Israel

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Israel are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who is the financial regulator?

  The Financial Services industry is not governed by a sole regulator in Israel. Depending on the financial activity and the business services, different regulatory frameworks apply. The Bank of Israel (BoI) regulates banking activity and payment and clearing systems. The Capital Market, Insurance and Savings Authority (CMISA) is responsible for financial services in the insurance, pension and provident funds markets and its primary purpose is to ensure stability and competitiveness in these markets. The CMISA, in its role as the supervisor of financial services providers, supervises non-bank providers of financial assets and their related services which includes lending.

  The Israel Securities Authority (ISA) regulates and supervises public companies listed on the Israeli Stock Exchange and the activity of the mutual funds sector, and safeguards the interests of public investments is securities. The Privacy Protection Authority regulates data protection and security. The Israel National Cyber Directorate (INCD) is responsible for all aspects of cyber defense in the civilian sphere.
  

• What regulations apply to financial institutions using AWS?

  Financial institutions in Israel may be subject to a number of different regulatory requirements, including on outsourcing arrangements, when they use cloud services.

  A banking corporation should develop, implement, and maintain an operational risk management framework that is fully integrated into their overall management processes. The risk assessment must be performed before engaging the provider and periodically thereafter. Firms regulated by the BoI should review the Proper Conduct of Banking Business Directives.
  

  The following directives are particularly relevant: No. 357 (“Banking Supervisor Procedures with respect to the Management of Information Technology”), No. 359A (“Banking Supervisor Procedures with respect to Outsourcing”), No. 361 ("Cyber Defense Management"), No. 362 (“Banking Supervisor Procedures with respect to Cloud Computing Banking Services”), No. 363 (“Banking Supervisor Procedures with respect Supply Chain Cyber Risk Management”), and No. 355 (“Business Continuity Management”). Information on differences between material and non-material services that can be hosted in the cloud are set out in the BoI directives referenced above.

  Institutional entities (i.e., insurance companies and management companies of provident and pension funds) must manage their cyber risks in an effective, up-to-date and ongoing manner, and on the basis of proper corporate governance principles that include reference to methods, processes and controls and in a way that will enable them to deal with cyber threats and manage cyber incidents. Such institutions should review the CMISA Circular on Cyber Risk Management in Institutional Entities (Hebrew only), the circular regarding Outsourcing in Institutional Entities (Hebrew only), and the Summary of Cyber Audit Findings (Hebrew only).

  Financial institutions regulated by the CMISA that are required to submit a document depicting their management of cyber risks as part of their licensing application, should consider the Cyber Defense Methodology for an Organization paper published by the INCD as part of their cyber risks management plan. The ISA has also issued guidance (Hebrew only) on required disclosures relating to cyber risks and incidents.

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institution customers to obtain appropriate advice on their compliance with all regulatory requirements that are relevant to their business, including local regulations, guidelines and laws.
   

• Key considerations for financial institutions using AWS

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Develop, implement, and maintain an operational risk management framework that is fully integrated into their overall management processes in line with the BoI directives for banking corporations. Perform a risk assessment before engaging the provider and periodically thereafter.
  

  2. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’ audit reports and conduct their assessment of the control responsibilities.

  3. Assess their policies and processes and update their governance framework as needed to evaluate and manage the change in the operational risk exposure from outsourcing to AWS. Review and assessment of the risk deriving from the laws in the jurisdiction in which the provider or the provider’s system is located.
  

  4. Generally, banking corporations should refrain from using cloud-computing for core services and core systems.

  If you have questions about using AWS services or need more information, please contact us.

• Key data protection, data privacy, and data residency considerations for financial institutions in Israel using AWS

  Financial institutions in Israel using AWS should consider applicable data protection and data privacy requirements, including:

  • The Israeli Privacy Protection Law, 5741-1981, in particular, Chapter B, which regulates protection of privacy in computerized databases.
  • The Privacy Protection Regulations (Data Security) 5777-2017.
  • The Privacy Authority’s Guidelines No. 2/2011- "The Use of Outsourcing Services for Personal Information Processing."
  • The Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001 (the "Data Transfer Regulations").

  The Data Transfer Regulations allows for data to be transferred and stored in regions where there is equal or more stringent data protection regulations to Israeli Law or to other regions upon fulfilling one of the conditions laid down in the Data Transfer Regulations (e.g., consent of the data subject or transfer to a country covered by the EU General Data Protection Regulations). Customers in Israel should be aware that the Data Transfer Regulations prohibit the onward transfer of personal data by the original foreign recipient.
  

  Customers in Israel can transfer data into and out of our AWS Regions throughout the European Economic Area (EEA) and Israel. Please note that the EEA includes the European Union (EU).
  

  Customers processing or planning to process the personal data of data subjects in the EEA should visit AWS’ General Data Protection Regulation (GDPR) Center. More information on these requirements is available at Navigating GDPR Compliance on AWS.

  AWS has announced the launch of the Israel (Tel Aviv) Region – in the first half of 2023 with three Availability Zones. This new Region will give AWS customers in Israel the ability to run workloads and store data that must meet low latency or data processing or residency requirements.

Resources