What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-03 compared with 2024-03-05 · 38 added, 26 removed, 31 unchanged (67% of the section changed)

7 unchanged sentences

Any of these systems are susceptible to compromise, whether by employees, clients, or other authorized individuals,

by malicious actors employing sophisticated and continuously evolving software, tools, and strategies.

as well as by malicious actors employing sophisticated and continuously evolving software, tools, and strategies.

Given our status as

a financial services provider and our relative size, we and our business partners are considered high-value targets for such malicious

For further details, please refer to the “Risks Related to Information Security and Business Interruption” section of

the Risk Factors outlined in Item 1A of this Form 10-K.

a financial services provider and our relative size, we and our business partners are considered high-value targets for

such malicious actors.

For further details, please

refer to the "Risks Related to Information Security and Business Interruption" section of the Risk Factors outlined in Item

1A of this Form 10-K.

As a result, we have devoted significant resources

to assessing, identifying, and managing cybersecurity risks and threats, including:

Maintaining policies and procedures regarding security operations and governance through the implementation of an Information Security Program;

Establishing a committee responsible for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements;

Implementing multi-layered controls to avoid reliance on single controls;

Utilizing both preventative and detective tools to monitor and block suspicious activity and to alert of potential threats;

Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in real time;

Managing and maintaining cybersecurity controls utilizing available people, processes and technology;

Utilizing a third-party risk management program for purposes of identifying, assessing and managing risks involved with external service providers;

Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices;

Collaborating with third-party cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes;

Providing regular cybersecurity training for both our employees and Board of Directors.

The Information Security Program, overseen by our Executive Project

and Technology Risk Committee (“EPTRC”), plays a vital role in our overall risk management system.

It encompasses administrative,

technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information.

an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies

for remediation, prevention of future incidents and resiliency to all types of threats.

The incident response team (i) includes subject

matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify

· Maintaining policies and procedures

regarding security operations and governance through the implementation of an Information Security Program;

· Establishing a committee responsible

for security administration, including regular assessments of our systems, existing controls, vulnerabilities, and potential improvements;

· Implementing multi-layered controls

to avoid reliance on single controls;

· Utilizing both preventative and

detective tools to monitor and block suspicious activity and to alert of potential threats;

· Keeping abreast of new technology

and evaluating tools to help respond to threats to cybersecurity in real time;

· Managing and maintaining cybersecurity

controls utilizing available people, processes and technology;

· Utilizing a third-party risk

management program for purposes of identifying, assessing and managing risks involved with external service providers;

· Conducting thorough due diligence

concerning our third-party service providers, including evaluating their cybersecurity practices;

· Collaborating with third-party

cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential

weaknesses in our systems and processes;

· Providing regular cybersecurity

training for both our employees and Board of Directors.

The Information Security Program, overseen by our Executive

Project and Technology Risk Committee (“EPTRC”), plays a vital role in our overall risk management system.

It encompasses

administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information.

We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term

strategies for remediation, prevention of future incidents and resiliency to all types of threats.

The incident response team (i) includes

subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify

events that may warrant Board notification and a Form 8-K cybersecurity notice.

4 unchanged sentences

effect on our business strategy, results of operations, and financial condition.

Our management team is tasked with the daily management of

the cybersecurity risks we encounter and supervises the EPTRC.

Our management team is tasked with the daily management

of the cybersecurity risks we encounter and supervises the EPTRC.

Our EPTRC, in turn, oversees the assessment of information security,

the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company.

The EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information

Security Program.

EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information Security

Furthermore, our Board of Directors, both collectively

11 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments