Amendments to Proper Conduct of Banking Business Directive No. 367 (E-banking Services)

Banking Supervision Department Technology, Innovation, and Cyber Division Banking Technology Unit June 17, 2026 Circular-C-06-2847 Attn: The banking corporations and payment services providers with prudential importance license holders Re: E-banking (Proper Conduct of Banking Business Directive No. 367) Introduction On November 18, 2024, the Banking Supervision Department published Proper Conduct of Banking Business Directive No. 364, titled “Management of Information Technology Risks, Information Security and Cyber Protection” (hereinafter: “Directive 364”). Pursuant to Circular 06 No. 2799, which accompanied the publication of the Directive, Directive 364 entered into force on May 18, 2026 and repealed, inter alia, Proper Conduct of Banking Business Directive No. 357, titled “Information Technology Management” (hereinafter: “Directive 357”), and Proper Conduct of Banking Business Directive No. 361, titled “Cyber Defense Management” (hereinafter: “Directive 361”). This circular includes the amendments required to Directive 367 following the entry into force of Directive 364. 2. The regulation was not accompanied by the publication of a Regulatory Impact Assessment (RIA) under the Principles of Regulation Law, 5782-2021 (hereinafter in this section: the “Law”), in accordance with Section 34(c)(2) of the Law, as the direct and indirect impacts expected to result from the regulation on the entities to which it applies, including compliance costs, are not material. The regulation will be subject to an ex post review pursuant to Section 36 of the Law, 10 years after its effective date. 3. Following consultation with the Advisory Committee on Banking Business Affairs and with the approval of the Governor, I have decided to amend Proper Conduct of Banking Business Directive No. 367, titled “E-banking Services.” Amendments to the Directive 4. Introduction Section 3 References to Directive 357 and Directive 361 have been replaced with a reference to Directive 364. No substantive changes have been made to the requirements set forth in this section.

5. Application Section 7 The section has been updated to align with the current wording of the Banking (Licensing) Law, 5741-1981. Accordingly, the term “acquirer” (as previously defined in Section 36i of the Law) has been replaced with “a payment service provider with prudential importance license holder, as defined in Section 36i of the Law, and its controlled entities.”
6. Board of Directors Section 9 References to Directive 357 and Directive 361 have been replaced with a reference to Directive 364. No substantive changes have been made to the requirements set forth in this section.
7. Online Account Designation and Monitoring Section 27 Since the provisions imposing restrictions on online accounts, including restrictions applicable to accounts opened remotely through a remote customer onboarding process (Sections 24-27 of the Directive), were repealed in previous Banking Supervision circulars relating to this Directive (see references at the end of the Directive), Section 27 no longer serves any regulatory purpose and has therefore been repealed. Accordingly, and in order to accurately reflect the content of the provisions included under the subsection currently entitled “Restrictions on Online Accounts,” the subsection heading has been changed to “Online Account Designation and Monitoring.” Effective Date
8. The amendments to the Directive shall take effect on the date of publication of this Circular. Updating the Proper Conduct of Banking Business File
9. Attached are the update pages for the Proper Conduct of Banking Business file. The update instructions are as follows: Remove Page Insert Page 7/25 [12] 367-1-27 (06/26) [13] 367-1-27