Israel's Bank Supervisor and Directive 411 on Crypto-sourced Funds: What Banks and Customers Should Prepare For

The Bank of Israel’s Banking Supervision Department has been developing its supervisory approach to how banks treat funds connected to virtual currencies. Proper Conduct of Banking Business Directive 411 governs anti-money-laundering and know-your-customer obligations for Israeli banking corporations, and the supervisory trend has been to move away from blanket refusal practices toward a case-by-case, risk-based approach to crypto-sourced funds. This direction recognises that the involvement of a licensed virtual-asset service provider (VASP) can act as a risk-mitigating factor, addresses the handling of proceeds of token offerings, and takes account of the distinct risk profile of stablecoins.

For Israeli exchanges, foreign custodians serving Israeli customers, corporate holders and retail investors, the practical question is no longer whether banks will accept crypto-sourced funds in principle, but what evidence and documentation will satisfy a bank’s risk assessment.

Audience: Israeli crypto businesses and exchanges; foreign exchanges and custodians with Israeli customers; investors and companies holding digital assets; and banks servicing clients with crypto-sourced funds. This article explains the supervisory approach to crypto-sourced funds under Directive 411, what banks must assess and record, what evidence customers should prepare, how licensed-VASP status helps, the AML obligations that remain, and the litigation risks involved. Readers should verify the current text and effective dates of any Directive 411 amendment directly with the Bank of Israel.

What the risk-based approach to Directive 411 changes, headline principles

The central principle of the supervisory approach is that banking corporations should not apply blanket refusals: a bank should not decline to provide payment services solely because funds are connected to virtual currencies. Instead, banks are expected to conduct an individualised, risk-based assessment of each customer and transaction, consistent with international standards and the Bank of Israel’s supervisory expectations.

The headline principles associated with this approach are:

• No blanket refusals. Banks should not refuse service purely because funds originate from or are connected to virtual-currency activity; a documented, case-by-case assessment is expected instead.
• Case-by-case risk assessment. Fixed rules of thumb are giving way to an individualised risk assessment of each customer and transaction.
• Licensed VASP recognition. The involvement of a licensed and supervised virtual-asset service provider can be recognised as a factor that mitigates risk.
• Token-offering proceeds. Supervisory guidance addresses how banks should handle the proceeds of token offerings.
• Stablecoins. The distinct risk profile of stablecoins is taken into account.

The practical significance is a shift in the market from a culture of refusal toward a culture of documented assessment. The table below contrasts the older practice with the risk-based approach.

What banks must assess, document and retain (risk-based checklist)

Under a risk-based approach to Directive 411, a bank’s decision to onboard or continue servicing a customer with crypto-sourced funds depends on the quality of its assessment and the documentation it retains. The supervisory expectation, consistent with international standards from the Financial Action Task Force (FATF), is that banks should calibrate due diligence to the risk presented by the customer, the counterparties, and the nature of the assets. A bank that applies a thoughtful, well-documented assessment is far better placed to defend its decision, whether it grants or declines service, than one relying on an informal or blanket policy.

Customer profile and KYC enhancements

Banks must build a comprehensive customer profile and enhance know-your-customer (KYC) procedures where the risk warrants it. Key factors include:

• Beneficial ownership. Identify the ultimate beneficial owners behind corporate accounts, including layered ownership structures and nominee arrangements.
• Business model. Understand how the customer generates revenue, whether through trading, custody, token issuance, mining or professional services.
• Source of wealth and source of funds. Distinguish the origin of the customer’s overall wealth from the origin of the specific funds being deposited.
• Linked accounts and counterparties. Map the network of accounts, wallets and trading partners connected to the customer to detect concentration or exposure to higher-risk jurisdictions.

Documentation to retain should include identity records, beneficial-ownership declarations, source-of-wealth narratives supported by evidence, and the bank’s internal risk rating with the reasoning behind it.

Identity and status of virtual-asset service provider (VASP)

Because licensed VASP involvement can be a mitigating factor, banks should verify the identity and regulatory status of any VASP in the transaction chain. This means confirming:

• Licence verification. Obtain and check the VASP’s licence or registration details and issuing authority.
• Regulatory jurisdiction. Identify where the VASP is supervised and whether that regime is credible.
• AML controls of the VASP. Assess the VASP’s own customer due diligence, transaction monitoring and reporting arrangements.

Where a VASP is licensed and supervised, the bank can place reasonable reliance on the VASP’s upstream checks, though it remains responsible for its own conclusions.

Asset/currency type, size and complexity

The nature of the asset materially affects risk. Banks should weigh:

• Stablecoins versus other tokens. Stablecoins may present a different profile from volatile or privacy-focused tokens.
• On-chain anonymity features. Assets or services designed to obscure provenance warrant heightened scrutiny.
• Transaction size and frequency. Large one-off inflows and high-frequency patterns each raise distinct questions that the assessment should address.

Transaction monitoring and red flags

Ongoing monitoring remains essential. Banks should configure systems to flag sudden high-value inflows inconsistent with the customer profile, funds routed through mixing or tumbling services, and other obfuscation techniques that break the traceable chain of custody. Each alert should be investigated and the outcome recorded.

Evidence customers should prepare, checklists by customer type

The most effective way for a customer to secure and preserve a banking relationship under a risk-based Directive 411 approach is to present a coherent evidence pack that answers a bank’s likely questions in advance. The packet needed differs by customer type, but the common thread is demonstrable provenance of funds and credible AML controls.

Israeli exchanges and crypto businesses

Israeli exchanges and crypto businesses should assemble:

• The VASP licence or registration and confirmation of supervisory status.
• Company incorporation documents and details of directors and officers.
• A written AML programme covering CDD, monitoring and reporting.
• Transaction logs demonstrating the flow of funds.
• Hot and cold wallet policies and key-management controls.
• Custodial agreements with third-party custodians.
• Independent audit or attestation reports.

A clear narrative linking these documents to the specific deposit helps the bank complete its source-of-funds assessment quickly.

Foreign exchanges and custodians with Israeli customers

Foreign platforms serving Israeli customers should prepare:

• Evidence of KYC and AML checks conducted on the underlying customer.
• The contract between the customer and the custodian or exchange.
• Proof of the transfer chain showing how funds moved to the Israeli account.
• The VASP licence or regulatory status in the home jurisdiction.
• Public blockchain evidence corroborating the on-chain movement of assets.

Corporate holders and token issuers

Companies holding digital assets or issuing tokens should compile:

• The whitepaper and token terms, where applicable.
• A current shareholder or cap-table list.
• A proceeds-usage plan explaining how token-sale funds will be deployed.
• Token-sale documentation and subscription records.
• Escrow or custody arrangements for the proceeds.
• Legal opinions, particularly on securities classification where relevant.

Because token offerings may implicate Israel Securities Authority rules, issuers should be ready to address the regulatory classification of their instruments.

Retail/investor checklist

Individual investors should gather exchange account statements, withdrawal histories, the relevant wallet addresses, and any chain-analytic reports or on-chain provenance links that trace the funds back to a legitimate source.

How licensed-VASP status helps, what banks will accept and why

The recognition of licensed VASPs as a mitigating factor is one of the most commercially significant elements of the risk-based approach. For customers, routing funds through a licensed and supervised VASP gives the bank a credible point of reliance: the VASP will itself have performed customer due diligence, monitored transactions and operated within a regulatory framework. This reduces the investigative burden the bank must carry alone and makes a favourable outcome more likely.

To take advantage of this factor, customers should provide verifiable evidence of the VASP relationship, including:

• Licence or registration details and issuer. Allowing the bank to confirm the licence directly with the supervisor.
• AML programme summary. Demonstrating the VASP’s controls over onboarding and monitoring.
• Proof of supervision. Evidence that the VASP is subject to ongoing regulatory oversight.
• Audit or attestation. Independent confirmation that controls operate as described.

It is important to manage expectations. Licensed-VASP status reduces but does not eliminate a bank’s obligations. The bank must still perform its own risk-based assessment, apply AML checks, and reach an independent conclusion. A VASP licence is a strong supporting factor, not a guarantee of acceptance. Where a bank treats VASP status as mitigating, the practical expectation is that it should articulate a specific, evidenced concern if it nonetheless declines service.

AML obligations that remain, reporting, CDD, suspicious activity and cooperation with authorities

A more flexible approach to crypto-sourced funds does not loosen the underlying anti-money-laundering framework. Banks and VASPs must continue to satisfy their customer due diligence (CDD), suspicious transaction reporting, enhanced due diligence for higher-risk relationships, record-retention, and cooperation duties. These obligations are grounded in Israel’s Prohibition on Money Laundering Law, 5760-2000, administered through the Israel Money Laundering and Terror Financing Prohibition Authority, and align with the FATF’s risk-based approach to virtual assets and VASPs.

In practice, several responsibilities sit alongside the Directive 411 approach:

• Customer due diligence. Banks must identify and verify customers and beneficial owners and understand the purpose of the relationship, the risk-based approach intensifies, rather than removes, this duty.
• Suspicious transaction reporting. Where a transaction raises suspicion of money laundering or terrorist financing, the obligation to report through the national reporting channels continues regardless of the source of funds.
• Enhanced due diligence. Higher-risk relationships, such as those involving anonymity-enhancing assets or higher-risk jurisdictions, require deeper investigation and senior-level approval.
• Record retention. Banks and VASPs must retain the documentation underpinning their assessments so decisions can be reconstructed and defended.
• Cross-border cooperation. Institutions must be able to respond to information requests and support inter-agency and international cooperation.

Responsibilities are shared but distinct. A VASP performs AML checks on its own customers and transactions; the bank performs its own checks on the customer in front of it and on the funds it receives. Each must maintain its own records and reporting discipline. The FATF guidance explains why these enhancements to CDD are justified for virtual-asset activity, and it offers a common reference point for calibrating controls in a way that both banks and VASPs can document.

Practical steps and timeline

Affected parties should not wait for further regulatory change. Now is the time to build documentation, test controls, and engage banking partners before onboarding volumes increase. A practical sequence is:

• Immediate (now). Map which accounts and transactions involve crypto-sourced funds; identify gaps in documentation; secure and verify VASP licences; and begin assembling evidence packs by customer type.
• Near-term. Update onboarding and acceptance policies to reflect the risk-based approach; conduct internal risk assessments; prepare introductory wording and evidence templates to present to banks; and open early dialogue with banking partners.
• Compliance testing. Dry-run the assessment process, confirm transaction-monitoring rules capture the relevant red flags, and ensure record-retention systems are ready.
• Contingency planning. Prepare for onboarding backlogs, maintain alternative banking relationships where feasible, and keep documentation current.
• Ongoing review. Monitor further Bank of Israel guidance and any amendments to Directive 411, which may bring refinements to the framework.

Engaging legal counsel to review policies and evidence templates is a sensible precaution. Because the regulatory framework continues to develop, confirm the current text and any effective dates of Directive 411 directly with the Bank of Israel before relying on them.

Litigation and enforcement risks, what to watch and remedial options

This area carries litigation and enforcement exposure on both sides. For banks, applying a blanket refusal or failing to document a risk-based assessment can invite administrative scrutiny, regulatory attention and reputational damage. For customers, an unjustified denial of payment services can cause real commercial harm and give rise to legal claims.

Where a bank declines service, affected customers have remedial avenues. Sensible pre-litigation steps include a formal demand letter setting out the evidence provided and requesting reasons for the refusal, followed by a complaint to the Bank of Israel’s banking supervision complaints channel where appropriate. In urgent cases, for example, where loss of banking access threatens a business, interim relief through the courts may be considered. Israeli case law has addressed the circumstances in which a bank may refuse to provide services in the context of crypto-related funds, and outcomes turn closely on the facts and the quality of the parties’ documentation. Early legal advice helps a customer preserve evidence, frame the complaint correctly and choose the right forum.

Key takeaways

The direction of travel is clear. The supervisory approach to Directive 411 discourages refusing customers simply because their funds touch virtual currencies, moves away from rigid thresholds toward case-by-case assessment, and rewards engagement with licensed VASPs. In exchange, it demands disciplined, documented, risk-based assessment from banks and well-prepared evidence from customers. The parties that benefit most will be those that treat this period as preparation time, building documentation and testing controls before they are needed.

Sources

1. Bank of Israel (Banking Supervision Department)
2. Israel Money Laundering and Terror Financing Prohibition Authority (Government of Israel)
3. Israel Securities Authority (ISA)
4. Financial Action Task Force (FATF), Guidance for a Risk-Based Approach to Virtual Assets and VASPs
5. Israel Bar Association