Capital Adequacy and Measurement—Operational Risk

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 1 ONLY THE HEBREW VERSION IS BINDING Capital Adequacy and Measurement—Operational Risk June 2024 Table of Contents

1. Definitions and group application (OPE10) Definitions Definition of Business Indicator components Application of the standardized approach within a banking group
2. Risk weighted assets calculation in respect of operational risk—the Standardized Approach (OPE25) Introduction Components of the standardized approach Minimum standards for the use of loss data under the standardized approach General criteria on loss data identification, collection and treatment Specific criteria on loss data identification, collection and treatment Exclusion of losses from the Loss Component Exclusions of divested activities from the Business Indicator Inclusion of losses and BI items related to mergers and acquisitions Disclosure to the public
3. Additional implementation guidelines Collecting internal loss data by a banking corporation in bucket 1 Frequency of calculating the risk weighted assets in respect of operational risk
4. Definitions and group application (OPE10) 1.1 Definitions “Operational risk” The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk1 , but excludes strategic and reputational risk. “Business indicator” Serves as an estimate of the operational risk based on financial statements; its calculation is detailed in this Directive.

1 Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 2 ONLY THE HEBREW VERSION IS BINDING “Banking corporation in bucket 1” A banking corporation for which the business indicator does not exceed NIS 5 billion. “Banking corporation in bucket 2” A banking corporation for which the business indicator exceeds NIS 5 billion and does not exceed NIS 150 billion. “Banking corporation in bucket 3” A banking corporation for which the business indicator exceeds NIS 150 billion. Definition of Business Indicator components 1.2 Table 1 defines the components of the Business Indicator (BI). Table 1 Business Indicator definitions BI component Income statement or balance sheet items Description Typical sub-items Interest, lease and dividend Interest income2 Interest income from all financial assets and interest income from other assets (includes interest income from financial and operating leases and profits from leased assets)  Interest income from loans and advances, assets available for sale, assets held to maturity, trading assets and financial leases  Interest income from hedge accounting derivatives  Other interest income  Interest expenses Interest expenses from all financial liabilities and interest expenses from other liabilities (includes interest expense from financial leases  Interest expenses from deposits, debt securities issued and financial leases  Interest expenses from hedge accounting derivatives  interest expenses from other liabilities

2 See a sample template of Note 2 to the Reporting to the Public Directives regarding the annual financial report—interest income and expenses.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 3 ONLY THE HEBREW VERSION IS BINDING Interest earning assets (balance sheet item) Total gross outstanding credit, interest bearing securities (including government bonds), and financial lease assets measured at the end of each financial year Dividend income Dividend income from investments in stocks not consolidated in the bank's financial statements, including dividend income from nonconsolidated subsidiaries and joint ventures. Services Fee and commission income3 Income received from providing advice and services. Includes income received by the banking corporation as an outsourcer of financial services. Fee and commission income from:  Securities (issuance, origination, reception, transmission, execution of orders on behalf of customers)  Credit cards, clearing and settlement; Asset management; Custody; Fiduciary transactions; Payment services; Structured finance; Servicing of securitizations; Loan commitments and guarantees given; and foreign transactions, foreign exchange fees or foreign trade activity Fee and commission expenses Expenses paid for receiving advice and services. Includes outsourcing fees paid by the banking corporation for the supply of financial services, but not outsourcing fees paid for the supply of nonfinancial services (e.g., Fee and commission expenses from:  Credit cards, clearing and settlement; Custody; Servicing of securitizations; Loan commitments and guarantees received; and foreign transactions

3 See a sample template of Note 4 to the Reporting to the Public Directives regarding the annual financial statement—fees.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 4 ONLY THE HEBREW VERSION IS BINDING logistical, IT, human resources) Other operating income Income from ordinary banking operations not included in other BI items but of similar nature  Rental income from investment properties  Gains from non-current assets and disposal groups classified as held for sale not qualifying as discontinued operations (item 205-20 in the Accounting Standards Codification "discontinued operations") Other operating expenses Expenses and losses from ordinary banking operations not included in other BI items but of similar nature and from operational loss events  Losses from noncurrent assets and disposal groups classified as held for sale not qualifying as discontinued operations (item 205-20 in the Accounting Standards Codification "discontinued operations")  Losses incurred as a consequence of operational loss events (e.g., fines, penalties, settlements, replacement cost of damaged assets), which have not been provisioned/reserved for in previous years  Expenses related to establishing provisions/reserves for operational loss events Financial4 Net profit (loss) on the trading book  Net realized and unrealized profit/loss from fair value adjustment of trading assets and trading liabilities and of assets and liabilities for which the fair value option is adapted (debt securities, equity securities, credit, short positions, other assets and liabilities)  Net income/expenses from trading accounting derivatives

4 See a sample template in Section 66a of the Reporting to the Public Directives regarding noninterest financial income.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 5 ONLY THE HEBREW VERSION IS BINDING  Net exchange differences Net profit (loss) on the banking book  Net profit/loss on non-trading equities securities measured at fair value through profit and loss  Realized gains/losses on financial assets and liabilities not measured at fair value through profit and loss debt securities available for sale, and held to maturity, financial liabilities measured at amortized cost)  Noninterest finance income from derivatives instruments  Net exchange differences 1.3 The following profit and loss items do not contribute to any of the items of the BI: (1) Income and expenses from insurance or reinsurance businesses. (2) Premiums paid and reimbursements/payments received from insurance or reinsurance policies purchased. (3) Administrative expenses, including salaries, outsourcing fees paid for the supply of non-financial services (e.g., logistical, human resources, information technology – IT), and other administrative expenses (e.g., IT, utilities, telephone, travel, office supplies, postage). (4) Recovery of administrative expenses including recovery of payments on behalf of customers (e.g., taxes debited to customers). (5) Expenses of premises and fixed assets (except when these expenses result from operational loss events). (6) Depreciation/amortization of tangible and intangible assets. (7) Provisions/reversal of provisions (e.g., on pensions, commitments and guarantees given) except for provisions related to operational loss events. (8) Not relevant. (9) Impairment/reversal of impairment (e.g., on financial assets, nonfinancial assets, investments in subsidiaries and joint ventures). (10) Changes in goodwill recognized in profit or loss. (11) Corporate income tax (tax based on profits including current tax and deferred) Application of the standardized approach within a banking group 1.4 At the consolidated level, the standardized approach calculations use fully consolidated BI figures, which net all the intragroup income and expenses. The calculations at the subsidiary level use the BI figures from the subsidiary. 1.5 when BI figures for subsidiary bank reach bucket 2 or 3, this banking corporation is required to use loss experience in the standardized approach calculations. A subsidiary

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 6 ONLY THE HEBREW VERSION IS BINDING bank uses only the losses it has incurred in the standardized approach calculations (and does not include losses incurred by other parts of the banking group). 1.6 In case a subsidiary of a banking corporation belonging to bucket 2 or higher does not meet the qualitative standards for the use of the Loss Component, this subsidiary must calculate the standardized approach capital requirements by applying 100% of the BI Component (ILM equal to 1). In such cases supervisors may require the subsidiary to apply an internal loss multiplier which is greater than 1. 2. Risk weighted assets calculation in respect of operational risk—the Standardized Approach (OPE25) Introduction 2.1 The standardized approach methodology is based on the following components: (1) the Business Indicator (BI) which is a financial-statement-based proxy for operational risk; (2) the Business Indicator Component (BIC), which is calculated by multiplying the BI by a set of regulatory determined marginal coefficients (αi); and (3) the Internal Loss Multiplier (ILM), which is a scaling factor that is based on a bank’s average historical losses and the BIC. 2.2 Operational risk capital requirements (ORC) are calculated by multiplying the BIC and the ILM, as shown in the formula below. Risk-weighted assets (RWA) for operational risk are equal to 12.5 times ORC. Components of the standardized approach 2.3 The BI comprises three components: the interest, leases and dividend component (ILDC); the services component (SC), and the financial component (FC). 2.4 The BI is defined as: BI = ILDC + SC + FC 2.5

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 7 ONLY THE HEBREW VERSION IS BINDING ILDC, SC and FC are defined in the formulae below, where a bar above a term indicates that it is calculated as the average over three years: t, t-1 and t-2: 1 2.6 The definitions for each of the components of the BI are as detailed in Chapter 1. 2.7 To calculate the BIC, the BI is multiplied by the marginal coefficients (αi). The marginal coefficients increase with the size of the BI as shown in Table 1. For banks in bucket 1, the BIC is equal to BI x 12 percent. The marginal increase in the BIC resulting from a one unit increase in the BI is 12 percent for a banking corporation in bucket 1, 15 percent for a banking corporation in bucket 2, and 18 percent for a banking corporation in bucket 3.2 Table 1 BI ranges and marginal coefficients Bucket BI range (in NIS billion) BI marginal coefficients (αi) 1 ≤5 12% 2 15< BI ≤150 15% 3 > 150 18% 2.8 A banking corporation’s internal operational risk loss experience affects the calculation of operational risk capital through the ILM. The ILM is defined as below, where the Loss Component (LC) is equal to 15 times average annual operational risk losses incurred over the previous 10 years:

1 The absolute value (abs) of net items (e.g., interest income – interest expense) should be calculated first year by year. Only after this year by year calculation should the average of the three years be calculated. 2 For example, given a Business indicator of NIS 175 billion, the calculation of the BIC is: (5 x 12%) + (150-5) x 15% + (175-150) x 18% =26.85.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 8 ONLY THE HEBREW VERSION IS BINDING 2.9 The ILM is equal to one where the loss and business indicator components are equal. Where the LC is greater than the BIC, the ILM is greater than one. That is, a banking corporation with losses that are high relative to its BIC is required to hold higher capital due to the incorporation of internal losses into the calculation methodology. Conversely, where the LC is lower than the BIC, the ILM is less than one. That is, a banking corporation with losses that are low relative to its BIC is required to hold lower capital due to the incorporation of internal losses into the calculation methodology. 2.10 The calculation of average losses in the LC must be based on 10 years of high-quality annual loss data. The qualitative requirements for loss data collection are outlined in Sections 2.14 to 2.34. As part of the transition to the standardized approach, banking corporations that do not have 10 years of high-quality loss data may use a minimum of five years of data to calculate the LC.3 Banking corporations that do not have five years of high￾quality loss data must calculate the capital requirement based solely on the BIC. The Supervisor may however require a banking corporation to calculate capital requirements using fewer than five years of losses if the ILM is greater than 1 and the Supervisor believes the losses are representative of the bank's operational risk exposure. 2.11 For a banking corporation in bucket 1, internal loss data does not affect the capital calculation. That is, the ILM is equal to 1, so that operational risk capital is equal to the BIC (=12% x BI). The Supervisor may allow the inclusion of internal loss data into the framework for banking corporations in bucket 1, subject to meeting the loss data collection requirements specified in Sections 2.14 to 2.34. In addition, the Supervisor may set the value of ILM equal to 1 for all banking corporations. In case this discretion is exercised, banking corporations would still be subject to the full set of operating loss disclosure requirements as established in the Reporting to the Public Directives (Pillar 3). Minimum standards for the use of loss data under the standardized approach 2.12 Banking corporations belonging to bucket 2 or bucket 3 are required to use loss data as a direct input into the operational risk capital calculations. The soundness of data collection and the quality and integrity of the data are crucial to generating capital outcomes aligned with the banking corporation’s operational loss exposure. The minimum loss data standards are outlined in Sections 2.14 to 2.34. The banking corporation should review the quality of banks’ loss data periodically.

3 Not relevant.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 9 ONLY THE HEBREW VERSION IS BINDING 2.13 Banking corporations that do not meet the loss data standards are required to hold capital that is at a minimum equal to 100% of the BIC. In such cases, the Supervisor may require the banking corporation to apply an ILM which is greater than 1. The exclusion of internal loss data due to noncompliance with the loss data standards, and the application of any resulting multipliers, must be publicly disclosed in accordance with the Pillar 3 requirements in the Reporting to the Public Directives. General criteria on loss data identification, collection and treatment 2.14 The proper identification, collection and treatment of internal loss data are essential prerequisites to capital calculation under the standardized approach. The general criteria for the use of the loss data are as follows. 2.15 Internally generated loss data calculations used for regulatory capital purposes must be based on a 10-year observation period. If ten years of good quality loss data are not available when the banking corporation first moves to the standardized approach, a shorter observation period is acceptable on an exceptional basis (with a minimum observation period of five years). Within the transitional period, all years of good-quality data available beyond five years must be included. 2.16 Internal loss data are most relevant when clearly linked to a banking corporation’s current business activities, technological processes and risk management procedures. Therefore, a banking corporation must have documented procedures and processes for the identification, collection and treatment of internal loss data. Such procedures and processes must be subject to validation before the use of the loss data within the operational risk capital requirement measurement methodology, and to regular independent reviews by internal and/or external audit functions. 2.17 Based on the requirement by the Supervisor of Banks, a banking corporation shall map its historical internal loss data into the relevant Level 1 supervisory categories as defined in Table 2 and shall provide this data to the Supervisor. The banking corporation must document criteria for allocating losses to the specified event types. Table 2 Detailed loss event type classification

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 10 ONLY THE HEBREW VERSION IS BINDING Event-type category (Level 1) Definition Categories (Level 2) Activity examples (Level 3) Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, which involves at least one internal party, excluding diversity/ discrimination events Unauthorized activity Transactions not reported (intentional) Transaction type unauthorized (with monetary loss) Mismarking of position (intentional) Theft and fraud Fraud / credit fraud / worthless deposits Theft / extortion / embezzlement / robbery Misappropriation of assets Malicious destruction of assets Forgery Check kiting Smuggling Account takeover / impersonation etc. Tax noncompliance / evasion (willful) Bribes / kickbacks Insider trading (not on firm's account) External fraud Losses due to acts of a type intended to defraud, misappropriate property or Theft and fraud Theft / robbery Forgery

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 11 ONLY THE HEBREW VERSION IS BINDING circumvent the law, by a third party Check kiting Systems security Hacking damage Theft of information (with monetary loss) Employment practices and workplace safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events Employee relations Compensation, benefit, termination issues Organized labor activity Safe environment General liability (slip and fall etc.) Employee health and safety rules events Workers compensation Diversity and discrimination All discrimination types Clients, products and business practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Suitability, disclosure and fiduciary Fiduciary breaches / guideline violations Suitability / disclosure issues (know-your￾customer etc.) Retail customer disclosure violations Breach of privacy Aggressive sales Account churning Misuse of confidential information Lender liability

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 12 ONLY THE HEBREW VERSION IS BINDING Improper business or market practices Antitrust Improper trade / market practices Market manipulation Insider trading (on firm's account) Unlicensed activity Money laundering Product flaws Product defects (unauthorized etc.) Model errors Selection, sponsorship and exposure Failure to investigate client per guidelines Exceeding client exposure limits Advisory activities Disputes over performance of advisory activities Damage to physical assets Losses arising from loss or damage to physical assets from natural disaster or other events Disasters and other events Natural disaster losses Human losses from external sources (terrorism, vandalism) Business disruption and system failures Losses arising from disruption of business or system failures Systems Hardware Software Telecommunications Utility outage / disruptions Execution, delivery and Losses from failed transaction processing or Transaction capture, Miscommunication

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 13 ONLY THE HEBREW VERSION IS BINDING process management process management, from relations with trade counterparties and vendors execution and maintenance Data entry, maintenance or loading error Missed deadline or responsibility Model / system misoperation Accounting error / entity attribution error Other task misperformance Delivery failure Collateral management failure Reference data maintenance failure Monitoring and reporting Failed mandatory reporting obligation Inaccurate external report (loss incurred) Customer intake and documentation Client permissions / disclaimers missing Legal documents missing / incomplete Customer / client account management Unapproved access given to accounts Incorrect client records (loss incurred) Negligent loss or damage of client assets Trade counterparties Nonclient counterparty misperformance

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 14 ONLY THE HEBREW VERSION IS BINDING Miscellaneous nonclient counterparty disputes Vendors and suppliers Outsourcing Vendor disputes 2.18 A banking corporation’s internal loss data must be comprehensive and capture all material activities and exposures from all appropriate subsystems and geographic locations. The minimum threshold for including a loss event in the data collection and calculation of average annual losses is set at NIS 100,000. 2.19 Aside from information on gross loss amounts, the banking corporation must collect information about the reference dates of operational risk events, including the date when the event happened or first began (“date of occurrence”), where available; the date on which the banking corporation became aware of the event (“date of discovery”); and the date (or dates) when a loss event results in a loss, reserve or provision against a loss being recognized in the bank’s profit and loss (P&L) accounts (“date of accounting”). In addition, the banking corporation must collect information on recoveries of gross loss amounts as well as descriptive information about the drivers or causes of the loss event.4 The level of detail of any descriptive information should be commensurate with the size of the gross loss amount. 2.20 Operational loss events related to credit risk and that are accounted for in credit RWA should not be included in the loss data set. Operational loss events that relate to credit risk but are not accounted for in credit RWA should be included in the loss data set. 2.21 Operational risk losses related to market risk are treated as operational risk for the purposes of calculating minimum regulatory capital under this framework. 2.22

4 Tax effects (e.g., reductions in corporate income tax liability due to operational losses) are not recoveries for purposes of calculating capital requirements for operational risk.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 15 ONLY THE HEBREW VERSION IS BINDING Banking corporations must have processes to independently review the comprehensiveness and accuracy of loss data. Specific criteria on loss data identification, collection and treatment 2.23 Building an acceptable loss data set from the available internal data requires that the banking corporation develop policies and procedures to address several features, including gross loss definition, reference date and grouped losses. 2.24 Gross loss is a loss before recoveries of any type. Net loss is defined as the loss after taking into account the impact of recoveries. The recovery is an independent occurrence, related to the original loss event, separate in time, in which funds or inflows of economic benefits are received from a third party.5 2.25 Banking corporations must be able to identify the gross loss amounts, noninsurance recoveries, and insurance recoveries for all operational loss events. Banking corporations should use losses net of recoveries (including insurance recoveries) in the loss dataset. However, recoveries can be used to reduce losses only after the banking corporation receives payment. Receivables do not count as recoveries. Verification of payments received to net losses must be documented. 2.26 The following items must be included in the gross loss computation of the loss data set: (1) Direct charges, including impairments and settlements, to the bank's P&L accounts and write-downs due to the operational risk event; (2) Costs incurred as a consequence of the event including external expenses with a direct link to the operational risk event (e.g., legal expenses directly related to the event and fees paid to advisors, attorneys or suppliers) and costs of repair or replacement, incurred to restore the position that was prevailing before the operational risk event;

5 Examples of recoveries are payments received from insurers, repayments received from perpetrators of fraud, and recoveries of misdirected transfers.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 16 ONLY THE HEBREW VERSION IS BINDING (3) Provisions or reserves accounted for in the P&L against the potential operational loss impact; (4) Losses stemming from operational risk events with a definitive financial impact, which are temporarily booked in transitory and/or suspense accounts and are not yet reflected in the P&L ("pending losses").6 Material pending losses should be included in the loss data set within a time period commensurate with the size and age of the pending item; and (5) Negative economic impacts booked in a financial accounting period, due to operational risk events impacting the cash flows or financial statements of previous financial accounting periods ("timing losses").7 Material "timing losses" should be included in the loss data set when they are due to operational risk events that span more than one financial accounting period. 2.27 The following items should be excluded from the gross loss computation of the loss data set: (1) Costs of general maintenance contracts on property, plant or equipment; (2) Internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives and enhancements; and (3) Insurance premiums. 2.28

6 A case where the impact of some events (e.g., legal events, damage to physical assets) is known and clearly identifiable before these events are recognized through the establishment of a reserve. 7 Timing impacts typically relate to the occurrence of operational risk events that result in the temporary distortion of a corporation’s financial accounts (e.g., revenue overstatement, accounting errors and mark-to￾market errors). While these events do not represent a true financial impact on the corporation (net impact over time is zero), if the error continues across more than one financial accounting period, it may represent a material misrepresentation of the corporation’s financial statements.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 17 ONLY THE HEBREW VERSION IS BINDING Banking corporations must use the date of accounting for building the loss data set. The banking corporation must the date of accounting for including losses related to legal events in the loss data set. For legal loss events, the date of accounting is the date when a legal reserve is established for the probable estimated loss in the P&L. 2.29 Losses caused by a common operational risk event or by related operational risk events over time, but posted to the accounts over several years, should be allocated to the corresponding years of the loss database, in line with their accounting treatment. Exclusion of losses from the Loss Component 2.30 Banking corporations may request approval from the Supervisor to exclude certain operational loss events that are no longer relevant to the banking corporation’s risk profile. The exclusion of internal loss events request should be in writing, in rare cases and be supported by strong justification. In evaluating the relevance of operational loss events to the bank's risk profile, the Supervisor will consider whether the cause of the loss event could occur in other areas of the banking corporation’s operations. Taking settled legal exposures and divested businesses as examples, the Supervisor will expect the banking corporation’s analysis to demonstrate that there is no similar or residual legal exposure and that the excluded loss experience has no relevance to other continuing activities or products. 2.31 The total loss amount and number of exclusions must be disclosed in accordance with the Pillar 3 requirements in the Reporting to the Public Directives, accompanied by appropriate description. 2.32 A request for loss exclusions is subject to a materiality threshold to be set by the Supervisor uniformly (for example, the excluded loss event should be greater than 5% of the bank’s average losses). In addition, losses can only be excluded after being included in a banking corporation’s operational risk loss database for a minimum period (for example, three years), to be specified by the supervisor uniformly. Losses related to divested activities will not be subject to a minimum operational risk loss database retention period. Exclusions of divested activities from the Business Indicator 2.33 Banking corporations may request supervisory approval to exclude divested activities from the calculation of the BI. Such exclusions must be disclosed in accordance with the Pillar 3 requirements.

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 18 ONLY THE HEBREW VERSION IS BINDING Inclusion of losses and BI items related to mergers and acquisitions 2.34 The scope of losses and BI items used to calculate the operational risk capital requirements must include acquired businesses and merged entities over the period prior to the acquisition/merger that is relevant to the calculation of the standardized approach (ten years for losses and three years for BI). Disclosure 2.35 The requirements regarding disclosure to the public shall be included within the framework of Pillar 3 of the Reporting to the Public Directives. 3. Additional implementation guidelines Collecting internal loss data by a banking corporation in bucket 1 3.1 In accordance with the provisions of Section 2.11 above, a banking corporation in bucket 1 is not required to use loss data in its capital calculations for operational risk. However, a banking corporation in bucket 1 with a Business indicator that is less than NIS 5 billion but equal to or exceeding NIS 3.5 billion (70 percent of the Bucket 2 threshold) is required to collect internal loss data, in accordance with the requirements in Sections 2.14 to 2.34 above, in order to be prepared ahead of a switch to those rules applying to the banking corporation in bucket 2 and for risk management needs. A banking corporation with a Business indicator smaller than NIS 3.5 billion is not required to collect internal loss data in accordance with the specific requirements of this Directive, unless the Supervisor determined otherwise in its regard, for reasons that will be documented. Frequency of calculating the risk weighted assets in respect of operational risk 3.2 Risk assets calculation will be carried out based on calendar year data. However, the calculation should be carried out once a quarter, based on the most updated year over year data. The Supervisor of Banks may establish a different frequency for a specific banking corporation under exceptional circumstances (such as a significant loss in a specific quarter).

Supervisor of Banks: Proper Conduct of Banking Business [4] (06/24) Capital Adequacy and Measurement—Operational Risk Page 206- 19 ONLY THE HEBREW VERSION IS BINDING Updates Circular 06 no. Version Details Date 2268 1 Original directive June 20, 2010 2328 2 Update February 14, 2012 2341 3 Update July 9, 2012 2785 4 Update June 19, 2024