3 unchanged sentences
Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries.
−Removed: To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program.
+Added: To mitigate these risks and protect sensitive customer data, financial transactions and the Company’s information systems, the Company has
+Added: implemented a comprehensive cybersecurity risk management program , which is a component of its overarching enterprise risk management program.
Key components of the cybersecurity risk management program include:
2 unchanged sentences
and reports results to executive management and the Board of Directors.
−Removed: • A third-party Managed Detection and Response (“MDR”) service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting.
+Added: • A third-party Managed Detection and Response (“MDR”) service, which monitors the security of the Company’s information systems around-the-clock, including intrusion detection and alerting.
• A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence.
4 unchanged sentences
Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.
−Removed: Our Third-Party Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements.
−Removed: This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.
+Added: The Company’s Third-Party Risk Management program is designed to ensure that its vendors meet its cybersecurity requirements.
+Added: This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with the Company’s cybersecurity requirements.
The Company’s cybersecurity risk management program and strategy are designed to ensure the company's information and information systems are appropriately protected from a variety of threats, both natural and man-made.
7 unchanged sentences
Accordingly, no matter how well designed or implemented the Company’s controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner.
−Removed: For more information on how cybersecurity risk may materially affect the Company’s business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.
+Added: For more information on how cybersecurity risk may materially affect the Company’s business strategy, results of operations or financial condition, please refer to Item 1A.
+Added: Risk Factors.
Board of Directors Oversight
The Company’s board of directors is charged with overseeing the establishment and execution of the Company’s risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness.
−Removed: Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company’s risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the
−Removed: Risk Committee of the Board of Directors.
−Removed: The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer (“CISO”) and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors.
−Removed: Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.
+Added: Consistent with this responsibility, the board of directors has delegated primary oversight responsibility (i) of the Company’s general risk management framework to the Risk Committee of the board of directors and (ii) of the Company’s information technology, cybersecurity risk and cybersecurity risk management to the Technology Committee of the board of directors, which was formed in the first quarter of 2025.
+Added: At least one member of the Risk Committee also serves as a member of the Technology Committee.
+Added: The Risk Committee previously has received, and the Technology Committee will receive on an ongoing basis, regular updates on the Company’s cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer (“CISO”) and the Chief Security
+Added: Officer (“CSO”).
+Added: The Risk Committee previously has provided, and the Technology Committee will provide on an ongoing basis, updates regarding cybersecurity risks and the cybersecurity program to the full board of directors.
+Added: Additionally, awareness and training on cybersecurity topics is provided to the board of directors on an annual basis.
Management's Role
4 unchanged sentences
Prior to joining the Company, the Company’s CISO served as leader of the Global Threat Management Center for a major global financial institution.
−Removed: The Information Risk department, led by the Head of Information Risk who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities.
+Added: The Information Risk department is led by the CSO, who reports directly to the Chief Risk Officer.
+Added: The CSO is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities.
As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm.
−Removed: Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board.
−Removed: The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board of Directors.
−Removed: These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.
+Added: Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the board of directors.
+Added: The risk committees include the Operational and Information Technology Risk Management Committee, the Executive Risk Management Committee and the Risk Committee and Technology Committee of the board of directors.
+Added: These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing cybersecurity risk.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.