Amendments to Proper Conduct of Banking Business Directive no. 420

Bank of Israel Banking Supervision Department Policy and Regulation Division 1 July 25, 2016 Circular Number C-06-2508 To: The banking corporations and credit card companies Issue: Sending notices via means of communication (Proper Conduct of Banking Business Directive no. 420) Introduction

1. In view of the technological means currently being used by customers, and in view of the tremendous importance that the Banking Supervision Department attributes to streamlining the banking system, the Banking Supervision Department is working to continue improving and streamlining the way in which information is provided to banking corporations’ customers. This amendment makes it possible for the banking corporations to provide most notices, which were previously sent by mail, digitally through means of communication, including the provision of notices and documents pertaining to transaction instructions issued in the branch through these channels.
2. In addition, the amendment enables the banking corporations to offer their customers a warning service, by way of notices via means of communication (such as text messages to a mobile phone (SMS messages)), which will help them manage their accounts in an informed manner, such as warnings about an expected deviation from the credit facility in the account, and more. In this framework, the Directive for the first time requires the banking corporations to send a warning via SMS to the customer’s mobile phone if five checks have been refused payment in his account, or if a restriction has been placed on his account, in addition to the duty to send a notice in another manner in accordance with the law. This is in order to assist the customer in preventing the restriction of his account and to rapidly know about a restriction placed on his account.
3. In view of the foregoing, and following consultation with the Advisory Committee on Banking Business, and with the approval of the Governor, I have amended this Directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division 2 The amendments to the Directive 4. The name of the Directive was amended from “Providing Information through Electronic Means” to “Sending Notices via Means of Communication”. Adjustments were made throughout the Directive to replace the terms “information” and “electronic means” to “notices” and “communication channels”, respectively. 5. The introduction to the Directive was revised in accordance with the changes that were made. The introduction was split into two sections, while the other sections were renumbered accordingly. Explanation: This amendment has a number of main purposes:  To enable the customer to receive information via communication channels, where the information was previously only received at the branch. This includes documents of instructions to carry out transactions, subject to the limitations set out in the Directive and in the law. The previous version of the Directive enabled this only regarding information sent to the customer by mail.  To enable the provision of a warning service to customers, with the aim of assisting them in managing their accounts.  To require a notice to be sent, to all customers, in the case of refusal of five checks and in the case of a restriction placed on the account. 6. Section 4 of the “Definitions”— a. The definition of “electronic means” was deleted, and replaced with the definition of “communication channels” b. The definition of “notices” was revised, with the definition of “notices not mandated by law” added. c. The definition of “service” was added to the Directive. In Section 5, the words “(hereinafter: the service”) were accordingly. d. The definition of “a refused check” was added to the Directive. Explanation:  According to the definition set out for “communication channels”, a banking corporation is permitted to send notices via Internet channels as defined in Section 8(a) of Proper Conduct of Banking Business Directive 367, excluding instant messaging services, which enable written notices to be sent,

Bank of Israel Banking Supervision Department Policy and Regulation Division 3 documented via electronic means and printed by the customer, and text messages.  The definition of “notices” was revised to enable warning services to customers in order to assist in the management of their accounts.  The addition of the definition of “service” is a technical correction intended to convey the definition that originally appeared in Section 5 of the “Definitions” section.  The definition of “a refused check” was added to the Directive with the aim of simplifying Section 8 of the Directive. 7. Section 5 was revised to add the possibility of sending documents heretofore delivered at the branch through means of communication. The provision of the service is conditional on meeting the requirements of the Proper Conduct of Banking Business Directives relating to information security and banking through means of communication, including the signing of a banking by communication agreement between the customer and the banking corporation. Explanation The purpose of the conditions is to ensure, inter alia, that the service is provided to the customer with his consent, that he can halt the service at any time, and that the information security rules are maintained. 8. Section 6 was added to the Directive, and the remaining sections were renumbered accordingly. Explanation The purpose of the section is to set out that, relating to notices containing information provided to the customer at the branch, including documents of instructions for carrying out transactions, the banking corporation is permitted to grant its customers the service, if the document contains disclosure regarding the cost of the service, in accordance with the provisions of Section 4(a) of the Banking (Service to the Customer)(Proper Disclosure and Provision of Documents) Rules, 5752–1992. Furthermore, the section sets out that the banking corporation must clarify to the customer that his request to receive banking notices by means of communication shall apply, at the banking corporation’s discretion, to all notices prepared in his presence in the future, and that he is permitted to request to receive a

Bank of Israel Banking Supervision Department Policy and Regulation Division 4 copy of the notice in addition, such that he is not prevented from receiving a specific notice in hard copy as well, should he wish to do so, without additional cost. 9. Under the title “Sending notices via text message”, Sections 8–10 were added to the Directive. The other sections were renumbered accordingly. Explanation  According to Section 8, the banking corporation is permitted to send notices mandated by law via text message only in cases where sending messages in this manner is provided for in the law.  According to Section 9, the banks are obligated to notify a customer for whom five checks have been refused in his account, or whose account has been restricted, via SMS notification. However, should the customer not be a subscriber to the service, or should he be a subscriber but select not to receive notices by SMS, the text of the warning shall be general only, and shall refer the customer to the bank for clarification. The purpose of the section is to assist customers so that they not reach the situation of a restricted customer, and so that they know quickly of a restriction placed on the account. It also sets out that should the banking corporation not send SMS messages to the customer due to technical limitations (the corporation does not know the customer’s mobile phone number, the customer’s mobile does not support SMS messages, and so forth), the banking corporation shall notify the customer of the special notices set out in this section through another rapid communication channel (such as a landline phone), as much as possible, and according to the internal communication procedures that shall be set out. It is clarified that these special notices are not a service included in the Banking (Service to Customers)(Fees) Rules, 5768–2008, and no fee can therefore be collected from the customer.  According to Section 10, the banking corporation is also permitted to send notices not mandated by law through text messages, for instance, a message regarding an expected deviation from the credit facility in the account, or a message notifying the customer about a message sent to the customer on the bank’s Internet site. It is clarified that notices sent by SMS shall not include full identifying details of the account or the customer, as mandated by Section 67 of Proper Conduct of Banking Business Directive 367.

Bank of Israel Banking Supervision Department Policy and Regulation Division 5 10. Section 11, titled “Telephone instructions” was added to the Directive. The rest of the sections were renumbered accordingly. Explanation The section deals with sending notice to the customer following the execution of a telephone instruction. The section previously appeared in Proper Conduct of Banking Business Directive 435 “Telephone instructions”, and was copied to this Directive. The requirement that the notice be the responsibility of a clerk different than the one who received the telephone instruction has been cancelled. Requests to obtain information shall not be considered an instruction in this regard. 11. Sub-sections (a) and (b) were added to Section 12. The remaining sub-sections were renumbered accordingly. In addition, the title “Control over receiving notices mandated by law” was added to the section. Explanation According to the section, the banking corporation must use online tools that enable it to determine whether the customer has received notices mandated by law through communication channels. The tools used must be consistent with the communication channel selected by the customer. If the notices were sent by electronic mail, the banking corporation must ascertain that the customer has opened the notices. Regarding notices sent via the banking corporation’s Internet set or application, a determination that the customer has opened the Internet page where notices to the customer are located is sufficient. The aim of the section is to implement control over the use of the service. Sub-section (b) sets out that control over the use of the service is not required in relation to notices sent by SMS as detailed in Sections 8 and 9 of the Directive. 12. The section entitled “Cessation of the service” was deleted from the Directive. Explanation This section appears in Proper Conduct of Banking Business Directive 357 “Information Technology Management”, Section 27(d)(1)(b), which will be in effect as of January 1, 2017, and in Section 31 of Proper Conduct of Banking Business Directive 367 “Banking via Means of Communication”, which will come into effect on January 1, 2017, and was therefore deleted from this Directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division 6 13. Section 13, entitled “Joint account” was revised. Explanation The obligation to obtain the consent of all partners, in a case where a request was submitted to obtain the service or to make a change to it by one of them, was replaced with a requirement to provide notice around the time of responding to the request, with the aim of protecting the partners, and of encouraging people to join the service. 14. Section 14, entitled “Manner of presenting the information” was revised, and a provision was added that insofar as a notice sent through communication channels bears a title, the title shall reflect the content of the notice, and shall not include full identifying details of the account or the customer. 15. Section 15, entitled “Access to the information” was revised in order to clarify that sub-Section (b) applies to instructions mandated by law that were sent to the customer via the banking corporation’s website and application only, and in order to bring it in line with the new terms set out in this Directive. The words “at least once for no fee” were deleted from sub-Section (b), in view of their inclusion in the Banking (Service to the Customer)(Fees) Rules, 5768–2008. 16. Section 16, entitled “Exclusion from the duty of encryption” was added to the Directive. Explanation The section is intended to clarify that a banking corporation is permitted to send a notice that is not mandated by law without using an encryption algorithm, notwithstanding the provisions of Section 63 of Proper Conduct of Banking Business Directive 367, provided that these notices do not include full identifying details of the account or the customer. 17. Section 17, entitled “Due disclosure”, was revised. The section sets out that soon after the date of joining the service or updating the details of the service, the banking corporation shall send the customer written notice of such. Soon after first joining the service, the notice shall include the main points of this Directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division 7 Effective Date 18. The amendments to the Directive shall apply from the date of its publication, excluding the following sections, which shall take effect on a gradual basis: a. Sections 9(a), 9(c), and 9(d) will take effect on April 1, 2017. b. Sections 9(b) and 12 will take effect on July 1, 2017. Transition directive 19. Until the implementation of Proper Conduct of Banking Business Directive 367 by the banking corporations, in accordance with the provisions of Section 66 in Circular 2507 (hereinafter: “the transition period”), the banking corporation shall implement Proper Conduct of Banking Business Directive 420 subject to the terms set out in Proper Conduct of Banking Business Directive 357. To remove doubt, it is clarified that in cases where the definitions in Proper Conduct of Banking Business Directive 420 are based on the definitions that appear in Proper Conduct of Banking Business Directive 367, they may be relied upon even during the transition period, provided that the terms set out in Proper Conduct of Banking Business Directive 357 are fulfilled. File update 20. The updated pages of the Proper Conduct of Banking Business file are attached. The following are the update instructions: Remove page: Insert page: 420-1-3 (8/13) [2] 411-1-4 (7/16) [3] Sincerely, Dr. Hedva Ber Supervisor of Banks