# Bank of Israel fines Isracard NIS 700,000 for opening accounts with unapproved remote facial identification Source: https://www.bankingnewsai.com/ai-incidents/isracard-2024-boi-remote-facial-identification-sanction Last updated: Oct 21, 2026 Isracard · Governance finding · severity 2 of 5 Per the Bank of Israel's Banking Supervision Department, Isracard used a remote face-to-face identification and authentication technology to open online accounts for loans and for settlement services to merchants without notifying the department in advance, as Proper Conduct of Banking Business Directive 367 requires, and without obtaining its approval. On 12 May 2024 the department imposed a NIS 700,000 monetary sanction, cut from a NIS 1 million maximum because Isracard stopped using the technology once instructed and corrected the defects. Isracard told Calcalist it had launched an advanced facial-recognition system, that a defect had occurred in obtaining the required approval, and that the system was taken offline until approval was granted and then relaunched. The regulator did not describe the system as AI; no customer harm was reported. ## Key facts | | | | --- | --- | | Date | May 12, 2024 | | Institution | Isracard | | Country | Israel | | AI system | Remote visual identification and authentication (facial recognition) used to open online accounts for loans and merchant settlement | | AI? | Machine-learning system (inferred from the record) — The sources describe a machine-learning model; nobody on the record labelled it AI. | | Category | Regulatory finding (Governance finding) | | Status | Regulator finding | | Severity | 2 of 5 — A regulatory finding with a NIS 700,000 monetary sanction (well under $1m), reduced by 30% because the company stopped using the technology when instructed; no customer harm or loss was reported. | ## What happened? A Banking Supervision Department examination found that Isracard "uses a remote face-to-face identification and authentication technology for the purpose of opening an online account in order to provide loans and in order to provide settlement services to authorized merchants, without notifying the Banking Supervision Department as required by Section 76 of Proper Conduct of Banking Business Directive 367, and certainly without obtaining its approval". Section 76 requires a banking corporation wishing to use such technology to notify the department in advance, "presenting all the risks and means of managing them", and to receive its approval. [1] The department explained that its 2018 amendment to Directive 367 on e-banking lets banking corporations open accounts online with remote face-to-face identification, subject to appropriate controls and prior approval once it has ascertained that controls are in place, with the aim of preventing "the exploitation of technology for purposes of fraud and impersonation" and upholding anti-money-laundering and documentation rules. Calcalist reported that Isracard began operating the service before receiving such a permit. [1][2] The maximum sanction for this type of breach is NIS 1,000,000. Because Isracard stopped using the technology from the moment the department instructed it to, and acted to correct the defects and obtain the necessary permit, the department reduced the sanction by 30 percent to NIS 700,000. Supervisor of Banks Daniel Hahiashvili said banking corporations using innovative technologies "must make sure to fulfill the provisions of the laws and regulations". [1] ## Timeline - May 12, 2024 — The Bank of Israel's Banking Supervision Department announces a NIS 700,000 monetary sanction on Isracard for using remote face-to-face identification without prior notice and approval. [1] - May 12, 2024 — Calcalist reports the sanction; Isracard says its facial-recognition system was taken offline until approval was obtained and then relaunched. [2] ## What was the impact? - Financial: NIS 700,000 monetary sanction - Customers: No customer harm reported; the technology was used to open online accounts for loans and merchant settlement - Other: Isracard stopped using the technology when instructed and sought the required approval. [1][2] ## How did Isracard respond? Isracard told Calcalist (translated from Hebrew): "Isracard works to advance digitisation processes and launched an advanced and reliable facial-recognition system, which was approved by the Bank of Israel. We act in accordance with the Banking Supervision Department's guidelines, but unfortunately, in this case a defect did occur in obtaining the required approval from the supervisor, and the system was taken offline until the required approval was received and then relaunched." [2] ## What was the outcome? The Bank of Israel imposed a NIS 700,000 sanction; Isracard stopped using the technology until approval was granted, and, by its own account, relaunched the facial-recognition system once the Bank of Israel approved it. No further enforcement action over the system was found in the sources reviewed as of 2026-10-21. [1][2] ## FAQ ### Why did the Bank of Israel fine Isracard? Its Banking Supervision Department found that Isracard used remote face-to-face identification and authentication to open online accounts for loans and merchant settlement without first notifying the department and obtaining its approval, as Directive 367 requires. It imposed a NIS 700,000 sanction in May 2024. ### Was Isracard's identification system AI? The Bank of Israel described it as remote face-to-face identification and authentication technology and did not call it AI. Isracard itself told Calcalist it was a facial-recognition system, a technology typically built on machine-learning models, which is why this record treats it as an inferred machine-learning system. ### Were Isracard customers harmed? No customer harm, fraud or loss was reported. The breach was procedural: the technology went live without the regulator's prior review of its risks and controls. Isracard stopped using it when instructed and relaunched it after approval, the Bank of Israel and Isracard said. ### Why was the Isracard fine reduced? The maximum sanction for this breach is NIS 1,000,000. The Bank of Israel cut it by 30 percent to NIS 700,000 because Isracard stopped using the technology as soon as it was instructed, corrected the defects and sought the necessary permit. ## Sources 1. [The Banking Supervision Department imposes a monetary sanction of NIS 700,000 on the IsraCard company](https://www.boi.org.il/en/communication-and-publications/press-releases/the-banking-supervision-department-imposes-a-monetary-sanction-of-nis-700-000-on-the-isracard-company/) — Bank of Israel, May 12, 2024 (official): "In view of this, the Banking Supervision Department has decided to impose a monetary sanction of NIS 700,000 on IsraCard." 2. [ישראכרט החלה בזיהוי לקוחות מרחוק ללא אישור ונקנסה ב-700 אלף שקל](https://www.calcalist.co.il/market/article/b1v8qg0mr) — Calcalist, May 12, 2024 (news): "והשיקה מערכת מתקדמת ואמינה לזיהוי פנים, שאושרה על ידי בנק ישראל" All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents --- Canonical page: https://www.bankingnewsai.com/ai-incidents/isracard-2024-boi-remote-facial-identification-sanction Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.