XML 57 R34.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Overview
| ● | The Bank maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.
| ● | The Bank’s Cybersecurity Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recovery strategies to help mitigate the impact of a cybersecurity incident across all business lines.
Management Role and Board Oversight.
| ● | The cybersecurity program is overseen by the Chief Information Security Officer (“CISO”) reporting to the Chief Risk Officer (“CRO”); the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others; and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors. Our Board of Directors includes members who have expertise in cybersecurity, data privacy law, fraud and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO’s extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans
|  | of known risks, compliance with regulations and standards, Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank’s Risk Management function is led by the CRO, who has extensive experience in risk management and audit. The cybersecurity program includes a cross-sectional team of internal and external Information Security professionals, all of which are provided with relevant training and are required to maintain industry accredited certifications. Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.
​
| ● | The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Enterprise Risk Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, status of operational changes, status of regulatory compliance, and risk reporting.
Managing Material Risks & Integrated Overall Risk Management
| ● | The Bank maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.
Cybersecurity Threats
| ● | To assess and manage cybersecurity threats from material risks, the Bank maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank’s business strategy, results of operations, or financial condition by following implemented processes.
​
| ● | The Bank has not identified any cybersecurity threats that have materially affected operations or financial position.
Oversee Third-Party Risk
| ● | The Bank has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank’s Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.
Cybersecurity Risks
| ● | The Bank considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by the Bank and third-party service providers, are critical to business operations and therefore require appropriate risk management.
Engagement With Third-Parties on Risk Management
| ● | Cybersecurity is part of the Bank’s overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, the Bank is a regulated entity and undergoes regulatory reviews to ensure it remains in compliance with all appropriate standards.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Managing Material Risks & Integrated Overall Risk Management
| ● | The Bank maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.
Cybersecurity Threats
| ● | To assess and manage cybersecurity threats from material risks, the Bank maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank’s business strategy, results of operations, or financial condition by following implemented processes.
​
| ● | The Bank has not identified any cybersecurity threats that have materially affected operations or financial position.
Oversee Third-Party Risk
| ● | The Bank has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank’s Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.
Cybersecurity Risks
| ● | The Bank considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by the Bank and third-party service providers, are critical to business operations and therefore require appropriate risk management.
Engagement With Third-Parties on Risk Management
| ● | Cybersecurity is part of the Bank’s overall risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Internal Audit actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. External audit results are reviewed and reported on in our annual filing. Additionally, the Bank is a regulated entity and undergoes regulatory reviews to ensure it remains in compliance with all appropriate standards.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The cybersecurity program is overseen by the Chief Information Security Officer (“CISO”) reporting to the Chief Risk Officer (“CRO”); the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others; and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Enterprise Risk Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] |
| ● | The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Enterprise Risk Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, status of operational changes, status of regulatory compliance, and risk reporting.
Cybersecurity Risk Role of Management [Text Block] | Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards, Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank’s Risk Management function is led by the CRO, who has extensive experience in risk management and audit
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Chief Information Security Officer
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO’s extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration