Amendment to Proper Conduct of Banking Business Directive 308

Bank of Israel Banking Supervision Department Policy and Regulation Division 1 June 3, 2015 Circular Number C-06-2459 To: The banking corporations and the credit card companies Issue: Compliance and the Compliance Function at a Banking Corporation (Proper Conduct of Banking Business Directive 308) Introduction

1. Proper Conduct of Banking Business Directive 308 regarding “Compliance Officer” was published on January 17, 2002, and has not been revised or adjusted since then (hereinafter, “the Existing Directive”). In recent years, there have been developments in the field of risk management in general, and compliance risk management in particular, such as the Basel Framework. In view of the foregoing, and following consultations with the Advisory Committee on Banking Business, and with the approval of the Governor, I have amended Proper Conduct of Banking Business Directive number 308, the name of which shall be changed to “Compliance and the Compliance Function in a Banking Corporation” (hereinafter, “the New Directive”). This Circular surveys the structure of the new directive and the main changes compared to the existing directive.
2. Explanation The main changes are based on the following sources: 2.1 The Basel Committee Guidelines—The Basel Committee document from April 2005, regarding “Compliance and the Compliance Function in Banks” (hereinafter, the Basel Document”) and a survey conducted by the Basel Committee in August 2008 regarding “Implementation of the compliance principles”; 2.2 Authorities abroad—Relevant international sources from regulators abroad were examined and adjusted to the existing situation in Israel; 2.3 Local regulation—The existing directive formed the basis and starting point for the new directive. The new directive was also brought in line with Proper

Bank of Israel Banking Supervision Department Policy and Regulation Division 2 Conduct of Banking Business directives in the area of risk management and corporate governance. 3. Definitions (Section 9) The following definitions were added to the section on Definitions: 3.1 A banking corporation, as defined in the Banking (Licensing) Law, 5741– 1981, including a banking corporation that is a joint services company, an auxiliary corporation that is a credit card company, and a Clearer as defined in Section 36i of the Banking (Licensing) Law, 5741–1981. This change was made for purposes of uniformity with other risk management directives. 3.2 The definitions for compliance risk, compliance function, chief compliance officer, and the compliance function’s employees, were adjusted to the definitions in the Basel Document. It was also set out that the compliance function employees are employees carrying out compliance tasks, subject to the Chief Compliance Officer, and are part of the second line of defense. In addition, the definition of the compliance directives has been expanded beyond consumer directives and in accordance with the Basel Document, which sets out that the “compliance risk” is derived from laws, regulations, regulatory directives, internal procedures, and the code of ethics that apply to the banking corporation’s activities. In addition, the positions of the Banking Supervision Department, which were set out as part of the handling of public enquiries, whether published or issued to that banking corporation, were also included.

4. The duties of the Board of Directors (Section 10) The New Directive emphasizes and brings into sharp relief the Board of Directors’ responsibility to supervise the banking corporation’s compliance risk management. The Board of Directors must take the measures necessary to fulfill its function: approve compliance policy and set out ways of implementing it; supervise the implementation of the policy; evaluate the effectiveness of compliance risk management, and set reporting channels regarding compliance.
5. The duties of senior management (Section 11) The New Directive sets out the responsibility of senior management to effectively manage compliance risk. Senior management must take the measures required to

Bank of Israel Banking Supervision Department Policy and Regulation Division 3 fulfill its role as required in the New Directive, including: formulating a written compliance policy; supervising the work of the compliance function; identifying and evaluating the main compliance risk issues in the banking corporation; maintaining reporting channels vis-à-vis the Board of Directors and taking disciplinary or corrective action in relation to contraventions of compliance policy that have been identified. 6. Compliance policy (Sections 12-14) In the New Directive, the “compliance program” term that appears in the Existing Directive has been replaced with “compliance policy”. The policy relates generally to the manner in which the banking corporation will prepare for the implementation of the New Directive, including the main processes through which compliance risks will be identified and managed, in the banking corporation’s material activities and processes. The compliance policy will be set on a group basis. 7. Features of the function (Chapter C, Sections 16–21) This chapter contains a list of the features required so that the compliance function can fulfill its duties in efficiently and effectively, including: The compliance function must be fixed; the compliance function shall be independent in the operations it examines; the status of the compliance function shall be anchored in a charter; the compliance function shall be located in an organizational states that does not or may not create a potential conflict of interests with its responsibility for the issue of compliance; remuneration for employees in the function shall be consistent with the function’s goals such that it should not create incentives for employees to act contrary to the goals and features of the function; the allocation of proper resources and manpower to the function, alongside the professional qualification of the employees in the function and of its head, such that the compliance function as a whole shall have a broad and comprehensive understanding of compliance issues. 8. Duties of the function (Chapter D, Sections 22–23) This chapter details the areas where the function must operate in order to assist senior management in managing compliance risk in the banking corporation. The new directive sets out that the compliance function shall have responsibility for at least management of the compliance risk that is derived from the Core Directives, as stated in Section 22(b) of the New Directive (such as: a bank’s fairness vis-à￾vis its customers, prohibition on money laundering and financing of terrorism;

Bank of Israel Banking Supervision Department Policy and Regulation Division 4 advising a customer; conflicts of interest; privacy protection; tax issues that are relevant to products or services to customers or similar directives). The risk derived from the other directives that apply to the banking corporation may be managed by other functions in the second line of defense. The division of duties and responsibilities between the functions shall be defined in the compliance policy. 9. The compliance function’s work plan (Sections 24-27) In the New Directive, the term “the compliance function’s work plan” provides a more detailed description of compliance risk management in the banking corporation. The program will be based, among other things, on the results of a compliance risk survey that may be carried out as part of the operational risk survey in Section 27 of Proper Conduct of Banking Business Directive 350 regarding “Operational Risk Management”. 10. Scope of activity (Chapter E, Sections 28–30) The scope of the compliance function’s work will be spread over all of the banking corporation’s activity and entities, including subsidiary corporations or branches in a certain jurisdiction. In order to fulfill its role, the compliance function shall have full access to the existing information in the banking corporation. 11. Chief Compliance Officer The compliance function is headed by a Chief Compliance Officer. The Chief Compliance Officer has an important role in ensuring the proper functioning of the compliance function and keeping it updated and professionally trained. In order to maintain the independence and strengthen the status of the Chief Compliance Officer, the Chief Compliance Officer shall not fulfill another role in the banking corporation, in order not to negatively impact his main job. 12. Effective Date This Circular shall become effective no later than January 1, 2016.

File update

Bank of Israel Banking Supervision Department Policy and Regulation Division 5 13. The updated pages of the Proper Conduct of Banking Business file are attached. The following are the update instructions: Remove page: Insert page: 300-2-4 [36] (12/12) 300-2-5 [37] (6/15) 308-1-7 [1] (1/02) 308-1-14 [2] (6/15) Sincerely, David Zaken Supervisor of Banks