Amendments to Proper Conduct of Banking Business Directive No. 366 on Reporting of Technology Failure Incidents, Information Security Incidents, and Cyber Attacks

Bank of Israel Page 1 Of 5 BANK OF ISRAEL Banking Supervision Department Technology, Innovation, and Cyber Division Banking Technology Unit Jerusalem June 17, 2026 Circular No. C-06-2848 To: The Banking Corporations and Payment Service Providers with Prudential Importance License Holders Re: Reporting of Technology Failure Incidents, Information Security Incidents, and Cyber Attacks (Proper Conduct of Banking Business Directive No. 366) Introduction

1. On 18 November 2024, the Banking Supervision Department issued Proper Conduct of Banking Business Directive No. 364, “Management of IT, Information Security, and Cyber Defense Risks” (hereinafter: “Directive 364”). In accordance with Circular 06 No. 2799 (hereinafter: “the Circular”) accompanying the publication of the Directive, Directive 364 entered into force on May 18, 2026.
2. Section 8 of the Circular stated that: “…in order to create consistency in the use of the terminology established in this Directive1 throughout the existing regulatory framework relating to information technology, the Banking Supervision Department intends to publish amendments to the relevant directives, including Proper Conduct of Banking Business Directive No. 366, ‘Reporting of Technology Failure and Cyber Incidents’…” The current update incorporates, among other things, the required adjustments referred to above.
3. In addition, the Directive has been updated based on lessons learned and insights gained by the Banking Supervision Department from its review of work processes implemented by various banking corporations in preparation for technology failure and information security incidents, as well as from practical experience with the implementation of the Directive during actual occurrences of such events.
4. This regulatory amendment was not accompanied by a report under the Regulatory Principles Law, 5782-2021 (hereinafter in this section: “the Law”),

1 Proper Conduct of Banking Business Directive no. 364 on “Management of IT, Information Security, and Cyber Defense Risks”.

Bank of Israel Page 2 Of 5 pursuant to Section 34(c)(2) of the Law, as the direct and indirect impacts expected to result from the regulation on the entities to which it applies, including compliance costs, are not considered material. The regulation will be subject to an ex post review under Section 36 of the Law, ten years after its effective date. 5. Following consultation with the Advisory Committee on Banking Business Affairs and with the approval of the Governor, I have decided to update Proper Conduct of Banking Business Directive No. 366, “Reporting of Technology Failure and Cyber Incidents.” Amendments to the Directive 6. Introduction Section 1 Adjustments were made to clarify the relationship between this Directive and Directive 364. 7. Applicability Section 3 The application section has been amended so that entities defined in Sections 11(a)(3a), 11(a)(3b), and 11(b)(2) of the Banking (Licensing) Law, 5741-1981 (hereinafter: “the Banking (Licensing) Law”) are no longer generally subject to the reporting requirements of this Directive. Accordingly, these entities are now required to report to the Banking Supervision Department only in the event of technology failure incidents or information security incidents, including cyberattacks (hereinafter: “an Incident”), as required under Section 6.5 of the Directive. That is, given the relatively limited impact of such entities on the banking system, only incidents that would otherwise be reportable under Sections 6.1- 6.4 of the Directive and that have a material impact, including technological, reputational, or financial implications for the controlling banking corporation, the banking group, or the banking system, must be reported to the Banking Supervision Department. Incidents whose impact is limited solely to the entity itself are not required to be reported. In addition, the section has been updated to align with the current wording of the Banking (Licensing) Law. The term “acquirer”, as previously defined in Section 36i of the Law, has been replaced by “Payment Service Provider with Prudential Importance License Holder”, as defined in Section 36i of the Law. For the avoidance of doubt, Section 6.5 of the Directive also applies to subsidiaries of a Payment Service Provider with Prudential Importance License Holder.

Bank of Israel Page 3 Of 5 8. Definitions Section 5 The definition of “Significant Technology Failure Incident” has been expanded to emphasize that disruption to a business activity, process, or function includes disruptions that have a severe and widespread internal impact on the banking corporation, even where customers or the banking system are not directly affected. Examples include:  An outage in production systems operating in an active-active configuration, where the backup systems were activated and service continuity was maintained.  A severe malfunction that was detected and remediated before any actual impact materialized reflecting technological risk potential, as distinct from information security or cyber incident potential. Furthermore, to ensure regulatory consistency with Directive 364, which serves as the foundational framework for supervisory directives concerning information technology:  The definition of “Technology Failure Incident” has been moved to Directive 364, and this Directive now references that definition.  The terms “Information Security Incident,” “Data Leakage,” “Information Technology Array, Information Technology (IT)” “Cyber attack,” “Damage,” and “Third Party” are now defined by reference to their respective definitions in Directive 364. 9. Types of Incidents that Require Reporting Sections 6 and 6A The categories of incidents requiring reporting to the Banking Supervision Department have been clarified and expanded:  Section 6.2 previously required reporting of incidents handled at the level of the Chief Cyber Defense and Information Security Officer (CISO). The requirement has now been clarified to specify that reporting applies to incident described in Section 6.2 that is managed by, or involves the participation of, the banking corporation’s Chief Cyber Defense and Information Security Officer or another management function acting on his behalf.  The reporting obligation, as well as the Directive’s other provisions, will also apply where there is a concern regarding the occurrence of an information security incident with systemic implications, following a request by the Banking Supervision Department. 10. Responsibility for Reporting Section 8 Adjustments have been made to ensure consistency with the terminology established in Directive 364, as described in Section 2 above.

Bank of Israel Page 4 Of 5 Section 9 The section has been updated to reflect the change in the name of the division within the Banking Supervision Department responsible for information technology matters. 11. Manner of reporting Sections 10 and 12 Adjustments have been made to reflect changes in:  The name of the division within the Banking Supervision Department responsible for information technology matters; and  The name of the unit within that division responsible for regulation and supervision of information technology in banking corporations. Section 11 Adjustments have been made to ensure consistent use of the terminology established in Directive 364, as described in Section 2 above. 12. Investigation of the incident and Reporting Section 14 To maintain the quality of incident investigations and to ensure that lessons learned and actionable insights can be derived to improve preparedness and potentially prevent similar incidents in the future, a new requirement has been added stipulating that investigations must be conducted by, or at least with the involvement of, a party that was independent of the incident. Section 15 A clarification has been added stating that any incident requiring reporting to the Banking Supervision Department under Section 6 of the Directive must also be subject to an incident investigation in accordance with this section. 13. Documentation of Incidents Not Reported Section 17 Incidents for which a banking corporation assessed the need for reporting under this Directive and concluded that reporting was not required must be documented. Such documentation must include:  The person or function responsible for the decision; and  The rationale supporting the decision. This documentation will serve as evidence for supervisory reviews or examinations relating to the banking corporation’s exercise of judgment regarding reporting obligations under this Directive.

Bank of Israel Page 5 Of 5 Effective Date The amendments to the Directive shall take effect on the date of publication of this Circular. Update to the Proper Conduct of Banking Business File Attached are the update pages for the Proper Conduct of Banking Business compilation, as follows: Remove pages Insert pages (01/23) [4] 366-1-4 (06/26) [5] 366-1-5 Sincerely, Daniel Hahiashvili Supervisor of Banks Bank of Israel