XML 50 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Origin’s information security program is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, and software and information assets, including client and other sensitive data. The program is comprised of policies, guidelines, and procedures, which are intended to align with regulatory guidance, and common industry practices. Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity Risk Management and Strategy Origin follows FFIEC guidance in protecting its network and information assets with industry-tested security products and processes. Our Network and Information Security teams actively monitor company networks and systems to detect suspicious or malicious events. The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments. Additionally, we conduct vulnerability scans, and contract with third-party vendors to perform penetration tests against the Company’s network. The Company also engages expert cyber consultants, as necessary and appropriate. At Origin, we expect each employee to be responsible for the security and confidentiality of client information. We communicate this responsibility to employees upon hiring, and regularly throughout their employment. We require each employee to complete training to protect the confidentiality of client information at the time of hire and during each year of employment. Employees must successfully pass a test to demonstrate understanding of these requirements and provide acknowledgement of their responsibilities. Additionally, we regularly provide employees with information security awareness training, covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to a company’s network, result in the theft of user credentials and, ultimately, place client or employee data, or other sensitive company data, at risk. Origin employs a number of technical controls to mitigate the risk of phishing emails. We regularly test employees to determine their susceptibility to phishing test emails. We require susceptible employees to take additional training and provide regular reports to management. We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information. Before engaging third-party service providers, we perform due diligence in order to identify and evaluate their cyber risks. This process is led by the Operational Risk Management team and includes participation of dedicated information security resources. Risk assessments are performed using Service Organization Controls (“SOC”) reports and other tools. Third party service providers processing sensitive client data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cyber security threats and unauthorized access to the sensitive data. After contract executions, third-party service providers undergo ongoing monitoring to ensure they continue to maintain internal controls and protocols designed to manage cybersecurity risk to systems, assets, data, and capabilities. As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is primarily overseen by our Senior Vice President, Information Security Officer (“ISO”). The Incident Response Plan describes our processes and procedures for responding to cybersecurity incidents, outlining various work streams, including containment and remediation actions by information technology and security personnel, as well as operational response actions by business, communications, and risk personnel. Our incident response team performs exercises to simulate responses to cybersecurity events. The Incident Response Plan includes procedures for escalation and reporting of potentially significant cybersecurity incidents to our Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, Chief Legal Counsel, and other executives as needed. To date, we have not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. Please see Part I, Item 1A. Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Origin’s information security program is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, and software and information assets, including client and other sensitive data. The program is comprised of policies, guidelines, and procedures, which are intended to align with regulatory guidance, and common industry practices. Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board of Directors is responsible for overseeing our business and affairs, including risks associated with cybersecurity threats. The Board oversees our corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Risk Committee. Management also participates in Cyber Risk and Information Technology Committees used to govern and oversee the information security program.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Risk Committee receives updates from management regarding review and assessments of cybersecurity and technology risk consistent with FFIEC guidance. Cybersecurity governance is a standing agenda item on each Risk Committee meeting. The Risk Committee reports to the full Board on a quarterly basis, including an overview of all matters discussed and approved at each Risk Committee meeting. Additionally, we have engaged the former Chief Information Officer of a Fortune 500 global technology company to consult with our Board of Directors, management, and management-level Cyber Risk and Information Technology Committees on cybersecurity and data privacy matters.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Risk Committee receives updates from management regarding review and assessments of cybersecurity and technology risk consistent with FFIEC guidance. Cybersecurity governance is a standing agenda item on each Risk Committee meeting.
Cybersecurity Risk Role of Management [Text Block] | Our ISO is responsible for the Company’s information security program. Our ISO holds a degree in Computer Information Systems and is a graduate of Louisiana Tech University. He possesses over 18 years of experience in diverse technology and information security roles within the financial services sector, with five years’ experience in the ISO role. In this role, the ISO manages the Company’s information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The ISO is a member of our Corporate Operations group and reports to our Chief Risk Officer, who in turn reports to our President and CEO. The ISO regularly attends Risk Committee meetings to review the Company’s material cybersecurity developments and risks, and otherwise periodically provides relevant cybersecurity updates to the Risk Committee, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our ISO is responsible for the Company’s information security program.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our ISO holds a degree in Computer Information Systems and is a graduate of Louisiana Tech University. He possesses over 18 years of experience in diverse technology and information security roles within the financial services sector, with five years’ experience in the ISO role.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Risk Committee reports to the full Board on a quarterly basis, including an overview of all matters discussed and approved at each Risk Committee meeting. Additionally, we have engaged the former Chief Information Officer of a Fortune 500 global technology company to consult with our Board of Directors, management, and management-level Cyber Risk and Information Technology Committees on cybersecurity and data privacy matters.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration