Israel: technology regulation at a glance

Framework: Multi-agency regime — no single dedicated digital-assets statute. Key regulators: Capital Market, Insurance and Savings Authority (CMISA) under the Supervision of Financial Services (Regulated Financial Services) Law, 5776-2016; Israel Securities Authority (ISA) under the Securities Law, 5728-1968 (with proposed 2023–2026 amendments to bring 'digital assets' expressly in scope); Bank of Israel (stablecoins and digital shekel); Israel Tax Authority (Circular 5/2018 + draft 2024 Income Tax Ordinance amendment); AML/CFT supervision via the Prohibition on Money Laundering Order for financial-service providers.

Crypto is legal in Israel and is regulated through a patchwork of sectoral rules rather than a comprehensive digital-assets law. Exchanges/custodians/wallet providers need a CMISA 'financial asset service' licence, token offerings that qualify as securities fall under the ISA (Howey-style test), tax is treated as capital gains under existing income-tax rules, and stablecoins are moving toward a formal Bank of Israel licensing regime ahead of the planned digital shekel. Several important pieces — the ISA's proposed Securities Law amendment defining 'digital assets', the November 2024 draft tax amendment, and the stablecoin/CBDC framework — remain pending in 2026.

Framework: Non-binding 'Policy on Artificial Intelligence Regulation and Ethics' (Dec 2023) issued by the Ministry of Innovation, Science and Technology (MIST) with the Ministry of Justice, implemented via sectoral regulators and existing horizontal laws (notably the Privacy Protection Law). No comprehensive AI Act is in force.

Israel has deliberately chosen a soft-law, sector-based approach to AI governance rather than enacting a comprehensive statute. The core instrument is the December 2023 'Responsible Innovation' policy, which sets principles (fairness, human oversight, explainability, accountability, safety, privacy, disclosure) and tasks each sectoral regulator with risk-based rulemaking in its own domain. Binding rules currently come from existing laws applied to AI — most actively via the Privacy Protection Authority's April 2025 draft AI guidance — alongside the April 2025 National AI Program focused on compute, talent and research.

Framework: Protection of Privacy Law, 5741-1981 (PPL), as substantially modernized by Amendment 13 (in force 14 August 2025); supervised by the Privacy Protection Authority (PPA) within the Ministry of Justice.

Israel has a comprehensive, GDPR-adjacent data protection regime anchored in the 1981 Protection of Privacy Law and the Protection of Privacy Regulations (Data Security) 2017. Amendment 13, which took effect on 14 August 2025, redefined core concepts (personal data, controller/processor), introduced mandatory DPOs, overhauled registration, and gave the PPA direct administrative-fine powers that it has started using in 2026. Israel also retains an EU adequacy decision, reaffirmed by the European Commission on 15 January 2024.

Framework: Regulation of Payment Services and Payment Initiation Services Law, 5783-2023 (in force 6 June 2024), administered by the Israel Securities Authority (ISA); Bank of Israel oversees payment and settlement systems (ZAHAV RTGS, instant payments via SHVA/MASAV) and Open Banking; Capital Market, Insurance and Savings Authority (CMISA) regulates Regulated Financial Services; Financial Information Services Law, 2021 governs open finance

Israel has moved from a patchwork regime to a dedicated, PSD2-style licensing framework: the Regulation of Payment Services and Payment Initiation Services Law entered into force on 6 June 2024, with the Israel Securities Authority (ISA) as the licensing authority for payment institutions, payment initiation and e-wallet providers. Payment systems (ZAHAV RTGS and retail instant payments operated by SHVA/MASAV) are supervised by the Bank of Israel, which also leads open banking/open finance implementation under the 2021 Financial Information Services Law. Legacy payment-service licences issued by CMISA are being transferred to ISA supervision on a transition schedule running into 2025–2026.

Framework: Entry into Israel Law, 1952, administered by the Population and Immigration Authority (PIBA / Rashut HaOchlosin veHaHagira) under the Ministry of Interior; Law of Return, 1950 governs Jewish-origin immigration separately.

Israel does not offer a dedicated digital-nomad or remote-work visa, and the B/2 tourist visa (and the ETA-IL electronic authorization that replaced visa-waiver entry in January 2025) expressly prohibits employment of any kind in Israel, including remote work for foreign employers while physically present. Long-stay routes exist only for narrow groups: a B/1 work permit tied to an Israeli employer, a B/5 investor visa limited to U.S. citizens running an Israeli business, or citizenship under the Law of Return for Jews and persons with Jewish ancestry/spouses. There is no general pathway for non-Jewish remote workers without an Israeli employer or substantial local business investment.

Framework: No comprehensive online-safety law. A patchwork regime: Communications Law/ISP filtering duty (2011); general criminal and incitement law applied to online content; a voluntary content-removal arrangement run by the Ministry of Justice 'Cyber Unit' (upheld by the Supreme Court in Adalah v. State Attorney, 2021); and the Foreign Broadcasters Law (Al Jazeera Law, extended to 2027). A comprehensive 'Regulation of Digital Content Platforms' framework recommended by the Ministry of Communications (Dec 2022) and a long-pending 'Facebook Bill' (criminal content-removal bill) remain unenacted.

Israel does not have a comprehensive online-safety or platform-liability statute equivalent to the EU DSA or UK OSA. It regulates online content through a mix of sectoral and criminal-law tools, an ISP filtering obligation, informal government-to-platform content-removal requests via the Cyber Unit (court-upheld but not statutory), and a temporary foreign-broadcast ban law. A broad Ministry of Communications policy paper (Dec 2022) and the 'Facebook Bill' authorising courts to order removal of criminal content have advanced in the Knesset but, as of October 2026, have not been enacted into a general online-safety regime.

Framework: No horizontal cybersecurity statute. Obligations arise from the Regulation of Security in Public Bodies Law, 5758-1998 (critical infrastructure), the General Security Service Law, 5762-2002 (Shin Bet/ISA role), the Protection of Privacy Law, 5741-1981 and Protection of Privacy Regulations (Data Security), 5777-2017 (data breach duties), and sectoral regulator directives (notably Bank of Israel Proper Conduct of Banking Business Directives 361/364). A National Cyber Protection draft bill was published in January 2026 but is not yet enacted.

Israel does not have a single comprehensive cybersecurity law. Instead, cybersecurity obligations are imposed through a sectoral/patchwork regime — critical-infrastructure directives issued by the Israel National Cyber Directorate (INCD) and the Israel Security Agency under the 1998 Public Bodies Law, data-security and breach-notification rules under the 1981 Privacy Law and 2017 Data Security Regulations enforced by the Privacy Protection Authority, and financial-sector rules from the Bank of Israel. A horizontal National Cyber Protection Bill was released for public consultation in January 2026 but remains a draft.

Framework: Companies Law, 5759-1999, administered by the Registrar of Companies at the Israel Corporations Authority (Ministry of Justice); tax registration with the Israel Tax Authority and VAT; immigration under the Entry into Israel Law (B/5 investor visa limited to US citizens)

Israel permits 100% foreign ownership of private limited companies with no statutory minimum share capital, and online incorporation through the Registrar of Companies typically takes 3–10 business days once documents are in order. In practice, foreigners face friction from notarization/apostille requirements, the need for a local tax representative, and especially bank-account onboarding which can take 8–12 weeks and is the main bottleneck; the dedicated investor visa (B/5) is available only to US citizens, so most other nationals rely on general work-permit routes.