Is a payment provider, in Israel

Proper Conduct of Banking Business Directive 366 (Reporting of Technological Failures, Data Security Incidents, and Cyber Attacks), sections 3, 6, 10, 12 and 16 · Read the law's page

• This binds a banking corporation as defined in the Banking (Licensing) Law, 5741-1981, a corporation defined in section 11(b)(1) of that Law, and a payment service provider with prudential importance license holder (reached by declaring that you are a bank or a payment or e-money provider); a corporation controlled by a banking corporation that is not itself one reports only an incident with a significant impact on the banking group or the banking system (Directive 366, sections 3 and 6.5).
• Report to the Banking Supervision Department a significant technological failure incident, a suspected cyber incident whose handling was not completed within four hours of its initial identification or within two hours from knowledge of the damage it caused, a cyber incident that affects a large number of customers or has new offensive characteristics, and any significant data leak incident (section 6).
• Report by telephone, at any time of day, within two hours of identifying the incident as one that requires reporting, and supplement the telephone report with a written initial report within 8 hours from the time of the telephone report (sections 10.1 and 10.2).
• Appoint a Reporting Officer for Technological Failure and a Reporting Officer for Information Technology Incidents, and give their details to the Technology, Innovation, and Cyber Division of the Banking Supervision Department (sections 8 and 9).
• Submit up-to-date written information on the incident at least once daily or whenever its characteristics or consequences change significantly, and report the completion of the incident (sections 12 and 13).
• Investigate the incident under a procedure carried out by or with the involvement of a function independent of the incident, and submit the approved investigation to the Banking Supervision Department within 45 days from the completion of the incident or within 60 days from its identification as one that requires reporting, whichever is earlier (sections 14 to 16).
• Document the decision, the function that made it and its reasons when you examined the need to report an incident and decided not to report it (section 17).

Proper Conduct of Banking Business Directive 364 (Management of IT, Information Security, and Cyber Protection Risks), sections 10, 28, 106 and 171 · Read the law's page

• This binds a banking corporation as defined in the Banking (Licensing) Law, 5741-1981, a corporation the Directive reaches under sections 11(a)(3a), 11(a)(3b) and 11(b) of that Law, and a payment services provider with prudential importance license holder (reached by declaring that you are a bank or a payment or e-money provider), from 18 May 2026 (Directive 364, section 10.1).
• Appoint a senior employee as the Chief Cyber Defense and Information Security Officer, subordinate to a member of management, responsible for monitoring and ensuring that you comply with the information security management framework (section 28).
• Document an information security and cyber defense policy that refers to the issues in section 106, among them identity management and logical access management controls, controls across the information asset lifecycle, monitoring and managing information security incidents, and information security when you enter agreements with third parties (section 106).
• Establish identity management and logical access management controls that allow access to information assets only when a clear business need exists (section 116).
• Use authentication of increased strength, such as multi-factor authentication, for system administrator access and remote access through a public network to a critical or sensitive information asset (section 119).
• Report technological failure incidents and information security incidents to the Supervisor of Banks as Directive 366 requires (section 171.1).