XML 74 R49.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our operational risk management and control model is based on a continuous process of identifying, evaluating, and mitigating sources of risk, regardless of whether they have materialized or not. Throughout the application of this process, risk management priorities are established appropriately, and internal controls are defined and executed to manage and mitigate the risk across the organization. For example, the internal cyber-security model, which is a part of our operational risk management and control model and is based on best practices and international standards, is periodically evaluated for its maturity level.

With respect to operational risk management specifically, we have implemented tools such as Heracles, which is our management and reporting system for operational risk and which supports the operational risk program with a Governance, Risk and Compliance (GRC) approach. Heracles provides information for management and reporting at the Bank and throughout the Santander Group. Heracles also facilitates better operational risk management decisions by using a common set of taxonomies and methodological standards to allow information consolidation, duplication prevention, and reporting simplification.

We have also implemented a qualitative “Risk control self-assessment” (RCSA) process, that allows us to identify, assess and measure, in a dynamic and proactive way, the material operational risks that could prevent the business or support units from achieving their objectives, as well as the effectiveness of the controls linked to their mitigation. Our RCSA integrates specific reviews that allows us to identify cyber, technology, fraud, third party supplier and other risk drivers, that could lead to operational risks as well as the failure to meet regulatory expectations. In addition, RCSA incorporates reviews related to regulatory compliance, conduct and financial crime risk.

In 2024, in light of an increase in cybersecurity and environmental related risks, as well as legal and regulatory requirements (including DORA in particular), we have strengthened our third-party supplier risk management model and internal control framework, and we have also developed various tools designed to assess, manage and control risks throughout the management cycle, including the risks in outsourcing and third-party agreements.

Security controls have been strengthened in an effort to mitigate the risks associated with the current environment, of heightened geopolitical tensions and the accelerated adoption of emerging technologies such as artificial intelligence. New controls have been implemented to address current risk areas and emerging attack methods. These include ransomware and Distributed Denial of Service (DDoS) preparedness and response, access management in virtual environments, supply chain protection, and the incorporation digital fraud and identity theft prevention measures to ensure a safer customer experience. Internal regulations have also been reviewed and adapted to ensure alignment with the cybersecurity requirements set out in DORA, with a focus on incident management and reporting, and advanced penetration testing. The Santander Fusion Center, which integrates the cybersecurity and IT monitoring teams, carries out the functions of detection, monitoring and response to operational failures and cybersecurity events for Chile and other Santander Group’s entities, 24 hours a day, seven days a week. In addition to the regular tests and reviews performed by our cybersecurity team, independent third-party certification bodies review and certify our critical cybersecurity processes and controls. Certifications are reviewed and updated periodically, and new processes and controls are certified on an annual basis.

Other instruments are used to analyze and manage operational risk, such as the assessment of new products and services, and transformation initiatives; business continuity plans (BCP); review of corporate insurance; review of the management perimeter; recommendations from internal and external auditors, and supervisors; and the quality assurance process.

In 2024, there has been an increase in cybersecurity events, primarily related to DDoS attacks and events involving third-party service providers. For example, on May 14, 2024, Santander Group announced that it became aware of an unauthorized access to a Santander database containing certain customer and employee information about Chile, which was hosted by a third-party service provider. We do not currently believe that any of these events have materially affected our operations. Our team remains vigilant and committed to maintaining and enhancing, as necessary, our cybersecurity measures designed to protect against evolving cybersecurity threats.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our operational risk management and control model is based on a continuous process of identifying, evaluating, and mitigating sources of risk, regardless of whether they have materialized or not. Throughout the application of this process, risk management priorities are established appropriately, and internal controls are defined and executed to manage and mitigate the risk across the organization. For example, the internal cyber-security model, which is a part of our operational risk management and control model and is based on best practices and international standards, is periodically evaluated for its maturity level.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
In turn, there is a group of supervisory bodies that include the Cybersecurity and Technology Risk Committee, who are responsible for ensuring adequate management of cybersecurity risks in line with business objectives and risk appetite; the Non-Financial Risk Committee, who is in charge of supervising and controlling the management of non-financial risks in order to prevent and mitigate operational losses. The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing.
Cybersecurity Risk Role of Management [Text Block]
The Bank has implemented a Cybersecurity Framework defining the governance, roles, responsibilities, and policies on preventing and confronting cybercrime. The Chief of Cybersecurity or CISO (Chief Information Security Officer) has been defined as the officer responsible for cybersecurity, embedded in the Bank’s Technology and Operations division, which is the front line of defense against cyber-security threats and data security. In addition, the Non-Financial Risk
Department through Cyber Risk (a specialized area) independently controls and supervises the Cyber Security Risk. Our CISO boasts 15 years of technology experience, including 11 years in cybersecurity at Grupo Santander and over 7 years in leadership roles. He has a proven track record in handling complex incidents, reducing impact and mitigating risks. With certifications such as CISM, CISSP, CCSP, and ITIL, our CISO is exceptionally well-equipped to navigate the evolving cybersecurity landscape and protect our assets.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Bank has implemented a Cybersecurity Framework defining the governance, roles, responsibilities, and policies on preventing and confronting cybercrime. The Chief of Cybersecurity or CISO (Chief Information Security Officer) has been defined as the officer responsible for cybersecurity, embedded in the Bank’s Technology and Operations division, which is the front line of defense against cyber-security threats and data security. In addition, the Non-Financial Risk
Department through Cyber Risk (a specialized area) independently controls and supervises the Cyber Security Risk.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO boasts 15 years of technology experience, including 11 years in cybersecurity at Grupo Santander and over 7 years in leadership roles. He has a proven track record in handling complex incidents, reducing impact and mitigating risks. With certifications such as CISM, CISSP, CCSP, and ITIL, our CISO is exceptionally well-equipped to navigate the evolving cybersecurity landscape and protect our assets.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true