Isracard · Governance finding · severity 2 of 5
Per the Bank of Israel's Banking Supervision Department, Isracard used a remote face-to-face identification and authentication technology to open online accounts for loans and for settlement services to merchants without notifying the department in advance, as Proper Conduct of Banking Business Directive 367 requires, and without obtaining its approval. On 12 May 2024 the department imposed a NIS 700,000 monetary sanction, cut from a NIS 1 million maximum because Isracard stopped using the technology once instructed and corrected the defects. Isracard told Calcalist it had launched an advanced facial-recognition system, that a defect had occurred in obtaining the required approval, and that the system was taken offline until approval was granted and then relaunched. The regulator did not describe the system as AI; no customer harm was reported.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
Isracard
Country
Israel
AI system
Remote visual identification and authentication (facial recognition) used to open online accounts for loans and merchant settlement
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Regulator finding
Severity
2 of 5
Impact
NIS 700,000 monetary sanction · No customer harm reported; the technology was used to open online accounts for loans and merchant settlement · Isracard stopped using the technology when instructed and sought the required approval.
What happened?
A Banking Supervision Department examination found that Isracard "uses a remote face-to-face identification and authentication technology for the purpose of opening an online account in order to provide loans and in order to provide settlement services to authorized merchants, without notifying the Banking Supervision Department as required by Section 76 of Proper Conduct of Banking Business Directive 367, and certainly without obtaining its approval". Section 76 requires a banking corporation wishing to use such technology to notify the department in advance, "presenting all the risks and means of managing them", and to receive its approval.[1]
The department explained that its 2018 amendment to Directive 367 on e-banking lets banking corporations open accounts online with remote face-to-face identification, subject to appropriate controls and prior approval once it has ascertained that controls are in place, with the aim of preventing "the exploitation of technology for purposes of fraud and impersonation" and upholding anti-money-laundering and documentation rules. Calcalist reported that Isracard began operating the service before receiving such a permit.[1][2]
The maximum sanction for this type of breach is NIS 1,000,000. Because Isracard stopped using the technology from the moment the department instructed it to, and acted to correct the defects and obtain the necessary permit, the department reduced the sanction by 30 percent to NIS 700,000. Supervisor of Banks Daniel Hahiashvili said banking corporations using innovative technologies "must make sure to fulfill the provisions of the laws and regulations".[1]
When did it happen?
- May 12, 2024
The Bank of Israel's Banking Supervision Department announces a NIS 700,000 monetary sanction on Isracard for using remote face-to-face identification without prior notice and approval.[1]
- May 12, 2024
Calcalist reports the sanction; Isracard says its facial-recognition system was taken offline until approval was obtained and then relaunched.[2]
What was the impact?
- Financial: NIS 700,000 monetary sanction[1][2]
- Customers: No customer harm reported; the technology was used to open online accounts for loans and merchant settlement[1][2]
- Other: Isracard stopped using the technology when instructed and sought the required approval.[1][2]
Severity 2 of 5: A regulatory finding with a NIS 700,000 monetary sanction (well under $1m), reduced by 30% because the company stopped using the technology when instructed; no customer harm or loss was reported.
How did Isracard respond?
Isracard told Calcalist (translated from Hebrew): "Isracard works to advance digitisation processes and launched an advanced and reliable facial-recognition system, which was approved by the Bank of Israel. We act in accordance with the Banking Supervision Department's guidelines, but unfortunately, in this case a defect did occur in obtaining the required approval from the supervisor, and the system was taken offline until the required approval was received and then relaunched."[2]
What was the outcome, and did regulators act?
The Bank of Israel imposed a NIS 700,000 sanction; Isracard stopped using the technology until approval was granted, and, by its own account, relaunched the facial-recognition system once the Bank of Israel approved it. No further enforcement action over the system was found in the sources reviewed as of 2026-10-21.[1][2]
Why did the Bank of Israel fine Isracard?
Its Banking Supervision Department found that Isracard used remote face-to-face identification and authentication to open online accounts for loans and merchant settlement without first notifying the department and obtaining its approval, as Directive 367 requires. It imposed a NIS 700,000 sanction in May 2024.
Was Isracard's identification system AI?
The Bank of Israel described it as remote face-to-face identification and authentication technology and did not call it AI. Isracard itself told Calcalist it was a facial-recognition system, a technology typically built on machine-learning models, which is why this record treats it as an inferred machine-learning system.
Were Isracard customers harmed?
No customer harm, fraud or loss was reported. The breach was procedural: the technology went live without the regulator's prior review of its risks and controls. Isracard stopped using it when instructed and relaunched it after approval, the Bank of Israel and Isracard said.
Why was the Isracard fine reduced?
The maximum sanction for this breach is NIS 1,000,000. The Bank of Israel cut it by 30 percent to NIS 700,000 because Isracard stopped using the technology as soon as it was instructed, corrected the defects and sought the necessary permit.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning