XML 52 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management Strategy Given the increasing reliance on technology and potential of cyber threats, we have integrated a cybersecurity component into our risk management program, which is designed to identify, assess and mitigate risks across various aspects of the Company. We have a dedicated Information Security Department, which is led by our Chief Information Security Officer. The Information Security Department serves to protect the security and confidentiality of customer information, protect against any threats or hazards to the security or integrity of Company information and protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to our customers. Our information security program strives to protect the confidentiality, integrity and availability of information and information systems and is aligned to the Company’s business and risk management strategies. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk. The information security program includes policies and standards that define the risk assessment procedures, reporting and an incident response plan. Key elements of our cybersecurity risk management program include: •IT risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; •Information Security Department responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to a cybersecurity incident; •Cybersecurity Assessment Toolkit (developed by the FFIEC) is assessed annually, tracks program maturity, changes in risk profile, and reviews security controls critical to reduce cybersecurity risk. Results are presented to and approved by the Board. We are currently in the process of transitioning to the Cybersecurity Framework developed by the National Institute of Standards and Technology as the FFEIC Cybersecurity Assessment Toolkit will sunset on August 31, 2025; •Ransomware Assessment Toolkit (developed by the Bankers Electronic Crimes Task Force, state bank regulators and the U.S. Secret Service) is assessed biannually to capture any gaps and address any potential control deficiencies; •training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; •the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; •a cybersecurity incident response plan that includes procedures for responding to a cybersecurity incident; and defines escalations to senior management and the Board, as well as required notifications and timeframes to customers and regulatory authorities, •a third-party risk management process for service providers, suppliers, and vendors, including those external service providers we engage in our cybersecurity risk management processes. Risks from cybersecurity threats are assessed with existing controls and residual risk is monitored. We have not experienced any material cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. We cannot provide full assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See “Part I - Item 1A. Risk Factors – Risks Related to Our Business” in this report for a discussion of risks related to cybersecurity.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Given the increasing reliance on technology and potential of cyber threats, we have integrated a cybersecurity component into our risk management program, which is designed to identify, assess and mitigate risks across various aspects of the Company. We have a dedicated Information Security Department, which is led by our Chief Information Security Officer. The Information Security Department serves to protect the security and confidentiality of customer information, protect against any threats or hazards to the security or integrity of Company information and protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to our customers.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Management’s Role Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate. We also have a trained response team lead by the CISO, consisting of key individuals from executive management, finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate. Additionally, we engage a third party that offers cybersecurity solutions, monitoring and incident response services for additional support. Board Oversight of Cybersecurity The Audit and Risk Committees of the Board oversee cybersecurity risk and the information security program which includes overseeing management’s actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives, from the CISO, an annual report of the information security program and monthly reports of any security incident or on notable security events for the period. The Board Chairman and Vice Chairman are notified of any high criticality security incidents within 24 hours. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives, from the CISO, annual reports on risk assessments and at least quarterly reports on key risk indicators. The Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats. Both the Bank’s management level Risk Committee and the Risk Committee of the Board review all risk assessments and remediations annually.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit and Risk Committees of the Board oversee cybersecurity risk and the information security program which includes overseeing management’s actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee receives, from the CISO, an annual report of the information security program and monthly reports of any security incident or on notable security events for the period. The Board Chairman and Vice Chairman are notified of any high criticality security incidents within 24 hours. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives, from the CISO, annual reports on risk assessments and at least quarterly reports on key risk indicators. The Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.Both the Bank’s management level Risk Committee and the Risk Committee of the Board review all risk assessments and remediations annually.
Cybersecurity Risk Role of Management [Text Block] | Management’s Role Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate. We also have a trained response team lead by the CISO, consisting of key individuals from executive management, finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate. Additionally, we engage a third party that offers cybersecurity solutions, monitoring and incident response services for additional support.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate. We also have a trained response team lead by the CISO, consisting of key individuals from executive management, finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate. Additionally, we engage a third party that offers cybersecurity solutions, monitoring and incident response services for additional support.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Audit and Risk Committees of the Board oversee cybersecurity risk and the information security program which includes overseeing management’s actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives, from the CISO, an annual report of the information security program and monthly reports of any security incident or on notable security events for the period. The Board Chairman and Vice Chairman are notified of any high criticality security incidents within 24 hours. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives, from the CISO, annual reports on risk assessments and at least quarterly reports on key risk indicators. The Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration