# How to Pull a Client's Clearing-House and Har HaBituach Data With Consent: The Process End to End

> The practical process for pulling a client's pension and insurance data with their consent: authorisation, what arrives, unifying it in a client card, what to record, and what to confirm with the regulator first.

- Published: 2026-10-25 · Updated: 2026-10-25
- Open banking & data · 10 min read · The Financi team
- Canonical page: https://www.financi.co.il/en/articles/clearing-house-data-for-agents

## The short version

- There is no pull without the client's authorisation, and it comes before any action in the system, not after.
- The clearing house and Har HaBituach are two different sources: the first is pension and long-term savings data, the second is insurance data. A full picture needs both.
- What arrives needs checking, not blind trust: gaps, duplicates and stale figures are part of life, and the first document is a “snapshot to verify”.
- Record who asked, when, under what authorisation and for what purpose. The record is the agency's protection.
- Who may order which data, and under what conditions, is set by licence type and the Authority's rules. Confirm with the Authority and a compliance adviser rather than assume.

Once the client card holds a real picture of the client's pension and insurance savings, the conversation changes: you stop asking “what do you have?” and start asking “what should we do with what you have?”. That makes pulling the data one of the most important steps in an agent's work, and one of the most sensitive. This article covers the process itself, from authorisation to the card. [The article on working properly with client consent](https://www.financi.co.il/en/articles/har-habituach-with-client-consent) is mostly about consent and presenting findings; here we focus on what actually happens on the agency's side.

> **An important note before you start.** This article is general information, not legal or regulatory advice. Who may order which data, and under what conditions, is set by licence type, the Commissioner of the Capital Market's instructions and the law, and the rules are updated. Before defining a process, confirm it with the Authority and the agency's compliance adviser.

## What you receive, and from where

In practice agents work with two sources, and each has a different role. The table summarises broadly; the exact details of each source are set by its operator.

| Source | Type of data | Why it is useful | What to remember |
| --- | --- | --- | --- |
| The pension clearing house | The client's pension products and long-term savings across providers | One unified picture of savings instead of letters from every fund | The data comes from the managing bodies, and its quality depends on them |
| Har HaBituach | The client's insurance data | Spotting coverage gaps and overlaps | It is insurance data, not savings data, so it needs a separate check |
| Documents the client brings | Reports, policies, confirmations | They fill in a missing figure and verify a doubtful one | Upload them to the card in an orderly way rather than leave them in an inbox |

## The process, step by step

1. **1. Explain to the client what you are asking and why** — In plain sentences: which data, from where, why you need it and what will be done with it. A plain explanation beats a complicated form nobody reads.
2. **2. Obtain authorisation in the form the law and the Authority require** — The wording, the way it is given and identification are set by the rules. Do not cut corners here, and do not assume what was right last year is right today.
3. **3. Record the authorisation before ordering** — Date, who gave it, how, for what purpose and until when, on the client card. That way you can show it a year later.
4. **4. Order only what you need** — Order the data required for the stated purpose. An order wider than necessary is a privacy problem even when it is technically possible.
5. **5. Receive, and check** — Check that the data belongs to the right client, that it is complete, that there are no duplicates and that the dates look reasonable. An unusual figure goes to the client for clarification and does not enter as fact.
6. **6. Unify on the client card** — Put the data in one place next to the documents and conversations, and mark what is verified and what is still to clarify.
7. **7. Present to the client and decide together** — Present as questions and gaps, not verdicts. The decision is the client's; the agent explains and suggests.
8. **8. Keep, and delete when needed** — Decide in advance how long each type of data is kept and who sees it. Data with no remaining purpose is not kept “just in case”.

## Authorisation: what to record

There is no single mandatory template in every case, so confirm the wording with the Authority and your compliance adviser. What we can say is which information is worth keeping with each authorisation, so you have an answer to “on what basis did you pull this?”:

- The client's name and an identifier as the rules require, and which agent or party received the authorisation.
- Which data was permitted to be ordered (pension, insurance, or both) and for what purpose.
- When the authorisation was given, how, and until when it is valid.
- A copy of what the client saw and approved, or a reference to the wording version that was in force on the day of approval.
- Who placed the order and when, and what was actually ordered.

> **Authorisation is not forever.** An authorisation is given for a purpose and a period. If the purpose changed, or time passed, ask for a new authorisation rather than keep working on the old one.

## Data quality: why you do not believe everything that arrives

Data from many sources does not always arrive tidy. Expect situations that recur in every agency, and build a standing way of handling each:

| Situation you meet | What to do | Why |
| --- | --- | --- |
| A product that appears twice | Check whether it is the same product from different sources or really two products | A duplicate inflates the picture and misleads the recommendation |
| A provider the client mentions is missing | Ask the client and request a document; do not assume the savings do not exist | What arrived is not necessarily complete |
| A stale figure | Mark the update date and request a current figure before presenting | A decision on an old figure can mislead |
| A gap between what the client remembers and what arrived | Go through the documents together and do not draw a conclusion alone | Either the memory or the figure may be wrong |
| Data that does not belong to the client | Stop, do not use it, and handle it under the privacy-incident procedure | It is an exposure of another person's personal data |

## From the figure to the client card

A figure sitting in a file in the downloads folder is a figure that disappears. For the team to use the information it has to be on the client card, next to documents, conversations and tasks. In Financi the order is made with the client's consent and the data from the clearing house and Har HaBituach is merged into one client card. [The client-card guide](https://www.financi.co.il/en/articles/client-360-playbook) lists what to check before a meeting, and [Financi's clearing house and Har HaBituach page](https://www.financi.co.il/en/clearing-house) describes the module.

- **Mark source and date** next to each figure, so it is possible to know where it is from and when it was pulled.
- **Separate “verified” from “to clarify”** so that a still-disputed figure is not presented as fact in a meeting.
- **Limit access** by role: not every employee needs to see every client's pension data.
- **Tie it to conversations and tasks**: the task “complete a document” should sit on the same card.

## And what about AI inside the card?

When an AI helps summarise or explain, the right question is which fields it sees. In Financi the AI inside a client file works on pre-defined fields only, a human approves every field the AI writes, and the AI does not write numbers. [The article on a safe AI team in your agency](https://www.financi.co.il/en/articles/ai-team-for-your-agency-safely) sets out the principles. The general rule applies to any system: ask the vendor to explain what data goes where, and check that it appears in the data processing addendum.

## Who does what in the agency

A process everyone is responsible for is a process nobody is responsible for. In an agency with several people it helps to define roles, even if one person fills several. The list assumes a small-to-medium agency; adapt it to your structure.

| Role | Responsibility | What is recorded on the card |
| --- | --- | --- |
| Whoever receives the client | Explains, obtains authorisation, makes sure the client understood | The authorisation, when and how it was given, and the stated purpose |
| Whoever orders | Places the order strictly under the authorisation | What was ordered, when, and under which authorisation |
| Whoever checks | Compares, finds duplicates and gaps, and marks “verified” or “to clarify” | A verification status for each figure and what remains open |
| Whoever presents to the client | Presents as questions and gaps and records the decision | What was shown, what the client decided and the next task |
| Whoever owns privacy | Sets retention, access and the incident procedure | A written policy and a record of exceptions |

**An internal check before every order**

- [ ] There is a recorded, valid authorisation that covers the type of data and the purpose.
- [ ] The data requested is needed for the stated purpose, and no more.
- [ ] Whoever orders is allowed to under the licence and the rules (checked with the compliance adviser).
- [ ] It is clear who will check the data that arrives and within what time.
- [ ] It is known where the data will be stored and who will see it.

## Common mistakes

- **Asking for data “just in case”.** An order wider than needed is a privacy problem.
- **Ordering before the authorisation is recorded.** The record comes before the action, not the other way round.
- **Presenting a raw figure as fact.** An unusual figure goes to clarification, not to the client as truth.
- **Keeping files with employees.** Files on personal computers and in emails are not access control.
- **Carrying on with an old authorisation.** A different purpose or elapsed time requires a new one.
- **Skipping the regulator.** Rules change; whoever does not check relies on what used to be true.

## The opening conversation with the client: what to say

The moment you ask for authorisation sets the trust for everything after. A short, clear conversation beats a long form. The client should leave it knowing four things, in their own words:

1. Exactly which data will be pulled, and from which sources: pension, insurance or both.
2. Why it is needed: what the agency will do with it and what it will not do.
3. Who in the agency will see it, and how long it will be kept.
4. That they may decline or withdraw, and what that means in practice for the service.

> **The understanding test.** If the client cannot explain to a family member what they approved, the explanation was not clear enough. Rephrase it in plain words, without professional jargon.

**Right after the conversation**

- [ ] The authorisation was recorded in the client card the same day.
- [ ] The client received a short summary of what was approved.
- [ ] It is settled who places the order and when.
- [ ] A date is set to present the results to the client.

## Frequently asked questions

### What do we do when a client hesitates to give authorisation?

Do not push. Explain again what is pulled and why, offer to start with one type of data, and if they still hesitate, work with documents they bring themselves. An authorisation given under pressure is a problem, not an achievement.

### Who in the agency needs access to the data that was pulled?

Only those who need it for their role. Set access by role in the client card, and review from time to time who sees what, including staff who left or changed roles.

### Can I order data without the client knowing?

No. It is sensitive personal data and requires the client's authorisation. Working without it can harm the client and the agency and may be contrary to law.

### What is the difference between the pension clearing house and Har HaBituach?

The clearing house gathers pension and long-term savings data, and Har HaBituach gathers insurance data. The first is about what has accumulated, the second about coverage.

### Who may order which data?

It is set by licence type and the Commissioner of the Capital Market's instructions and may change. Confirm with the Authority and a compliance adviser rather than assume.

### How long can the data be kept?

We have no general number to give. Set a retention policy by purpose and law, record it, and delete what has no remaining purpose.

### What do I do if the data received is wrong or belongs to someone else?

Stop, do not use it, and handle it under the agency's privacy-incident procedure. Another person's data is an exposure that must be dealt with.

### How do I record the authorisation?

On the client card: who gave it, when, how, for what purpose and until when, and what was actually ordered. That lets you show it later.

### Do we need a new authorisation for every order?

Authorisation is given for a purpose and a period. An order for a different purpose, or after the period has passed, needs a new authorisation. A further order for the same purpose within the period is recorded against the existing authorisation, subject to the wording agreed and the Authority's guidance.

### What happens if the client withdraws the authorisation?

Stop ordering new information and record the withdrawal in the card. What was already received is kept or deleted under the retention policy you set and the law, so the policy should cover the case of withdrawal.

> **Want to see a client card with the clearing house and Har HaBituach?** Book a demo and we will walk through the process from authorisation to the card, including what Financi does not do. [Book a demo](https://www.financi.co.il/en#contact)

## Sources and further reading

- [Har HaBituach site (Capital Market, Insurance and Savings Authority)](https://harb.cma.gov.il/)
- [gov.il: Israel government services and information](https://www.gov.il)

---

*The information in this article is general only and is not financial, pension, legal or tax advice, nor a substitute for personal advice. Demos and calculators are illustrative models: your numbers will differ.*