Revision of Proper Conduct of Banking Business Directive No. 301 on Board of Directors

Bank of Israel Banking Supervision Department Policy and Regulation Division Jerusalem, 11 Tamuz 5777 July 5, 2017 Circular no. C-06-2535 Attn: The banking corporations and the credit card companies Re: Board of Directors (Proper Conduct of Banking Business Directive No. 301)

Introduction

1. The revisions to the Directive are designed to improve the effectiveness of Board of Directors’ work and enhance its professional qualifications as a corporate organ.
2. The revised version of the Directive includes changes that are designed to allow the Board of Directors, in the course of its work, to place emphasis on the banking corporation’s most substantive issues and allocate more time to them in its meetings by, among other means, delegating some resolutions to board committees. Other major changes include a reduction in the number of maximum members required of the board, a requirement to set policy on the maximum term of service of the Chairperson of the board of directors, an expanded definition of individuals with “banking experience,” an increase in the required share of directors with banking experience, and the requirement to include at least one director with proven experience in technology-related fields. Alongside these changes, the revised version also incorporates the Basel principles of corporate governance published in July 2015.
3. After consulting with the Advisory Committee on Banking Matters and with the approval of the Governor, I have decided to revise Proper Conduct of Banking Business Directive No. 301 on Board of Directors (hereinafter, “the Directive”). The main amendments to the Directive Chapter 1: General
4. Section 2 (Application) - The structure of the section was amended to include a detailed list of all the types of corporations to which the Directive applies. Explanatory note: The structure of the section was amended to more clearly include all the types of corporations to which the Directive applies, without an additional reference to the Definitions section in the Directive.
5. Section 3 (Definitions) – 5.1. The definition of the term “internal auditor,” which previously also referenced the Companies Law, now only references the Banking Ordinance. Explanatory note: In specific cases, the Banking Ordinance sets different provisions than the Companies Law. For example, like the Companies Law, the Banking Ordinance imposes on an internal auditor of a banking corporation provisions of the Internal Audit Law, but [unlike the

Companies Law] it excludes Section 3(a)(2), which determines that the internal auditor must be a resident of Israel. 5.2. Reference to the Companies Law in the definition of “external auditor” was deleted and only reference to Proper Conduct of Banking Business Directive No. 302 “The external auditor of a banking corporation” remains. Explanatory note: Directive 302 references both the Companies Law and the Auditors Law and therefore the reference to the Companies Law is superfluous. 5.3. The definition of “a banking corporation” was deleted. Explanatory note: The definition was deleted following the change to the section on Application. 5.4. A definition of “audit and control function” was added. Explanatory note: The term “audit and control function” recurs in the Directive. The definition is designed to clarify the functions to which the Directive refers and to emphasize that this is not an exhaustive list. Banking corporations are expected to examine whether additional units in the bank warrant inclusion under this definition. 5.5. A definition of “branches” was added. Explanatory note: The term “branches” recurs in the Directive. The definition is designed to clarify this term and to emphasize that it also includes representative offices and not only overseas subsidiaries and branches. 5.6. A definition of “personal interest” was added. Explanatory note: The definition is added to clarify that the interpretation of this term follows the meaning of the term in the Companies Law, that is to say, the definition that appears in Section 1 of the Law and the references to this term in the Law itself, such as Section 270(1). Chapter 2: The functions and authority of the board of directors 6. Section 6 (Subjects that the board of directors is obligated to discuss and decide) 6.1. Subsection (a) – A new requirement was added calling for meetings of strategy goals to also address the bank corporation’s business model and profit sources, and operational efficiency in light of developments in its macroeconomic, business, and regulatory environment. Explanatory note: The change to this section is designed to add emphases in discussions on the banking corporation’s overall strategic goals, including reference to the banking corporation’s profit sources, the effect of strategy on its operating efficiency goals, and reference to the banking corporation’s environment, and a forward-looking examination of the effects of changes in this environment on the strategy goals. 6.2. Subsection (a1) – A new requirement calls for the board to discuss the bank’s organizational structure and the structure of its group. Explanatory note: The organizational structure of the group (the banking corporation and the corporations under its control) and the banking corporation affect the latter’s ability to achieve the strategic goals that were defined, and therefore, organizational structure must be consistent with these goals. Furthermore, the organizational structure of the bank and its group affects

the banking corporation’s ability to perform effective risk management at the group level with a view of clearly defined areas of authority and responsibility in the organizational structure, complex structures in the group, branches in countries with a weak regulatory environment, and other aspects. 6.3. Subsection (M) – The following words were deleted: “and any audit report required by the Supervisor, which shall be discussed in the plenum of the board of directors, including taking the actions that are required by the reports, and discussion of the banking corporation’s responses until handling of the audit report is completed.” Explanatory note: This sentence was deleted because it was derived from the Supervisor’s demand when the audit report was transferred to the banking corporation. Deleting this sentence does not imply any change in the position of the Supervisor of Banks on the manner in which the banking corporation should handle audit reports. 7. Section 8 (The business situation of the banking corporation) – subsection (b) was deleted. Explanatory note: Subsection (b) was deleted as part of the corrections to the Directive that are designed to increase the effectiveness of the board of directors by, among other things, limiting the topics that the board is required to discuss and on which it is required to make resolutions. At the same time, changes in the structure of the corporation’s assets and liabilities, and information on provisions for credit losses, which significantly affect the corporation’s risks deriving from its activity, should be reflected in the risk document that is brought before the board of directors for discussion. 8. Section 10 (Mechanisms for supervision and control of controlled corporations) – Subsection (b) now stresses overseas branches (the requirement to maintain a centralized headquarters unit was deleted). Explanatory note: The requirement to establish a headquarters unit that concentrates and analyzes information on the controlled corporations arose mainly after the discovery of flaws in the supervision and control of banking corporations’ overseas branches. As a result, emphasis is placed on overseas branches, and application of the requirement to controlled corporations incorporated in Israel is not mandatory. Deleting the requirement to maintain a central unit shifts the responsibility for determining the most suitable organizational structure for analyzing and concentrating information on overseas branches to the banking corporation. 9. Section 11 (Audit and control functions) – emphases were added for board of director discussions on the audit and control functions, including: a discussion on the objectivity and effectiveness of the work of these functions, and a discussion on the resources allocated to them for the performance of their duties. Explanatory note: Emphases were added according to the principles of corporate governance published by the Basel Committee, among other things. 10. Section 12 (General manager) – The discussion on appointing a general manager was changed to a discussion on the appointment, performance assessment, and dismissal of the general manager, and a requirement to establish an appointment procedure. Explanatory note: The banking corporation must define a procedure for identifying the most suitable candidate for the position of general manager and discussing his or her performance assessments and the terms of his or her dismissal. 11. Section 16 (Conflicts of interest) - The discussion of conflicts of interest now includes emphasis on the mechanisms for separating between the banking

corporation’s controlled corporations, in addition to the required separation between operations in the various operating segments and between the various activities of the banking group. Explanatory note: Conflicts of interest can develop on several levels, including between various segments within the banking corporation, between the controlled corporations, and between the corporations of the banking group using the broadest definition of the group (for example, between affiliated companies controlled by the controlling banking corporation) 12. Section 17 (non-transparent activities) – The revised section now includes topics related to non-transparent activities that the board of directors is required to discuss. The definition of the term “non-transparent activities” now includes the corporation’s activities on its own behalf or on behalf of others, and also activities of corporations in jurisdictions that the banking corporation has defined “offshore” jurisdictions. Explanatory note: This change is designed to stress that the banking corporation’s responsibility for risk management also extends to the activities performed by controlled corporations for their clients, and not only for themselves, and to activities performed in countries defined by the corporation as “offshore” jurisdictions, pursuant to Reporting to Banking Supervision Directive No. 825, “Semiannual Report on Exposure to Compliance Risk” 13. Section 18 (Frequency of discussion) - Subsection (a) now includes a requirement to discuss overall strategy goals at least once every three years. Explanatory note: The Banking Supervision Department expects the banking corporation to conduct a discussion of its overall strategic goals and the strategic goals of its main controlled corporations, its overall risk strategy, and its risk appetite at least once every three years. The Banking Supervision Department found it fit to include this expectation in the Directive in view of the rapid changes that have occurred in recent years in the banking corporations’ environments, changes that stress the need to periodically re-examine the corporation’s strategic goals and business model. 14. Section 20 (Meetings without the presence of management) 14.1. Subsection (a) – Now includes a requirement to discuss the quality of the audit and control functions in addition to a general discussion of the effectiveness of the controls in the banking corporation. Explanatory note: The Banking Supervision Department believes that a discussion of the quality of the audit and control functions is part of the discussion on the effectiveness of the banking corporation’s controls. 14.2. Subsection (b) – Now includes a requirement to discuss an assessment of the effectiveness of the board of directors’ work, as required by Section 59. Explanatory note: The requirement in Section 59 was added to this subsection because the Banking Supervision Department believes that an efficient discussion of the effectiveness of the board’s work should be conducted without the presence of members of management. 15. Section 21 (Vesting authority in committees of the board of directors) 15.1. Subsection (c) - the requirement to have all board committee resolutions ratified by the board of directors plenary was cancelled. Explanatory note:

To enhance the effectiveness of the discussions in the board plenary, the plenary’s obligation to ratify all resolutions made by board committees was cancelled, provided that no specific request to do so is made by a director within a period of time defined for this purpose by the board of directors. In lieu of ratification, the committee resolutions will be reported to the upcoming plenary assembly accompanied by the background materials that were provided for the committee discussion. The requirement to report the resolutions to the upcoming plenary meeting replaces the requirement to submit committees' minutes of meetings to the plenary, due to the lengthy ratification procedures used by several banks, and in order to ensure that reporting is performed soon after the resolution is adopted. Nonetheless, if possible, the banking corporations should also submit the transcripts of their meetings, to allow the plenary to review the main points raised in the discussion on the reported topic. This change allows the plenary to delegate more responsibility to the various committees and to focus its own discussions on the most significant and key topics for the banking corporation. It should be stressed that this change does not release the board of directors as a whole, or any director independently, of responsibility for any resolution adopted by the committees, pursuant to the provisions of the Companies Law. 15.2. Subsection (d) - the list of issues that cannot be delegated to board committees was amended. Explanatory note: The list of issues that may not be delegated to committees was reduced in order to allow the board to make time for discussions of material issues. For example, regarding Section 6(b), the board may delegate a discussion of risk management framework of immaterial risks to the risk management committee; With respect to material risks, the plenary will discuss the key elements of the risk management framework, such as organizational structure, key models, significant exposure limits, while the committee may discuss the remaining elements of the framework, as defined in Directive No. 310 “Risk management.” Chapter 3: The composition of the board of directors 16. Section 21a – This subsection adds a general principle that refers to the significance of conducting effective board discussions, with emphasis on the differences between the directors, which give rise to a diverse range of opinions and prevents “groupthink.” Explanatory note: The board should work harmoniously to facilitate efficient work that contributes to the banking corporation’s competitiveness and provides rapid responses to the changing needs of clients and the bank, among other things. Nonetheless, to ensure that the need for harmony does not prevent a diversity of opinions, the Banking Supervision Department deemed it appropriate to add this principle. Diversity in the board of directors is achieved by selecting directors who have different profiles. For example, the Companies Law determines that boards of directors of public companies should include at least one female director. The Banking Supervision Department does not determine how to achieve diversity but stresses that board members should be selected based on their professional and personal qualifications for the position of director. 17. Section 22 (Number of members of the board of directors) — This section determines that the board of directors should comprise no more than 10 directors, rather than the current maximum of 15 directors. Banking corporations may, subject to the Supervisor’s approval, appoint a larger number of directors if they believe that this is necessary for the proper functioning of the board of directors. Explanatory note: The Banking Supervision Department believes that decreasing the number of directors will improve the effectiveness of board plenary discussions. However, banking corporations may

apply to the Supervisor for approval to appoint a larger number of directors if they believe that it is necessary for the proper functioning of their boards. 18. Section 25 (“The board’s qualifications” replaced “Banking experience and accounting and financial expertise”) 18.1. The requirement of the board’s collective qualifications was extended to include, in addition to collective knowledge, also qualifications, expertise and experience that are in accordance with the banking corporation’s strategies and types of activity. Explanatory note: The text that appeared in the Directive’s accompanying circular was inserted into the Directive itself. 18.2. Subsection (a) – The share of directors who are required to have “banking experience” was increased from one fifth to one third, and the definition of banking experience was expanded. For banking corporations that are not banks or for banking corporations that are subsidiaries of banks, the minimum required share of directors with banking experience remains one fifth. Explanatory note: To enhance the board of directors’ professional competence, it was decided to increase the share of directors with banking experience from one third to one fifth. The definition was also expanded, based on the Supervision’s position, which was communicated to the banking system in the Q&A file. The increased share will not apply to corporations that are not banks or to subsidiaries of banks. 18.3. Subsection (c) – This new requirement determines a minimum share of directors with professional qualifications, as this term is defined in this Directive. Explanatory note: To improve the professional competence of the board, at least one half of the board members must have professional qualifications as stated in Section 24(b)(1)(ii) of the Directive. 18.4. Subsection (d) – This new requirement determines that at least one director should have knowledge and proven experience in the IT sector. This requirement does not apply to banking corporations that are subsidiaries of and receive IT services from banking corporations. Explanatory note: This requirement was added in view of the accelerated development in e-banking and given technology’s role as a major component of operational risks, and to support banks’ steps to improve efficiency. The Banking Supervision Department did not define knowledge and experience in the IT sector and therefore added that such knowledge and experience must be “proven” (through certificates of education or adequate terms of service in relevant positions). This subsection does not apply to banking corporations that are subsidiaries of other banking corporations from which they receive IT services, which is why they have less of a need for expertise in this field in their own board of directors. 18.5. Subsection (e) – This subsection expands the option of counting a director as meeting the minimum required for several qualifications per those sections. Explanatory note: The expanded option is designed to facilitate a board’s satisfaction of the various qualification requirements in the event that a director meets several qualification requirements. 19. Section 26 (“Knowledge of Hebrew” replaced “Place of residence of directors”) — The requirement that the permanent place of residence of at least two thirds of the

directors is in Israel was replaced by the requirement that the directors must be fluent in Hebrew. Explanatory note: In light of globalization and foreign investors’ interest in acquiring financial companies in Israel, the residency requirement was replaced by a requirement of fluency in the Hebrew language. Knowledge of Hebrew is essential if a board of directors is to continue to conduct effective discussions and effectively conduct itself in the bank’s operating language. Nonetheless, the Banking Supervision Department may grant an exemption from the language requirement in special cases. Chapter 4 - Chairman of the board of directors 20. Section 28 (Chairman of the board of directors) 20.1. A new paragraph was added, providing a general description of the duties of the chairman of the board as well as specific qualification requirements. Within the chairman’s duties, subsection (b) also emphasizes the requirement to conduct open discussions that allow the expression of different opinions, and the requirement to make decisions based on adequate information. Explanatory note: This paragraph elaborates on the role of the chairman of the board and stresses his or her significance for the proper functioning of the board pursuant to the Basel Committee’s Corporate Governance principles published in July 2015. Emphasis was also placed on holding open discussions in which different opinions are voiced, in order to prevent groupthink. This emphasis should also be reflected in the selection of directors, as noted above. 20.2. Subsection (f) – In view of the repeal of Section 29, this subsection was added and extended to include all board chairmen. Explanatory note: The Banking Supervision Department expects the chairman of the board to attend board meetings on a regular basis, even if the chairman is a foreign resident. This expectation is based on, among other things, the expectation that the chairman serves in a full-time capacity. 20.3. Subsection (g) – According to this new requirement, the board of directors will determine a policy on the maximum term of the chairman of the board. Explanatory note: The board is required to define a policy on the maximum term that a chairman may serve, in order to balance between the chairman’s required experience, continuity, and achievement of long-term goals, and the need for reinvigoration, which contributes to different modes of thinking and validation of past decisions, regarding both strategy and work and risk management processes. When a chairman’s term is renewed periodically, the maximum term of service refers to the total number terms of service approved for him. This requirement does not detract from the effect of the provisions in this Directive that refer to the term of service of an outside director who serves as chairman of the board in banks operating without a controlling group of shareholders. 21. Section 29 – Repealed. Explanatory note: This section was repealed and replaced by Section 28(f). Chapter 6 - Board of directors’ committees

22. Section 34 (Composition and work methods of board of directors committees) — This section now includes the principle that board committees should be established according to the bank’s profile, including its size, the size of the board of directors, its strategic goals, its operating environment, and its risk profile. Furthermore, committees should have no more than 7 directors each, rather than one half of the number of directors. Explanatory note: The board must periodically examine whether the board committees and their composition is consistent with its strategy and operating profile. For example, in light of rapid technological change, banking corporations may consider establishing a technology committee if they believe that such a committee enhances the effectiveness of discussions on this topic. The maximum number of directors on a committee was restricted to 7 following the reduction in the maximum number of directors on the board. This change was designed to allow adequate representation of the directors in the committees, on the one hand, and to allow effective work in professional committees, on the other hand.
23. Section 38 (Remuneration committee - composition and work methods) – The new subsection (c) determines that an audit committee that meets the conditions of subsections (a) and (b) may also serve as a remuneration committee. In this case, the requirement that at least one committee member have expertise and experience in risk management and control activities does not apply. Explanatory note: This correction was made in line with Amendment No. 27, 5776-2016, to the Companies Law.
24. Section 39 (Risk management committee) – This section elaborates on the roles of the risk management committee, which now include discussing and developing recommendations on the internal capital adequacy assessment process (ICAAP) prior to the discussion in the plenary, and maintaining ongoing contact with the Chief Risk Officer, the board’s audit committee, and other relevant functions. Explanatory note: This section enumerates the roles of the risk management committee according to the Basel Committee's corporate governance principles published in July 2015, among others. These corrections do not make the requirements listed in Directive 310 “Risk Management” redundant. Chapter 7 – Meetings of the board of directors
25. Section 41 (Attendance at meeting of the board of directors) – In subsection (a) the words “shall physically attend” replaced the words “shall attend.” Explanatory note: This correction is designed to clarify the Supervision’s current position that attendance of board meetings entails physical attendance.
26. Section 45 (Minutes) - In subsection (c), the maximum period of time for approving minutes of a meeting was extended from 30 days to 60 days. Explanatory note: This section was amended in light of numerous communications made by banks, stating that approval of minutes of meetings generally requires a period over more than 30 days.
27. Section 47 (Determining additional work procedures) was repealed. Explanatory note:

This section was repealed because its contents were transferred to Chapter 8 and incorporated in the section “Work procedures.” 28. Section 49 (Holding meetings via communications media) – subsection (c) modified the requirement to submit minutes of meetings conducted via communications media to the relevant forum at the first meeting after a resolution is adopted, and instead the requirement is to submit the resolutions. Minutes of the meetings will be submitted immediately after they are completed. Explanatory note: This correction was made because the time required to approve minutes of meetings precludes submitting the minutes to the first meeting after the resolutions are adopted in a meeting via communications media. Chapter 8 - Practices for Effective Functioning of the Board of Directors 29. Section 50a (Work procedures) – This new subsection includes a requirement to clearly define the board’s responsibilities and roles that derive from this Directive and from all other laws or directives in work procedures. Explanatory note: The foundation for proper control is setting and implementing procedures that define the various work processes. Consequently, the board of directors, which is the entity responsible for ensuring that the organization has adequate controls in place, should define its work in work procedures. 30. Section 56 (Personal interest) – Section (d) was added. Explanatory note: Due to its relevance to this Directive, this section was transferred from Directive 312 “A banking corporation's business with related parties.” 31. Section 57 (Relations with employees of the banking corporation outside of meetings) 31.1. Subsection (a) – text was amended. Explanatory note: The amendment does not modify the Banking Supervision Department’s position on this section (see reference to this section in the Q&A file). The text was corrected merely for the sake of clarification, in view to the various interpretations that banks gave to the term “business matters”. The exceptions to the general prohibition in subsection (a) are listed in subsection (b) and include, among others, requests for professional explanations on any topic relevant to the director’s role, especially risk management and control. 31.2. Subsection (b)(6) – In addition to inquiries concerning the manner of composing documents, this subsection now includes inquiries on all other topics derived from the role of the chairman (of the board or chairman of a committee), including determining the agenda for meetings. Explanatory note: The section was expanded to clarify that Section 57 does not prevent work meetings being held wherever necessary, such as meetings of a committee chairman with a relevant member of management in order to determine the agenda for meetings. 31.3. Subsection (b)(7) – The requirement to coordinate through the bank secretary and report to the board was replaced with a requirement to report to the bank secretary, who records the inquiry. Explanatory note:

The requirement to coordinate with the bank secretary was replaced with a reporting requirement, in order to ease the process in which directors request professional explanations from professional sources. The documentation requirement was added to prevent concerns of undue influence or involvement in matters that are not the responsibility of the board of directors. Accordingly, the requirement to report to the remaining board members was cancelled. 31.4. Subsections (c)(1) and (2) were repealed. Explanatory note: The requirement to concentrate all the requests and transfer them to the chairman of the audit committee was cancelled. It should be clarified that cancelling this requirement does not affect any requirement in this section to document the requests, to allow others to peruse the requests upon demand. 32. Section 59 (Evaluating the effectiveness of the board of directors’ work) 32.1. Subsection (a) – According to this section, the board of directors is required to examine both the effectiveness of its work, and efficiency, according among other things, the board’s structure and its work processes. Explanatory note: The effectiveness of the board’s work is made possible by, among other things, efficient work processes and a suitable structure, but does not end with these. Effectiveness is measured, among other things, by the board’s ability to meet the qualitative objectives that it sets for itself, such as identifying material weaknesses in the banking corporation’s work processes, adequately handling flaws, and adequate lessons-learned procedures. 32.2. Subsection (c) – The board is required to introduce changes in its work modes, as necessary. Explanatory note: In addition to a holding a discussion on the findings of the assessment process, the board should make the necessary changes to ensure that the assessment process leads to improvement in its work. Chapter 9 - Reporting to the Supervisor of Banks 33. Section 61 (Annual reporting) – the requirement to report the directors’ attendance was cancelled. Explanatory note: Cancelling this reporting requirement is designed to relax the requirements of reporting to the Supervisor of Banks, while the banking corporation remains responsible for examining compliance with the various Supervision requirements. 34. Section 62 (Reporting an exceptional event) – This section adds a new requirement to report immediately to the Supervisor of Banks on the resignation or dismissal of the Chief Compliance Officer or Chief Accountant. Explanatory note: This section was amended in view of the significance of these officers (in addition to the officers listed in subsection (b)) for the banking corporation, as a result of which an examination of each resignation or dismissal event involving them is required. Application 35. The amendments to the Directives as stated in this circular come into effect on the date of publication.

36. For the purpose of Section 22 (Number of directors) and Section 25 (Qualifications of the board of directors), the application date is July 1, 2020. It should be clarified that for the purpose of Section 22, no increase in the number of directors is allowed in the transition period until the application date. Revised file
37. Update pages for the Proper Conduct of Banking Business Directive file are attached. Following are the provisions of the update: Insert page Remove page 301-1-52 (07/17) [23] ( 06/15) [22] 301-1-51 Respectfully, Dr. Hedva Bar Supervisor of Banks