Regulatory Alerts2026-06-17
Added
Amendments to Proper Conduct of Banking Business Directive No. 366 on Reporting of Technology Failure Incidents, Information Security Incidents, and Cyber Attacks
The Bank of Israel updates Proper Conduct of Banking Business Directive No. 366 to align terminology with Directive 364 and modify reporting obligations for Payment Service Providers with Prudential Importance License Holders, who are now required to report only incidents with material impact on the banking system rather than all incidents. The definition of Significant Technology Failure Incident is expanded to include severe internal disruptions, while the definition of Technology Failure Incident is moved to Directive 364. A new requirement mandates that incident investigations be conducted by or involve an independent party, and entities must document the rationale for any decision not to report an incident.