Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Technology and cybersecurity risk We operate in an extensive and complex technology landscape. We need to remain resilient to support customers, our colleagues and financial markets globally. Risks arise where, for example, technology – including rapidly advancing AI – is not understood, maintained or developed appropriately. We also continue to operate in an increasingly complex cyber threat environment globally. These threats include potential unauthorised access to systems, whether ours or those of our third-party suppliers, including access to and potential exfiltration of customer data. These threats require ongoing investment in business and technical controls to defend against them. Mitigating actions –We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally. –We respond to attempts to compromise our cybersecurity in accordance with our cybersecurity framework. To date, none of these attacks have had a material impact on our business or operations.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Mitigating actions –We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally. –We respond to attempts to compromise our cybersecurity in accordance with our cybersecurity framework. To date, none of these attacks have had a material impact on our business or operations.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Mitigating actions –We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally. –We respond to attempts to compromise our cybersecurity in accordance with our cybersecurity framework. To date, none of these attacks have had a material impact on our business or operations.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions.
|
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Mitigating actions –We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally. –We respond to attempts to compromise our cybersecurity in accordance with our cybersecurity framework. To date, none of these attacks have had a material impact on our business or operations.
|
| Cybersecurity Risk Role of Management [Text Block] | We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | We continue to upgrade many of our technology systems and are transforming how software solutions are developed, delivered, maintained and tested as part of our investment in the Group’s operational resilience to seek to meet the expectations of our customers and regulators, and to help prevent disruptions to our services and recover when they occur. –Our cyber intelligence and threat analysis team continually evaluate threat levels for the most prevalent cyber-attack types and their potential outcomes (see page 63), and we continue to seek to strengthen our controls to help reduce the likelihood and impact of attacks including advanced malware, data leakage, exposure through third parties and security vulnerabilities. –We continue to seek to enhance our cybersecurity capabilities, including infrastructure and network security, cloud security, identity and access management, metrics and data analytics, and third-party security assurance, and to invest in mitigating the potential threats of emerging technologies. –We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions. –We participate globally in industry bodies and working groups, working together to seek to protect against, detect, respond to and recover from cyber-attacks on financial organisations globally.
|
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | We regularly report and review cyber risk and control effectiveness at executive level across business segments, functions and regions, as well as at non-executive Board level to help enable appropriate visibility and governance of the risk and its mitigating actions.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |