XML 77 R43.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Cybersecurity is one of our strategic priorities and one of the pillars of our digital transformation. Our information security team defines the strategy, policies, practices, procedures, and organizational structure that best aligns with our business objectives, which we use to identify, analyze, evaluate, measure, mitigate, and monitor cybersecurity risks. We work together with different teams of our organization to conduct continuous analysis of potential failures, vulnerabilities or risks that may impact our processes and products.

Our information security strategy is based on the following three security frameworks: defense in depth, security by design, and zero trust. During 2024, we focused on improving the level of maturity our  systems using the Center for Internet Security controls framework, which is based on internationally recognized cybersecurity best practices. Additionally, our controls are aligned to new regulations of regulatory bodies such as the Central Bank. This strategy is implemented by a multidisciplinary group of information security professionals who work full-time and operate in an agile and collaborative manner. They collaborate not only among themselves but also with our business teams to maintain and develop new products.

Our security professionals are organized in the following teams: (i) a “green team” who is responsible for managing digital identities, (ii) a “red team” whose mission is to perform cyberattack tests to our products and infrastructure through vulnerability assessment and penetration tests, (iii) a “blue team” who is focused on protecting our information assets, delivering security solutions to product-building cells, and strengthening defense mechanisms based on the findings made by our “red team,” and (iv) a “purple team” who is assembled ad hoc with members from the blue and red teams to conduct retrospective analyses. All these teams manage and mitigate cybersecurity risks on a regular basis. These teams work in bi-weekly sprints, holding daily and weekly meetings where

information related to the progress of ongoing projects, new products, risks and threats is exchanged and analyzed. Executive summaries of all the activities carried out by these teams are compiled, analyzed, and discussed bi-monthly in meetings of our Cybersecurity Committee, which are attended by senior management, directors, and the Company’s chairman.

As cyber-attacks evolve and become more sophisticated, companies must strengthen their prevention and monitoring efforts and adopt new measures to mitigate cybersecurity risks. In recent years, the average number of cybersecurity incidents has increased significantly worldwide. As a result, in 2024, one of our goals was to prevent the most common cyberattacks, which are related to ransomware, smishing, phishing, brand abuse, among others, ant to maintain ratios below the competition. Therefore, we have enhanced our system monitoring capabilities, paying special attention to critical assets that support business processes. Additionally, we have incorporated machine learning and artificial intelligence to achieve automation and improve efficiency in our security services. Our cybersecurity Security Operations Center (“SOC”), which operated by a third party, enables us to detect and respond to cyber-attacks. In addition, our threat intelligence service proactively detects potential cyber-attacks on our infrastructure and/or ours customers through the analysis of Clear, Deep, and Dark web sources. We will promptly report any material incidents to the supervisory or regulatory authorities.

For the second consecutive year, we are in compliance with the SWIFT security assessment and we meet all mandatory and recommended controls. This milestone underscores our unwavering commitment to cybersecurity excellence, demonstrating a proactive and innovative approach to safeguarding critical assets and customer data. By maintaining the highest standards of protection on one of the most targeted infrastructures in the financial sector, we reinforce our resilience against evolving threats.

To address the dynamic nature of cyber risks, we have implemented several strategic initiatives. These include a comprehensive information classification framework, significantly improved through automation to prevent data leakage by blocking unauthorized transmissions. Additionally, we conduct regular inspections and testing of our security measures through simulation exercises, including cybersecurity tests by our “red team.” These exercises help us identify vulnerabilities through technical assessments, social engineering simulations, and ethical phishing campaigns. We have also embraced a model to ensure that our business initiatives, products and their underlying technologies are secure.

We have also adopted an innovative gamification approach to educate diverse audiences on secure operations while actively participating in prominent cybersecurity events in Argentina. During 2024, we implemented a comprehensive communication campaign addressed to employees and clients to raise awareness about secure digital transactions. This initiative featured redesigned materials, updated security tips, and tutorials across social media platforms such as Facebook, Instagram, Twitter (currently named X), and YouTube, alongside dedicated cybersecurity blogs offering resources for scam victims. This continued effort strengthens our commitment to promoting security and prevention, reinforcing our position as a leader in cybersecurity awareness.

Based on the information we have as of the date of this Form 20-F, we do not believe any cybersecurity threats have materially affected or are reasonably likely to materially affect the Group, including our business strategy, results of operations or financial condition.  However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see “Item 3.D. Risk Factors—Risks Relating to Our Business—Cybersecurity events could negatively affect our reputation, results of operations and financial condition.”

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

Cybersecurity is one of our strategic priorities and one of the pillars of our digital transformation. Our information security team defines the strategy, policies, practices, procedures, and organizational structure that best aligns with our business objectives, which we use to identify, analyze, evaluate, measure, mitigate, and monitor cybersecurity risks. We work together with different teams of our organization to conduct continuous analysis of potential failures, vulnerabilities or risks that may impact our processes and products.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

To ensure that the Company’s security strategy is implemented efficiently, we have established a security governance model. This security governance model has been prepared by committees responsible for approving and supervising the execution of the information security strategy in areas such as corporate security and risk management.

In addition to our CISO, our Cybersecurity Committee plays a key role in implementing our information security strategy. Our Cybersecurity Committee is composed of the following members: two directors of Grupo Supervielle, the CEO of Grupo Supervielle, the CEO of Banco Supervielle S.A., the Chief Risk Officer, the Corporate Audit team, and the CISO of Grupo Supervielle and Banco Supervielle. Additionally, the Chief Technology Officers and the Chief Product and Information Officer of our subsidiaries participate in the meetings of our Cybersecurity Committee.

Our Board of Directors regularly receives cybersecurity updates as an integral part of its ongoing risk oversight from the Board committees. Additionally ,the Chief Product and Information Officer, the Chief Risk Officer and the Chief Information Security Officer may convene ad hoc meetings with board members. Our incident response plan set forth procedures for incident escalation, including convening crisis committees comprised by members of our Board of Directors, in order to facilitate decision-making procedures in response to cybersecurity events. Our crisis committees analyze the quantitative and/or qualitative materiality of cybersecurity events to determine if they exceeds the materiality thresholds and the actions to be taken in response thereto, which enables us to adopt swift and effective responses to mitigate potential impacts on our operations and reputation.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Cybersecurity Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] In addition to our CISO, our Cybersecurity Committee plays a key role in implementing our information security strategy. Our Cybersecurity Committee is composed of the following members: two directors of Grupo Supervielle, the CEO of Grupo Supervielle, the CEO of Banco Supervielle S.A., the Chief Risk Officer, the Corporate Audit team, and the CISO of Grupo Supervielle and Banco Supervielle. Additionally, the Chief Technology Officers and the Chief Product and Information Officer of our subsidiaries participate in the meetings of our Cybersecurity Committee.Our Operational Risk Committee analyzes deviations to our information security policy and adopts decisions in line with the Group’s risk appetite. This committee reports to the Integral Risk Committee which discusses cybersecurity matters and reports to our Board of Directors. Our Board of Directors regularly receives cybersecurity updates as an integral part of its ongoing risk oversight from the Board committees. Additionally ,the Chief Product and Information Officer, the Chief Risk Officer and the Chief Information Security Officer may convene ad hoc meetings with board members.
Cybersecurity Risk Role of Management [Text Block]

While the primary responsibility for cybersecurity lies with our CISO, who has more than 30 years of experience and extensive academic training in cybersecurity and cryptography, we recognize the importance to collaborate with other experts and we highly value the diversity of expert opinions.

Our Operational Risk Committee analyzes deviations to our information security policy and adopts decisions in line with the Group’s risk appetite. This committee reports to the Integral Risk Committee which discusses cybersecurity matters and reports to our Board of Directors. Our Operational Risk Committee communicates every month all the decisions taken by it. In compliance with regulatory standards, our Operational Risk Committee convenes periodically to fulfill its primary objective of reviewing reports submitted by the Group’s non-financial risk management department. These reports provide thorough evaluations encompassing operational and technological risks, reputational risks, supplier risks, and environmental risks. Additionally, these reports include assessments of potential deviations in planned evaluation processes.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] CISO
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

While the primary responsibility for cybersecurity lies with our CISO, who has more than 30 years of experience and extensive academic training in cybersecurity and cryptography, we recognize the importance to collaborate with other experts and we highly value the diversity of expert opinions.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Operational Risk Committee communicates every month all the decisions taken by it. In compliance with regulatory standards, our Operational Risk Committee convenes periodically to fulfill its primary objective of reviewing reports submitted by the Group’s non-financial risk management department. These reports provide thorough evaluations encompassing operational and technological risks, reputational risks, supplier risks, and environmental risks. Additionally, these reports include assessments of potential deviations in planned evaluation processes.Moreover, our Operational Risk Committee oversees the implementation of mitigation plans, key risk indicators, and internal control reports. As part of its responsibilities, this committee offers recommendations to address emerging risks or enhance risk management strategies.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true