2 unchanged sentences
Cybersecurity.
+Added: Cybersecurity Risk Management and Strategy
Financial institutions have an obligation to customers, consumers and stakeholders to safeguard the confidentiality, integrity and availability of nonpublic, sensitive information and the information systems used to store, transmit or process such information.
−Removed: Consistent with industry guidelines, such as the National Institute of Standards and Technology Cybersecurity framework, and regulatory requirements, guidelines and standards, b1BANK’s information security and cybersecurity programs (collectively, “Program(s)”) have been adapted to fulfill this obligation by establishing and employing administrative, technical and physical safeguards to maintain a secure and dependable infrastructure and environment .
−Removed: These Programs focus on identifying and addressing threats to the company and its customers and contribute corporate decision-making guidance for information security, cybersecurity and risk management objectives.
−Removed: Defending against information security and cybersecurity (collectively, “Security”) threats demands a concentrated, collaborative approach and, as such, supplementary programs and processes have been instituted into governing Security and risk management strategies.
−Removed: Global threat intelligence is monitored for potential Security risks or vulnerabilities.
−Removed: These threats are analyzed for potential impact to the bank and are addressed in accordance with Program requirements.
−Removed: b1BANK’s Chief Information Security Officer (“CISO”) presents Security reports to the Operating Committee and Risk Committee of b1BANK’s board of directors on a quarterly basis or as needed.
−Removed: These reports consist of significant Security events and issues, vulnerability metrics, and material risks.
−Removed: Additional reporting representing the overall state of the Program is presented on at least an annual basis to the full board of directors, which is responsible for overseeing Security functions and associated initiatives.
−Removed: Security is embedded into our culture, being promoted through security awareness materials, mandatory testing campaigns and the mandatory annual review and acknowledgement of corporate Security policies and standards.
−Removed: Business Continuity and Incident Response plans have been cohesively established and employed to provide frameworks for responding to and recovering from events such as natural disasters or security events.
−Removed: Our Director of Business Continuity and CISO , respectively, are responsible for the facilitation of these plans, as needed, and testing each on at least an annual basis.
−Removed: The owners of these plans are responsible for identifying an appropriate group of cross-enterprise subject matter experts and convening them to ensure a comprehensive response.
−Removed: These groups, under the leadership of our Chief Operations Officer (“COO”), provide appropriate internal notifications of material security events and response activities to our General Counsel, Chief Risk Officer, Chief Executive Officer, and board of directors or other appropriate corporate executives.
−Removed: A vendor management program has been developed and employed to manage potential risks for third-party service providers, suppliers and external partners who have access to our confidential information.
−Removed: The effectiveness of these processes is verified by independent internal and external audit functions or organizations.
−Removed: Independent internal and external auditors are engaged to perform Security assessments to determine the appropriateness and effectiveness of the overall Program.
−Removed: Supplementary self-assessments are performed as needed or as required by regulatory guidelines.
−Removed: Assessment results are evaluated to determine the scope of risk on the security of the bank and are addressed in accordance with Program requirements.
−Removed: Our current CISO maintains appropriate security certifications and has over 20 years of experience in an information security role.
−Removed: The CISO manages a group dedicated to the security of the bank.
−Removed: This group is responsible for information technology monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CISO.
−Removed: Our CISO reports directly to our COO and oversees, is assigned the responsibly of and is held accountable for the implementation and monitoring of the Program.
−Removed: Our COO serves on the Risk Committee of the Board, chaired by a board director.
−Removed: The Company engages in a continuous, focused risk monitoring process to identify the likelihood and impact of internal and external threats to our information security systems and data and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis.
−Removed: The CISO and COO together lead efforts to design, implement and operate necessary controls commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the bank.
−Removed: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect b1BANK.
+Added: Consistent with industry guidelines, such as the National Institute of Standards and Technology Cybersecurity framework, and regulatory requirements, guidelines and standards, b1BANK’s cybersecurity program has been adopted to fulfill this obligation by establishing and employing administrative, technical and physical safeguards to maintain a secure and dependable infrastructure and environment.
+Added: This program focuses on identifying and addressing threats to the company and its customers and contributes corporate decision-making guidance for cybersecurity and risk management objectives.
+Added: Effectively defending against cybersecurity threats demands a concentrated, collaborative approach and, as such, supplementary programs and processes have been instituted into cybersecurity and risk management strategies.
+Added: We employ a multilayered approach to assessing, identifying and managing material risks from cybersecurity threats.
+Added: These processes include continuous monitoring of global threat intelligence, vulnerability management processes, incident alerting and periodic, independent audits.
+Added: Our risk assessment methodology evaluates potential impacts to critical systems and sensitive information across operational, financial, legal, and reputational domains, enabling us to determine whether a cybersecurity threat or incident is material.
+Added: Materiality determinations follow structured criteria consistent with emerging industry practices and SEC guidance.
+Added: Security considerations are integrated into our enterprise risk management (ERM) program .
+Added: Cyber risks are incorporated into the Company’s risk taxonomy, risk appetite framework, and enterprise‑level risk assessments, ensuring consistency in how operational risks—including technology and security risks—are identified, prioritized, and managed.
+Added: We maintain incident response and business continuity plans that provide structured processes to contain, eradicate, and recover from cybersecurity events.
+Added: These plans are tested at least annually and updated as necessary to reflect emerging threats, operational changes, and regulatory developments.
+Added: We also manage cybersecurity risks arising from third‑party service providers through a dedicated vendor management program.
+Added: Service providers are subjected to comprehensive due‑diligence reviews, contract controls, and ongoing monitoring.
+Added: Our Board of Directors, through its Risk Committee , provides oversight of cybersecurity risk.
+Added: The Committee receives quarterly reports from management regarding cybersecurity events, vulnerability trends, risk assessments, and program maturity.
+Added: Management of cybersecurity risk is led by our Chief Information Security Officer (“CISO”) , who has over 20 years of information security experience and maintains relevant industry certifications.
+Added: The CISO is responsible for implementing and monitoring the cybersecurity program and reports directly to the Chief Operating Officer (“COO”).
+Added: Consistent with peer disclosures, our management structure ensures that individuals with appropriate expertise lead cybersecurity functions and regularly communicate with the Board.
+Added: Our cybersecurity governance model includes cross‑functional committees and working groups responsible for coordinating risk assessments, program enhancements, incident response preparedness, and alignment with regulatory requirements.
+Added: Security awareness and training programs are mandatory for all employees, reinforcing a security‑focused culture across the enterprise.
+Added: Cybersecurity Incidents
+Added: We assess whether identified cybersecurity incidents are material under applicable regulatory standards.
+Added: During the reporting period, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank.
+Added: We continue to monitor the evolving threat landscape and adapt our controls accordingly.
+Added: While immaterial cybersecurity incidents may occur from time to time, our established controls and incident response processes have effectively mitigated these events without material impact.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.