XML 26 R11.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | We depend heavily on various information systems and electronic resources to conduct our business operations. Additionally, a majority of our clients, service providers, and other business partners on whom we rely, including providers of our online banking, mobile banking, and accounting systems, utilize their own electronic information systems. Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals, as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies. Given our status as a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious actors. For further details, please refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item 1A of this Form 10-K. As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including:
| · | Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program;
| · | Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements;
| · | Implementing multi-layered controls to avoid reliance on single controls;
| · | Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats;
| · | Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time;
| · | Managing and maintaining cybersecurity controls utilizing available people, processes and technology;
| · | Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers;
| · | Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;
| · | Collaborating with third-party cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes;
| · | Providing regular cybersecurity training for both our employees and Board of Directors.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | As a result, we have devoted significant resources to assessing, identifying, and managing cybersecurity risks and threats, including:
| · | Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program;
| · | Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements;
| · | Implementing multi-layered controls to avoid reliance on single controls;
| · | Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats;
| · | Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time;
| · | Managing and maintaining cybersecurity controls utilizing available people, processes and technology;
| · | Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers;
| · | Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;
| · | Collaborating with third-party cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes;
| · | Providing regular cybersecurity training for both our employees and Board of Directors.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Information Security Program, overseen by our Executive Project and Technology Risk Committee (“EPTRC”), plays a vital role in our overall risk management system.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats.
Cybersecurity Risk Role of Management [Text Block] | The Information Security Program, overseen by our Executive Project and Technology Risk Committee (“EPTRC”), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information. We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice. Occasionally, we have encountered cybersecurity threats necessitating adjustments to our procedures and the integration of extra safeguards. Although these specific threats or incidents haven't significantly impacted us thus far, it is possible that future threats and incidents we detect could potentially have a material adverse effect on our business strategy, results of operations, and financial condition. Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. The EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information Security Program. Furthermore, our Board of Directors, both collectively and through its Risk Committee, holds responsibility for overseeing risk management, including cybersecurity risks. In this capacity, the Board and the Risk Committee, supported by management and third-party cybersecurity advisors, ensure that the risk management processes devised and executed by management are adequate and operational as intended. Annually, the Board reviews and approves our information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy, and business continuity planning policy. These policies are developed and implemented by our management team. To fulfill their duties, the Board receives regular updates from the Risk Committee regarding cybersecurity risks and management’s endeavors to prevent, detect, mitigate, and address any cybersecurity incidents, at least quarterly.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Furthermore, our Board of Directors, both collectively and through its Risk Committee, holds responsibility for overseeing risk management, including cybersecurity risks. In this capacity, the Board and the Risk Committee, supported by management and third-party cybersecurity advisors, ensure that the risk management processes devised and executed by management are adequate and operational as intended. Annually, the Board reviews and approves our information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy, and business continuity planning policy. These policies are developed and implemented by our management team. To fulfill their duties, the Board receives regular updates from the Risk Committee regarding cybersecurity risks and management’s endeavors to prevent, detect, mitigate, and address any cybersecurity incidents, at least quarterly.

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceAbstract
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration