Amendments to Proper Conduct of Banking Business Directive No. 355 on Business Continuity Management

Bank of Israel Banking Supervision Department Policy and Regulation Division Jerusalem, 13 Nissan April 9, 2017 Circular no. C-06-2532 Attn: The banking corporations and the credit card companies Re: Business continuity management Introduction

1. The amendments to the Directive are designed to improve the accuracy of aspects related to cases of major operational disruptions, including strikes and potential major operational disruptions to the entire banking system, as well as the importance of maintaining the proper functioning of the payment and settlement systems; continued provision of banking services to the public; and maintaining a banking corporation’s reputation and profitability, and protecting a banking corporation’s deposit holders and the holders of a banking corporation’s securities.
2. The revised directive also includes several editorial and formulation corrections, and the text was also adjusted to the changes in the Proper Conduct of Banking Business Directives that are related to e-banking and to guidelines for the national entities.
3. The main corrections are: 3.1. Clarification of the significance of business continuity management in order to reduce the potential damage that major operational disruptions might cause, with an emphasis on the proper functioning of payment and settlement systems, provision of banking services to the public, reputation, profitability, depositors and the holders of a banking corporation’s securities. 3.2. Revised definition of a “critical operation or service.” 3.3. Inclusion of strikes as a potential cause of a “significant operational disruption.” 3.4. Revision of the requirements imposed on critical sites: 3.4.1.The requirement to maintain no less than a Tier 3 level upon establishing a new critical sites; 3.4.2.The site’s management during earthquakes and events of war.

3.5. The Directive was divided into two parts: A. General —Major Operational Disruptions; and B. Levels of Critical Service Objectives. 3.6. Clarification of the requirements concerning the payment and settlement services during operational disruptions and during an emergency. 3.7. Revision of the policy on opening new branches in an emergency. 3.8. Appendix B — Possible Dispensations for the Population in an Emergency” was adjusted to the new Directives on E-Banking. 3.9. General — editorial corrections and other improvements designed to ensure logical coherence and order. 4. After consulting with the Advisory Committee on Matters Related to Banking Businesses and with the approval of the Governor, I have decided to amend Proper Conduct of Banking Business Directive No. 355 on Business Continuity Management (hereinafter, “the Directive”). Main amendments to the Directive: 5. Section 1 – Introduction Emphasis was added on improving the corporation’s resilience in the event of a major operational disruption. Reference to the effects of disruptions and the potential damage that disruptions of this type may cause was revised. Specific reference was added to the protection of the proper functioning of payment and settlement systems and provision of banking services to the public. Furthermore, the term “shareholders” was changed to” holders of the banking corporation’s securities.” Explanatory note: Emphases and terms were revised to conventional terms used in the field of bank crisis management. 6. Section 3 - Definitions 6.1. The definition of a “critical operation or service” was amended to “Any activity, function, process, or service, that are crucial to maintaining the banking corporation’s stability and the public’s confidence, to protecting its customers and depositors, and to the continuous operation of payment systems to the extent that depends on the banking corporation. Determining whether a certain operation or service is “critical” depends on the nature of the relevant banking corporation. In particular, processes that are required for continual operation of critical sites and payment and settlement systems will be considered as critical operations or services.” Explanatory note: The definition was revised to stress the connection between a banking corporation’s ability to continue management of a critical operation or service in order to protect the bank corporation’s stability and public trust, its customers and deposit holders, and to maintain the continuous functioning of the payment systems, to the extent that this depends on the banking corporation. 6.2. Editorial corrections were made to the definition of “major operational disruption” and “strike” was added as an example of an event that might cause a major operational disruption. Explanatory note:

The events that might cause a major operational disruption are diverse and are not always foreseen. The definition was amended to remove any doubt that that the resilience of a banking corporation is required in any event, including a strike, that might have a serious impact on its ordinary business operations, and that adversely affects a large region or population that is economically integrated in this region. 6.3. Reference to intra-corporate incidents was added to the definition of a “reference scenario.” Explanatory note: The range of events that might cause a major operational disruption to a banking corporation and for which a banking corporation is required to prepare may also include intra-organizational events. A banking corporation must prepare for such possibilities in advance. 7. Part A—Business Continuity Management (edited) 7.1. Section 5 – Additional reference was made that the business continuity management framework shall refer mainly to the possibility of a major operational disruption at the banking corporation, but is to take into account the possibility of such a disruption in the overall banking system. The edited section clarifies the new division of the Directive into Part A on the broad meaning of business continuity management and Part B, which includes specific reference to critical service level objectives. 7.2. The formulation of Section 5(a) on reference scenarios was improved. “Business Impact Analysis—a dynamic process for identifying critical operations and services, including those that are mutually dependent, key internal and external dependencies and appropriate resilience levels. The analysis is to examine the risks and the potential impact of various disruption scenarios on a banking corporation’s operations and reputation.” Explanatory note: The Directive was divided into two parts: A. business continuity management with respect to potential major operational disruptions; and B. Critical service level objectives. Furthermore, the business continuity management framework should also consider potential systemic operational disruptions. When analyzing business effects, the banking corporation should examine a range of scenarios. 7.3. Section 6 – the correction is mainly editorial. The text was moved from Section 5, and was limited to reference scenarios. 7.4. Section 6(c)(1) Human resources — includes new emphasis on developing a backup plan for personnel who are essential to the operation of critical operations and services, including in the event of a strike. 7.5. Section 6(c)2 Communications and media relations — includes new clarification that the work procedures refer to the communication interfaces relevant to the banking corporation in the event of a major operational disruption, including an emergency. 7.6. Section 6(c)5 Payment and settlement systems — The formulation was changed from “alternate arrangements for ATM systems and for payment and settlement systems in the event of operational disruption” to “alternate arrangements for continued operation in the event of operational disruptions, from the following perspectives: (a) Cash withdrawal (including from ATMs), (b) providing service to make payments through the various e-banking

channels and through branches, (c) operation of the Zahav (RTGS) and Paper￾based (Checks) Clearing House systems, with an emphasis on activity vis-à-vis CLS.” 7.7. Section 6(c)6 — Specific reference to emergencies was removed, and the amended sub-section refers to preparation in general. 7.8. Section 6(c)7 Manual work alternatives — The new formulation now clarifies that manual work alternatives are also required for critical operations and services, and not only for critical operations. 7.9. Section 6(d) — Clarification was added that assimilation of the business continuity plan will also help “to test the bank’s ability to operate critical operations and services in the event of a shortage of key personnel.” Explanatory note: These are editorial corrections and revisions concerning preparing for major operational disruptions involving critical operations and services, in an emergency, during a strike, and in any scenario related to major operational disruptions. Specific reference was added to aspects related to cash and liquidity needs, the payment and settlement systems, communications and media interfaces, and human resources. Examples were added in the case of payment and settlement systems, and significant actions to ensure systemic stability were specified. 7.10. Section 7 (Insurance) — the words “at least” were added in reference to the frequency at which the banking corporation is required to examine the adequacy of its insurance coverage with regard to its most recent risk profile. Explanatory note: Text was corrected and clarified. 7.11. Section 10 (Protection of critical sites) - Sub-sections (b)(1) and (b)(2) were reformulated to state that at least the main or an alternate site must be protected against conventional warfare and be earthquake resilient. The text was amended to state that where a critical site is not earthquake resilient, the banking corporation shall maintain an operative plan for making critical services available at the alternate site, in accordance with the service objectives set out in Section 12. Explanatory note: The new text harmonizes the preparations required for conventional warfare and earthquake events. 7.12. Section 10 (Protection of critical sites) - Sub-section (b)(4). The new addition clarifies that the tier level for computer sites will not be less than 3 when setting up a new critical site. Explanatory note: The text was adapted to conventional standards in the event of national and other reference scenarios. 7.13. Section 10a. The text “A banking corporation shall consistently act to protect its branches in accordance with Home Front Command guidelines” was transferred from Part B, which refers to the level of critical services in an emergency, to Part A of the Directive in the context of site protection. Explanatory note:

Editorial correction. 8. Part B — Levels of critical service objectives (newly edited and adjusted text). Explanatory note: This section was adjusted to references to critical service level objectives, and includes changes to the text that reflect these adjustments. In general, the banking system shall aim to maintain business continuity to the greatest extent possible. However, during emergencies or a situation of major operational disruptions, it is conceivable that major operational disruptions (system-wide or bank-specific) may adversely impact the ability to provide full service. Therefore, a banking corporation shall prepare for the continuation of its business activities in a manner that ensures that it meets at least the service level objectives set forth in this section. 8.1. The general paragraph of Section 12 was revised — A banking corporation shall prepare for the continuation of its business activities and continued attainment of the service level objectives, as far as this is in its control. 8.2. Section 12(a)(1) — A requirement was added that a banking corporation should make an effort, within several hours of the beginning of a disruption, to ensure uninterrupted operation of the payment system, including interfaces with the Zahav system, as far as this is in the corporation’ control. The text was amended to “will make an effort to ensure uninterrupted operation of its payment systems, including its interfaces with the Zahav (RTGS) system” and the term “will ensure” was replaced by “will make an effort” with reference to ensuring uninterrupted operation of cash withdrawals from ATMs. 8.3. Section 12(a)(3) — improved formulation. 8.4. Section 12(a)(4) — Moved to Section 13 on branches. Explanatory note: As a rule, the banking system should aspire to maintain full business continuity as far as possible, yet since major operational disruptions may occur in an emergency or in other circumstances, the Directive specifies a baseline for the service level objectives that the banking corporation should take steps to attain. The Directive was revised and necessary formulation corrections were made, with emphasis on the significance of the continuous functioning of critical systems such as the Zahav system; Taking into consideration that the continued operation of such systems also depends on other entities that are not under the control of the banking corporation, the banking corporation is therefore required to “make an effort to ensure” the operations. 8.5. Section 13 (Opening of branches in an emergency) - In addition to editorial corrections that involve relocation of paragraphs. Sub-section (b) became sub￾section (a), and the text was changed such that the branch opening policy will be to strive to open all branches, rather than to open all branches, under the guidance of the Supervision of Banks and subject to the instructions of the defense forces including the Home Front Command. 8.6. Furthermore, the level of services in branches was clarified such that operating a branch means that the banking corporation will, at least, provide services via the branch’s self-service machines or by opening the branch to the public. A banking corporation shall continue to provide banking services through alternative means, to the extent possible under the circumstances, even if some branches do not open due to the emergency situation. Banking services

provided in branches that operate during an emergency shall include, at least, providing customers with information on the state of their accounts and execution of basic banking services, such as cash withdrawals and deposits, cashing and depositing checks, and interbank and intrabank transfers. Explanatory note: The service level objectives should be adjusted to the actual scenario. The policy was consequently revised to take into consideration the risk to life (employees and the public) during an emergency that is a state of war. Section 18- removed. Explanatory note: Improved formulation. Concurrently with the amendment to this Directive, adjustments were also made to the Reporting to Banking Supervision Directive 888 (Branches) and 889 (Reporting in Special Situations). 9. Appendix B Possible Dispensations for the Population in a State of Emergency: 9.1. The text was adjusted such that the possible dispensations with regard to directives related to e-banking and telephone instructions were adapted to the current versions of Proper Conduct of Banking Business Directives on these issues. The text clarifies that these dispensations are for the period declared by the Supervisor to be a State of Emergency, and when that period ends, the banking corporation will complete the procedures for those customers who signed up for e-banking services during that period. Effective date 10. The amendments to the directives according to this Circular come into effect on the date of its publication. Revised file 11. Following are the update page for the Proper Conduct of Banking Business Directive file. Following are the revision instructions: Remove page: ( 5/14) [2] 355-1-18 Insert page: ( 4/17) [3] 355-1-17

Sincerely, Dr. Hedva Bar Supervisor of Banks