XML 48 R30.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Company’s board of directors maintains an information security policy directing management to establish and operate a global information security program with the goals of identifying, assessing and monitoring existing and emerging cybersecurity threats and ensuring that the Company’s information assets and data, and the data of its customers, are appropriately protected from loss or theft. The Board has delegated oversight of the Company’s information security program to the Audit and Risk Committee. The Company’s senior officers, including its Global Security and Chief Information Security Officer (GSCISO), are responsible for the operation of the global information security program and communicate quarterly with the Audit and Risk Committee on the program, including with respect to the state of the program, compliance with applicable regulations, risks associated with current and evolving threats, and recommendations for changes in the information security program. The global information security program includes a cybersecurity incident response plan that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. This framework establishes a protocol to report certain incidents to the GSCISO and other senior officers, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Board of Directors. The incident response plan directs the executive officers to report certain incidents immediately and directly to the Lead Non-Management Director and/or the Chair of the Audit and Risk Committee. The above framework tracks and allows team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews are also performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence. As a part of the global information security program, an enterprise cybersecurity risk assessment is performed annually in coordination with the GSCISO to identify and assess material cybersecurity risks and mitigating controls. The assessment results are incorporated into a risk register managed by the Company’s overall enterprise risk management group to integrate the risks into the overall risk management processes. The Company engages with independent firms to conduct operational control assessments, which cover information protection. Every three years, the Company engages independent consultants specifically for cyber matters. Additionally, the Company performs third-party risk assessments to evaluate security controls and identify inherent and residual risks associated with third-party engagements. Issues identified during third-party risk assessments are documented and escalated to Company management through an established committee structure based on the risk ratings associated with each issue. The Company also utilizes professionals from the Company’s legal team and GSCISO's leadership team, a majority of whom have specialized skills and knowledge in cybersecurity risk management based on their prior work experience and relevant industry certifications, such as Certified Information Systems Security Professional and Certified Information Security Manager, to assist in employee awareness and training, as well as assessing cybersecurity risks, materiality of cybersecurity incidents and disclosures of the same. Specifically, the GSCISO has security experience in the public sector and private sector financial services industry holding positions in areas such as business continuity, information assurance, and technology risk management as well as being a Certified Information Systems Security Professional, Certified Information Security Manager and Certified Project Manager as well as being certified in Risk and Information Systems Control. The GSCISO and his direct reports have an average of over 20 years of experience in the field of cybersecurity. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that occurred during the year ended December 31, 2024 that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see Item 1A. Risk Factors for the risk factor titled "Interruption in telecommunication, information technology and other operational systems, or a failure to maintain the security, confidentiality, integrity or privacy of sensitive data residing on such systems, could harm the Company's business" for additional information regarding how the Company's business strategy, results of operations, and financial condition could be adversely affected by risks from cybersecurity threats.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Company’s board of directors maintains an information security policy directing management to establish and operate a global information security program with the goals of identifying, assessing and monitoring existing and emerging cybersecurity threats and ensuring that the Company’s information assets and data, and the data of its customers, are appropriately protected from loss or theft.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Company’s board of directors maintains an information security policy directing management to establish and operate a global information security program with the goals of identifying, assessing and monitoring existing and emerging cybersecurity threats and ensuring that the Company’s information assets and data, and the data of its customers, are appropriately protected from loss or theft. The Board has delegated oversight of the Company’s information security program to the Audit and Risk Committee.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Audit and Risk Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Company’s senior officers, including its Global Security and Chief Information Security Officer (GSCISO), are responsible for the operation of the global information security program and communicate quarterly with the Audit and Risk Committee on the program, including with respect to the state of the program, compliance with applicable regulations, risks associated with current and evolving threats, and recommendations for changes in the information security program. The global information security program includes a cybersecurity incident response plan that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. This framework establishes a protocol to report certain incidents to the GSCISO and other senior officers, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Board of Directors. The incident response plan directs the executive officers to report certain incidents immediately and directly to the Lead Non-Management Director and/or the Chair of the Audit and Risk Committee.
Cybersecurity Risk Role of Management [Text Block] | The Company’s senior officers, including its Global Security and Chief Information Security Officer (GSCISO), are responsible for the operation of the global information security program and communicate quarterly with the Audit and Risk Committee on the program, including with respect to the state of the program, compliance with applicable regulations, risks associated with current and evolving threats, and recommendations for changes in the information security program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Company’s senior officers, including its Global Security and Chief Information Security Officer (GSCISO)
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The Company also utilizes professionals from the Company’s legal team and GSCISO's leadership team, a majority of whom have specialized skills and knowledge in cybersecurity risk management based on their prior work experience and relevant industry certifications, such as Certified Information Systems Security Professional and Certified Information Security Manager, to assist in employee awareness and training, as well as assessing cybersecurity risks, materiality of cybersecurity incidents and disclosures of the same. Specifically, the GSCISO has security experience in the public sector and private sector financial services industry holding positions in areas such as business continuity, information assurance, and technology risk management as well as being a Certified Information Systems Security Professional, Certified Information Security Manager and Certified Project Manager as well as being certified in Risk and Information Systems Control. The GSCISO and his direct reports have an average of over 20 years of experience in the field of cybersecurity.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Company’s senior officers, including its Global Security and Chief Information Security Officer (GSCISO), are responsible for the operation of the global information security program and communicate quarterly with the Audit and Risk Committee on the program, including with respect to the state of the program, compliance with applicable regulations, risks associated with current and evolving threats, and recommendations for changes in the information security program. The global information security program includes a cybersecurity incident response plan that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. This framework establishes a protocol to report certain incidents to the GSCISO and other senior officers, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Board of Directors. The incident response plan directs the executive officers to report certain incidents immediately and directly to the Lead Non-Management Director and/or the Chair of the Audit and Risk Committee.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration