Debits by Authorization

Bank of Israel Banking Supervision Department Bank–Customer Division Regulation (Bank–Customer) Unit September 1, 2014 Circular Number C-06-2428 Issue: Debits by Authorization (Proper Conduct of Banking Business Directive 439) Introduction

1. The process of transferring debits by authorization from an old account to a new account at another bank has been identified as one of the main obstacles faced by customers interested in moving their account from one bank to another in order to improve their terms with the banks. This is a complicated process, which at times involves a lot of bother for the customer. The goal of this directive is to deal with these difficulties, by creating an efficient and rapid process of transferring debits by authorization, which does not involve bother for the customer.
2. After consultation with the Advisory Committee on Banking Issues, and with the authorization of the Governor, I have enacted this directive. Main points of the directive
3. The chapter “Bank contact with beneficiary” refers to the manner of contact by the customer’s bank with the beneficiary to whom the customer provides the authorization. Explanation Within the framework of this chapter, Section 5(b) was revised in order to provide a response to cases in which beneficiaries are interested in submitting, to the banking corporation, requests to set up an authorization, on behalf of their customers. In such cases, the banking corporation shall be responsible to ensure, within the framework of a letter of indemnity that it receives from the beneficiary, the propriety of the identification procedures, and shall receive a copy of the customer’s written consent for the beneficiary to set up an authorization.

Bank of Israel Banking Supervision Department Bank–Customer Division Regulation (Bank–Customer) Unit 4. The chapter “Submission of a request to set up a debit by authorization” regulates the process of submitting a request to set up an authorization to debit an account by the customer, either directly or via the beneficiary. Explanation This amendment is intended to cancel the requirements to use a letter of authorization signed by the customer and for the bank to keep a copy of the letter. This demand has been identified as one of the main factors in the difficulty of the process of setting up an authorization to debit an account and then to move it to another bank. Instead, a process was set up of moving a closed list of details (defined in Annex A of the directive), from the customer or the beneficiary to the customer’s bank, by any means of communication set up between the bank and the customer in their agreement, or between the bank and the beneficiary in the letter of indemnity. To remove any doubt, it is clarified that a request presented via the bank’s Internet site meets the requirement of being written. As part of the list of details defined in Annex A, it is established that a customer will be able to choose, when setting up the authorization, between setting up a general authorization to debit an account, and setting up an authorization with up to two limitations—a maximum amount to debit, and an expiration date for the authorization. Banks must track that the debits received from beneficiaries are within these limitations, and return them if they do not meet them. The banks must explicitly clarify to the customer that if the beneficiary submits a debit that does not meet the limitations set by the customer, they will be returned by the bank, with all the implications of such action. Under circumstances in which a request to set up an authorization is submitted by a beneficiary, setting up the authorization by the bank will only be permitted if attached to the request is a copy of the customer’s written consent to the beneficiary submitting the request on his behalf (Section 6a(c) of the directive). As noted above, with reference to Section 5(b) of the directive, there is a need for a letter of indemnity that refers to this specifically, and sets up the work procedures between the beneficiary and the banking corporation and their areas of responsibility. In Section 6a(e) of the directive, it is established that the bank is to enable the customer to verify the identity of the beneficiary by checking that the institution code

Bank of Israel Banking Supervision Department Bank–Customer Division Regulation (Bank–Customer) Unit and institution name match. Establishing this is intended to avoid mistakes in entering details of the request by the customer. The bank must make available to the customer convenient and efficient tools to carry out this check—for example, when setting up an authorization on the banking corporation’s website, when entering the institution code and institution name, a closed list of institution codes will open which will automatically link to the appropriate institution name. Sections 6a(g)-(h) of the directive were moved from the chapter “Request to debit an account by authorization”, which was deleted, and were revised. It was established in these sections that the bank must send its decision on the customer’s request within five business days of the date of receiving the customer’s request. In a case of a positive reply, the bank is to notify the beneficiary of the setting up of the authorizations in its systems and of any limitations existing in the authorization. In a case of a negative reply, the bank is to notify the customer of such, as was done until now. Likewise, the bank is to document the details of the authorization, and the customer’s consent, to the extent that the authorization was set up via the beneficiary. In a case of a negative reply, the reason for such is also to be documented. In this regard, it is clarified that the bank is to develop the appropriate infrastructures to document the customer’s consent, in accordance with the means of communication used to submit the request. Section 6a(i) refers to a “Report of authorizations to debit an account”. This report is a report which is to be constantly updated, and banks are to allow their customers to receive it in an accessible and convenient manner, by all means of communication and information terminals. The report structure is presented in Annex B of the directive. 5. The chapter “Request to change an account debited by authorization” is revised, and it sets up a new procedure to transfer authorizations to debit an account from one bank to another. Explanation The chapter “Request to change an account debited by authorization” regulates the process to change the particulars of the account to be debited, in accordance with the various stages of the process: submitting a request to transfer debits by the customer,

Bank of Israel Banking Supervision Department Bank–Customer Division Regulation (Bank–Customer) Unit checking the details of the authorizations and setting them up, and sending the information to the beneficiary. The process is based on transferring information from the new bank, via a “Report of authorizations to debit an account” generated by the old bank, and which is defined, as noted, in Annex B of the directive. 6. Section 7(a) of the directive is revised, so that the customer is permitted to cancel a debit no later than 3 business days after the date of the debit. The revision is intended to provide a response to the need that arose among bank customers who are only able to know that a debit has taken place after the fact. It was also established in this section that the credit will be made at the value on the date the cancellation instruction is given. 7. Section 7(c) of the directive is revised, removing the 90 day limitation and the burden of proof imposed on the customer. 8. Section 7(d) of the directive is cancelled, the requirement of being written was integrated into 7(a) and 7(c), without further requirements. 9. Section 7(e) is cancelled. It is obvious that the bank is required to act in accordance with the customer’s notice, without need of the beneficiary’s consent. 10. Section 7(f) was reworded but is not materially different. The goal of the change is to word the section as a rule and not as a prohibition imposed on the customer. 11. Sections 8(a) and 8(b) were combined, and the additional requirements beyond the requirement that the notice be in writing were cancelled. To remove any doubt, it is clarified that the notice submitted via the banking corporation’s website meets the requirement of being written. 12. In Section 10 of the directive it is established that the bank must present the name of the beneficiary on account statements. The option of noting the beneficiary’s code was cancelled. 13. Section 11 of the directive was revised. The goal of the update was to clarify that the directive does not apply to cases in which the customer provided authorization to the

Bank of Israel Banking Supervision Department Bank–Customer Division Regulation (Bank–Customer) Unit beneficiary to debit his payment card. In cases in which a credit card company is the beneficiary authorized by the customer to debit the bank account, the directive applies in similar fashion to any other beneficiary, excluding Section 1.4(b) of Annex A. Application 14. The amendments to the directive come into effect as of October 1, 2015. File update 15. Update pages for the Proper Conduct of Banking Business Directives file are attached. The following are the update instructions: Remove page (1/00) [5] 439-1-7 Insert page (9/14) [6] 439-1-8 Sincerely, David Zaken Supervisor of Banks

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 1 ONLY THE HEBREW VERSION IS BINDING DEBITS BY AUTHORIZATION Introduction (9/14)

1. Debits by Authorization are a method of making payments under which a beneficiary collects funds from the customer via banks. The customer’s bank account is debited and the beneficiary’s account is credited by force of a debit presented by the beneficiary based on an authorization given by the customer.
2. Payments made under this method involve the beneficiary, the customer, and their banks. Consequently, there needs to be a process which regulates the relations between the various sides.
3. This directive regulates the system of payments through debits by authorization, primarily as regards to preserving the rights of the customer (henceforth, the arrangement).
4. It is hereby clarified that this directive does not impose on the bank a responsibility to the customer with regards to a transaction between the beneficiary and the customer. Bank contact with beneficiary (3/97) (9/14)
5. (a) If a beneficiary contacted the bank for the purpose of the arrangement, the bank shall first examine the nature of the party making the request and the chances that he will be able to meet all the terms of the arrangement and the agreement between him and the bank. (b) The bank shall receive a letter of indemnity from the beneficiary in which the beneficiary undertakes to indemnify any customer or any bank for damage incurred because of a deficiency in the material submitted by the beneficiary. In circumstances in which the beneficiary is interested in the possibility of submitting a request to establish an authorization to debit an account on behalf of the beneficiary’s customers, the banking corporation shall act vis-à-vis the beneficiary

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 2 ONLY THE HEBREW VERSION IS BINDING to ensure the propriety of the customer identification process and receive a copy of the customer’s consent in writing. (c) (1) The bank shall receive from the beneficiary a commitment stating that if there are several debits for the same customer, the beneficiary will inform the customer what the amount and origin of each debit is, unless these details appear on the statement sent by the bank to the customer. The notice informing the customer shall be sent to him near the date on which his account is debited; (2) Notwithstanding the aforesaid in Section (1), if there are several debits for the same customer, the total of which is determined in the agreement with the customer, and the amount of the debit changes only as a result of the addition of indexation differentials, a detailed notice as aforesaid, sent at least once a year, will suffice. If, however, there is a change in the composition of the payment during the year, another detailed notice, as specified in Section (1), should be sent. Submission of a request to set up a debit by authorization (9/14) 6a. (a) A bank shall permit a customer to submit a request to set up an account debit by authorization, either directly or via a beneficiary. (b) A bank shall permit a customer to submit a request to set up an account debit by authorization directly through any of the following means of communication: the banking corporation’s website, fax, mail, banking corporation branch, or by any additional means of communication in accordance with the bank’s decision (hereinafter, “means of communication”). (c) If a request to set up an account debit by authorization was submitted by a beneficiary, the debit authorization shall only be permitted if the request includes a copy of the customer’s written consent to such authorization.

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 3 ONLY THE HEBREW VERSION IS BINDING (d) A request to set up a debit by authorization shall include the details listed in Annex A to this directive. The bank must bring to the customer’s attention that he must receive from the beneficiary the details required to fill out the request. (e) The bank must provide the customer the possibility of verifying the beneficiary’s identity by examining the details (that is, verifying that the institution’s code and the institution’s name match) when submitting a request to set up an account debit by authorization. (f) The bank must inform the customer, when the request to set up an account debit by authorization is submitted, of his right to give notice of the cancellation of a debit or cancellation of authorization in accordance with Sections 7 and 8, respectively, and how to cancel them. (g) When a bank receives a request to set up an account debit by authorization, the bank shall send a response to the beneficiary in writing. If the reply is positive, the bank shall note in its reply to the beneficiary that the authorization was set up in its systems, and shall detail the limitations existing in the authorization, in accordance with Annex A, to the extent that there are any. If the reply is negative, the bank shall inform the beneficiary of its answer, and shall also inform the customer of such, including the reason for the negative reply. The bank’s reply, positive or negative, shall be sent within 5 business days of receiving the request. (h) The bank shall document the details of the authorization to debit the account, as noted in Annex A, the customer’s consent, as well as negative replies given as stated in Subsection (g), including the reasons for the negative replies. (i) The bank shall permit the customer to receive at any time an updated “Report of authorizations to debit an account” (hereinafter, “the report”), which shall include the information noted in Annex B of this directive, using any means of communication as well as automated information booths in bank branches.

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 4 ONLY THE HEBREW VERSION IS BINDING Request to change an account debited by authorization (1/00), (9/14) 6b. For a customer whose account in a given bank (henceforth, the old bank) is debited by authorization, and who wishes the debit to be implemented in an account at another bank (henceforth, the new bank), the following provisions shall apply: Submission of a request by the customer to transfer debits (1) The new bank shall receive from the customer, via any of the means of communication, a request to transfer debits by authorization—all or part—in accordance with Annex C of the directive. (2) If the customer requested, within the framework of the request to transfer debits by authorization, that the new bank contact the old bank in order to receive the report from the old account, this contact shall be made within one business day from the date of submitting the request. (3) The old bank must respond to the contact from the new bank within one business day of the date of receiving the request. (4) In a case of a negative reply to the request to transfer debits by authorization— all or part—the new bank shall submit a written response to the customer, noting the reason for the negative reply, within five business days from the date of receiving the report. Examining the details of the authorizations and setting them up (5) The new bank shall verify that the customer requesting to transfer the authorizations is authorized to do so, based on the account holder details and signature list appearing in the report generated from the customer’s old account. (6) The new bank, after verifying that the customer is authorized to transfer the authorizations, shall set up the authorizations in its systems and submit the report, which shall be issued from the new account, to the customer. The new bank must complete the setting up of the authorizations and sending the

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 5 ONLY THE HEBREW VERSION IS BINDING report to the customer within three business days from the date of receiving the report from the customer’s old account. (7) If the new bank finds, based on the particulars appearing in the report issued from the customer’s old account, that the customer is not authorized to transfer the authorizations, the new bank shall allow the customer to submit a request to set up a debit by authorization in the account pursuant to Section 6a. Transferring information to the beneficiary (8) The new bank shall submit to the bank which—based on the details of the most recent debit that took place in the old account—is the bank representing the beneficiary to whom the customer provided an authorization to debit the account (hereinafter, the representing bank) within one business day from the date that the setting up of the authorization is completed, the particulars noted in Sections 1–5 of Annex C of the directive, as well as the relevant particulars of the authorization, as they appear in Section 4 of the report. (9) The representing bank shall transfer to the beneficiary the notice from the new bank, within one business day of the date of receiving it, so that it may continue to debit the customer’s new account on an ongoing basis. (10) Notwithstanding the provisions of Subsections 8–9, the new bank may transfer to the beneficiary within one business day, the particulars noted in Subsection 8, directly and not via the representing bank. (11) If a debit from the beneficiary was not received in the customer’s new account within 65 days from the date of the customer’s request, the new bank shall notify the customer of such. Cancellation of debit by customer (9/14) 7. (a) The customer is entitled to cancel a specific debit by informing his bank in writing, provided the aforesaid notice is submitted to the bank no more than 3

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 6 ONLY THE HEBREW VERSION IS BINDING business days after the date of the debit. To the extent that the notice of cancellation is submitted after the date of the debit, the credit shall be made at the value of the date of submission of the cancellation notice. (b) The customer is entitled to demand that the bank cancel a debit if the debit was made in accordance with an authorization that was cancelled under Section 8; (c) A customer is entitled to demand from the bank, via written notice, to cancel a debit if the debit does not match the expiration date, or the amounts, determined in the authorization, if they were determined. (d) Cancellation of a debit as noted in Sections (a)–(c) means cancellation of the debit in whole, and not amending or correcting it. Cancellation of authorization (3/97) (7/99)(9/14) 8. (a) The customer is entitled to cancel his authorization at any time, by written notice. (c) The cancellation shall go into effect one business day after the notice has been given to the bank; (d) If the bank debited the customer’s account despite the cancellation as stated in this section, in Section 7(b) or in Section 7(c), the bank shall refund the customer the amount debited at its value on the debit date; (e) An authorization that has not been used for a period of 24 months from the date of the last debit is cancelled. Removal of customer from arrangement 9. A bank may remove a customer from the arrangement if it has a reasonable cause to do so and informs the customer as soon as the decision is made, noting the reason for doing so.

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 7 ONLY THE HEBREW VERSION IS BINDING Returned debit (3/97) 9a. If a debit is returned by the bank not at the instruction of the customer, the bank shall inform the customer that the debit has been returned as soon as it is done, noting the reason for this. Identifying the debit in an account statement (9/14) 10. The statement that a bank issues for the customer shall contain the amounts of the authorized debits or their return in such a way as to enable the customer to identify the beneficiary; this shall be done by noting the beneficiary’s name. Debits via debit cards ( 7/99) (1/00) (9/14) 11. This directive shall not apply to authorizations to debit a debit card as defined in the Debit Cards Law, 5746–1986. With regard to an authorization provided by a customer to a credit card company to debit his bank account, all the sections of the directive apply, except for Section 1.4(b) of Annex A. Revisions Circular 06 number Version Details Date 148/16 Original circular 16/6/91 ---- 1 Integration into Proper Conduct of Banking Business Directives 8/91 ---- 2 Updated version of Proper Conduct of Banking Business Directives file 12/95 1860 3 Revision 31/3/97 1978 4 Revision 8/7/99 1991 5 Revision 13/1/00 2428 6 Revision 01/09/14

---

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 8 ONLY THE HEBREW VERSION IS BINDING Annex A Request to set up an authorization to debit an account—as per Section 6a(d)

1. A request submitted directly by the customer, to set up an authorization to debit an account, shall include the following particulars: 1.1 Date of request 1.2 Beneficiary details Institution code Institution name 1.3 Customer reference/identification number (if such exists) at beneficiary 1.4 When submitting a request, the customer shall have two options: (a) Setting up a general authorization, which is unrestricted (b) Setting up an authorization with at least one of the following restrictions: Maximum amount to debit Expiration date for authorization The bank shall explicitly clarify to the customer that if debits which do not meet said restrictions set by the customer are sent by the beneficiary, they will be returned by the bank, with all the implications of such action.
2. A request submitted by the beneficiary, to set up an account debit by authorization, shall include the following particulars in addition to those noted above: 2.1 Particulars of customer’s bank account: account numbers, branch, bank 2.2 Name of customer(s) 2.3 ID numbers 2.4 Copy of customer’s written consent to the request to set up an authorization to debit the account shall be submitted by the beneficiary

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 9 ONLY THE HEBREW VERSION IS BINDING Annex B Report of authorizations to debit account—as per Section 6a(i) 1. Date report is generated Account number Branch number Bank number 2. Account holders: Name ID number/Passport number/Private company number 3. Signature list Joint/Joint and separate 4. List of existing authorizations in account: Beneficiary details Details of most recent debit in account Institution code Institution name ID number listed with beneficiary Beginning date of authorization Maximum debit amount* Expiration date of authorization* Date of most recent debit Amount of most recent debit Details of representing bank**

• These columns are only to be filled in if customer opted for an authorization including these limitations. ** Representing bank: The bank which—based on the details of most recent debit in the customer’s account—is the bank representing the beneficiary to whom the customer issued the authorization to debit the account.

Supervisor of Banks: Proper Conduct of Banking Business (9/14) [6] Debits by Authorization Page 439- 10 ONLY THE HEBREW VERSION IS BINDING Annex C Request to transfer debits by authorization—as per Section 6b(1) A request to transfer debits by authorization shall include the following particulars:

1. Date of request
2. Details of new account (account numbers, branch, and bank)
3. Identity numbers of each account holder in new account*
4. Details of account at old bank (account numbers, branch, and bank)
5. Customer consent to transfer said information to representing bank and/or to beneficiaries and/or to old bank
6. Clarification noting that the customer is to attach the “Report of authorizations to debit account” from the old account (the report includes the list of the currently existing authorizations to debit the account in the old account, and their particulars), in order to complete carrying out the actual transfer. Therefore, the customer will be asked to choose one of the following two options: a) Having the new bank contact the old bank in order to receive the report (the bank is to note that the report will be received within three business days) b) Submission of the report by the customer

• In this matter, “Identity number”—as it is defined in the Prohibition on Money Laundering (the Banking Corporations’ Requirement regarding Identification, Reporting and Record￾keeping for the Prevention of Money Laundering and the Financing of Terrorism) Order, 5761–2001. Note: When a customer requests to transfer only some of the authorizations from the old account, the request should also include the details of the authorizations that the customer wishes to transfer.