Regulatory Alerts2025-01-01
Circular No. 26: Precautionary Measures to Limit Electronic Fraud Crimes
The Palestine Monetary Authority issued Circular No. 26/2025 to mandate precautionary measures for banks operating in Palestine, requiring enhanced cybersecurity controls including mandatory two-factor authentication, IP-based geo-blocking, proxy/VPN restrictions, and multi-device registration limits. The directive further obligates financial institutions to deploy automated fraud detection systems for unusual transactions, link third-party transfers and purchases to OTP or electronic approvals, and intensify customer notifications via SMS. Additionally, banks must establish 24/7 call center support and respond promptly to official authorities regarding electronic fraud complaints and legal proceedings.
Palestine Monetary Authority
Circular No. (26 / 2025) To all banks operating in Palestine Date: Thursday, March 27, 2025
Subject: Precautionary Measures to Limit Electronic Fraud Crimes
In light of fraudsters developing and innovating criminal methods aimed at defrauding bank customers, stealing their personal and banking data, funds, and savings amid the growing use of technology and modern financial technologies. Therefore, the Palestine Monetary Authority emphasizes the necessity to undertake the following:
- Comply with the requirements of Article No. (2.16) of Circular No. (11) for the year 2022 regarding the Cybersecurity Regulatory Framework, concerning safeguards and monitoring of internal and external electronic applications.
- Activate two-factor authentication procedures during registration and login to the mobile banking application and when conducting financial transactions, as well as when adding a new beneficiary or changing account settings such as email and mobile phone number.
- Strengthen the necessary controls and measures on systems to limit electronic fraud, including:
- Monitoring access operations to the bank's electronic applications via IP addresses outside Palestine, and working to provide and apply a Geo-Blocking policy.
- Prohibiting access to internet and mobile banking applications for making payments and transfers using (Proxy, VPN) applications.
- Not allowing electronic services and applications to be registered on more than one device, with some cases exempted based on customer request and approval.
- Implement a system to detect suspicious fraud transactions, including the detection of:
- Unusual and suspicious electronic financial transactions executed via the bank's electronic applications and banking cards of all types.
- Suspicious behaviors; such as logging in from unusual locations or repeated failed login attempts, and taking automatic actions like temporarily suspending the account or requesting additional verification.
1
Palestine Monetary Authority
- Link the execution of electronic transfers to third parties and settlement of domestic and external purchases with transaction confirmation via an One-Time Password (OTP) or electronic approval through the bank's approved applications.
- Inform and educate customers about the nature of risks of financial and banking products and services, how to use them, intensify sending warning SMS messages to customers, and provide them with notifications or text messages when making any transfer to third parties and settlement of purchases.
- Take appropriate legal actions and respond promptly to official authorities' requests regarding complaints and cases of electronic fraud.
- Commit to providing customer support services through the Call Center to answer any inquiries or receive customer complaints (7/24) at the fastest possible speed.
Supervision Group Palestine Monetary Authority
2
www.pma.ps Ramallah & Al-Bireh Governorate - Palestine P.O. Box 452 Postal Code: P6160675 | Phone: +970 2 2415251 | Fax: +970 2 2415310 | info@pma.ps