Bank of Israel Adjustments to Proper Conduct of Banking Business Directives for New Banking Corporations

Bank of Israel Banking Supervision Department Policy and Regulation Division 1 March 8, 2020 Circular Number C-06-2608 Attn: The Banking Corporations Re: Adjustments to Proper Conduct of Banking Business Directives that Apply to a New Banking Corporation (Proper Conduct of Banking Business Directive no. 480) Introduction

1. The Banking Supervision Department has been acting to encourage competition in the banking system in various ways, including lowering entrance barriers to the banking industry, e.g., by introducing leniencies that will lower the preparation costs that a new banking corporation and a banking corporation in formation incur at the beginning of their activity, and by creating regulatory certainty.
2. This Directive is a continuation of the supervisory policy concerning the establishment of a new bank in Israel, promulgated in June 2018—“The process of establishing a new bank and guidelines for bank-license applicants”—and includes adjustments to Proper Conduct of Banking Business Directives. Said adjustments were made in directives in which the compliance requirements were found to weigh on a new banking corporation and a banking corporation in formation and would impose high costs that are disproportionate to the risks to which said new banking corporation or banking corporation in formation may be exposed, or the systematic risk that they would create; all of which, while maintaing the basic rules of proper banking conduct in order not to impair the stability of the new banking corporation or the banking corporation in formation, and customers' protection.
3. In the future, the Banking Supervision Department will consider adjusting bank-customer directives and the Reporting to the Banking Supervision Department directives that apply to a new banking corporation and a banking corporation in formation.
4. After consulting with the Advisory Committee on Banking Business Affairs and with the approval of the Governor, I have established this Directive. Main provisions of the Directive Chapter A: General Remarks Scope of application and definitions (Sections 4, 6, and 7)
5. In Section 4, it is determined that all Proper Conduct of Banking Business Directives shall apply to a new banking corporation subject to the provisions of Chapters B–F of this Directive, and that only Chapter G shall apply to a banking corporation in formation.

Bank of Israel Banking Supervision Department Policy and Regulation Division 2 A “new banking corporation,” as set forth in Section 6, is a banking corporation that meets all of the following conditions: a. It has received a banking license that is not a limited license after the promulgation of this Directive; b. It does not belong to an existing banking group; c. It has neither branches nor subsidiaries abroad; d. Its total consolidated balance-sheet assets do not exceed 1 percent of total balance-sheet assets of the banking system or NIS 16 billion, whichever is smaller, and its total deposits from the public do not exceed 0.5 percent of total deposits from the public in the banking system or NIS 6 billion, whichever is smaller; e. It engages in non-complex activity, as explained in the Directive. Explanatory notes The definition of a new banking corporation includes quantitative and qualitative criteria. Compliance with the qualitative criteria shall be examined by the Banking Supervision Department on a case-by-case basis. 6. A limited license is one that is issued to a banking corporation in formation. It is issued for a three-year period and allows limited banking activity, such that credit to the public shall not exceed NIS 250 million and deposits from the public shall not exceed NIS 250 million. During its period of operation under a limited license, the bank shall complete its preparations, including raising capital, filling positions on the Board of Directors and in senior management; hiring employees; developing and establishing operating infrastructures and systems, formulating mechanisms of corporate governance, control, and risk management, and closing regulatory gaps relative to the directives that apply to a new banking corporation. Insofar as said preparations have not been completed by the end of three years from receiving the limited license, but have reached advanced stages, an extension of the limited license for an additional year might be received. A banking corporation that holds a limited license does not automatically receive a non-limited license at the end of the specified period. A non-limited license is given only after further review of the adequacy of the banking corporation’s business plan, its resilience and stability, and after it has successfully passed an audit by the Banking Supervision Department. A banking corporation that ceases to be a new banking corporation (Section 10) 7. If a banking corporation ceases to comply with the terms of the definition of a “new banking corporation,” the Supervisor of Banks may afford it a transition period that shall not exceed three years to apply a particular Proper Conduct of Banking Business Directive or all relevant directives.

Bank of Israel Banking Supervision Department Policy and Regulation Division 3 Explanatory note As the Supervisor of Banks shall determine, and under the circumstances at hand, the transition from the definition of a “new banking corporation,” which is subject to this Directive, to the status of an “ordinary” banking corporation, which must comply with all directives of the Banking Supervision Department, shall be gradual. Chapter B: Proper Conduct of Banking Business Directives concerning Capital Measurement and Adequacy, Leverage, and Liquidity Proper Conduct of Banking Business Directives no. 201–211, concerning capital measurement and adequacy (section 11) 8. It is determined that if the total credit-risk assets of a new banking corporation do not exceed NIS 600 million, the banking corporation is required to hold no less than NIS 50 million in Common Equity Tier 1 Capital; and that if total credit-risk assets exceed the amount established, a new banking corporation must maintain a Common Equity Tier 1 Capital ratio no smaller than 8 percent and minimum total capital adequacy of 11.5%. Notwithstanding this, a banking corporation whose credit-risk assets exceed NIS 600 million but less than NIS 5 billion, may maintain a Common Equity Tier 1 Capital ratio no smaller than 10 percent. Explanatory notes The Directive establishes risk-adjusted capital-adequacy requirements. It also allows Tier 2 equity to be replaced by Tier 1 equity because Tier 1 equity is considered of higher quality. Regulatory capital and risk assets shall be calculated in the manner set forth in the Banking Supervision Department’s directives. Proper Conduct of Banking Business Directive no. 218, “Leverage Ratio” (Section 13) 9. It is determined that when the total credit-risk assets of a new banking corporation do not exceed NIS 600 million, the corporation need not maintain a leverage ratio; when total credit-risk assets exceed the sum set forth, the Corporation shall maintain a 4 percent leverage ratio. Explanatory notes The leverage ratio is a supplemental metric for the capital-adequacy ratio; therefore, the adjustments are made under the same conditions. Proper Conduct of Banking Business Directive no. 221, “Liquidity Coverage Ratio” (Section 14) 10. It is determined that a new banking corporation need not comply with Proper Conduct of Banking Business Directive no. 221 (“Liquidity Coverage Ratio”) provided it maintains a simple liquidity ratio calculated in the manner specified in the Directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division 4 Explanatory note The liquidity coverage ratio (LCR) was adopted as part of the Basel 3 reform. Since it is complex to calculate and operate, a new banking corporation may be absolved from having to apply it provided it choose the option of a simple liquidity ratio that is easy to calculate although not necessarily more lenient. Chapter C: Proper Conduct of Banking Business Directives concerning Management and Control Proper Conduct of Banking Business Directive no. 301, “Board of Directors” (Section 15) 11. It is determined that a new banking corporation shall apply Proper Conduct of Banking Business Directive no. 301 with the following main adjustments relative to the existing directive: a. The minimum number of directors shall be five. b. In accordance with the possibility of a smaller number of board members, the requirement that directors have specific credentials are adjusted as well:

1. a director with “banking experience”—one or two directors are needed, commensurate with the size of the Board of Directors, instead of a third.
2. a director with “accounting and financial expertise”—one or two directors are needed, commensurate with the size of the Board of Directors, instead of a fifth. c. For a limited period of time, the owner of controlling interest or his relative may be named chair of the Board of Directors or chair of a board committee, with the exception of committees for which this is prohibited under the Companies Law, 5759-1999 (hereinafter: the Companies Law). d. In a new banking corporation that has a Board of Directors comprised of no more than seven members, at least one director who has accounting and financial expertise, instead of two, shall serve on the Audit Committee. e. The mandatory committees have been reduced, such that there is no need to establish a risk￾management committee and an information-technology and innovation committee. The remuneration committee shall also not be compulsory as long as the new banking corporation is exempted from having to make its appointments under the Companies Law. f. The frequency of discussions and reports is reduced wherever the Banking Supervision Department is of the view that this will not impair the proper functioning of the Board of Directors. Explanatory note Proper Conduct of Banking Business Directive no. 301 is set to ensure effective corporate governance by establishing requirements in regard to the duties, composition, and modus operandi of the Board of Directors. The adjustments introduced in this Directive are meant to simplify and facilitate the board’s activity, it being understood that the appropriate mechanism

Bank of Israel Banking Supervision Department Policy and Regulation Division 5 for a banking corporation that acts on a small scale with a non-complex activity is different from that applying to a large and complex banking corporation. Proper Conduct of Banking Business Directive no. 307, “Internal Audit Function” (Section 16) 12. Adjustments are made in the frequency of reports that the internal auditor must carry out. Proper Conduct of Banking Business Directive no. 308, “Compliance and the Compliance Function in a Banking Corporation” (Section 17) 13. It is determined that the Chief Compliance Officer of a new banking corporation may hold an additional function in the corporation, provided he is not responsible for an area of business activity, in which concern is raised about conflict of interest between his position and the other function , and subject to prior approval of the Supervisor of Banks. Explanatory note The executive functions that are required in the Banking Supervision Departments' directives have been reduced by allowing functions to be merged. Proper Conduct of Banking Business Directive no. 308A, “Handling of Public Complaints” (Section 18) 14. It is determined that at a new banking corporation: a. The Ombudsman and the staff of the public-complaints function may hold additional posts, provided nothing on this account shall create a conflict of interest with said duties of theirs, and provided prior written notice to the Supervisor of Banks is given. b. Reporting about the handling of complaints shall be presented to the Banking Supervision Department once per year instead of once every half-year. Explanatory note The executive functions that are required in the Banking Supervision Departments' directives have been reduced, as has the frequency of reporting to the Banking Supervision Department. Proper Conduct of Banking Business Directive no. 309, “Controls and Procedures relating to Disclosure and Internal Control over Financial Reporting” (Section 19) 15. It is determined that a new banking corporation may assess the effectiveness of its controls and procedures concerning disclosure by a banking corporation and requisite changes therein under Sections 4 and 6 of Proper Conduct of Banking Business Directive no. 309 once per year instead of once per quarter. Proper Conduct of Banking Business Directive no. 310, “Risk Management” (Section 20) 16. It is determined that the Chief Risk Officer at a new banking corporation shall be an employee of the new banking corporation and may have responsibilities in the risk function, such as Chief

Bank of Israel Banking Supervision Department Policy and Regulation Division 6 Compliance Officer, manager of the operational risk function, Anti-Money Laundering and Countering the Financing of Terrorism Officer, or Credit Control Officer, and may also have additional headquarter or control duties such as Ombudsman, provided his set of responsibilities be commensurate with the corporation’s level of activity, the complexity of its activity, and the characteristics of the risks inherent to said activity, and shall not impair the independence of the function and the effective performance of its work. Additionally, prior permission from the Supervisor of Banks to hold the additional post of a Chief Accounting Officer shall be needed. Explanatory note The executive functions that are required in the Banking Supervision Departments' directives have been reduced by allowing functions to be merged. Chapter D: Proper Conduct of Banking Business Directives concerning Credit and Investments Proper Conduct of Banking Business Directive no. 313, “Limitations on the Indebtedness of a Borrower and a Group of Borrowers” (Section 21) 17. Until the end of three years from the date on which a banking license that is not a limited license is received, the indebtedness of a banking group of borrowers or a credit-card group of borrowers to a new banking corporation shall not exceed 50 percent of the banking corporation’s capital; by the end of three years from the receipt of a banking license that is not a limited license, the indebtedness of a banking group of borrower or a credit-card group borrowers to a new banking corporation shall not exceed 25 percent of the banking corporation’s capital.” Explanatory note Banking groups of borrowers and credit-card groups of borrowers under Bank of Israel supervision typically have small indebtedness to a new banking corporation. Proper Conduct of Banking Business Directive no. 315, “Industry Indebtedness Limitation” (Section 22) 18. A new banking corporation is exempt from per-industry credit-concentration restrictions as long as the level of its business activity is small, up to the thresholds established in this section of the Directive. Explanatory note Industry indebtedness limitations are less relevant for a new banking corporation, which by definition is oriented to households and small businesses; accordingly, it is exempted from the Directive as long as its business activity remains small. Proper Conduct of Banking Business Directive no. 318, “Collateral Database” (Section 23)

Bank of Israel Banking Supervision Department Policy and Regulation Division 7 19. A new banking corporation is exempted from the specific requirements regararding a collateral database as set in Directive no. 318 as long as it does not grant housing loans and as long as its activity remains small, up to the thresholds established in this section of the Directive. Explanatory note Due to cost-benefit consideration, according to the Directive, the management of collateral databse is in the discreation of a new banking corporation, as long as it fulfill the conditions in this section of the Directive. Chapter E: Proper Conduct of Banking Business Directives concerning Financial Risks Proper Conduct of Banking Business Directive no. 333, “Management of Interest-Rate Risk” (Section 24) 20. It is determined that a new banking corporation that operates on a very small scale, as defined in the Directive, and is not heavily exposed to interest-rate risks, is exempt from the requirements in Directive no. 333, but must manage its interest-rate risk using common tools and in accordance with the general principles set forth in the main directive in regard to risk management, Directive no. 310. Explanatory note A new banking corporation by definition does not engage in activity that entails a large exposure to interest-rate or market risks; accordingly, it is allowed to have flexiblity in managing this risk as long as it complies with the conditions set forth in this section of the Directive. Proper Conduct of Banking Business Directive no. 339, “Market Risk Management” (Section 25) 21. It is determined that a new banking corporation with a small level of trading activity, as defined in the Directive, is exempt from the requirements in Directive no. 339, but must manage its market risk using common tools and in accordance with the general principles set forth in the main directive in regard to risk management, Directive no. 310. Explanatory note A new banking corporation by definition does not engage in activity that entails a large exposure to market risks; accordingly, it is allowed to have flexiblity in managing this risk as long as it complies with the conditions set forth in this section of the Directive. Chapter F: Proper Conduct of Banking Business Directives concerning Technology and Cyber Proper Conduct of Banking Business Directive no. 357, “Information Technology Management” (Section 26) 22. It is determined that a new banking corporation may apply the provisions of Directive no. 357 mutatis mutandis:

Bank of Israel Banking Supervision Department Policy and Regulation Division 8 a. It may define the CEO also as the information technology manager provided he has appropriate professional training and relevant experience in all of these fields or define the information-technology manager also as the information-security manager and the cyber￾defense manager, subject to appropriate professional training and relevant experience in all those areas. b. It may outsource the function of information-technology manager or information-security manager if the digital services are obtained from an (authorized) service agency, provided the Board of Directors so approves and a written notice is submitted to the Banking Supervision Department in advance. Said leniency shall not apply to a new banking corporation that operates under Subsection (a) above. c. It may assess the risks of the information-technology array and carry out the safety survey and controlled-intrusion attempts as part of the operational-risks survey, under the responsibility of the manager of the operational-risk function. Explanatory note The executive functions required in the Banking Supervision Departments' directives have been reduced by allowing functions to be merged, enabling certain core functions to be outsourced, and merging risk-assessment surveys. Proper Conduct of Banking Business Directive no. 359A, “Outsourcing” (Section 27) 23. The provisions of Section 38 of Proper Conduct of Banking Business Directive no. 359A shall not apply to a new banking corporation. Explanatory note Since new banking corporations mostly have a limited branch system, the Directive allows adjustments, like those given to credit-card companies, in approaching households proactively in order to refer them to the new banking corporation for receiving credit. Proper Conduct of Banking Business Directive no. 361, “Cyber Defense Management” (Section 28) 24. It is determined that a new banking corporation may outsource the function of cyber-defense manager under the conditions specified in the Directive. When the cyber-defense manager is an employee of the new banking corporation, it is stated with emphasis that he may hold other functions in the corporation, under the terms spelled out in Section 17 of Directive no 361. Explanatory note The executive positions required in the Banking Supervision Departments' directives have been reduced by merging functions and allowing activities of certain core functions to be outsourced. As stated in Section 26(a)(2) of the Directive, the functions of information-technology manager, information-security manager, and cyber-defense manager may be merged under the terms specified ad loc.

Bank of Israel Banking Supervision Department Policy and Regulation Division 9 Proper Conduct of Banking Business Directive no. 362, “Cloud Computing” (Section 29) 25. It is determined that a new banking corporation may use cloud-computing services for core activities or core systems provided it obtains prior approval of the Supervisor of Banks. Explanatory note In accordance with the principle of risk-adjusted regulation and in light of the small scale of activity, a new banking corporation may use cloud-computing services for core activities or core systems provided it obtains prior approval of the Supervisor of Banks. Said approval will be given, inter alia, after the new banking corporation satisfies the Banking Supervision Department that it has the knowledge and the abilities to manage the risk attending to the use of cloud￾computing services for core activities or core systems. Chapter G: Banking Corporation in Formation (Section 30) 26. The Proper Conduct of Banking Business Directives, with the exception of those specified in Chapter G, shall not apply to a banking corporation in formation. Explanatory note A banking corporation in formation needs to comply with only a few directives, e.g., capital, liquidity, corporate governance, compliance, and management of anti-money laundering and countering financing of terrorism risks, and these directives shall be adjusted to the banking corporation’s formation period and the level of its activity. Date of effect 27. The Directive shall go into effect on the day this Circular is published. File update 28. Update pages for the Proper Conduct of Banking Business Directives file are attached. The following are the update instructions: Remove page Insert page --------- 480-1-15 [1] (3/20) Respectfully, Dr. Hedva Ber Supervisor of Banks