XML 49 R33.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Our ERM program is designed to identify, assess, and mitigate risks across our Company, including financial, operational, reputational, strategic, legal, liquidity, and credit. Cybersecurity is a critical component of this program as it is necessary for supporting our business and protecting our customers in an increasingly complex environment. The cybersecurity component of our ERM program is designed around the FFIEC Information Security IT Examination Handbook, the FFIEC Business Continuity Planning Handbook, and the FFIEC Cybersecurity Assessment Tool, and is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software, and information assets, including client and other sensitive data. Cybersecurity is an ongoing initiative that we monitor very closely. Threats to data security emerge and change rapidly. Cyber threats could include attacks that are common to most industries, such as ransomware attacks, unauthorized access, tampering, malware insertion, or other system integrity events, but could also include attacks from highly organized perpetrators targeting financial services companies. The cybersecurity component of our ERM program consists of several elements including: •A risk assessment process that identifies and prioritizes material cybersecurity risks, defines and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the board of directors. •A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. •A dedicated information security team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation, and threat intelligence. •A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. •An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. •An incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis. We expect each of our employees to be responsible for the security and confidentiality of our client information and our computer systems. We communicate this responsibility to each employee upon beginning employment with us and regularly throughout their employment. We require new hires to complete training on cyber-crime, social engineering, and cybersecurity awareness, and we also require this training during each year of employment thereafter. Employees are tested on their understanding of these requirements and provide acknowledgement of their responsibilities. Additionally, we regularly provide employees with information security awareness training covering the recognition and appropriate handling of potential phishing emails, which can introduce malware to our network, result in the theft of user credentials, and place sensitive data at risk. We regularly test employees to determine their susceptibility to phishing emails and require those more susceptible employees to take additional training. We protect our network and information assets with industry-tested security products and processes. Our information security team actively monitors our networks and systems to detect suspicious or malicious activity. We also conduct vulnerability scans to determine areas that need improvement. Our cybersecurity team maintains their current knowledge through training, obtaining professional certifications, and participating in industry groups. Our information security team expands and tests their knowledge of cyber threats through on-the-job training and periodic simulated exercises to practice responses to potential real-life threats. We also engage expert cyber consultants, as necessary and appropriate. We engage in regular assessments of our infrastructure, software systems, and network architecture, using both our internal information security team as well as third-party consultants to ensure that cybersecurity risks are appropriately identified and that controls are appropriately designed to mitigate such risks. We also maintain a third-party risk management program designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls, and monitoring vendor compliance with our cybersecurity requirements. While cybersecurity risks have the potential to materially affect our business, financial condition, and results of operations, we do not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations, or financial condition. For further discussion of risks from cybersecurity threats, see “Item 1A. Risk Factors” in this Report.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | The cybersecurity component of our ERM program is designed around the FFIEC Information Security IT Examination Handbook, the FFIEC Business Continuity Planning Handbook, and the FFIEC Cybersecurity Assessment Tool, and is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software, and information assets, including client and other sensitive data.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program. The information security team consists of information security professionals with varying degrees of education and experience. In particular, our IT Director and ISO are both qualified professionals with appropriate education, experience, and professional certifications. Each has more than 20 years of experience in the fields of IT and data security and hold relevant professional certifications that ensure expertise in preventing, detecting, and managing cyber risk. Our board of directors has approved management committees, including the OTC, to provide operational risk oversight for information security risks. The IT Director is the chair of the OTC, and the ISO is a member of the OTC. The OTC generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, and mitigation and prevention efforts employed to manage security risks. It also ensures that our internal control infrastructure is appropriate and commensurate with the growth of, or changes to, our information systems and processes. More frequent meetings may occur as needed to facilitate timely communication and monitoring efforts. In the event of a cybersecurity incident, the IT Director and ISO would become aware of the incident or potential incident through their own detection, detection by us, detection by a third-party consultant, or, in the case of a cybersecurity incident occurring on a system administered by a third party, through notification from that third party. Upon becoming aware of a cybersecurity incident or a potential cybersecurity incident, the IT Director and the ISO, in collaboration with the information security team, other employees, and external consultants as needed, would work to mitigate any impact of the incident or potential incident. The IT Director and the ISO would also inform the OTC of an incident or potential incident. Our board of directors has ultimate authority and responsibility for overseeing our ERM program, including risks related to cybersecurity. Our board oversees our ERM program through the Bank’s board, which meets monthly with the exception of August and November. The Bank’s board reviews all minutes of the OTC and also receives a report at each meeting regarding cybersecurity risk levels and performance regarding various information security metrics.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The OTC generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, and mitigation and prevention efforts employed to manage security risks. It also ensures that our internal control infrastructure is appropriate and commensurate with the growth of, or changes to, our information systems and processes. More frequent meetings may occur as needed to facilitate timely communication and monitoring efforts.
Cybersecurity Risk Role of Management [Text Block] | Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our IT Director and ISO are primarily responsible for the cybersecurity component and are key members of the ERM program, reporting directly to the Chief Operating Officer and Chief Executive Officer, respectively. Both our IT Director and ISO engage with our information security team to accomplish the goals of the cybersecurity component of our ERM program. The information security team consists of information security professionals with varying degrees of education and experience. In particular, our IT Director and ISO are both qualified professionals with appropriate education, experience, and professional certifications. Each has more than 20 years of experience in the fields of IT and data security and hold relevant professional certifications that ensure expertise in preventing, detecting, and managing cyber risk. Our board of directors has approved management committees, including the OTC, to provide operational risk oversight for information security risks. The IT Director is the chair of the OTC, and the ISO is a member of the OTC. The OTC generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, and mitigation and prevention efforts employed to manage security risks. It also ensures that our internal control infrastructure is appropriate and commensurate with the growth of, or changes to, our information systems and processes. More frequent meetings may occur as needed to facilitate timely communication and monitoring efforts. In the event of a cybersecurity incident, the IT Director and ISO would become aware of the incident or potential incident through their own detection, detection by us, detection by a third-party consultant, or, in the case of a cybersecurity incident occurring on a system administered by a third party, through notification from that third party. Upon becoming aware of a cybersecurity incident or a potential cybersecurity incident, the IT Director and the ISO, in collaboration with the information security team, other employees, and external consultants as needed, would work to mitigate any impact of the incident or potential incident. The IT Director and the ISO would also inform the OTC of an incident or potential incident.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The information security team consists of information security professionals with varying degrees of education and experience. In particular, our IT Director and ISO are both qualified professionals with appropriate education, experience, and professional certifications. Each has more than 20 years of experience in the fields of IT and data security and hold relevant professional certifications that ensure expertise in preventing, detecting, and managing cyber risk.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our board oversees our ERM program through the Bank’s board, which meets monthly with the exception of August and November. The Bank’s board reviews all minutes of the OTC and also receives a report at each meeting regarding cybersecurity risk levels and performance regarding various information security metrics.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration