Bank of Israel Circular C-06-2570: E-Banking Amendments

1 Bank of Israel Banking Supervision Department Technology and Innovation Division IT Regulation and Examination Unit October 4, 2018 Circular no. C-06-2570 Attn: Banking corporations and credit card companies Re: E-Banking (Proper Conduct of Banking Business Directives no. 367 and no. 462) Introduction Granting power of attorney online to a portfolio manager

1. The current amendment is an additional stage in the overall process being undertaken by the Banking Supervision Department toward granting a customer the full possibility to execute a range of banking services without having to arrive at the branch. The amendment makes it possible to provide a power of attorney to someone who holds a portfolio management license under the Regulation of the Investment Consulting, Investment Marketing, and Investment Portfolio Management Occupation Law, 5755-1995 (hereinafter, “the Consulting Law”) online, without the customer having to go to the branch, subject to the terms established in Proper Conduct of Banking Business Directive no. 462 on Customers’ Investments in Financial Assets via Portfolio Managers (hereinafter, “Directive 462”). In addition, from now on a holder of power of attorney who holds a portfolio management license under the Consulting Law, may also act in an account that was opened online. A corporation’s waiver of receipt of explanations
2. A leniency was provided, according to which similar to a qualified customer, a customer that is a corporation can waive the receipt of explanations regarding issues regulated in the power of attorney to the portfolio manager, provided that the customer signed an appropriate waiver document in front of a lawyer chosen by the customer. Bank transfer when opening an acquiring account online
3. The requirement to transfer a random amount to an account in a banking corporation in Israel under the acquiring account applicant’s name while opening an acquiring account was cancelled, when the annual acquiring volume in it does not exceed NIS 50,000. File format for the information transfer regarding the customer’s current account balance
4. The file structure in Appendix C of Proper Conduct of Banking Business Directive no. 367 on the issue of “E-banking” (hereinafter, “Directive 367”) was amended in order to allow a uniform interface for transferring information on a customer’s current account balance between banking corporations and financial entities as they are defined in Section 73a of Directive 367. The amendments to the directives

2 Granting power of attorney online to a portfolio manager 5. The definition of “portfolio manager license holder” was added (Section 8 of Directive 367). In the account, an “authorized signatory” as defined in Section 1 of the Order, shall not act in the bank account, except someone with power of attorney to manage investment portfolios who holds a portfolio manager license (Section 26 of Directive 367). Activities defined as high risk, in accordance with the principles approved by the board of directors, shall be allowed only after authentication through at least two authentication factors. A high-risk transaction shall include, at a minimum: (a) Transfers, payments and transactions over the first limit threshold prescribed by the banking corporation in accordance with Section 60(a) below; (b) Adding a channel and a service that is other than for information only; (c) Cash withdrawals from Automated Teller Machines (ATMs). (d) Change of the contact details or the name of the account holder in accordance with Sections 57–58 below. (e) Adding or removing of an authorized signatory upon whom there are qualifications that prevent them from carrying out transfers, payments, or other activities to beneficiaries, in accordance with Section 39a(b) of this Directive. (Section 42 of Directive 367) (d) A power of attorney can also be given online, provided that in lieu of Sections (a) and (b) above, the following conditions apply: (1) The banking corporation identified the customer and authenticated the customer’s identity at the time the power of attorney was given, by one of the ways listed in Section 19 of Proper Conduct of Banking Business Directive no. 367 on e-banking (hereinafter, “Directive 367”) or via at least two authentication factors, in accordance with Section 42 of Directive 367. (2) At the time of the granting of the power of attorney, the customer will confirm that he received from the banking corporation an explanation of the issues covered by the power of attorney. Prior to the customer’s confirmation, the banking corporation shall give the customer an explanation of the issues covered by the power of attorney. The banking corporation shall enable the customer, pursuant to his request and during the banking corporation’s working hours, to speak with an authorized signatory of the banking corporation, and to receive an answer to any question required by the customer. (3) The banking corporation shall ensure via checking on the Israel Securities Authority website that the portfolio manager holds a valid “portfolio manager license” under the Consulting Law. (4) The banking corporation shall clarify to the customer at the time the power of attorney is granted that it will not act in accordance with the power of attorney, should the portfolio manager not hold a valid license under the Consulting Law. (Section 14(d) of Directive 462)

3 Explanation 6. In accordance with the amendment, a customer may remotely appoint as power of attorney regarding investment in financial assets in the customer’s account, only one who holds a portfolio management license under the Consulting Law. 7. The amendment allows:  The granting of power of attorney online to one who holds a portfolio management license under the Consulting Law. It should be emphasized that appointing a portfolio manager online is to be made possible for all portfolio managers holding a portfolio management license and under equal terms.  An authorized signatory who holds a portfolio management license to act in an account that was opened online. It should be emphasized that except for this leniency, the prohibition on activity in an online account by an authorized signatory who is not a portfolio manager, established in Directive 367, remains in place. 8. The process of issuing a power of attorney regarding portfolio management via the customer going to the branch is regulated in Directive 462, and primarily Section 14 of that Directive. The amendment to Directive 462 allows the appointment of someone holding a portfolio manager license in an online manner as well, provided that all the following conditions apply:  Identification of the customer requesting to appoint a portfolio manager to act in his account and authenticating the identification particulars shall be done by one of the methods detailed in Section 19 of Directive 367 or via at least two authentication factors, in accordance with Section 42 of that directive.  Before the customer signs the said power of attorney, the banking corporation shall give the customer an explanation of the issues covered by the power of attorney. The explanation may be given, among other things, by phone conversation, video clip, or by screening it on a screen, provided the customer is a party to an e-banking agreement for those channels.  The banking corporation is to make available to the customer during the banking corporation’s working hours an authorized signatory to whom he can turn at his request with any question he has, and this is prior to his signing the power of attorney. The interaction with the authorized signatory does not have to be face to face, and can be via an e-banking channel for which the customer registered, including by phone. Section 3(a) of the Banking (Service to Customer) (Full disclosure and submission of documents) Rules, 5752-1992 (hereinafter, “the Full Disclosure rules”) establishes that an agreement such as a power of attorney or other type of authorization has to be executed in writing, with the providing of an option to the customer to view it before signing it. In accordance with Section 2(a)(2) of amendment #3, dated February 28, 2018, to the Electronic Signature Law, 5761-2001, (hereinafter, “the Electronic Signature Law”), it is possible to fulfill the signature requirement established in the Full Disclosure rules by electronic signature as defined in the Electronic Signature Law, provided that it provides a response to the relevant objectives that are the foundation of the signature requirement under those rules. The signature can be carried out via an e-banking channel for which the customer registered, provided that the power of attorney agreement is executed in

4 writing with the customer given the option of viewing it before signing it and documentation of the signature is retained.  The customer’s authorization of having received the explanations on the issues regulated under the power of attorney, can also be given via any e-banking channel for which the customer registered, including by telephone, provided that documentation of the authorization is retained.  As the Directive makes it possible to remotely appoint as a portfolio manager only someone who holds a valid portfolio manager’s license, the banking corporation is required to clarify to the customer in order to remove all doubt, that if after its check of the Israel Securities Authority website (hereinafter, “the authority”) it is found that the portfolio manager who was appointed by the customer does not hold such a license, the banking corporation will not be able to act in accordance with his instructions. A corporation’s waiver of receipt of explanations 9. The banking corporation shall act with regard to a power of attorney in accordance with the following guidelines: (a) The power of attorney shall be signed before an authorized signatory, who shall by his signature attest that he has examined the particulars requiring verification in the power of attorney, and that he has given the customer all the explanations required by him with regard to the nature of the subjects to which it refers; (b) When the power of attorney is signed in the presence of the authorized signatory, as stated above, the customer shall confirm in writing that he has received all the explanations as per the provisions of Subsection (a) above; (c) Notwithstanding the provisions of Subsections (a) and (b) above, the following customers may waive the receipt of explanations from an authorized signatory as noted in Subsection (a) above: (1) A qualified customer, and provided he gave his written consent in advance; (2) A customer that is a corporation, and provided it signed a waiver as stated above in front of a lawyer of its choosing. (Section 14(a)–14(c) of Directive 462) Explanation 10. The formulation of Sections 14(a) and 14(b) was amended, without the essence of the requirement they incorporated having been changed. The amendment was executed due to the lack of clarity regarding the provisions of these sections and the various interpretations that came with that. As such, a customer who is interested in granting a power of attorney in his account will receive from the bank explanations related to the essence of the issues regulated by the power of attorney. This includes receipt of explanations that will be required by the customer, with notice being taken of Section 4 of the Israel Securities Authority directive to consulting license holders and marketing license holders related to referring customers to receipt of portfolio management services. 11. Similar to a qualified customer, from now on a customer that is a corporation can waive the receipt of explanations of issues covered by a power of attorney, provided that the corporation signs an appropriate waiver document in the presence of a lawyer of its choosing.

5 There is no change in the Directive in anything related to the corporation’s obligation to sign the power of attorney in front of the authorized signatory of the banking corporation, to the extent it signs it at the branch. 12. The consent of a qualified customer can be given via any e-banking channel for which the customer registered that allows the provision of the consent in writing. Valid license 13. A banking corporation may act on the subject of investments in financial assets on customers’ behalf by means of a portfolio manager who must, under the Counselling Law, hold a license to engage in portfolio management, only if the said portfolio manager has a valid license as aforesaid. In this respect, the banking corporation shall be considered as meeting the requirements of this section if, prior to the start of the portfolio manager’s activity, it verified by checking on the Israel Securities Authority website that the portfolio manager holds a valid “portfolio manager license” under the Counselling Law, and received a declaration from the portfolio manager that he will inform the banking corporation about any change in the validity of the license. (Section 14a of Directive 462) Explanation A list is available on the Israel Securities Authority website, updated daily, of people who hold a portfolio management license. Accordingly, the requirement of the banking corporation was updated, and from now on it is required to verify, in accordance with the provisions of the section, that the portfolio manager has a valid license, via the ISA website. Bank transfer when opening an acquiring account online 14. (c) Without derogating from the generality of the provisions of Subsection (a) of this Section, when opening an online account per Subsection (b), which is an acquiring account in which the annual acquiring turnover does not exceed NIS 50,000, the banking corporation is permitted to not make use of video conferencing technologies, notwithstanding the provisions of Subsection (b)(1) of this Section, provided the amount of the acquiring funds is transferred to an account under the name of the acquiring account applicant at a banking corporation in Israel. If the annual acquiring turnover increases to over NIS 50,000, the banking corporation shall establish a threshold up to which it will continue to provide acquiring services to the customer, and will act to complete the identification and authentication process so long as it has not already done so previously, within a reasonable amount of time given the specific conditions, through the following means: (1) Use of video conferencing technology. (2) The transfer of a random amount to an account at a banking corporation in Israel under the name of the acquiring account applicant, out of the amount of funds that the banking corporation is required to credit the customer the first time that acquiring funds are to be credited.

6 If necessary, the banking corporation will carry out a “Know Your Customer” process as detailed in Sections 20–21 below, updated in accordance with the expected activity in the account. The provisions of Subsections (a)–(c) above do not derogate from the other obligations detailed in Section 3(a)(1) of the Order. )a (Section 19(c) of Directive 367) Explanation The provision was cancelled according to which when opening an account online, which is an acquiring account whose annual acquiring turnover does not exceed NIS 50,000, it is required to carry out a transfer of a random amount to an account at a banking corporation in Israel, under the name of acquiring account applicant, out of the acquiring funds that the banking corporation is required to the first time that acquiring funds are to be credited. In accordance with the amendment, the banking corporation is permitted not to make use of video conferencing technology provided that the amount is transferred to an account under the name of the acquiring account applicant, at a banking corporation in Israel. If the scope of annual acquiring amount increases to above NIS 50,000, the banking corporation will be required to complete the customer identification and authentication process by a bank transfer as well, as required in Section 19(b)(2) of the Directive, to the extent that it did not already do so previously, in addition to using video conferencing technology. File format for the information transfer regarding the customer’s current account balance 15. The field type of the “Currency” field is changed to alphanumeric (Appendix C of Directive 367). Explanation Due to the publication of a FAQ file on the implementation of Proper Conduct of Banking Business Directive no. 367 that was published on July 5, 2018, which established, among other things, that the list of foreign currency codes based on the SWIFT standards (ISO international standards) will serve as the values table for the “Currency” field, the field type for that field was changed to alphanumeric. Effective date 16. The changes to these directives shall go into effect with their publication. Update of file 17. Update pages for the Proper Conduct of Banking Business Directive file are attached. Following are the provisions of the update: Remove page Insert page (3/18) [4] 367-1-24 (10/18) [5] 367-1-24

7 (9/11) [7] 462-1-8 (10/18) [8] 462-1-9 Respectfully, Dr. Hedva Ber Supervisor of Banks