Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Mar. 31, 2026
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	Key measures undertaken by the Bank to mitigate information security related risks: We continue to enhance its information security posture through a robust, multi layered control environment designed to safeguard customer data and ensure secure digital operations. This is supported by Board approved Information Security and Cyber Security policies, with strategic oversight provided by the Information Technology Strategy Committee and the Information Security Committee. The committees review key risks, monitor emerging threats, and ensure alignment with regulatory expectations. Our advanced AI/ML enabled Cyber Security Operations Centre (“CSOC”) provides round the clock monitoring of infrastructure, network traffic and applications. Enriched threat intelligence feeds and machine learning–driven analytics enable early detection of anomalies and improved correlation of suspicious activities, while behavioral modelling further enhances incident identification and response. The Attack Surface Management (ASM) programme further mitigates risk by continuously identifying and remediating exposures across internal and external digital assets, supported by vulnerability assessments and penetration testing. Further, our security controls across networks, applications and endpoints include anti malware technologies, Intrusion Detection and Prevention Systems (IDS/IPS), micro segmentation, and enterprise wide Data Loss Prevention (DLP) safeguards. Cloud and data security measures are strengthened through Cloud Security Posture Management (CSPM), Cloud Infrastructure Entitlement Management (CIEM) and Cloud Workload Protection Platform (CWPP) to ensure secure cloud configurations, entitlement governance, workload protection, and sensitive data oversight across hybrid environments. Strong access controls form a key part of the Bank’s security framework, with Identity and Access Management (IAM), Privileged Access Management (PAM), authentication methods, and periodic access reviews enforcing least privilege principles and preventing unauthorized access. Periodic adversarial exercises are carried out by the bank’s Red Team to assess system resilience, uncover vulnerabilities, and validate detection and response controls. Activities include red team operations, breach simulations, and targeted assessments of key security technologies, aligned to the MITRE ATT&CK framework for testing. To mitigate phishing, impersonation, and customer facing cyber fraud risks, the Bank continuously monitors for fraudulent domains and phishing campaigns, initiating rapid takedown actions when required. These initiatives are reinforced by regular employee training, cyber drills, and awareness programs that build a strong culture of cybersecurity across the organization. This layered approach helps contain threats, limit their spread across the environment, and preserve business continuity by ensuring that endpoints remain consistently protected and actively monitored. Collectively, these measures demonstrate our ongoing commitment to mitigating information security risks and maintaining a secure, resilient, and trusted digital banking environment. Extended Detection and Response (XDR) / Malware Programme : These programmes deliver a unified security arrangement that integrates protection across networks, endpoints, cloud workloads, and user identities. By consolidating visibility and correlating indicators from multiple security layers, they enhance the detection and remediation of sophisticated threats, including ransomware and advanced malware. As part of maintaining strong cyber hygiene, antivirus and anti malware signatures are routinely updated across all critical assets such as workstations, servers, email gateways, and web gateways ensuring the organization remains protected against emerging and evolving threats. Vulnerability management : We have maintained a structured vulnerability management process that conducts continuous scanning of systems, applications, and network components to identify security weaknesses. A dedicated team tracks identified vulnerabilities, assesses their risk levels, and coordinates remediation activities with the respective technology and business teams. The process includes routine internal scans, periodic external assessments, and validation of fixes to ensure that issues are appropriately addressed. This program helps reduce exposure to known threats, supports timely mitigation of high risk vulnerabilities, and ensures that security gaps are managed in line with defined policies and regulatory expectations. We have adopted the AI-for-security and security-of-AI themes for all programs and is actively working with security tool providers for incorporating near machine speed capabilities in the tools used for vulnerability management. Patch management: We have maintained a structured and disciplined patch management process supported by tools to assess, prioritize, and deploy operating system, network, and application level updates. Vendor supplied patches are evaluated for relevance and risk, formally documented, and tested where required to ensure compatibility. Timely deployment of approved patches across endpoints, servers, and critical infrastructure helps reduce vulnerabilities, strengthen resilience, and maintain a secure and compliant technology environment. Penetration testing: We have conducted comprehensive penetration testing both routine and event driven to identify and validate potentially exploitable vulnerabilities across its technology landscape. These assessments are performed on all critical internal and external systems, including networks, hosts, and applications, and are triggered by significant changes such as new deployments, major upgrades, or architectural enhancements. The testing uses ML to anticipate the logical moves an attacker might take by analyzing the network structure, identifying weak points, and simulating possible exploits. We also actively working with security tool providers for incorporating AI to achieve near machine speed capabilities. Findings are analyzed, prioritized, and remediated through a defined governance process, ensuring continuous strengthening of our security posture and resilience against emerging threats. Network security : We have employed a defense in depth security architecture that layers multiple controls to safeguard its network against a wide spectrum of cyber threats. Firewalls and proxy servers form the first line of protection by regulating and segregating network traffic based on defined trust levels, ensuring that only validated and authorized communication is permitted. This model is further enhanced through the adoption of Zero-Trust principles, where no user, device, or workload is inherently trusted and continuous verification is required at every access point. To limit lateral movement and contain potential threats, we have implemented micro segmentation, dividing the network into tightly controlled zones with granular access restrictions aligned to business functions and security requirements. Complementing these measures, advanced Distributed Denial of Service (DDoS) defense mechanisms continuously analyze traffic patterns, absorb malicious volumetric attacks, and maintain service availability during attempted disruptions. Our intrusion detection and prevention systems (IDS/IPS) provide deep, real time inspection of network traffic to identify, alert, and block malicious activity. Regular signature updates and behavioral analytics enhance detection accuracy and improve responsiveness to new threats, attacker techniques, and anomalous patterns. Configured with automated alerting and threshold based triggers, these systems support proactive monitoring and rapid containment, strengthening the Bank’s ability to detect, prevent, and mitigate potential security breaches. Together, these integrated network security controls form a robust, multi layered defense model that aligns with global best practices and ensures strong protection across our digital ecosystem. Data privacy: Financial institutions regularly encounter a variety of data-related challenges involving issues such as data quality and accessibility. In a highly automated banking environment such as the one in which the Bank operates, such challenges can have serious effects on virtually all aspects of bank operations. Our data privacy program is a highly regulated initiative headed by the Data Privacy Officer under the direct supervision of the Board and the Chief Data Officer.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	Cybersecurity risks, including those associated with third-party service providers, are assessed using defined parameters and key risk indicators, which are integrated into our risk management and reporting framework.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]	true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]	We face cybersecurity threats, such as hacking, phishing, trojans, distributed denial-of-service attacks and emerging automated cyberattacks, including AI-driven cyberattacks, attempting to exploit our network to disrupt services to customers and/or theft or leaking of sensitive internal Bank data or customer information. Cybersecurity incidents have in the past, and may in the future, cause damage to our reputation and adversely impact our business and financial results.
Cybersecurity Risk Board of Directors Oversight [Text Block]	We continue to enhance its information security posture through a robust, multi layered control environment designed to safeguard customer data and ensure secure digital operations. This is supported by Board approved Information Security and Cyber Security policies, with strategic oversight provided by the Information Technology Strategy Committee and the Information Security Committee. The committees review key risks, monitor emerging threats, and ensure alignment with regulatory expectations.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	To effectively manage risks in these critical areas, the Bank has established specialized governance forums such as the IT Strategy Committee and the Information Security Committee (ISC), which provide strategic oversight and ensure that security practices evolve in line with emerging threats and regulatory expectations. For further details in relation to the IT Strategy Committee, see “ Management—Corporate Governance—Structure and Responsibilities of the Board and its Committees—IT Strategy Committee ”.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]	The ISC convenes at least once every two months with representatives from Information Technology, the Information Security Group and other enabling functions, Audit and relevant business units. The Chief Information Security Officer (“CISO”) proposes and finalizes the ISC agenda, presents the current state of information security to the ISC, drives the implementation of the ISC approved ISMS agenda and also reports major security incidents faced by us.Our cybersecurity strategies are periodically presented to the Information Security Committee and IT Strategy Committee of the Board. The cybersecurity risks and their mitigation plans are also presented to the Risk Policy and Monitoring Committee of the Board on a half-yearly basis
Cybersecurity Risk Role of Management [Text Block]	The Information Security Committee is chaired by the Chief Risk Officer. The Information Security Committee is tasked with reviewing information security policy dispensations, making strategic and financial decisions on information security plans, reviewing performance and monitoring the progress of the information security program. It also discusses any significant information security risks, determines actions for risk remediation and approves changes to the constitution and functioning of the ISC. The ISC convenes at least once every two months with representatives from Information Technology, the Information Security Group and other enabling functions, Audit and relevant business units. The Chief Information Security Officer (“CISO”) proposes and finalizes the ISC agenda, presents the current state of information security to the ISC, drives the implementation of the ISC approved ISMS agenda and also reports major security incidents faced by us. Our cybersecurity strategies are periodically presented to the Information Security Committee and IT Strategy Committee of the Board. The cybersecurity risks and their mitigation plans are also presented to the Risk Policy and Monitoring Committee of the Board on a half-yearly basis by the CISO. We also maintain oversight of our information security posture, with the information security team publishing an “Executive Metrics” report to senior management on a monthly basis comprising key information security metrics. The qualifications of our senior management are described under “ Management—Senior Management ”. We operate a comprehensive Cyber Security Framework, a Cybersecurity Policy (approved by the Board), an Information Security Policy, and a robust Information Security Program designed to safeguard customer information and maintain secure operations. Our cybersecurity-related policies define clear responsibilities and controls for maintaining security hygiene and embedding data protection into business processes and technology design. We have set up an independent IT Risk Management (“ITRM”) function within the Risk Management Group under the GCRO. This IT Risk Management function caters to risk assessment of technology solutions and applications, the Enterprise Business Continuity Management (“BCM”) program, third party risk management, and other areas. For further details in relation to the Bank’s technology risk management, see “ Business—Risk Management— Information Technology Risk ”. We continue to strengthen our security posture through technology driven initiatives that proactively enhance resilience. A dedicated Attack Surface Management (ASM) program operates on a continuous basis to identify and address vulnerabilities across assets, helping maintain a secure environment for customers and internal functions. The program leverages advanced AI-assisted capabilities to enable near-machine-speed detection and validation and ML-powered external attack surface mapping that continuously discovers and classifies exposed assets, complemented by strong vulnerability management for internet facing properties, advanced anti malware protection, and periodic penetration testing. The Bank’s Red Team conducts adversarial simulations to assess defensive readiness, with identified gaps remediated promptly to ensure uninterrupted and secure banking services. Centralized patch management improves operational efficiency through discovery and remediation of vulnerabilities across endpoints and servers, helping reduce risk exposure and maintain compliance with internal and regulatory security standards. With cloud adoption increasing, the Bank has strengthened cloud security through mature posture and access governance capabilities. Cloud Security Posture Management (CSPM) ensures continuous configuration monitoring and compliance enforcement, while Cloud Access Security Broker tools (CASB) provide visibility into cloud usage and ensure policy aligned access. These are complemented by Cloud Infrastructure Entitlement Management (CIEM) for granular control over cloud identities and privileges, and Cloud Workload Protection Platforms (CWPP) that secure workloads through continuous vulnerability detection, runtime protection, and threat prevention. Together, these capabilities form a multi layered cloud security architecture that enhances governance, visibility, and protection while supporting the Bank’s broader Zero-Trust strategy. We continue to adhere strictly to regulatory requirements, including strong governance, persistent vigilance, and a culture of continuous improvement.
Cybersecurity Risk Management Positions or Committees Responsible [Flag]	true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]	The Information Security Committee is chaired by the Chief Risk Officer. The Information Security Committee is tasked with reviewing information security policy dispensations, making strategic and financial decisions on information security plans, reviewing performance and monitoring the progress of the information security program. It also discusses any significant information security risks, determines actions for risk remediation and approves changes to the constitution and functioning of the ISC. The ISC convenes at least once every two months with representatives from Information Technology, the Information Security Group and other enabling functions, Audit and relevant business units. The Chief Information Security Officer (“CISO”) proposes and finalizes the ISC agenda, presents the current state of information security to the ISC, drives the implementation of the ISC approved ISMS agenda and also reports major security incidents faced by us.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]	The qualifications of our senior management are described under “ Management—Senior Management ”.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	We operate a comprehensive Cyber Security Framework, a Cybersecurity Policy (approved by the Board), an Information Security Policy, and a robust Information Security Program designed to safeguard customer information and maintain secure operations. Our cybersecurity-related policies define clear responsibilities and controls for maintaining security hygiene and embedding data protection into business processes and technology design.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]	true

Cybersecurity Risk Management and Strategy Disclosure

12 Months Ended

Mar. 31, 2026

Cybersecurity Risk Management, Strategy, and Governance [Line Items]

Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Key measures undertaken by the Bank to mitigate information security related risks:

We continue to enhance its information security posture through a robust, multi layered control environment designed to safeguard customer data and ensure secure digital operations. This is supported by Board approved Information Security and Cyber Security policies, with strategic oversight provided by the Information Technology Strategy Committee and the Information Security Committee. The committees review key risks, monitor emerging threats, and ensure alignment with regulatory expectations.

Our advanced AI/ML enabled Cyber Security Operations Centre (“CSOC”) provides round the clock monitoring of infrastructure, network traffic and applications. Enriched threat intelligence feeds and machine learning–driven analytics enable early detection of anomalies and improved correlation of suspicious activities, while behavioral modelling further enhances incident identification and response. The Attack Surface Management (ASM) programme further mitigates risk by continuously identifying and remediating exposures across internal and external digital assets, supported by vulnerability assessments and penetration testing.

Further, our security controls across networks, applications and endpoints include anti malware technologies, Intrusion Detection and Prevention Systems (IDS/IPS), micro segmentation, and enterprise wide Data Loss Prevention (DLP) safeguards. Cloud and data security measures are strengthened through Cloud Security Posture Management (CSPM), Cloud Infrastructure Entitlement Management (CIEM) and Cloud Workload Protection Platform (CWPP) to ensure secure cloud configurations, entitlement governance, workload protection, and sensitive data oversight across hybrid environments.

Strong access controls form a key part of the Bank’s security framework, with Identity and Access Management (IAM), Privileged Access Management (PAM), authentication methods, and periodic access reviews enforcing least privilege principles and preventing unauthorized access. Periodic adversarial exercises are carried out by the bank’s Red Team to assess system resilience, uncover vulnerabilities, and validate detection and response controls. Activities include red team operations, breach simulations, and targeted assessments of key security technologies, aligned to the MITRE ATT&CK framework for testing.

To mitigate phishing, impersonation, and customer facing cyber fraud risks, the Bank continuously monitors for fraudulent domains and phishing campaigns, initiating rapid takedown actions when required. These initiatives are reinforced by regular employee training, cyber drills, and awareness programs that build a strong culture of cybersecurity across the organization.

This layered approach helps contain threats, limit their spread across the environment, and preserve business continuity by ensuring that endpoints remain consistently protected and actively monitored. Collectively, these measures demonstrate our ongoing commitment to mitigating information security risks and maintaining a secure, resilient, and trusted digital banking environment.

Extended Detection and Response (XDR) / Malware Programme

: These programmes deliver a unified security arrangement that integrates protection across networks, endpoints, cloud workloads, and user identities. By consolidating visibility and correlating indicators from multiple security layers, they enhance the detection and remediation of sophisticated threats, including ransomware and advanced malware. As part of maintaining strong cyber hygiene, antivirus and anti malware signatures are routinely updated across all critical assets such as workstations, servers, email gateways, and web gateways ensuring the organization remains protected against emerging and evolving threats.

Vulnerability management

: We have maintained a structured vulnerability management process that conducts continuous scanning of systems, applications, and network components to identify security weaknesses. A dedicated team tracks identified vulnerabilities, assesses their risk levels, and coordinates remediation activities with the respective technology and business teams. The process includes routine internal scans, periodic external assessments, and validation of fixes to ensure that issues are appropriately addressed. This program helps reduce exposure to known threats, supports timely mitigation of high risk vulnerabilities, and ensures that security gaps are managed in line with defined policies and regulatory expectations. We have adopted the

AI-for-security

and

security-of-AI

themes for all programs and is actively working with security tool providers for incorporating near machine speed capabilities in the tools used for vulnerability management.

Patch management:

We have maintained a structured and disciplined patch management process supported by tools to assess, prioritize, and deploy operating system, network, and application level updates. Vendor supplied patches are evaluated for relevance and risk, formally documented, and tested where required to ensure compatibility. Timely deployment of approved patches across endpoints, servers, and critical infrastructure helps reduce vulnerabilities, strengthen resilience, and maintain a secure and compliant technology environment.

Penetration testing:

We have conducted comprehensive penetration testing both routine and event driven to identify and validate potentially exploitable vulnerabilities across its technology landscape. These assessments are performed on all critical internal and external systems, including networks, hosts, and applications, and are triggered by significant changes such as new deployments, major upgrades, or architectural enhancements. The testing uses ML to anticipate the logical moves an attacker might take by analyzing the network structure, identifying weak points, and simulating possible exploits. We also actively working with security tool providers for incorporating AI to achieve near machine speed capabilities. Findings are analyzed, prioritized, and remediated through a defined governance process, ensuring continuous strengthening of our security posture and resilience against emerging threats.

Network security

: We have employed a defense in depth security architecture that layers multiple controls to safeguard its network against a wide spectrum of cyber threats. Firewalls and proxy servers form the first line of protection by regulating and segregating network traffic based on defined trust levels, ensuring that only validated and authorized communication is permitted. This model is further enhanced through the adoption of Zero-Trust principles, where no user, device, or workload is inherently trusted and continuous verification is required at every access point. To limit lateral movement and contain potential threats, we have implemented micro segmentation, dividing the network into tightly controlled zones with granular access restrictions aligned to business functions and security requirements. Complementing these measures, advanced Distributed Denial of Service (DDoS) defense mechanisms continuously analyze traffic patterns, absorb malicious volumetric attacks, and maintain service availability during attempted disruptions.

Our intrusion detection and prevention systems (IDS/IPS) provide deep, real time inspection of network traffic to identify, alert, and block malicious activity. Regular signature updates and behavioral analytics enhance detection accuracy and improve responsiveness to new threats, attacker techniques, and anomalous patterns. Configured with automated alerting and threshold based triggers, these systems support proactive monitoring and rapid containment, strengthening the Bank’s ability to detect, prevent, and mitigate potential security breaches. Together, these integrated network security controls form a robust, multi layered defense model that aligns with global best practices and ensures strong protection across our digital ecosystem.

Data privacy:

Financial institutions regularly encounter a variety of data-related challenges involving issues such as data quality and accessibility. In a highly automated banking environment such as the one in which the Bank operates, such challenges can have serious effects on virtually all aspects of bank operations. Our data privacy program is a highly regulated initiative headed by the Data Privacy Officer under the direct supervision of the Board and the Chief Data Officer.

Cybersecurity Risk Management Processes Integrated [Flag]

true

Cybersecurity Risk Management Processes Integrated [Text Block]

Cybersecurity risks, including those associated with third-party service providers, are assessed using defined parameters and key risk indicators, which are integrated into our risk management and reporting framework.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

We face cybersecurity threats, such as hacking, phishing, trojans, distributed denial-of-service attacks and emerging automated cyberattacks, including AI-driven cyberattacks, attempting to exploit our network to disrupt services to customers and/or theft or leaking of sensitive internal Bank data or customer information. Cybersecurity incidents have in the past, and may in the future, cause damage to our reputation and adversely impact our business and financial results.

Cybersecurity Risk Board of Directors Oversight [Text Block]

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

To effectively manage risks in these critical areas, the Bank has established specialized governance forums such as the IT Strategy Committee and the Information Security Committee (ISC), which provide strategic oversight and ensure that security practices evolve in line with emerging threats and regulatory expectations. For further details in relation to the IT Strategy Committee, see “

Management—Corporate Governance—Structure and Responsibilities of the Board and its Committees—IT Strategy Committee

”.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The ISC convenes at least once every two months with representatives from Information Technology, the Information Security Group and other enabling functions, Audit and relevant business units. The Chief Information Security Officer (“CISO”) proposes and finalizes the ISC agenda, presents the current state of information security to the ISC, drives the implementation of the ISC approved ISMS agenda and also reports major security incidents faced by us.Our cybersecurity strategies are periodically presented to the Information Security Committee and IT Strategy Committee of the Board. The cybersecurity risks and their mitigation plans are also presented to the Risk Policy and Monitoring Committee of the Board on a half-yearly basis

Cybersecurity Risk Role of Management [Text Block]

The Information Security Committee is chaired by the Chief Risk Officer. The Information Security Committee is tasked with reviewing information security policy dispensations, making strategic and financial decisions on information security plans, reviewing performance and monitoring the progress of the information security program. It also discusses any significant information security risks, determines actions for risk remediation and approves changes to the constitution and functioning of the ISC. The ISC convenes at least once every two months with representatives from Information Technology, the Information Security Group and other enabling functions, Audit and relevant business units. The Chief Information Security Officer (“CISO”) proposes and finalizes the ISC agenda, presents the current state of information security to the ISC, drives the implementation of the ISC approved ISMS agenda and also reports major security incidents faced by us. Our cybersecurity strategies are periodically presented to the Information Security Committee and IT Strategy Committee of the Board. The cybersecurity risks and their mitigation plans are also presented to the Risk Policy and Monitoring Committee of the Board on a half-yearly basis by the CISO. We also maintain oversight of our information security posture, with the information security team publishing an “Executive Metrics” report to senior management on a monthly basis comprising key information security metrics. The qualifications of our senior management are described under “

Management—Senior Management

”.

We operate a comprehensive Cyber Security Framework, a Cybersecurity Policy (approved by the Board), an Information Security Policy, and a robust Information Security Program designed to safeguard customer information and maintain secure operations. Our cybersecurity-related policies define clear responsibilities and controls for maintaining security hygiene and embedding data protection into business processes and technology design.

We have set up an independent IT Risk Management (“ITRM”) function within the Risk Management Group under the GCRO. This IT Risk Management function caters to risk assessment of technology solutions and applications, the Enterprise Business Continuity Management (“BCM”) program, third party risk management, and other areas. For further details in relation to the Bank’s technology risk management, see “

Business—Risk Management— Information Technology Risk

”.

We continue to strengthen our security posture through technology driven initiatives that proactively enhance resilience. A dedicated Attack Surface Management (ASM) program operates on a continuous basis to identify and address vulnerabilities across assets, helping maintain a secure environment for customers and internal functions. The program leverages advanced

AI-assisted

capabilities to enable near-machine-speed detection and validation and

ML-powered

external attack surface mapping that continuously discovers and classifies exposed assets, complemented by strong vulnerability management for internet facing properties, advanced anti malware protection, and periodic penetration testing. The Bank’s Red Team conducts adversarial simulations to assess defensive readiness, with identified gaps remediated promptly to ensure uninterrupted and secure banking services.

Centralized patch management improves operational efficiency through discovery and remediation of vulnerabilities across endpoints and servers, helping reduce risk exposure and maintain compliance with internal and regulatory security standards.

With cloud adoption increasing, the Bank has strengthened cloud security through mature posture and access governance capabilities. Cloud Security Posture Management (CSPM) ensures continuous configuration monitoring and compliance enforcement, while Cloud Access Security Broker tools (CASB) provide visibility into cloud usage and ensure policy aligned access. These are complemented by Cloud Infrastructure Entitlement Management (CIEM) for granular control over cloud identities and privileges, and Cloud Workload Protection Platforms (CWPP) that secure workloads through continuous vulnerability detection, runtime protection, and threat prevention. Together, these capabilities form a multi layered cloud security architecture that enhances governance, visibility, and protection while supporting the Bank’s broader Zero-Trust strategy.

We continue to adhere strictly to regulatory requirements, including strong governance, persistent vigilance, and a culture of continuous improvement.

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

The qualifications of our senior management are described under “

Management—Senior Management

”.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true