Amendments to Proper Conduct of Banking Business Directive no. 367 Regarding E-Banking

Bank of Israel Banking Supervision Department Technology and Innovation Division IT Regulation and Examination Unit Jerusalem, December 25, 2017 Circular no. C-06-2547 Attn: Banking corporations and credit-card companies Re: E-Banking (Proper Conduct of Banking Business Directive no. 367) Introduction The Enhancement of Competition and Reduction of Concentration in the Israeli Banking Sector Law

1. The Enhancement of Competition and Reduction of Concentration in the Israeli Banking Sector Law (Legislative Amendments), 5777-2017 (hereinafter: “the Law”) was published on January 31, 2017.
2. Within the framework of the Law, Section 7E of the Banking (Service to the Customer) Law, 5741-1981 (hereinafter: “the Banking (Service to the Customer) Law”), inter alia, was established, requiring banking corporations to transfer information about customers’ current-account balances to other financial entities as specified in this Law. Section 7E(b) of the said Law authorizes the Supervisor of Banks to issue a Proper Conduct of Banking Business Directive concerning the times at which said information may be transferred, the method by which it shall be transferred, and the way a customer’s request in this matter shall be received.
3. To establish the requisite provisions in accordance with said authorization, it is necessary to amend this Directive. Sending a temporary One Time Password via voice message
4. Many banking corporations use a One Time Password (OTP) as an authentication factor with which to verify a customer’s identity for a range of E-Banking transactions.
5. It has recently come to our knowledge that some customers of banking corporations use mobile devices that cannot receive SMS messages (hereinafter: “kosher devices”), meaning that they cannot receive a textual OTP to their mobile phones for authentication purposes; this makes it difficult for them to enjoy the advantages of E-banking services by which they would no longer need to visit the branch. The visually impaired face a similar hardship.
6. To surmount this difficulty and enable all customers of the banking system to use the OTP authentication method in order to access E-banking services, and in view of technology that allows text messages to be converted into voice, we clarified the matter in the Directive. In accordance with the clarification, a

banking corporation that sends OTPs to the customer by SMS must make sure that customers who cannot receive or read SMS messages will have an appropriate alternative in the form of a voice message. 7. In view of the foregoing and after consulting with the Advisory Committee on Banking Business with the approval of the Governor, I hereby amend said Directive as specified below. Amendments to the Directive 8. The definition of a “voice message” is added (Section 8 of the Directive). Explanatory remarks A voice message is an SMS message that the customer’s mobile device receives in voice form. 9. In the example of “an item in the user’s possession,” the expression “— including a voice message—” is added after the words “Short Messages Service (SMS)” (Section 8 of the Directive—definition of “authentication factor”). Explanatory remarks A temporary One Time Password (OTP) sent to a customer’s mobile device by voice message shall also be considered an authentication factor in the sense of “an item in the user’s possession.” 10. The expression “including a voice message” is added (Section 29(b)(1) of the Directive). Explanatory remarks A temporary One Time Password may be sent by voice message even if the customer is not a party to an E-banking agreement that covers this channel. 11. A banking corporation that uses a temporary one-time password sent via Short Message Service as an authentication factor shall provide a solution to those customers who are unable to receive such a message, or who are unable to read it, by sending a voice message (Section 67(b) of the Directive). Explanatory remarks To allow users of kosher devices and persons with visual impairment to use a temporary One Time Password for authentication purposes, banking corporations that offer such a possibility by SMS must make sure that said customers receive an appropriate response by sending the temporary OTP via voice message. In accordance with the requirements of Section 69 of the Directive, banking corporations shall also instruct customers on how to use a temporary OTP by voice message and shall advise them of the risks inhering to this service, particularly concerning the temporary OTP being a sole authentication factor for the receipt of service. 12. Chapter H.1, “Transferring Information Regarding the Balance in a Current Account,” is added. Explanatory remarks The chapter was added in order to implement Section 7e of the Banking (Service to the Customer) Law as worded in Section 3(3) of the Law.

According to said section of the Law, a banking corporation must respond to a customer’s request to share information with another financial entity about the balance in the customer’s current account in order to be provided credit. The provisions of said chapter specify the timing and method of said information transfer and the manner in which a customer’s request to the banking corporation is received and handled, so that it is carried out as efficiently and securely as possible. In the future, when the secured technological mechanism through which financial information shall be transferred, as referenced in Section 70b(b) of the Control of Financial Services (Regulated Financial Services) Law, 5776-2016, is set up, the need to adjust the provisions of this chapter shall be considered. 13. The customer’s request shall be submitted to the banking corporation via E￾Banking services that are agreed upon by the banking corporation and the customer for the purpose of executing transactions, or through the customer’s request at the branch of the banking corporation (Section 73a(1) of the Directive). Explanatory remarks Insofar as the banking corporation’s customer subscribes to E-Banking services that allow the customer to perform transactions, the banking corporation shall enable the customer to present a request for the transfer of information about the balance of the customer current account by means of the same services. 14. In said request by the customer, the details of the financial entity to which the customer wants to transfer the information shall be noted (Section 73a(2) of the Directive). Explanatory remarks Said details shall include the full name and a one-to-one identifier (e.g., private corporation number, VAT transactor number, or license number) of the financial entity. 15. Banking corporations shall enable the customer to choose the frequency at which the information is transferred, from among the following four options: daily, every 3 days, weekly, or monthly (Section 73a(3) of the Directive). Explanatory remarks To make the process easier to carry out, create uniformity, and give customers a range of options, banking corporations shall allow customers to choose one of only four frequencies of information transfer: daily, once every three days, weekly, or monthly. 16. The banking corporation shall send a notice, through one or more E-Banking channels, and if that is not possible, via mail, to all customers who did not submit such a request on their own to the banking corporation. Said notice shall include all the relevant details required for the customer, including the name of the financial entity to which the customer requested to transfer the information, the frequency at which the information is to be transferred, the period of the authorization, and the ways available to the customer for approving the request for the banking corporation. In a corporate account, the banking corporation shall act in accordance with the corporation’s decision as it is presented to the banking corporation (Section 73a(4) of the Directive). A banking corporation may send a notice of the kind referenced in Section 73a(4)

even if the customer is not a party to an E-Banking agreement that covers the E-Banking channel in question (Section 29(b)(3) of the Directive). Explanatory remarks Said notice shall be sent to each partner to the account who has not directly presented the banking corporation with a request, including a "Singly and collectively" account. The banking corporation may use the various E-Banking channels to send said notice even if the customer is not a party to an E-Banking Agreement for said channels (Section 29(b)(3) of the Directive). 17. A request to transfer information regarding the balance, as requested by the customer, shall be executed no later than three business days from the date of receiving the authorization of all the account holders, provided the financial entity previously arranged the interface with the banking corporation (Section 73a(5) of the Directive). Explanatory remarks A banking corporation shall transfer balance-of-account information no later than three business days after it has received the customer’s request or, if the request was presented in the customer’s name, after the customer confirms. If the financial entity at issue still has no interface with the banking corporation for the transfer of said information, the count of business days for this purpose shall apply immediately after said interface is set up. 18. A banking corporation shall notify all the account holders in writing of the carrying out of the request and of any changes in it (Section 73a(5) of the Directive). Explanatory remarks A notice from the banking corporation to the customer about the implementation of the customer’s request, and any change therein including cancellation, may be sent by electronic mail, SMS, or any other E-Banking channel, provided this be done in writing so that it may be documented. Said notice shall not be sent by means of a telephone call. Effect 19. The amendments to the Directive shall go into effect as follows: 19.1 Chapter H.1, Section 29(b)(3)—when Section 7E of the Banking (Service to the Customer) Law, as worded in Section 3(3) of the Law, goes into effect. However, during the period from the onset of effect of the amendment to April 1, 2019, the following alternative arrangement shall apply concurrently:  Instead of Section 73a(4), the following shall appear: “In the case of a joint account, the customer’s request shall be presented to the banking corporation with the consent of all parties in the account, in ways that the banking corporation shall make available to the customer. In a corporate account, the banking corporation shall act in accordance with the corporation’s decision on the matter as shall be presented to the banking corporation.”  Instead of the beginning of Section 73a(5), the following shall appear:

“A customer’s request to transfer balance-of-account information shall be carried out no later than three business days from the date on which the account holder’s request is received….” 19.2 Sections 8 and 29(b)(1), concerning voice message, and Section 67(b)— on April 1, 2018. However, a banking corporation may act in accordance with these sections at an earlier time. Revised file 20. Update pages for the Proper Conduct of Banking Business Directive file are attached. Following are the provisions of the update: Remove page Insert page (3/17) [2] 367-1-17 (12/17) [3] 367-1-19 Respectfully, Dr. Hedva Ber Supervisor of Banks