XML 161 R35.htm IDEA: XBRL DOCUMENT
v3.25.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cybersecurity presents significant challenges to the business community in general, as well as to the financial services industry. Increasingly, bad actors, both domestically and internationally, attempt to steal personal data and/or interrupt the normal functioning of businesses through accessing individuals’ and companies’ files and equipment connected to the internet. Recently, intruders have become increasingly sophisticated and use deceptive methods to steal funds and personally identifiable information which they either take for their own purposes, release to the internet, or hold for ransom. Regulators are increasingly requiring companies to provide more advanced levels of cybersecurity measures. Our cybersecurity program aims to identify, manage, and mitigate cybersecurity risks – both internal and client-facing. We continue to maintain systems and ongoing planning measures to minimize the disruption of our services to clients as well as to prevent the loss of data concerning our clients, their financial affairs, and company-privileged information from cybersecurity incidents. Cybersecurity Risk Management & Strategy We utilize the widely recognized National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) as the foundation of our cybersecurity program, with strategic direction aligned to the following core functions:
| ● | Identify: We continuously assess our systems, data, and vulnerabilities to understand our cybersecurity risk profile. We enlist third-party cybersecurity consultants and vendors to support our cybersecurity efforts, tapping into their specialized knowledge and insights to assess and test the effectiveness of our cybersecurity program and to inform decision-making on detection and the deployment of defense measures, commensurate with our risk profile. As part of our Vendor Risk Management program, we periodically examine our third-party providers’ and vendors’ risks by reviewing the content and enforcement of their cybersecurity standards, policies, and procedures. We also employ real-time monitoring to detect suspicious activity in order to minimize risks associated with data breaches or other security incidents that may arise from third-party sources or insider threats.
| ● | Protect: We implement technical safeguards, including access controls, data encryption, network security, endpoint protection, and regular vulnerability patching. Our employee training and awareness programs are designed to improve cybersecurity awareness throughout the organization, and we are committed to educating our employees on security best practices in an industry-relevant context, relating to topics such as anti-money laundering, social engineering, and fraud prevention.
| ● | Detect: We employ automated monitoring tools and operational procedures for timely detection of anomalies, cybersecurity events, and potential cybersecurity incidents.
| ● | Respond: We have a Security Incident Response Plan, which is supported by operational procedures, to help guide response teams to prioritize and execute containment, investigation, eradication, and communication for confirmed cybersecurity incidents or breaches.
| ● | Recover: Our Business Continuity & Disaster Recovery Plan is in place to enable response to significant business disruptions and timely restoration of systems, data, and business operations following confirmed cybersecurity incidents or disaster scenarios.
We also incorporate industry-relevant context and emphasize security considerations beyond the core NIST CSF functions:
| ● | Regulatory Compliance: We integrate cybersecurity controls that address requirements of FINRA, SEC, and other relevant regulatory bodies.
| ● | Financial Transaction Security: We employ specific fraud detection and prevention measures to protect client funds and trading operations.
| ● | Market Integrity: We strive to safeguard systems and data that contribute to fair and efficient markets.
This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program is integrated into our overall risk management process by providing periodic updates to certain members of the management team which in turn regularly provide updates to our Board of Directors. As of the filing of this Report, we are not aware of any cybersecurity incidents that occurred during the fiscal year ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all cybersecurity risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see Part I, Item 1A, - Risk Factors of this Report. Cybersecurity Governance The management and assessment of cybersecurity risks and related risk management processes are handled primarily by our Chief Information Security Officer (“CISO”), whose experience includes approximately 25 years of cybersecurity experience leading and building cybersecurity programs for global Fortune 500 companies. Our CISO’s extensive cybersecurity background is supplemented with industry-leading certifications and credentials such as Cisco’s CCIE Security, Palo Alto Networks (PNCSE, PCDRA, PSE), Juniper Networks (JNCIS), and Checkpoint (CCSE) specializations on Endpoint Detection and Security Architecture. Our Chief Technology Officer (“CTO”), whose experience includes approximately 25 years of managing technology strategy and programs at public financial services organizations. The CTO also has key responsibilities and provides input into the management of our cybersecurity risks from a technology perspective. In order to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, our CISO, CTO, and respective technology and operations teams monitor the cybersecurity threat landscape, plan and implement security controls, and detect and respond to cybersecurity threats and incidents using a combination of security tooling, automated systems, and manual processes. Our Board of Directors, through its Audit Committee, oversees the cybersecurity risk management program. The Board of Directors and the Audit Committee are informed about risks from cybersecurity threats through periodic updates and reports provided by management. The periodic updates include briefing materials on our security posture, emerging cybersecurity threats and risks, cybersecurity incident response planning, significant cybersecurity incidents and breaches, and cybersecurity-related matters involving third parties or vendors.
Cybersecurity Risk Role of Management [Text Block] | Cybersecurity Risk Management & Strategy We utilize the widely recognized National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) as the foundation of our cybersecurity program, with strategic direction aligned to the following core functions:
| ● | Identify: We continuously assess our systems, data, and vulnerabilities to understand our cybersecurity risk profile. We enlist third-party cybersecurity consultants and vendors to support our cybersecurity efforts, tapping into their specialized knowledge and insights to assess and test the effectiveness of our cybersecurity program and to inform decision-making on detection and the deployment of defense measures, commensurate with our risk profile. As part of our Vendor Risk Management program, we periodically examine our third-party providers’ and vendors’ risks by reviewing the content and enforcement of their cybersecurity standards, policies, and procedures. We also employ real-time monitoring to detect suspicious activity in order to minimize risks associated with data breaches or other security incidents that may arise from third-party sources or insider threats.
| ● | Protect: We implement technical safeguards, including access controls, data encryption, network security, endpoint protection, and regular vulnerability patching. Our employee training and awareness programs are designed to improve cybersecurity awareness throughout the organization, and we are committed to educating our employees on security best practices in an industry-relevant context, relating to topics such as anti-money laundering, social engineering, and fraud prevention.
| ● | Detect: We employ automated monitoring tools and operational procedures for timely detection of anomalies, cybersecurity events, and potential cybersecurity incidents.
| ● | Respond: We have a Security Incident Response Plan, which is supported by operational procedures, to help guide response teams to prioritize and execute containment, investigation, eradication, and communication for confirmed cybersecurity incidents or breaches.
| ● | Recover: Our Business Continuity & Disaster Recovery Plan is in place to enable response to significant business disruptions and timely restoration of systems, data, and business operations following confirmed cybersecurity incidents or disaster scenarios.
We also incorporate industry-relevant context and emphasize security considerations beyond the core NIST CSF functions:
| ● | Regulatory Compliance: We integrate cybersecurity controls that address requirements of FINRA, SEC, and other relevant regulatory bodies.
| ● | Financial Transaction Security: We employ specific fraud detection and prevention measures to protect client funds and trading operations.
| ● | Market Integrity: We strive to safeguard systems and data that contribute to fair and efficient markets.
This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program is integrated into our overall risk management process by providing periodic updates to certain members of the management team which in turn regularly provide updates to our Board of Directors. As of the filing of this Report, we are not aware of any cybersecurity incidents that occurred during the fiscal year ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all cybersecurity risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see Part I, Item 1A, - Risk Factors of this Report.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our cybersecurity program is integrated into our overall risk management process by providing periodic updates to certain members of the management team which in turn regularly provide updates to our Board of Directors.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | we are not aware of any cybersecurity incidents that occurred during the fiscal year ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial condition.
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Cybersecurity Governance The management and assessment of cybersecurity risks and related risk management processes are handled primarily by our Chief Information Security Officer (“CISO”), whose experience includes approximately 25 years of cybersecurity experience leading and building cybersecurity programs for global Fortune 500 companies. Our CISO’s extensive cybersecurity background is supplemented with industry-leading certifications and credentials such as Cisco’s CCIE Security, Palo Alto Networks (PNCSE, PCDRA, PSE), Juniper Networks (JNCIS), and Checkpoint (CCSE) specializations on Endpoint Detection and Security Architecture. Our Chief Technology Officer (“CTO”), whose experience includes approximately 25 years of managing technology strategy and programs at public financial services organizations. The CTO also has key responsibilities and provides input into the management of our cybersecurity risks from a technology perspective. In order to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, our CISO, CTO, and respective technology and operations teams monitor the cybersecurity threat landscape, plan and implement security controls, and detect and respond to cybersecurity threats and incidents using a combination of security tooling, automated systems, and manual processes. Our Board of Directors, through its Audit Committee, oversees the cybersecurity risk management program. The Board of Directors and the Audit Committee are informed about risks from cybersecurity threats through periodic updates and reports provided by management. The periodic updates include briefing materials on our security posture, emerging cybersecurity threats and risks, cybersecurity incident response planning, significant cybersecurity incidents and breaches, and cybersecurity-related matters involving third parties or vendors.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors, through its Audit Committee, oversees the cybersecurity risk management program. The Board of Directors and the Audit Committee are informed about risks from cybersecurity threats through periodic updates and reports provided by management.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration