Fintech regulation in Israel: which license you need

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Why fintech in Israel starts with regulation, not with the product

Fintech (Financial Technology) is the use of technology to provide financial services: payments, loans, investments, digital insurance and asset management. Israel is one of the global fintech centers, with hundreds of startups serving customers in Israel and around the world.

But unlike other technology fields, in fintech, unlicensed activity is a criminal offense. Oversight in Israel is split among at least three authorities, each with a different area of authority. If you build a financial product without understanding the regulatory map, you may reach a seed round with problems that cannot be solved easily.

Who supervises what: a map of the authorities

Fintech regulation in Israel is divided by type of service:

• Bank of Israel: the Supervisor of Banks supervises banking corporations under the Banking Ordinance, 1941 and the Banking (Licensing) Law, 5741-1981 (חוק הבנקאות (רישוי), התשמ״א-1981). The Payment Services Law, 5779-2019 regulates the relations between payment service providers and their customers; it is not a licensing law.
• Israel Securities Authority: supervises portfolio managers, investment advisers and the securities market, under the Securities Law, 5728-1968 (חוק ניירות ערך, התשכ״ח-1968) and the Regulation of Investment Counseling, Investment Marketing and Portfolio Management Law, 5755-1995. It also grants licenses to payment companies and payment initiation service providers (section 2 of the Regulation of Engagement in Payment Services and Payment Initiation Law, 5783-2023), and to financial information service providers (section 2 of the Financial Information Service Law, 5782-2021 (חוק שירות מידע פיננסי, התשפ״ב-2021)).
• Capital Market, Insurance and Savings Authority: supervises insurers and insurance agents, provident funds and pension funds. Under the Supervision of Financial Services (Regulated Financial Services) Law, 5776-2016, it also supervises non-bank credit providers and providers of a service in a financial asset, including virtual currency.
• Israel Money Laundering and Terror Financing Prohibition Authority: the “competent authority” under the Prohibition on Money Laundering Law, 5760-2000 (חוק איסור הלבנת הון, התש״ס-2000; section 29). It receives the reports and manages the database (section 28). The duties of identification (KYC), reporting and record-keeping apply to the financial bodies set out in the Law and in the orders under it (section 7).

A company that operates across fields (for example, both payments and investments) may need licenses from several authorities at the same time.

Which license you need depends on what you offer

There is no general “fintech license”. The license required depends entirely on the type of service. If you offer several services, you may need several licenses at the same time:

• Payment service provider (PSP): under the Regulation of Engagement in Payment Services and Payment Initiation Law, 5783-2023, anyone who engages in providing payment services (managing a payment account, issuing a means of payment, clearing or payment initiation) must hold a license from the Israel Securities Authority (section 2), unless exempt, for example a banking corporation (section 3). Engaging in this without a license is an offense (section 55).
• Non-bank credit: providing credit as a business requires a credit license from the Supervisor of Financial Service Providers at the Capital Market Authority (section 12 of the Supervision of Financial Services (Regulated Financial Services) Law, 5776-2016). A loan contract is subject to the ceiling on the “maximum cost of credit” in the Fair Credit Law, 5753-1993 (חוק אשראי הוגן, התשנ״ג-1993; section 5).
• Investment portfolio management: a license from the Israel Securities Authority, with equity requirements and fitness tests for managers.
• Crowdfunding platform: an offer of securities to the public through a website is made through an “offering coordinator”: a company registered in the register of coordinators kept by the Chairperson of the Israel Securities Authority (section 35MM of the Securities Law, 5728-1968; Securities Regulations (Offering of Securities through an Offering Coordinator), 5777-2017 (תקנות ניירות ערך (הצעת ניירות ערך באמצעות רכז הצעה), התשע״ז-2017)).
• Digital assets (crypto): providing a service in virtual currency (exchange, including conversion, sale or transfer; management; or safekeeping) is a “service in a financial asset”. It requires a license from the Supervisor of Financial Service Providers at the Capital Market Authority (sections 11A and 12 of the Supervision of Financial Services (Regulated Financial Services) Law). A digital asset that is a security is also subject to the Securities Law, and providers of a service in a financial asset are subject to the anti-money laundering order that applies to them.

What every fintech company must do, whatever its license

Even after you receive the specific license, there is a compliance floor that applies to everyone:

• KYC (know your customer): identifying customers and verifying identity before opening an account. This is required under the Prohibition on Money Laundering Law and the reporting regulations.
• AML (anti-money laundering): a system to monitor suspicious transactions and report to the financial intelligence unit (IMPA) in the Ministry of Justice.
• Data security: compliance with the Protection of Privacy Regulations (Data Security), 5777-2017. Appointing a data security officer is mandatory for the bodies listed in section 17B of the Protection of Privacy Law, 5741-1981. They include a bank, an insurance company, a company engaged in rating or assessing credit, and anyone who holds five databases that must be registered or notified.
• Financial information is sensitive information: since Amendment No. 13 to the Protection of Privacy Law (in force from 14 August 2025), personal information about a person’s salary data and financial activity is “information of special sensitivity” (section 3). A database that does not have to be registered and contains such information about more than 100,000 people requires a notice to the Privacy Protection Authority within 30 days (section 8A(b)). A body whose main business includes processing such information on a significant scale (among them a banking corporation and an insurer) must appoint a privacy protection officer (section 17B1(a)(4)).
• Minimum equity: every license sets an equity threshold that must be maintained throughout the activity.
• Ongoing reporting: reports, notices and data to the relevant authority, on the dates and in the manner set in its directives (for example, section 25(b) of the Payment Services Regulation Law).
• Corporate governance: qualified senior management, including a dedicated compliance officer.

Tiered licensing and exemptions: how to start on a small scale

The law itself sets tiered requirements. The Supervision of Financial Services (Regulated Financial Services) Law has a “basic license” for activity that is not extensive and an “extended license” above it, for example for a credit portfolio of more than NIS 25 million (section 11A). The Payment Services Regulation Law exempts from a license anyone who provides a payment service on a limited scale, as set by the Minister of Finance in regulations, subject to notice to the Israel Securities Authority (section 3(a)(6) and (b)).

If the relevant authority has a dedicated testing framework, its conditions and length are set by that authority and change. Check with the authority before you apply.

Consumer protection in fintech

Beyond the licensing requirements, fintech companies are also subject to the Consumer Protection Law, 5741-1981. This means:

• Full transparency on charges, interest rates and terms: before the consent, not after it.
• A right to cancel the transaction within 14 days under section 14C of the Consumer Protection Law, 5741-1981 (distance sale).
• A prohibition on unfair terms in a standard-form contract under the Standard Contracts Law, 5743-1982.
• The duty to provide a human response in telephone service (section 18B of the Consumer Protection Law) applies only to dealers listed in the Second Schedule to the Law, such as communications, electricity and water providers. It does not apply to fintech companies in general. Additional service duties may arise from the regulator’s directives.

What digital banking is, and why regulation has not kept pace

Have you launched a digital wallet, a lending platform or a payment service? In Israel, this requires a license. However innovative the product, regulators classify a service by what it actually does, not by what it is called. A platform that in practice mediates between borrowers and lenders may be a “credit intermediation system”, and operating one requires a license under the Supervision of Financial Services (Regulated Financial Services) Law.

Fintech (Financial Technology) is the general name for companies that use technology to provide financial services: digital payments, Peer-to-Peer loans, automated investment management (Robo-advisors), digital wallets and cryptocurrencies. Digital banks (Neobanks), such as ONE ZERO in Israel, are banks without branches that operate entirely through an app.

The problem is that the old regulatory framework was built for traditional banks. When a fintech company provides a service that looks like banking but is not defined as such in the law, a gap opens. This gap was used in two directions: innovation that the old regulation did not prevent, and businesses that operated without the protections consumers are entitled to.

AML and KYC: not just bureaucracy

The Prohibition on Money Laundering Law, 5760-2000 imposes duties of identification, reporting and record-keeping on the financial bodies set out in it. They include providers of a service in a financial asset, credit providers and payment companies, under a dedicated order for each type of body (section 7). The practical requirements: customer identification (KYC: Know Your Customer), monitoring suspicious transactions, and reporting to the Money Laundering and Terror Financing Prohibition Authority.

The point small fintech companies miss: reporting suspicious transactions is not limited to large amounts. Reporting an unusual activity is, as a rule, not conditional on a minimum amount. Even a NIS 500 transaction that looks suspicious may require a report. A breach of the reporting duties may lead to a monetary sanction (section 14). An act, or giving false information, intended to prevent a report or to cause an incorrect report is a criminal offense (section 3(b)).

Consumer protection in digital banking

The Payment Services Law and the regulators’ directives set specific duties: transparency on charges, maximum execution times, and a complaints mechanism. In addition, the Payment Services Law (which replaced the Debit Cards Law, repealed on 14 October 2020) limits the payer’s liability for misuse of a means of payment before they gave notice of it. The limit is NIS 75 plus NIS 30 for each day until the notice, and no more than NIS 450 if they gave notice within 30 days of the first misuse, or the actual charges if lower (section 24(c)). After the notice, the payer is not liable at all (section 24(b)). The limit does not apply if the payer made the essential component available to someone else (section 24(d)) or acted fraudulently (section 26).

Money that a payment company receives from its customers is not considered receiving monetary deposits (section 24(g) of the Regulation of Engagement in Payment Services and Payment Initiation Law). It is protected by the segregation mechanism: the company must keep the money in a separate dedicated account with a managing body, and it is not considered the company’s assets, including in insolvency proceedings (section 24(a) and (c)). The exception is when the authority allowed insurance or a guarantee instead (section 24(d)). Many consumers are not aware of this detail.

Open Banking and the future of fintech in Israel

The Financial Information Service Law, 5782-2021 (“open banking”) requires “information sources”, among them banks, to give a licensed service provider (TPP: Third Party Provider) access to a customer’s financial information. This is done in line with an access authorization the customer gave, and through a dedicated interface system (sections 39–40). This will allow fintech companies to access a customer’s bank account data (with the customer’s consent) and provide data-based services: expense analysis, product comparison and budget planning.

This is a huge opportunity, but also a heavy legal responsibility. Access to bank data requires compliance with the Protection of Privacy Law, a strict data security policy, and a license to provide a financial information service from the Israel Securities Authority (section 2 of the Financial Information Service Law). A supervised financial body needs approval from its own regulator instead.

Frequently asked questions

Does a loan comparison platform need a license?

Possibly. Regulators classify a service by what it actually does, not by what it is called. A platform that in practice mediates between borrowers and lenders may be a “credit intermediation system”, and operating one requires a license under the Supervision of Financial Services (Regulated Financial Services) Law. So the nature of the activity must be examined.

Is my money protected if the payment company collapses?

The law sets a segregation mechanism. Money that a payment company receives from its customers is not considered receiving deposits (section 24(g) of the Regulation of Engagement in Payment Services and Payment Initiation Law). The company must keep the money in a separate dedicated account with a managing body, and it is not considered the company’s assets, including in insolvency proceedings (section 24(a) and (c)). The exception is when the authority allowed insurance or a guarantee instead (section 24(d)).

Can you start on a small scale without a full license?

The law sets tiered requirements. The Supervision of Financial Services (Regulated Financial Services) Law has a “basic license” for activity that is not extensive and an “extended license” above it (section 11A). The Payment Services Regulation Law exempts from a license anyone who provides a payment service on a limited scale, as set by the Minister of Finance in regulations, subject to notice to the Israel Securities Authority (section 3(a)(6) and (b)).

Does the duty to report a suspicious transaction apply only to large amounts?

No. Reporting an unusual activity is, as a rule, not conditional on a minimum amount. Even a NIS 500 transaction that looks suspicious may require a report. A breach of the reporting duties may lead to a monetary sanction (section 14 of the Prohibition on Money Laundering Law). An act, or giving false information, intended to prevent a report or to cause an incorrect report is a criminal offense (section 3(b)).

What is needed to access a customer’s bank data (open banking)?

An access authorization the customer gave, compliance with the Protection of Privacy Law, a strict data security policy, and a license to provide a financial information service from the Israel Securities Authority (section 2 of the Financial Information Service Law, 5782-2021). A supervised financial body needs approval from its own regulator instead.