XML 22 R11.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management, Strategy and Governance | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. Cybersecurity As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption. Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program. Governance The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer (“CISO”) on cybersecurity risks, industry trends, and best practices. The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company’s enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk. The Board of Directors is also responsible for the approval and oversight of the Information Security (“IS”) Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate. All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements. We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts. For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. “Risk Factors,” including the risk factor titled “An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses.”
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company’s enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk. The Board of Directors is also responsible for the approval and oversight of the Information Security (“IS”) Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board of Directors is also responsible for the approval and oversight of the Information Security (“IS”) Program
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company’s enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.
Cybersecurity Risk Role of Management [Text Block] | Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer (“CISO”) on cybersecurity risks, industry trends, and best practicesThe Board of Directors is also responsible for the approval and oversight of the Information Security (“IS”) Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration