XML 56 R36.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
The Company has complex information systems used for a variety of functions by customers, employees, and vendors. In addition, third parties with which the Company does business or that facilitate business activities (e.g., vendors, exchanges, clearing houses, central depositories and financial intermediaries) could also be sources of cybersecurity risk to the Company, including breakdowns or failures of their systems, misconduct by the employees of such parties, or cyberattacks which could affect their ability to deliver a product or service to the Company.

Our systems are regularly targeted by attacks aimed at disrupting services, misusing or accessing customer data without authorization, seeking financial extortion, or executing fraudulent activities. To date, no such incidents have significantly impacted the Company’s operations or adversely affected our customers, nor have they materially influenced our operational results. Nevertheless, it is important to acknowledge that we cannot guarantee the prevention or detection of sophisticated cyber-attacks. In the event of significant service disruptions, unauthorized access leading to the misuse of customer information, or fraudulent activities affecting our or third-party systems, the Company may face operational, regulatory, legal, and reputational challenges, which could adversely affect our business and financial conditions.

The Company’s Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company’s Information Security Program through ongoing initiatives. The Company implements a formal Information Security Program aligning to industry best practices and focuses on the following key areas to mitigate cyber risks:

i.Risk Assessment – At least annually, a risk assessment is conducted that incorporates other security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat
landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.
ii.Technical Safeguards – Multi-layered controls, defenses, and continuous monitoring tools are used to protect, detect, and respond to cyber threats and incidents. External independent assessments, regular threat intelligence review, and lessons learned from incident response drive continuous tool and process improvements.
iii.Incident Response and Recovery - The Company's formal Incident Response and Business Continuity Programs establish a clear, consistent, standard, and organized process by which cybersecurity incidents will be promptly responded to by the Company's incident response teams.
iv.Third-Party Risk Management – The Company's formal vendor management program includes security risk assessments requiring the vendor to meet or exceed appropriate security requirements prior to the hosting or sharing of sensitive information by third parties. The Company’s standard contract provisions obligate third-party compliance with industry standard security protections.
v.Education and Awareness - The Company conducts cybersecurity training, both formally through mandatory courses and informally through written communications and other updates. Employees are tested periodically with phishing tests to reinforce training. The Company has held webinars and also sends periodic emails to its customers with tips and suggestions to protect themselves against cybersecurity incidents.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] As a regulated financial institution, the Company must adhere to the security requirements and expectations of the applicable regulatory agencies, which include requirements related to cybersecurity, data privacy, vendor security risk management, systems availability, and business continuity planning, among others.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
As a regulated financial institution, the Company must adhere to the security requirements and expectations of the applicable regulatory agencies, which include requirements related to cybersecurity, data privacy, vendor security risk management, systems availability, and business continuity planning, among others. The regulatory agencies have established responsibility guidelines for the Board of Directors and senior management, which include establishing policy, appointing and training personnel, implementing review and testing functions, and ensuring an appropriate frequency of reporting. The Company is examined annually, and its Information Security Program, policies and standards are designed to meet regulatory requirements and industry standards to implement physical, administrative, and technical controls to comply with the Gramm-Leach-Bliley Act ("GLBA"), Sarbanes-Oxley Act ("SOX") of 2002, and industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC").

The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, and Information Security Director more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.
Cybersecurity Risk Role of Management [Text Block]
The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, and Information Security Director more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Information Security Program, which is in compliance with banking regulations, includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, annual audits, and reviews of vendors who handle sensitive information.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true