XML 55 R32.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | The Information Security Program is supported by our three lines of defense model of risk management. The Information Security Team is the first line of defense under the Chief Information Security Officer and provides day-to-day cybersecurity operations including identification and reporting of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, performance of vulnerability and third party information security assessments, and employee awareness and training programs. In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities. The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response. The Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains. As the second line of defense, the ERM Team under the Chief Risk Officer independently monitors the cybersecurity risk framework across the Company, as well as the effectiveness of the Information Security Program, and third party vendors’ vulnerability and penetration tests against the Company’s network. Furthermore, the Third-Party Risk Management Team, in conjunction with the ERM Team and the Information Security Team, oversees, identifies, monitors, investigates and addresses material risks from cybersecurity threats associated with the Company’s use of third-party service providers. The Third-Party Risk Management Team is also part of the independent risk management function of the Bank and included in the second line of defense. The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Risk Officer, who reports to the Board’s ROC. When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties. Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management. In addition, the Company regularly engages independent external assessors to perform assessments of its cybersecurity control environment and operating effectiveness. In addition, the Company uses several internal training methods, through annual mandatory courses on security and privacy for all employees, as well as multiple simulated phishing attacks and regularly providing information security awareness materials throughout the year. The Company also maintains cybersecurity insurance.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company’s ERM framework. The Information Security Program encompasses the Company’s cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents. In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company’s information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion. The Information Security Program follows a National Institute of Standards and Technology based Cybersecurity Framework and other applicable industry standards.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Board’s ROC has primary oversight responsibility for management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The ROC receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes are made to the program. These updates include information regarding management’s ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The ROC members include independent directors from the Board who have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board’s ROC has primary oversight responsibility for management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The ROC receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes are made to the program. These updates include information regarding management’s ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The ROC members include independent directors from the Board who have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board’s ROC has primary oversight responsibility for management’s efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The ROC receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes are made to the program. These updates include information regarding management’s ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The ROC members include independent directors from the Board who have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.
Cybersecurity Risk Role of Management [Text Block] | At the management level, the Information Technology Steering Committee has overall responsibility for identifying, assessing, and managing information security risks, including cybersecurity risk. The Information Technology Steering Committee provides cybersecurity reports periodically to the ROC and is comprised of the Company’s senior information technology, information security and third party risk management leaders, including the Chief Risk Officer and Chief Information Security Officer. The Chief Risk Officer is responsible for managing cybersecurity risk and coordinating with the Chief Information Security Officer to ensure the Company’s cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Risk Officer also provides periodic reports to the Board’s ROC, outlining the overall status of the Company’s Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company’s Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions. The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 50 active professional certifications in related fields.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | At the management level, the Information Technology Steering Committee has overall responsibility for identifying, assessing, and managing information security risks, including cybersecurity risk. The Information Technology Steering Committee provides cybersecurity reports periodically to the ROC and is comprised of the Company’s senior information technology, information security and third party risk management leaders, including the Chief Risk Officer and Chief Information Security Officer. The Chief Risk Officer is responsible for managing cybersecurity risk and coordinating with the Chief Information Security Officer to ensure the Company’s cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Risk Officer also provides periodic reports to the Board’s ROC, outlining the overall status of the Company’s Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company’s Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions. The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 50 active professional certifications in related fields.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | At the management level, the Information Technology Steering Committee has overall responsibility for identifying, assessing, and managing information security risks, including cybersecurity risk. The Information Technology Steering Committee provides cybersecurity reports periodically to the ROC and is comprised of the Company’s senior information technology, information security and third party risk management leaders, including the Chief Risk Officer and Chief Information Security Officer. The Chief Risk Officer is responsible for managing cybersecurity risk and coordinating with the Chief Information Security Officer to ensure the Company’s cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Risk Officer also provides periodic reports to the Board’s ROC, outlining the overall status of the Company’s Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company’s Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions. The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 50 active professional certifications in related fields.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration