Management of Anti-money Laundering and Countering Financing of Terrorism Risks

Bank of Israel Banking Supervision Department Policy and Regulation Division March 6, 2017 Circular Number C-06-2531 To: Banking corporations and credit card companies Re: Management of Anti-money Laundering and Countering Financing of Terrorism Risks (Proper Conduct of Banking Business Directive no.411) Introduction

1. In 2012, the FATF organization revised its recommendations for the effective implemementation of the Prohibition on Money Laundering and Financing of Terrorism, and in January 2014 the Basel Committee published guidelines that were intended to be in line with the FATF recommendations and to complete their goals and targets with an emphasis on banks’ activity. The amendments to the directive were made in order to bring it line with those recommendations while correcting deficiencies from the last assessment report of the Moneyval organization.
2. The writing of the Directive was based on guidelines and regulation that included, among other things, relevant FATF documents—international standards (recommendations) on the issue of AML and CFT from December 2, 2012, methodology for assessing compliance with recommendations and increasing the efficiency of the AML and CFT system from February 2013, guidance for politically exposed persons from June 2013, guideline to a risk￾based approach in the banking sector from October 2014, as well as a Basel document from January 2014 regarding risks related to money laundering and terrorism financing and guidelines of the supervisory authorities in Canada and Hong Kong.
3. The Directive incoporates circulars and supervisory letters regarding AML and CFT, which were published over the years since 2010, when the last comprehensive revision of the Directive was made.
4. The Directive was expanded and reorganized as a Directive for Risk Management, meaning the identification and assessment of the risks, as well as operative steps to reduce risks.
5. In parallel, a file of questions and answers is published, to clarify various issues that arose, in view of the amendment to the directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division 6. Following consultation with the Advisory Committee on Banking Business and with the approval of the Governor, I have decided to amend this Directive as follows. Main Changes to the Directive Chapter A: General 7. An explanation was added of the risk based approach in accordance with the recommendations of FATF and reference to the three lines of defense in accordance with Proper Conduct of Banking Business Directive no. 310. 8. The definitions in the Directive were sharpened and concentrated into one section. Among other things, definitions were added for a “domestic publicly exposed person” and “senior official in an international organization”. Chapter B: Corporate Governance 9. The details of the roles of corporate governance functions were expanded, in line with their alignment with compliance risk management in Proper Conduct of Banking Business Directive no. 308. 10. Issues included in Prohibition on Money Laundering and Terrorism Financing policy were expanded, also as part of consolidation of letters and circulars into the Directive. Chapter C: Risk Assessment 11. The factors on which the banking corporation is to base a risk assessment were detailed, as was the information base that the banking corporation is to collect from internal and external sources in order to formulate the risk assessment. Chapter D: Risk Mitigation 12. When setting Customer Due Diligence policy and procedures, the banking corporation must take into account the risk factors detailed in the Directive. The risk factors are segemented by customers, countries and territories, and products, services, and distribution channels. 13. A banking corporation is required to assess, through a structured and computerized questionairre, the level of AML and CFT risk attibuted to it from actvity vis-à-vis the customer, based on, among other things, risk variables detailed in the Directive, while weighting the risk factors. When a customer is identified as being high risk, the banking corporation is required to adopt one or more of the actions listed in the Directive.

Bank of Israel Banking Supervision Department Policy and Regulation Division Chapter E: Risk activity 14. Expanded delineation of risk activities: a. From now on, politically exposed persons are also to include domestic politically exposed persons and senior officials in international organizations. In addition, the Directive details the factors in which the banking corporation is to consider clarifying the source of the funds that are to be deposited in an acount prior to its opening and during the business relationship. b. When opening correspondent accounts, the banking corporation is required to collect information from open sources as well as questionairres, in order to recognize and understand the essential business of the banks managing correspondent accounts with it, while taking into consideration the factors detailed in the directive. c. The list of risk activities, by its nature, is not exhustive, and the banking corporation is to establish additional risk activities. To that end, it may utilize parameters established in the chapter dealing with risk mitigation, and the national risk assessment, when it is published. 15. Several Supervisor letters were incorporated into the directive, on the following issues: a. Activity vis-à-vis an Aggregator (Letter dated August 5, 2013). Further to the addition of Section 7b to the Banking (Service to Customer) Law, 5741-1981, within the framework of the Enhancing Competition and Reducing Concentration in the Banking Industry in Israel (Amendments) Law, 5777-2017, after the going into effect of an effective AML regime on Aggregators, as required in this section, the Banking Supervision Department shall examine updating the directives realted to this issue. b. Execution of transfers whose source or destination is a bank account that ostensibly serves illegal gaming activity (Letter dated January 29, 2012). c. Customers’ cross-border activity risk (Letter dated March 16, 2015). Scope of Activity—Group Risk Management 16. Requirements were detailed for the formulation of group policy for banking corporations that conduct international activity through subsidiaries or branches in jurisdictions outside of Israel. Among other things, it was established that in a case in which a banking corporation is required to implement the more stringent instructions (between local requirements and those of this Directive),

Bank of Israel Banking Supervision Department Policy and Regulation Division and they contradict the provisions of the law in the host country, additional controls are to be established and the continued activity in that country should be considered. Effective Date 17. The changes pursuant to this Circular shall go into effect on January 1, 2018. Transition Directives 18. Pursuant to the prohibition on opening numbered accounts, the banking corporation is to act to change numbered accounts to regular accounts by December 31, 2017. File update 19. The updated pages of the Proper Conduct of Banking Business file are attached. The following are the update instructions: Remove page Insert page (11/16) [15] 411-1-14 (03/17) [16] 411-1-29 Sincerely, Dr. Hedva Ber Supervisor of Banks