12 unchanged sentences
Our CEO has ultimate responsibility for developing strategy and overseeing execution to meet the firm’s objectives.
−Removed: The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution.
−Removed: The COO has several leaders within the COO organization who develop and oversee the firm’s risk management, technology, and information security practices.
+Added: The CEO has delegated to our Chief Technology Officer (CTO) oversight of this operational execution.
+Added: The CTO has several leaders within the Technology organization who develop and oversee the firm’s risk management, technology, and information security practices.
These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.
+Added: The firm has a unified Technology, Data, and Operations (TDO) organization to enhance alignment, efficiency, and innovation across global business functions.
+Added: Under this TDO model, technology, data, and operational capabilities have been integrated to drive modernization, accelerate execution, and strengthen collaboration across the enterprise.
The firm’s Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO) .
−Removed: The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats.
+Added: The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risk from cybersecurity threats.
The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Global Compliance to provide risk assurance activities.
13 unchanged sentences
Cybersecurity risks are managed across all lines of business, requiring support and participation across all levels in the organization.
−Removed: Within Global Technology, Enterprise Security is responsible for maintaining security policies, standards, and guidelines and routinely works with our Enterprise Risk, Compliance, Internal Audit, and other key technology and corporate stakeholders to establish security controls, enforce them, and monitor their adherence on an ongoing basis.
−Removed: Enterprise Security also conducts regular phishing tests and manages annual employee training
−Removed: focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats.
+Added: Within TDO, Enterprise Security is responsible for maintaining security policies, standards, and guidelines and routinely works with our Enterprise Risk, Compliance, Internal Audit, and other key technology and corporate stakeholders to establish security controls, enforce them, and monitor their adherence on an ongoing basis.
+Added: Enterprise Security also conducts regular phishing tests and manages annual employee training focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats.
Business Continuity and Disaster Recovery programs execute regular testing across business and technology teams to demonstrate resilience.
13 unchanged sentences
We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication.
−Removed: Although no cybersecurity incident during the year ended December 31, 2024, resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm’s strategy, financial condition or results of operations.
−Removed: The scope and impact of any future incident cannot be predicted.
+Added: During the year ended December 31, 2025, no cybersecurity incident resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm’s strategy, financial condition or results of operations;
+Added: however the scope and impact of any future incident cannot be predicted.
See “Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.