Amendments to Proper Conduct of Banking Business Directive no. 470 regarding Payment Cards

1 Bank of Israel Banking Supervision Department Policy and Regulation Division June 29, 2015 Circular no. C-06-2470 Attn: The banking corporations and credit card companies Re: Payment Cards (Proper Conduct of Banking Business Directive no. 470) Introduction

1. The EMV (Europay MasterCard Visa) standard is a collection of specifications that were developed by the international credit card organizations with the objective of providing a uniform and secure format for transactions using payment cards with a chip (smart cards), at an ATM (automated teller machine) or POS (point of sale) supporting the standard. The specifications refer to “card present” transactions, both in contact and contactless transactions.
2. To deal with abuse in “card present” transactions, the EMV standard includes security mechanisms against various forms of fraud such as forgery and duplication, loss, theft, etc. These mechanisms are based on identification of card holders by their entering a secret PIN. The EMV refers to the level of the physical component (chip and card reader), the communication, and payment applications.
3. As part of the shift of Israel’s payment system to the EMV standard in general, and the implementation of the use of smart cards in Israel in particular, beginning in January 2016 the Shva company (Automated Banking Services Ltd.) will operate the “Ashrait EMV” protocol, through which transactions at smart terminals will be approved and cleared.
4. The Bank of Israel sees importance in the switch of Israel’s payment system to the EMV standard. The goals of the shift include: 4.1. To reduce the potential for fraud that exists in using magnetic cards, and thus contribute to strengthening the trust and security of customers of banking corporations and merchants using payment cards; 4.2. To enable banking corporations’ customers to use payment cards abroad in accordance with the international standards and without the limitations existing today in some markets regarding magnetic-strip transactions; 4.3. To encourage competition in the area of acquiring payment card transactions and developing advanced means of payment.
5. In addition, in this Directive, various aspects related to promoting the use of immediate debit cards and prepaid cards were amended, as additional steps to increasing competition, as noted above.
6. After consultation with the Advisory Committee on Banking Business Affairs, and with the consent of the Governor, I have amended this Directive. Changes to the Directive
7. In Section 2, “Definitions”, the terms “debit card”, “prepaid card”, “immediate debit transaction”

2 and “acquirer” were added. 8. Section 16—converting transactions in foreign currency into shekels—the section was deleted. Explanation The issue was regulated in an amendment dated February 1, 2015, to the Banking (Service to Customer)(Fees) Rules, 5768-2008, and as such the section in the Directive was deleted. 9. A chapter on “debit card and prepaid card” was added to the Directive. 9.1. Section 17 establishes the date of transferring funds in immediate debit transactions. Within the framework of the Section it was established that in immediate debit transactions, the issuer is to transfer the funds to the acquirer within 2 business days, at the most, from the date the transaction was transmitted, and the acquirer is to transfer the funds for the transactions that were executed to the merchant within 3 business days, at the most, from the date the transaction was transmitted. Explanation Section 17(a) establishes that with a debit card, the customer is to be debited at the value of the transaction’s transmission date. This is to distinguish the debit card as a card used as a substitute for cash for the consumer, as it makes it possible to execute payments at businesses through the immediate debit of the current account. Sections 17(b)–(c) refer to a debit card and to a prepaid card. In current practice, there is no difference for these cards between arrangements for transferring the funds in immediate debit transactions and in deferred debit transactions. As a result, in immediate debit transactions as well the merchants receive the proceeds of the transaction approximately 20 days, on average, after the date of the transaction being carried out. This arrangement does not encourage businesses to prefer an immediate debit transaction, whether via debit card or via prepaid card, over a deferred debit transaction. As such, and in order that the merchant views such transactions as substitutes for cash transactions, the period for transferring funds between isuuers and acquirers and between acquirers and businesses, was established in the Directive, so that it will be carried out as close as possible to the date that the transaction was carried out. 9.2. Section 18 requires issuers to stamp a mark on the debit card and prepaid card, upon their issue or renewal, that distinguishes them from other payment cards. Explanation Visual differentiation of the debit card and the prepaid card via stamping a clear mark that clarifies the type of card, on the card itself, and that distinguishes it from other payment cards, is intended to assist the customer to easily choose the card the he or she is interested in using, as well as to enhance the transparency and convenience for businesses and card holders. The determination that the stamping of the mark is to occur upon card issuance or renewal is intended to clarify that there is no need for an iniative by the banking corporations to exchange existing cards for the stamping. 9.3. In Section 19(a) it is determined that with a debit card every transaction is to be presented

3 on the current account statement, close to its occurrence, and noting that the transaction was carried out via debit, the date the transaction was carried out, and the supplier’s name, in accordance with Section 12(1)(a), and the transaction amount. Explanation Currently, there is little disclosure related to debit card transactions—in the details of transactions in a current account, the total charges executed with the card during the business day are presented, without details on each individual transaction. In view of the need for immediate transparency of the charges with the debit card in a current account, both for the the customer’s control in order to identify abuse of the card as well as for the customer’s monitoring of expenditures, this section was established requiring the presentation of every debit card transaction in the account. In this regard it should be clarified that the disclosure can be made in various ways, such as via a separate line on the current account statement for each transaction, including all the transaction details, or via one summary line per banking business day while providing access to the transaction details as noted above. The presentation of the transaction is to be made soon after the transaction is executed, meaning no later than the business day immediately following the day the transaction is sent. 9.4. In Section 19(b) it is established that for a debit card, the issuer is to disclose to the customer, on a detailed monthly statement, the transactions carried out with the card, as well as the provisions detailed in Section 12(1) of the Directive. Explanation The detailed monthly statement is a complementary report—in addition to the main details on each immediate debit transaction presented in framework of the details of the transaction in the current account—and is intended for the customer’s control needs. The details page shall be available to the customer at automated service stands and at the banking corporation’s computer terminals, as well as via the communication means through which the customer generally receives notifications from the bank, including electronic means (subject to Proper Conduct of Banking Business Directive no. 420). 10. In Section 20 of the Directive, Sections 7–9 of the Debit Cards Law, 5746-1986 were imposed on immediate debit cards. Explanation The sections of the Law noted in this section currently are imposed only on credit cards, and therefore their application was expanded to immediate debit cards as well. 11. The chapter on “Use of payment cards in the EMV standard” was added to the Directive. The adoption of the standard requires a switch to the use of smart cards (EMV cards) and the use of POS terminals at businesses and ATMs that support the EMV standard (smart terminals). Accordingly, the directive refers both to activity of issuance of payment cards as well as to acquiring activity of payment transactions and cash withdrawals. 11.1. Section 22(a) of the Directive establishes that all payment cards that are issued, except for a bank-issued card that is only for cash withdrawals, are to be cards with the EMV standard, and therefore this circular establishes a transition period that will allow a gradual

4 withdrawal of magnetic cards from use. 11.2. Section 22(b) of the Directive requires issuers to implement an operational solution that allows a self-selected PIN (the setting of the secret PIN by the card holder). This solution is intended to ease the implementation of the use of the PIN by customers, particularly when there are numerous cards. 11.3. Section 23 of the Directive establishes that new terminals are not to be connected if they do not support the execution of transactions with a smart card at the hardware and software levels, and will require the support of acquirers in carrying out EMV transactions at terminals with relevant certifications. In addition, the Directive requires that every new terminal is to have the relevant certification for the PCI (payment card industry) standard, which is an accepted international information-security standard for card holders. In addition, it is recommended that the new terminal is to include support for NFC contactless transactions, in light of the guidelines published by Mastercard Europe, in which support for contactless transactions will be required in every new terminal installed beginning July 1, 2016, and by 2020 all the terminals at merchants will be required to support such transactions. This circular establishes a gradual implementation of terminals that support the EMV standard with special consideration of businesses with a small volume of payment card transactions, in light of the importance of reducing the use of cash and the shift to electronic means of payment, and taking into account how substantial it is. 11.4. Section 24 of the Directive determines that the banking corporations are to cease using ATM devices that don’t comply with the EMV standard. The Directive applies both to ATMs of banking corporations and those that connect to the banking system. 11.5. The liability shift mechanism is a mechanism accepted in various countries around the world for encouraging the switch of the payment system to executing smart card transactions. Accordingly, Section 25 of the Directive establishes a mechanism that transfers to the acquirer the responsibility for paying the amount of the charge deriving from abuse of a smart card that doesn’t comply with the EMV standard. Likewise, it was determined that acquirers may shift the liability for paying to the merchant, in cases where transactions were conducted that are not under the EMV standard. 11.6. The Banking Supervision Department will monitor the process of changing over the terminals, and and will consider providing incentives, in addition to the liability shift mechanism, as required. To do so, a Reporting to Banking Supervision Directive will be published soon, which will detail the relevant parameters. Effective date 12. The amendments to the Directive will go into effect on April 1, 2016, except for the following sections: 12.1. Sections 17(b) and 17(c), with regard only to prepaid cards, will go into effect on October 1, 2016. 12.2. Section 18 will go into effect on October 1, 2015. 12.3. Section 22:  Subsection (a) with regard to international payment cards will go into effect on October 1, 2015; with regard to a payment card solely for domestic use, it will go into effect on October 1, 2016.  Subsection (b) will go into effect on December 31, 2018.

5 12.4. Section 23:  Subsection (a) will go into effect on July 1, 2016.  Subsection (b): Connecting a new terminal as of October 1, 2015 and onward will have to support the EMV standard at the hardware level and bear the relevant certifications for the PCI standard; Connecting a new terminal as of July 1, 2016 and onward will have to support the EMV standard at the hardware and software level, regarding a small business with transaction acquiring volume that does not exceed NIS 60,000, it will go into effect from July 1, 2017. 12.5. Section 24 will go into effect on January 1, 2018. 12.6. Section 25 will go into effect on July 1, 2016. Transition provisions 13. Immediate debit cards issued before April 1, 2016, shall be exchanged with cards that meet the Directive’s requirements by December 31, 2016. Update of file 5. Update pages for the Proper Conduct of Banking Business Directive file are attached. Following are the provisions of the update: Remove page Insert page (12/14) [10] 470-1-6 (6/15) [11] 470-1-8 Respectfully, David Zaken Supervisor of Banks