Supervision of Overseas Branches

Bank of Israel Banking Supervision Department Policy and Regulation Division April 24, 2018 Circular no. C-06-2561 Attn: Banking corporations Re: Supervision of Overseas Branches (Proper Conduct of Banking Business Directive no. 306) (Proper Conduct of Banking Business Directive no. 306A) Introduction

1. Banking corporations operate abroad through controlled corporations, branches, and representative offices (collectively: overseas branches]. Unique risks are inherent in this activity. These risks have materialized in recent years, foremost in the field of compliance and particularly compliance relating to the prohibition of money laundering and terror financing. The realization of these risks have prompted the Banking Supervision Department (hereinafter, BSD) to toughen regulation of the banking corporations’ cross-border activity and to promulgate this Proper Conduct of Banking Business Directive (hereinafter, the Directive).
2. This Directive adds to existing directives from the BSD, which include requirements for control on a consolidated basis, and is meant emphasize the importance of control over overseas branches and of having in place high￾quality mechanisms of corporate governance, audit, and control at the overseas branches themselves.
3. The Directive articulates the BSD’s stand that banking corporations should concentrate their activity in main overseas branches only, in a small number of jurisdictions, and on a scale that will allow each banking corporation to allocate appropriate managerial resources, focus its activity, and have the required expertise in managing the risks that exist in the jurisdictions in question.
4. After consulting with the Advisory Committee on Banking Matters and with the approval of the Governor, I have established this Directive. Main provisions of the Directive
5. Implementation of directives of the Supervisor of Banks at the branches (Section 3)—The BSD expects banking corporation to act to apply the principles of the Supervisor of Banks’ directives that concern corporate governance and risk management at the overseas branches insofar as they do not contradict the provisions of local laws and regulations.

Explanation In general, the directives of the Supervisor of Banks set best standards commensurate with the world. Accordingly, the BSD expects the banking corporation to act to apply the principles of the Supervisor of Banks' Directives in the fields of corporate governance, control, and risk management at their overseas branches. 6. Definitions (Section 4) Explanation The definitions in the Directive rely on existing definitions from other Directives. It is explained for clarity that while the requirements in the Directive apply to controlled corporations, branches, representative offices, and mobile representatives abroad, they will be applied to representative offices and mobile representatives abroad mutatis mutandis in respect of the nature of their activity and the types of risks that they may impose on the banking group (e.g., compliance risks and reputation risk). 7. Board of Directors—strategy of overseas activity and its risk appetite (Section 5)—The Board of Directors must set its overseas strategy and, in particular, must determine the countries in which the banking group wishes to operate and those in which it does not, in which activities each overseas branch may and may not engage, and the minimum size of a branch that will allow it to maintain adequate audit and control resources. Wherever existing activity is inconsistent with its strategy, the banking corporation must prepare a plan for the cessation of its activity in the relevant country or at the relevant overseas branch and must implement it no later than December 31, 2020. Explanation The BSD has fine-tuned its expectations of the Board of Directors in devising a strategy for its overseas branch activity, including reexamination of existing strategy. 8. Board of Directors—supervision role and risk-management committee (Sections 6–7)—The Board of Directors must verify that senior management is implementing an adequate group-based risk-management framework and is effectively supervising the overseas branches’ activity, inter alia by means of the audit and control functions of the banking corporation and by means of a function responsible for coordinating and analyzing the situation at the overseas branches. In addition, due to the physical distance from the overseas branches and lack of knowledge and expertise in the various jurisdictions, the Board of Directors must verify that the overseas branches’ own audit and control environment is subjected to independent external audits and that the main findings of these audits be presented to it. The Directive also stresses the importance of having the parent corporation’s Board of Directors and risk￾management committee discuss the situation and risk exposure of the overseas branches.

Explanation The BSD emphasize its expectations from the Board of Directors in regard to supervising the banking group’s overseas activity. It is explained for clarity that the list of Directives in Section 6(a) is not exhaustive. 9. Senior management—group-level risk-management (Section 8)—Senior management is responsible for having in place a group-level framework for risk management that includes overseas branches, for verifying that those responsible at the group level assure adequate inclusion of the overseas branches in their purview, and for the absence of barriers to the implementation of the group-level risk-management framework, including the timely receipt of requisite information. Also, effective processes must be in place for administration and monitoring of the correction of deficiencies found at the overseas branches, at the overseas branches themselves and at the banking corporation. Explanation The BSD emphasizes its expectation that risk management will take place on a consolidated basis, including overseas branches. 10. Senior management—effective risk-management at overseas branches (Section 9)—Senior management is responsible for making sure that the risk￾management framework assimilated at overseas branches is adequate, that the branches’ risk-management functions have adequate and appropriate resources commensurate with their job, and that the overseas branches have management information systems that support their risk-management. Also, the risk￾management framework at each overseas branch should be examined by means of external audits, as set forth in Section 6(b) of the Directive. Explanation Consolidated risk-management must also include mechanisms meant to verify that each overseas branch maintains adequate risk management and has the enabling tools for it. 11. Senior management—Aggregate and analyzed view of overseas branches (Section 10)—as part of the tools to control overseas offices, a banking corporation must set a unit responsible for the aggregation and analysis of information on overseas branches as detailed in the Directive. Explanation The central unit at the banking corporation is responsible for putting together a comprehensive picture of the state of affairs at the overseas branches and analyzing it. It shall report to the Board of Directors on its work products. 12. Compliance and management of anti-money laundering and countering financing of terrorism risks (Section 11)—Compliance and management of anti-money laundering and countering financing of terrorism risks are material elements in the management of risks of overseas branches. The parent

corporation must give them due attention, encompass them in group-level policy, make sure that the overseas branches have adequate resources to manage them, and examine the effectiveness of these overseas branch-level risk-management processes. Extra stringency must be applied in regard to requisite transparency in managing customer accounts. These areas of activity and the function responsible for them shall also be examined by means of external audits, as stated in Section 6(b) of the Directive. Explanation Given the realization of compliance risks at various overseas branches in recent years, particularly in regard to statutory and regulatory requirements concerning prohibition of money laundering and terror financing, a banking corporation that wishes to engage in overseas activity must tighten and improve its risk management in these fields, both at its own level and at the overseas branches. 13. Internal audit (Section 12)—Internal audit at the overseas branch shall comport with the standards set forth in Directive 307 and shall be examined periodically by an independent external examiner. The banking corporation internal audit shall examine the effectiveness of the corporation’s control over its overseas branches and shall report to the audit committee on the main findings of the overseas branch-level audit, as well as any irregular finding therein. Explanation Internal audit is an additional and important layer in supervising overseas offices. Therefore, the Directive expresses in more pointed terms the role of internal audit in regard to overseas branches, including examination of the parent corporation’s supervision of the branches. Effective Date 14. (a) This Directive shall go into effect on January 1, 2019. (b) Notwithstanding the contents of Section (a), a banking corporation may align its overseas branch activity with the strategy that it shall determine under Section 5(a) of this Directive by December 31, 2020, insofar as it needs time to prepare for the downscaling of activities and/or the closure of overseas branches. Cancellation of Supervisor’s letter 15. The Supervisor’s letter of August 18, 2008, concerning banking corporations’ exposure to the activity of branches abroad (S-341), is canceled as of the date specified in Section 14 supra. Renumbering of Proper Conduct of Banking Business Directive 306 16. With the promulgation of this Directive, the number of Proper Conduct of Banking Business Directive 306 (“Control or Substantial Non-Controlling Interest in Financial Corporations Abroad”) shall be revised to Proper Conduct of Banking Business Directive 306A.

Revised file 17. Update pages for the Proper Conduct of Banking Business Directive file are attached. Following are the provisions of the update: Remove page Insert page (8/13) [2] 306-1-4 ——— (4/18) [3] 306A-1-4 (4/18) [1] 306-1-10 Respectfully, Dr. Hedva Ber Supervisor of Banks