Proper Conduct of Banking Business Directive no. 412: Customer Service against the Background of Sanction Regimes

Banking Supervision Department
Policy and Regulation Division
Jerusalem, December 30, 2025
Circular Number C-06-2829
Attn:
Banking Corporations and Payment Service Providers with Prudential Importance Re: Customer Service against the Background of Sanction Regimes Proper Conduct of Banking Business Directive no. 412 Introduction

1. In recent years, there has been growing use by states and international organizations of various
   types of financial sanctions, as a judicial enforcement tool used for various objectives and that serve as a means of pressure and deterrence in the international arena. Sanction regimes, instituted by various foreign countries and international organizations, are complex in terms of the essence of the sanctions and have various implications for individuals, businesses, and financial entities.
2. Circumventing foreign sanction regimes through the Israeli banking system exposes the banking
   corporations to various risks that they are required to manage. These include compliance risks, AML/CFT risks, legal risks, and reputation risks. Managing these risks impacts on the relations between the banking corporation and its customers.
3. Given that the Banking Supervision Department wants to ensure that alongside effective risk
   management, the provision appropriate banking service to customers affected by sanction regimes, I find it correct to promulgate, in this Directive, the requirements imposed on the banking corporations in respect of the requirements imposed on the banking corporations in all that relates to the risk management and the providing of banking services to customers.
4. This Directive shall not derogate from any other obligation that applies to a banking corporation
   by law in regard to risk management and customer service, including Proper Conduct of Banking Business Directive no. 310, “Risk Management”; the Payment Services Law, 5779-2019; Proper Conduct of Banking Business Directive no. 422, “Opening a Current Account with No Credit Facility and Managing an Account”; Proper Conduct of Banking Business Directive no. 432, “Transferring Activity and Closing a Customer’s Account”; and Proper Conduct of Banking Business Directive no. 501, “Management of Customer Service and Support Array.”
5. This regulation is accompanied by the publication of a Regulatory Impact Assessment under the
   Principles of Regulation Law, 5782-2021, which is issued conterminously with this Directive.
6. In view of the foregoing, after consulting with the Advisory Committee on Banking Business
   Affairs, and after obtaining the Governor’s approval, I have amended this Directive. Main provisions of the Directive Risk management and provision of banking services to customers (Sections 8–9)
7. Sections 8–9 of the Directive establish obligations in regard to establishing policy and procedures
   for the way sanction lists may be used, and shall assess the risks of breaching the sanctions or

misuse of the banking corporation in order to circumvent said sanctions. When formulating such policy, banking corporations shall relate to aspects of customer service in addition to the matter of risk management.
8. When formulating such policy, banking corporations shall ensure that they have the requisite
expertise to assess the risks that flow from the various sanction lists.
Explanatory notes
Given that misuse of the banking system to circumvent foreign countries’ and international organizations’ sanction regimes exposes banking corporations to significant risks including compliance risks, money laundering and terror financing risks, legal risks, and reputation risks, banking corporations must assess the risks that accompany the breaching or circumvention of various sanction lists and, accordingly, must establish policy and procedures relating to the way sanction lists are used and the providing of services that may be used vis-a-vis entities that appear on such lists. This assessment of risks shall be carried out as part of the risk management processes specified in Proper Conduct of Banking Business no. 310, “Risk Management.”
9. When establishing said policy, banking corporations shall ensure that they have the requisite
expertise to assess the risks that flow from the various sanction lists, including by using outside experts on sanction lists and foreign law, as required. It is stated for clarity that the foregoing shall not derogate from the obligations of the bank in connection with establishing policy and procedures concerning the manner in which lists of terror organizations and activists, or international lists of elements declared as aiding Iran’s nuclear program, as published by the sanctions team at the Ministry of Finance, may be used, as set forth in Proper Conduct of Banking Business Directive no. 411, “Management of Anti-Money Laundering and Countering Financing of Terrorism Risks.” When establishing such policy and procedures, banking corporations shall also relate to aspects of customer service. Obligations regarding banking services to customers (Sections 10–11)
9. In Section 10 of the Directive, it is explained that in view of the contents of Section 2 of the
Banking (Service to the Customer) Law, 5741-1981, a banking corporation shall not manage risks by wholesale avoidance, from the outset, of providing the services to the customers generally and to customers who appear on relevant sanction lists particularly.
10. Section 11 of the Directive establishes obligations meant to ensure appropriate customer service,
and herein it is stated that if a banking corporation decides to restrict a customer’s financial activity as part of its implementation of a risk-management policy, it must share its decision with the customer as expeditiously as possible and shall explain the decision in detail, subject to any law. Similarly, if a banking corporation conditions the provision of services or the carrying out of a transaction on the presentation of documents or the receipt of clarifications, it shall ensure that these are indeed necessary and shall specify them within the framework of its decision. Further within the framework of the decision, the banking corporation shall notify the customer

of the types of transactionsthey may carry out and explain to them the specific channels of service on which such transactions may be taken. Explanatory notes It is stated for clarity that risks emanating from sanction regimes shall not be managed by wholesale avoidance, from the outset, of providing the services to the customers affected by them. Measures to be taken vis-à-vis as part of banking corporations’ implementation of a risk-management policy that shall be established, shall be applied with attention to the corporations’ legal obligations to their customers and, inter alia, in consideration of the circumstances and essence of the service sought. Insofar as a banking corporation decides to restrict the financial activity of a given customer or to turn down a customer’s request to carry out a given transaction as part of the implementation of a risk-management policy laid down in accordance with the Directive, the corporation shall, subject to statutory prohibitions against disclosure of information, share its decision with the customer in writing, explain its decision in detail, and do so as expeditiously as possible. In this matter, if the banking corporation conditions the provision of services or performance of a transaction on the presentation of documents or clarifications by the customer, it shall explain out its demands of the customer in full within the framework of the decision in a manner that is clear and lucid. In addition, the banking corporation shall present the customer with the channels of services available to them and also, insofar as their financial activity has been restricted, present the types of transactions that they may carry out. In this matter, we note that in accordance with
Section 11(5) of Proper Conduct of Banking Business Directive no. 422, “Opening a Current
Account with No Credit Facility and Managing an Account,” if a banking corporation does not allow a certain customer to use a remote banking channel that it makes available to its general population of customers, it must offer the customer an appropriate alternative way to carry out the transactions remotely, subject to its risk-management policy. It is stated for clarity that the obligations established in this Section shall not derogate from any other obligation that exists by force of any law, including the Payment Services Law and Proper Conduct of Banking Business Directives no. 422, 432, and 501. In this matter, we should note that Proper Conduct of Banking Business Directive no. 501, “Management of Customer Service and Support Array,” lays down principles for the provision of services and support to customers, including adequate services commensurate with customers’ needs, in a manner that is clear, professional, rapid, and useful. Accordingly, where giving services and support to customers affected by sanction regimes banking corporations must respond as expeditiously and clearly as possible as to the manner of managing the account, the restrictions applying to it, if any, and the possibility of providing various financial services commensurate with the customers’ needs in view of the possible effect of the sanction regimes on the customers’ financial activity. It isstated for clarity that in this matter, a banking corporation may regard populations of customers affected by the various sanction regimes as separate population groups for the purposes of Section 24 of Directive 501, as the case may be.

Reasonable refusal (Section 12)
11. In Section 12 of the Directive, it is stated that refusal to give service to a customer, including
refusal to enter into a contract or termination of a contract, due to the application of a risk￾management policy relating to the use of sanction lists as set forth in accordance with this Directive, shall not be considered unreasonable refusal to provide service for the purposes of the Banking (Service to the Customer) Law, 5741-1981. Explanatory notes In view of the risks to which banking corporations are exposed in the context of the sanctions lists , including compliance risks, money laundering and terror financing risks, legal risks, and reputational risks, if a banking corporation refuses to serve a customer due to its implementation of his risk-management policy in regard to sanctions lists as set forth in accordance with this Directive, this shall not be considered unreasonable refusal to provide service for the purposes of the Banking (Service to the Customer) Law. File update
12. Attached are update pages for a Proper Conduct of Banking Business file. The update instructions
follow:
Remove page Insert page
--------- 412-1-4 [1] (12/25)
Respectfully,
Daniel Hahiashvili
Supervisor of Banks

Regulatory Impact Assessment
Title of regulation: Proper Conduct of Banking Business Directive no. 412, Customer Service against the Background of Sanction Regimes Number of attached circular of the Banking Supervision Department:
Date of promulgation of regulation: December 30, 2025 Regulator at the Banking Supervision Department:
Compliance Section, Regulation Unit, Policy and Regulation Division Status of regulation: Final Date effective: December 30, 2025 Incidence: Banking corporations, as defined in the Banking (Service to the Customer) Law, 5741-1981 Date of publication of Regulatory Impact Assessment:
December 30, 2025
General Remarks
Concise description of the regulation
Proper Conduct of Banking Business Directive no. 412, “Customer Service against the Background of Sanction Regimes,” explains the obligations that banking corporations must satisfy in regard to risk management and the providing of banking service to customers affected by various sanction regimes instituted by foreign states, including intergovernmental organizations and various international organizations. The Directive sets out obligations concerning the establishment of policies and procedures that govern the way sanction lists may be used, including assessment of risks emanating from breach of such sanctions or misuse of a banking corporation to circumvent such sanctions. In determining such policy, banking corporations must relate to obligations to provide customer service in addition to those relating to risk management. It is also explained that the risks emanating from sanction regimes must not be managed by blanket refusal from the outset to provide services to customers who are affected by them. Furthermore, it is explained that refusal to open an account, close an account, or carry out a transaction due to application of a risk-management policy in accordance with the Directive shall not be considered unreasonable refusal to provide service for the purposes of the Banking (Service to the Customer) Law, 5741-1981. The directive also provides obligations that are meant to ensure appropriate customer service provision including obligation of written explanations and adequate disclosure to customers.
Part 1—The Outline of the Main Regulatory Principles, Goals, Rationale,
and Expected Utility of the Regulation
Description of the existing situation
Risk management obligations
Proper Conduct of Banking Business Directive no. 310, “Risk Management,” sets out the basic principles for risk management and control of risks in an integrated perspective, and among other things, it provides that risk management should be undertaken from a forward-looking point of view that includes identification of new or emerging risks along with regular monitoring of existing ones.

The section of Directive 412 that relates to management of risks affected by economic sanction regimes is, in effect, a specific implementation of general Directive 310. As part of the risk￾management processes specified in this Directive, banking corporations are instructed to set out policies and procedures regarding the manner international sanctions lists, and national sanctions of foreign states, shall be used, and for contracting or carrying out transactions with those appearing on such lists. This was already explained in the Supervisor’s June 8, 2022, letter to the directors of banking corporations and prudential payment service providers concerning “risks associated with contracting with partiesthat appear on internationalsanction lists and foreign states’ nationalsanction lists.” In this letter, the Supervisor also explained that refusing to approve a transaction, refusing to establish a contractual relationship, and terminating a contractual relationship due to the application of a policy such as the aforesaid shall be considered reasonable refusal to provide service for the purposes of the Banking (Service to the Customer) Law, 5741-1981. Customer-service obligations According to the Banking (Service to the Customer) Law, 5741-1981, banking corporations must allow every customer to open and manage a current account with a credit balance provided there is no reasonable cause to withhold such service. The law also establishes additional obligations regarding customer service, including providing customers with explanations and due disclosure, such as obligations set forth in the Payment Services Law, 5779-2019; Proper Conduct of Banking Business Directive no. 422, “Opening a Current Account with a Credit Balance and Managing an Account”; Proper Conduct of Banking Business Directive no. 432, “Transferring Activity and Closing a Customer’s Account”; and Proper Conduct of Banking Business Directive no. 501, “Management of Customer Service and Support Array.” Difficulties in the existing situation In recent years, there has been growing use worldwide by states and international organizations of various types of financial sanctions as judicial enforcement tools used for various objectives and that serve as a means of pressure and deterrence in the international arena. Sanction regimes instituted by various foreign states and intergovernmental organizations and various international organizations are complex in terms of the essence of the sanctions and in their implications for individuals, businesses, and financial-service entities, among others. Circumventing foreign sanction regimes through the Israeli banking system exposes the banking corporationsto variousrisksthat they are required to manage. These include compliance risks, money laundering and terror financing risks, legal risks, and reputation risks. The purpose of requiring banking corporations to manage risks associated with sanction regimes traces primarily to the immense
importance of maintaining banking corporations’ relations with foreign financial entities that are directly or indirectly subject to international sanctions. Therefore, a banking corporation that contracts with a sanction regime may impair its contractual relations with the affected foreign financial entities. These relations are essential for the banking corporations’ regular activity and are enormously important for Israel’s economic and trade relations with the rest of the world because they constitute the infrastructure of banking corporations’ cross-border financial activity. This risk management approach has an impact on relations between a banking corporation and its customers. Given the impact of various sanction regimes on customers of the Israeli banking system and as the Banking Supervision Department wants to ensure the provision of appropriate banking service, the Banking Supervision Department found it necessary to establish binding obligations for banking corporations in regard to risk management and customer service.

Objective of the regulation
Effective management of risks incidental to sanction lists, in conjunction with adequate banking services for customers affected by sanction regimes. Relevant stakeholders Banking corporations, including payment service providers with prudential importance and customers of the banking corporation who are affected by relevant sanction regimes. Examination of the existence of parallel or clashing regulation The regulation merges and itemizes the provisions of statute, Banking Supervision Department directives, and the aforementioned letter from the Supervisor of Banks. There is no regulation that clashes with the one being promulgated.
Part 2—Main Alternatives and Rationales for the Alternative Chosen
Relevant professional issues that the regulator faced in establishing the regulation

1. Coexistence of risk-management and customer service obligations—structural tension in the
   banking system between the obligation of risk management and that of providing customers adequate service is attested in everything related to managing risks associated with sanction lists. Within the framework of risk management, there are cases where a banking corporation, under specific circumstances, will refuse to open an account, provide certain banking services, or restrict activity in the account due to risks that it faces from sanction lists, including compliance risks, money laundering and terror financing risks, legal risks, and reputational risks. These risks, when realized, may impair banking corporations’ contractual relations with foreign financial-service entities, which are essential for their regular activity and are enormously important for Israel’s economic and trade relations, as stated above. In recent years, there has been growing use by states, including intergovernmental organizations and international organizations of various types, of financial sanctions, as a judicial enforcement tool used in the international arena. As a result, friction between managing services and customer-service obligations has been worsening. Risk-management policy—From a risk management perspective, it must be ensured that banking corporation have the tools to establish risk-management policies that will ensure the ongoing sound functioning of the banking corporation amid the existence ofsanction regimes, including by refusing to provide service. This is necessary because the materialization of the aforementioned risks is likely to impair the banking corporations’ regular activity, their financial relations with the global economy, potentially resulting in the overall functioning of the economy, for financial interactions with the global economy, and the sound functioning of the Israeli economy. (See, for example, Civil Appeal Authority 1052/24, Mizrahi Tefahot Bank, Ltd., v. ZAKA Search and Rescue (ruling handed down on April 2, 2024.)) Concurrently, it must be ensured that risk management be applied not via sweeping avoidance from the outset, but rather proportionately, in consideration of the identified risks and their assessment. For this purpose, the banking corporation must have the expertise needed to assess the risks emanating from sanction lists so that it can map them.
2. Customer service—the question of customer service arises alongside that of risk
   management. Consumer-related obligations associated with due disclosure to customers, inter alia, are established in provisions of the law and directives of the Supervisor of Banks. However, it has been found that in reference to restricting activity in an account or refusing to carry out transactions, existing regulation provides a less-than-total response to the disclosure obligations.

Given the implications of applying sanction regimes to the banking activity of customers affected by them, the Banking Supervision Department deemed it appropriate to establish additional obligations relating to disclosure and explanation for customers in cases of restriction of activity or refusal to perform a transaction, all in view of the implementation of a risk-management policy in the context of various sanction regimes in mind, including the obligation of explaining the bank’s decision in writing subject to law. Insofar as the performance of a transaction is conditional on document-sharing or provision of clarifications by the customer, these requirements must be specified as part of the decision and the types of transactions that the customer may carry out, and the channels of service available to them must be spelled out. Alternatives to the regulation examined and regulatory measures The alternatives examined dealt with the question of the very enshrinement in the regulation examined of provisions that already exist in the Directive, i.e., whether to regulate the matter in a dedicated directive or not. As noted, even without this directive, banks are obliged to manage risks incidental to sanction lists under Proper Conduct of Banking Business Directive no. 310, “Risk Management,” alongside the obligation not to make unreasonable refusal to open and manage an account under Section 2(b) of the Banking (Service to the Customer) Law, 5741-1981, and additional obligations in the field of bank-customer relations. The refusal to provide service in view of the implementation of a risk policy concerning the manner of use of international sanctions lists and foreign countries’ national sanction lists, and for contracting with those who appear on such lists, shall be considered reasonable refusal for the purposes of the Banking (Service to the Customer) Law, 5741-1981, as was clarified in the June 8, 2022, letter from the Supervisor of Banks concerning “risks associated in contracting with parties that appear on international sanction lists and foreign countries’ national sanction lists.” Additional supervisory expectations and sharpening of obligations relating to management of risks incidental to sanction regimes alongside customer-service obligations, and explaining that such risks may not be managed by sweeping refusal, from the outset, to serve the customer, were communicated to the banking system by means of various supervisory tools including supervisory letters, public enquiries, direct discourse with the banking system, and the Attorney General’s positions in legal proceedings, but not in a dedicated directive that merges all of these instructions and expectations. The Banking Supervision Department believed that even though the obligations already apply, given the extent of use of international sanction regimes and their impact on banking￾system customers in Israel, there is reason to anchor in a dedicated directive the full set of
expectations of banking system as to banking corporations’ risk-management and customer-service obligations. As for consumer obligations, in the absence of a directive, the requirements of disclosure to customers would remain asset forth in existing law, which limitsthe obligation of written explanation to cases of refusal to open or close an account. In this context, and given the acute sensitivity that pertains to sanction regimes in regard to managing accounts for banking-system customers, the Banking Supervision Department believed that these disclosure obligations may be inadequate. Thus, the Banking Supervision Department saw fit to broaden the disclosure-to-customer requirements to include refusal to carry out transactions and impose restrictions on an account.
Part 3—Expected Effects (Direct and Indirect) of the Regulation
Expected effects of the regulation
As noted, the obligations related to managing risks associated with sanction regimes and those relating to customer service already exist. Therefore, the regulation in this context is meant to anchor in a dedicated directive the totality of instructions and expectations as to the obligations imposed on

banking corporations regarding risk management and the provision of banking services to customers. As for the expansion of consumer-related obligations in respect of disclosure to customer, the obligations may give customers a better understanding of the circumstances under which transactions may be refused or restrictions on their account imposed. In addition, disclosure about customers’ need to present documents or clarifications, and presentation of channels of service available to them, may in certain cases make their comportment vis-a-vis their bank less onerous. Means and measures for assessing attainment of the goal of the regulation As for anchoring the obligations associated with risk management and customer service in a dedicated directive—since the obligations in question already exist, as stated, it is difficult to quantify the direct effect of the regulation. As for obligations concerning disclosure to a customer incidental to sanction regimes, given that this is a regulatory obligation, one expects the regulation to immediately attain its objective vis-a-visthe population of customers who are affected by the sanction regime. This may be tested through the lens of public enquiries that the Banking Supervision Department will handle in connection with applying this Directive, particularly in regard to such disclosure.
Part 4— Public consultation - Description of the Public
the consultation Process and Its Impact on the Regulation

1. As the regulation was being established, a systematic process of consultation with the public and
   the relevant stakeholders, in accordance with the Principles of Regulation Law, 5781-2021, and the procedures of the Banking Supervision Department, was undertaken.
2. A first draft for consultation with the supervised entities was discussed at a meeting of the Sound
   Procedures Committee forum on May 25, 2025.
3. On June 5, 2025, a second draft was presented in writing, for consultation, to the Advisory
   Committee on Banking Business Affairs, in which representatives of the banking system, the public, and parallel financial regulators are members by law as mandated by the 1941 Banking Ordinance.
4. A draft for consultation with the public at large, ahead of the promulgation of the final regulation,
   was circulated on June 5, 2025, with the deadline for submission of remarks set for July 3, 2025.