XML 56 R39.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management Strategy And Governance | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management Strategy And Governance [Line Items] |
Cybersecurity Risk Management Processes For Assessing Identifying And Managing Threats [Text Block] | Cybersecurity Risk Management and Strategy The Corporation recognizes the significance of cybersecurity in the financial industry and the potential risks associated, such as the risks arising from the loss of confidentiality, integrity, or availability of information systems. The Corporation’s processes to identify, assess, and monitor material risks from cybersecurity threats are part of its Enterprise Risk Management (“ERM”) Program, under which the Corporation has implemented a comprehensive Corporate Information Security Program (“CISP”). Cybersecurity risk is managed as part of the overall information technology risk, under the direction of the Corporate Security Office (“CSO”) led by the Corporate Security Officer (“CSO Officer”), who directly reports to the Chief Operations Officer. The CSO Officer also serves as Chief Information Security Officer (“CISO”). The CISP outlines the Corporation’s overall vision, direction, and governance to protect the confidentiality, integrity, and availability of customer information and seeks to prevent unauthorized access as required by regulatory guidelines and industry security best practices. The CISP is based on well-renowned frameworks such as the International Organizational Standard ISO 27000 series and the NIST Cybersecurity Framework. As such, it serves as a guide for the implementation of security safeguards across the Corporation and its subsidiaries. The CISP also addresses cybersecurity breaches and procedures for appropriate response efforts, including any required notification, depending on the severity of the specific security incident. In addition, the CISP incorporates a risk-based approach to ensure that risk is treated in a consistent and effective matter and is designed to protect classified information to prevent disclosure to unauthorized individuals; prioritize the use of information security resources by concentrating on critical business applications; develop quality, cost-effective, and reliable systems; ensure the proper and secure disposal of sensitive information; and implement adequate processes to ensure compliance. The ERM Program includes a Corporate Incident Response Program, which features a risk-based escalation process to manage corporate incidents, including cybersecurity incidents, and notify the Risk Committee of the Board of Directors and applicable stakeholders as appropriate. The Corporation incorporates the Information Technology (“IT”) Risk Unit of the ERM Department, which is comprised of several members such as IT Risk Managers and the ERM Director who is part of senior management, as well as external expertise, in the review of its processes, including an independent internal assessment of cybersecurity measures and controls. The Corporation also invests in threat intelligence, vulnerability management, and incident response drills. Furthermore, all of the Corporation’s employees and consultants with access to the Corporation’s network are required to complete a comprehensive cybersecurity awareness program on an annual basis. Additionally, awareness and training on information technology and cybersecurity risk is provided to the Board on a regular basis. The Corporation has a Vendor Management Program and a Third-Party Risk Management function to manage the cybersecurity risks associated with conducting business with third-party vendors, which includes the requirement for third-party vendors to implement appropriate measures to ascertain security and confidentiality of the Corporation’s resources. The Corporation places vendors into tiers based on the inherent risk due to the nature of the relationship with that vendor to determine any additional security requirements commensurate to such level of risk. The Corporation does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Corporation’s business strategy, results of operations or financial condition as of December 31, 2024. While the Corporation continues to closely monitor cyber risk and has implemented processes that are intended to assess, identify, and manage material risks from cybersecurity threats, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate these risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon. See Item 1A, “Risk Factors – Risks Relating to Cybersecurity and Technology” for more information on how cybersecurity risk could adversely affect the Corporation, which should be read in conjunction with this Item 1C.
Cybersecurity Risk Management Processes Integrated Flag | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The Corporation’s processes to identify, assess, and monitor material risks from cybersecurity threats are part of its Enterprise Risk Management (“ERM”) Program, under which the Corporation has implemented a comprehensive Corporate Information Security Program (“CISP”).
Cybersecurity Risk Management Third Party Engaged Flag | true
Cybersecurity Risk Third Party Oversight And Identification Processes Flag | true
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant Flag | true
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant [Text Block] | The Corporation does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Corporation’s business strategy, results of operations or financial condition as of December 31, 2024. While the Corporation continues to closely monitor cyber risk and has implemented processes that are intended to assess, identify, and manage material risks from cybersecurity threats, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate these risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon. See Item 1A, “Risk Factors – Risks Relating to Cybersecurity and Technology” for more information on how cybersecurity risk could adversely affect the Corporation, which should be read in conjunction with this Item 1C.
Cybersecurity Risk Board Of Directors Oversight [Text Block] | Responsibility for risk oversight and management generally lies with the Corporation’s Board of Directors
Cybersecurity Risk Board Committee Or Subcommittee Responsible For Oversight [Text Block] | To effectively manage oversight of the CISP’s governance and cybersecurity risk management, the Board has delegated such responsibility to the Risk Committee.
Cybersecurity Risk Process For Informing Board Committee Or Subcommittee Responsible For Oversight [Text Block] | As part of its oversight, the Risk Committee receives reports from the Executive Risk Management Committee and IT Steering Committee, which are committees at the management level, on the Corporation’s cybersecurity processes.
Cybersecurity Risk Role Of Management [Text Block] | The Corporate Internal Audit Department performs periodic audits of the Corporation’s information security practices and presents them to the Audit Committee of the Board.
Cybersecurity Risk Management Positions Or Committees Responsible Flag | true
Cybersecurity Risk Management Positions Or Committees Responsible [Text Block] | The Risk Committee provides the Board with updated information on the matters discussed in the Risk Committee meetings as it relates to the CISP and the overall information security strategic direction and evaluates and approves (if necessary) reports presented by executive management related to the information security strategic direction of the Corporation.
Cybersecurity Risk Management Expertise Of Management Responsible [Text Block] | The CSO, led by the CSO Officer, oversees the CISP, its development, and any applicable updates in response to changes in operations and other circumstances, and reports on a quarterly basis to the IT Steering Committee and to the Board’s Risk Committee. The CSO Officer, who has been in charge since 2016, has over 20 years of experience in functional expertise concerning all aspects of information security, integrity and privacy of systems, and data resources, and holds several relevant licenses and/or certifications. Also, certain topics related to information security are presented on an ad hoc basis to the Executive Risk Management Committee. The CSO provides the Board’s Risk Committee regular reports and engages in discussions on the effectiveness of the CISP, including risk mitigation strategy and progress. The Board’s Risk Committee reviews and approves the CISP annually and receives a report on the security safeguards annually.
Cybersecurity Risk Process For Informing Management Or Committees Responsible [Text Block] | Findings from internal audit procedures are reported to Management and the Audit Committee.
Cybersecurity Risk Management Positions Or Committees Responsible Report To Board Flag | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration