and that the contact is in accordance with the requirements established in said law. The bank is to establish in its procedures the processes related to the contact with the customer. Termination of Payment Card Contract 10. An issuer shall document a customer’s notice of termination of the payment card contract. After completing the actions needed to terminate the payment card contract, the issuer shall send the customer written notice to this effect. The notice to the customer may also be forwarded on the monthly statement. Debits and Credits of Cancelled Payment Card 11. (a) An issuer shall not debit a customer’s account for transactions made after the termination of the payment card contract, as set forth in Section 4 of the Debit Cards Law. However, in the event of misuse of a payment card, the issuer shall act as set forth in Sections 5 and 6 of the Debit Cards Law. (b) In the event of an extended transaction that spreads past the termination of the payment card contract: (1) The issuer shall send the customer written notice about the termination of the payment card contract and shall note the duration of the period in which it shall continue to honor debits, insofar as it has decided that there should be such a period. This period shall not exceed three months from the date of termination of contract unless the customer stipulates a shorter period (hereinafter: “transition period”). The notice shall state that the customer must transfer the debits to another payment card or to some other means of payment. (2) The issuer shall send the merchant or the acquirer, as the case may be, written notice about the termination of contract and shall note the date on which the issuer shall cease to debit the customer for said transaction. If the issuer and the acquirer are separate corporations, the acquirer shall forward said notice to the merchant after having received it from the issuer. (c) Notwithstanding the provisions in Subsection (b)(1) supra, if during the transition period the customer applies for a new card or owns another card, the issuer may transfer the debits to the new or other card on behalf of the customer. Details of Account 12. (1) The issuer shall disclose to the customer information regarding the customer’s debits for transactions that were carried out via payment card, as it appears on the monthly statement, and shall also disclose information that is as up to date as possible, as it was provided to it by the merchant at that time, via the communication channels it provides for

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 5 ONLY THE HEBREW VERSION IS BINDING its customers, and at least on its Internet site and on its mobile application, to the extent they are provided by it. The issuer is to disclose, at least, the following particulars: (a) Issuer name; (b) Issuing processor name; (c) Name of the customer for whose use the payment card was issued (d) The last four digits of the number imprinted on the card or the card name, as agreed to with the customer; (e) The total amount the customer was debited on the last debit date; (f) The total amount the customer will be debited on the next debit date; (g) The next debit date; (h) The last date on which there was a change in the information presented (i) The actual and utilized credit facility and the nominal interest rate charged in respect of utilizing the credit facility; (j) Details on each debit of the customer in respect of a transaction carried out with the payment card, and at least:

1. Transaction amount
2. Transaction execution date
3. For a transaction with a deferred payment, the following details, at least, are to be listed: current amount to be paid, the number of the current payment out of the total number of payments, payment dates or the methods for determining them.
4. In an extended transaction, a notation of the type of transaction.
5. The merchant’s name as it is presented to customers, as reported to the issuer by the acquirer.
6. Whether the card was presented at the execution of the transaction, as reported to the issuer by the acquirer, unless it is an extended transaction as defined in Section 11, about which the issuer reported to the customer, in the monthly statement, that it is such a transaction. In this matter, “card presentation”: reading card details via a Point of Sale terminal at the merchant or via another designated means used by the merchant for reading cards. (k) In regard to transactions conducted in foreign currency, including purchase of assets, cash withdrawal of foreign currency, and cancellation of transactions, the following details shall also be reported, in addition to those in Subsection (i): (1) The amount of the original transaction; (2) The currency in which the original transaction was carried out;

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 6 ONLY THE HEBREW VERSION IS BINDING (3) The date on which the transaction was converted into the currency in which the customer was charged; (4) The exchange rate at which the conversion was made (including type of exchange rate and reference to historical data). If the conversion was made on the basis of the amount collected from the issuer by the international acquirer (in a different currency from that in which the original transaction was made), the issuer shall also disclose the amount and the type of currency in which it was charged by the international acquirer. (5) The total amount that the customer was charged for the transaction (including the currency in which the charge was made). (6) The amount of fees that the issuer charged the customer, by component. (l) In regard to payment transactions indexed to foreign currency—the base exchange rate and the exchange rate at which the charge was made. In regard to CPI￾indexed credit transactions—the base index and the last known index at which current charge was performed. (m) An issuer that allows customers to accumulate rights shall itemize the charges made by use of rights and the balances available to the customer after the charges were made (opening balance, additions, reductions itemized by date and nature of transaction, and closing balance). (n) For cards that offer the possibility of an exemption from certain fees in accordance with the extent of transactions (a required value and/or number of transactions), the card issuer shall itemize, at least once every three months, the number of transactions and/or the value of purchases actually made with the card as against the number of transactions and/or the value of purchases required to obtain the exemption, for the period to which the exemption pertains. (2) Notwithstanding the provisions of Subsection (1) above, if the customer’s card shall be cancelled or blocked, and the issuer continues to charge the customer’s account for transactions conducted with the card prior to the cancellation or blocking, the issuer may only send the customer a statement regarding such transactions, soon after the first and last payment dates after the cancellation or blocking, and at least once every three months. The issuer is required to continue to present the detailed listing via the communication channels, for at least three months from the final charge date. Presenting Information on Payment Card Transactions on the Bank Website 12a. (1) A bank shall enable a customer to submit a request via the issuer, to present the information on the customer’s transactions via a payment card issued by that issuer, in a manner detailed in Subsection (2)(a) below, where the payment for them is made

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 7 ONLY THE HEBREW VERSION IS BINDING through debiting a current account belonging to the customer at the bank (hereinafter, an external payment card). The bank is to present the information to the customer 14 business days, at the most, after the date of the customer’s request to the bank, as it was submitted to it by the issuer. In a case of renewing a contract to use an external payment card, and of updating the expiration date of said payment card, a renewal request by the customer for presenting the information by the bank is not required. (2) The manner of presenting the information by the bank: (a) A bank shall present, in the customer’s account, via the communication channels offered to it for such needs, and at least the bank’s website and mobile application, in the location relevant to the matter of the customer’s payment card activity, the information detailed in Section 12(1)(a)–(g), and shall also present a secured link to the issuer’s website or the issuing processor’s website, including the information regarding the customer’s payment card transactions, as noted in Section 12(1), where the access to the said information does not require additional identification by the customer. (b) The bank shall present in an identical format the information noted in Subsection (a) regarding all the payment cards, including those issued by it, and it shall be updated at the frequency with which it receives the information from the issuer, and in an identical manner to updating such information for the payment cards issued by it. (c) It is the bank’s obligation to present said information, subject to transferring the relevant information and the link in a valid manner to the bank by the issuer or by the issuing processor. Points/Stars 13. Cancelled. 14. Cancelled. 15. Cancelled. Conversion of Foreign-Currency Transactions into NIS 16. Cancelled. Debit Card and Prepaid Card 17. The transfer of funds in immediate debit card transactions shall be as follows: (a) In transactions executed with a debit card, the issuer shall debit the customer at the transmission date value.

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 8 ONLY THE HEBREW VERSION IS BINDING (b) In immediate debit transactions, the issuer shall transfer the funds to the acquirer within 2 business days, at the most, from the date the transaction was transmitted. (c) Cancelled. 18. A mark that distinguishes a debit card or prepaid card from other types of payment cards is to be stamped on the cards, upon their issuance or renewal. 19. Reporting of debit card transactions shall be as follows: (a) The issuer is to present every debit card transaction on the current account statement, soon after it takes place, while marking the transaction as one carried out via immediate debit, and to note the transaction execution date, merchant name in accordance with Section 12(1)(a), and the transaction amount. (b) With a debit card, the issuer is to disclose to the customer, on a monthly statement, the transactions that were carried out with the card, as well as the details in Section 12(1) of the Directive. 20. Sections 7–9 of the Debit Cards Law are imposed on an immediate debit card. Use of Payment Cards with the EMV Standard 21. Sections 22–25 shall apply to a banking corporation as the term is defined in the Banking (Licensing) Law, including: a banking corporation that is a joint services company, an auxiliary corporation that is a credit card company, as well as an acquirer. Issuing Payment Cards 22. (a) An issuer shall not issue a payment card, except for a bank card that is only for withdrawing cash, unless it supports the EMV standard (a “smart card”); (b) The issuer is to implement an operational solution that allows the setting of a self￾selected PIN, required for carrying out a smart card transaction, by the customer. Acquiring Payment Card Transactions 23. Cancelled. Automated Teller Machines 24. A banking corporation shall not operate nor connect to its systems automated devices for withdrawing cash (automated teller machines—ATMs) unless those devices have complete functional support for carrying out transactions with a smart card. Liability Shift 25. Cancelled.

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 9 ONLY THE HEBREW VERSION IS BINDING Transferring Funds from the Issuing Bank to the Issuing Processor 26. The proceeds in respect of all transactions carried out via an issuing bank’s payment card, shall be transferred from the issuing bank to the issuing processor, in line with the date or dates set in the four-party acquiring model, independent of the date the customer is debited and independent of the identity of the acquirer, to whom the issuing processor sends the proceeds. New Operating Agreements—Transition Provisions 27. (a) New operating agreements between an issuing bank and an issuing processor, which are signed by January 31, 2022, are to be provided to the Supervisor. In this regard, the renewal of an existing agreement in which a material change has been made, in the view of the bank or of the issuing processor, shall be considered a new agreement. (b) If the banking issuer was a bank with a wide scope of activity, as defined in the Enhancing Competition Law, the said operating agreement shall require the approval of the Supervisor of Banks. (c) If the Supervisor of Banks did not provide an opinion within 45 days of the date all the required materials were submitted regarding the provisions of Subsection (b), it shall be taken as an approval.

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 10 ONLY THE HEBREW VERSION IS BINDING Appendix Proper Conduct of Banking Business Directives that Apply to Credit Card Companies1 a. Board of Directors (301)* b. The External Auditor of a Banking Corporation (302)* c. Communication of External Auditor with Those Charged with Governance in the Banking Corporation (303)* d. Chief Accountant (305)* e. Compliance Officer (308) f. Cancelled g. A Banking Corporation Business with Related Parties (312) h. Limitations on the Indebtedness of Borrowers and a Group of Borrowers (313) i. Self-Purchase by Banking Corporations (332) j. Risk Management (339)* k. Cancelled l. Embezzlement by Employees and Officials (351)* m. Banker's Insurance (352)* n. Removal of Documents from the Offices of Banking Corporations (356)* o. Information Technology Management (357) p. Banking Corporations' Ties with Intermediaries (359) q. Rotation and Uninterrupted Vacation (360)* r. Benefits to Customers' Employees (404)* s. Banking Services for New Immigrants (406)* t. Charging Customers for Legal Fees (409) u. Solicitation of Contributions from Customers by Employees of a Banking Corporation (410)* v. Prevention of Money Laundering and Financing of Terror, and Customer Identification (411) w. Procedures Regarding Fees (415) x. Minors' Accounts (416) y. Early Repayment Fee on a Non-housing Loan (454) z. Correction and Cancellation of Entries by Credit-Card Companies (471) aa. Transfer of Activity and Closure of a Customer's Account (Section 21 in Directive 432) bb. Measurement and Capital Adequacy (201-211) 1 The term “customer” in a given Directive may also relate to merchants that are, in fact, customers of a credit-card company.

• Directives that were applied to credit-card companies when this Directive went into effect.

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 11 ONLY THE HEBREW VERSION IS BINDING cc. Electronic Transfer of Information (420) dd. Reduction or increase in interest rates (421) ee. Non-banking benefits to customers (403)

---

Supervisor of Banks: Proper Conduct of Banking Business [14] (11/18) Payment Cards Page 470- 12 ONLY THE HEBREW VERSION IS BINDING Revisions Circular 06 number Version Details Date 2156 1 Original directive 30/1/05 2266 2 Update 25/3/10 2277 3 Update 19/10/10 2314 4 Update 13/11/11 2323 5 Update 27/12/11 2346 6 Update 19/09/12 2395 7 Update 4/8/13 2398 8 Update 9/9/14 2424 9 Update 6/7/14 2443 10 Update 15/12/14 2470 11 Update 29/6/15 2552 12 Update 21/01/18 2565 13 Update 04/07/18 2572 14 Update 13/11/18