Israel

Article 8A requires registration of a database where the listed conditions apply, with the application procedure in article 9; article 13 gives every person the right to access personal data about them in a database, and article 15 allows a Magistrate's Court claim if access is refused. Article 17 makes controllers and processors responsible for data security.

The Order requires identification certificates to be kept for at least seven years after the account is closed or the transaction carried out (s. 7), and transaction details and instruction documents for at least seven years from the date recorded in the bank's books, longer if the Supervisor requires (s. 14). Directive 411 requires irregular-activity findings and report documentation to be kept no shorter than seven years (ss. 39, 40(c)).

Directive 411 requires an AML/CFT Officer of senior formal status with suitable credentials (s. 14(a)) and unrestricted access to customer and transaction records (s. 14(c)); the Chief Compliance Officer may hold the role (s. 14(b)). The Officer presents an annual assessment directly to management and the board (s. 17). Section 8 of the Prohibition on Money Laundering Law separately provides for a person responsible for compliance.

A bank may not open an account without recording the identification particulars (Order s. 2(a)) and identifies customers before the first transaction in the account (s. 6(a)). Directive 411 applies KYC at account opening (s. 10(a)), uses a structured risk questionnaire (s. 29), requires enhanced measures for high-risk customers (s. 30) and screening of PEPs (ss. 58-61).

Section 10.1 requires a telephone report to the Banking Supervision Department's Technology, Innovation and Cyber Division within two hours of identifying a reportable incident and a written initial report within eight hours of the telephone report. Written updates are due at least daily (s. 12.1) and an investigation report within 45 days of completion or 60 days of identification, whichever is earlier (s. 16).

Section 33(a) requires the bank to explain the rationale for a material outsourcing to the Supervisor promptly after the senior-management decision. Within 21 days the Supervisor may say whether it intends to examine the arrangement (s. 33(b)); if it does, it presents the results, including any approval conditions, within 90 days of receiving all the information (s. 33(c)). The bank must report developments that materially affect the provider (s. 34).

A banking corporation reports an unusual transaction by a service recipient to the competent authority (Order s. 9(a)). The Order sets no deadline; Directive 411 requires reports to be made as promptly as the circumstances allow and any justified delay documented (s. 40(b)).

Identification documents are kept at least seven years after the end of the year in which the contract obligation concluded or the account closed (s. 6); transaction details and correspondence for seven years after the end of that year (s. 17(b)); reports to the competent authority for seven years from the transaction date (s. 17(c)). The Commissioner may require longer.