XML 47 R33.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Mar. 31, 2026
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity represents a critical component of the Company’s overall approach to risk management. The Company’s cybersecurity policies, standards and practices are fully integrated into the Company’s enterprise risk management (“ERM”) approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Board of Directors, the Audit Committee, and management’s Risk Review Committee. The Company’s cybersecurity policies, standards and incident response practices generally follow recognized frameworks established by National Institute of Standards and Technology (“NIST”). The Company approaches cybersecurity threats, as such term is defined in Form 20-F, Part II, Item 16K(a), through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating actual or potential cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting the Company’s intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.
Risk Management and Strategy
Consistent with overall ERM policies and practices, the Company’s cybersecurity program focuses on the following areas:
Vigilance: The Company maintains a global presence, with 24/7 cyber defense operations focusing on identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents and vulnerabilities in accordance with our established security incident response plan.
Systems Safeguards: The Company deploys system safeguards where feasible that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.
Incident Response and Recovery Planning: The Company has established comprehensive security incident response plans that fully address the Company’s response to a cybersecurity threat, including the recovery from a cybersecurity incident, which is tested outside of real incident response at least annually.
Collaboration: The Company’s security incident response plan contains mechanisms to collaborate with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity threats.
Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity threat affecting those third-party systems.
Training: The Company provides annual mandatory training for personnel regarding cybersecurity threats, which reinforces the Company’s information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel.
Communication, Coordination and Disclosure: The Company has established a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company’s enterprise security, technology, operations, legal, business continuity management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.
Governance: The Board of Directors’ oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company’s VP of Audit and Risk, the Chief Information Security Officer, and other members of management involved in overseeing risks from cybersecurity threats.
A key part of the Company’s strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company’s processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, penetration testing, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit
Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Cybersecurity represents a critical component of the Company’s overall approach to risk management. The Company’s cybersecurity policies, standards and practices are fully integrated into the Company’s enterprise risk management (“ERM”) approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Board of Directors, the Audit Committee, and management’s Risk Review Committee. The Company’s cybersecurity policies, standards and incident response practices generally follow recognized frameworks established by National Institute of Standards and Technology (“NIST”). The Company approaches cybersecurity threats, as such term is defined in Form 20-F, Part II, Item 16K(a), through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating actual or potential cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting the Company’s intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company’s management implements to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties. The Audit Committee timely oversees any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Risks of cybersecurity threats are also discussed with the Board of Directors in connection with other relevant matters such as enterprise risk management, operational budgeting, strategic planning, business continuity planning, mergers and acquisitions, and brand management.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties. The Audit Committee timely oversees any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Risks of cybersecurity threats are also discussed with the Board of Directors in connection with other relevant matters such as enterprise risk management, operational budgeting, strategic planning, business continuity planning, mergers and acquisitions, and brand management.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties.
Cybersecurity Risk Role of Management [Text Block]
The Company’s Chief Information Security Officer is the member of the Company’s management that is principally responsible for overseeing the Company’s security incident response plan and cybersecurity risk management program. The Chief Information Security Officer works in partnership with members of the Company’s Risk Review Committee and other business leaders across the Company, including the Chief Information Officer, Chief Accounting Officer, VP and Deputy General Counsel, Litigation, and the Chief Compliance Officer.
The Company’s Chief Information Security Officer reports to the CFO. This group has industry experience building and leading security teams and is responsible for overseeing data security and Company-wide preparedness. The Chief Information Security Officer is a qualified holder of CISSP and CISM certifications and has served in various roles in information technology and information security for over 10 years. Prior experience includes security leadership roles in financial services.
The Company’s Chief Information Security Officer manages a dedicated enterprise security team who provide information assurance governance and consultation across all regions of our business.
The enterprise security team works collaboratively across the Company to implement the Company’s security strategy, which includes evaluating and considering the relevance of specific cyber security capabilities to the Company’s business model and external threats. To facilitate the success of this strategy, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company’s security incident response plan designed to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to executive management, and to the Audit Committee when appropriate.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Company’s Chief Information Security Officer reports to the CFO. This group has industry experience building and leading security teams and is responsible for overseeing data security and Company-wide preparedness. The Chief Information Security Officer is a qualified holder of CISSP and CISM certifications and has served in various roles in information technology and information security for over 10 years. Prior experience includes security leadership roles in financial services.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] This group has industry experience building and leading security teams and is responsible for overseeing data security and Company-wide preparedness. The Chief Information Security Officer is a qualified holder of CISSP and CISM certifications and has served in various roles in information technology and information security for over 10 years. Prior experience includes security leadership roles in financial services.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
The enterprise security team works collaboratively across the Company to implement the Company’s security strategy, which includes evaluating and considering the relevance of specific cyber security capabilities to the Company’s business model and external threats. To facilitate the success of this strategy, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company’s security incident response plan designed to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to executive management, and to the Audit Committee when appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true