Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Our operational risk management and control model is based on a continuous process of identifying, evaluating, and mitigating sources of risk, regardless of whether they have materialized or not. Throughout the application of this process, risk management priorities are established appropriately, and internal controls are defined and executed to manage and mitigate the risk across the organization. For example, the internal cyber-security model, which is a part of our operational risk management and control model and is based on best practices and international standards, is periodically evaluated for its maturity level. With respect to operational risk management specifically, we have implemented tools such as Heracles, which is our management and reporting system for operational risk and which supports the operational risk program with a Governance, Risk and Compliance (GRC) approach. Heracles provides information for management and reporting at the Bank and throughout the Santander Group. Heracles also facilitates better operational risk management decisions by using a common set of taxonomies and methodological standards to allow information consolidation, duplication prevention, and reporting simplification. We have also implemented a qualitative “Risk control self-assessment” (RCSA) process, that allows us to identify, assess and measure, in a dynamic and proactive way, the material operational risks that could prevent the business or support units from achieving their objectives, as well as the effectiveness of the controls linked to their mitigation. Our RCSA integrates specific reviews that allows us to identify cyber, technology, fraud, third party supplier and other risk drivers, that could lead to operational risks as well as the failure to meet regulatory expectations. In addition, RCSA incorporates reviews related to regulatory compliance, conduct and financial crime risk. Other instruments are used to analyze and manage operational risk, such as the assessment of new products and services, and transformation initiatives; business continuity plans (BCP); review of corporate insurance; review of the management perimeter; recommendations from internal and external auditors, and supervisors; and the quality assurance process. During 2025, we faced a dynamic and increasingly sophisticated threat landscape in Latin America, affecting Chile. The region experienced a continued rise in ransomware attacks, with critical infrastructure and large enterprises being frequent targets. Supply chain attacks remained a relevant risk, given the interconnected nature of service providers. Additionally, threat actors intensified the use of social engineering techniques and AI-enabled tools to enhance phishing campaigns, credential theft, reflecting trends observed across emerging markets. To face these challenges, Santander has continued to evolve its defenses in line with the cybersecurity strategy, centered on three pillars: (i) the principles of security by design were strengthened, incorporating risk management and the definition of security architectures from the early stages of each initiative; (ii) we continued to harness the potential of AI and automation to strengthen threat prevention, detection and response; and (iii) we strengthened our capacity to anticipate, resist and recover from potential cyber scenarios, strengthening response preparedness and continuity of essential services. Among the main improvements are the global expansion of the permanently operational Cyber Emergency Response Team (CERT) and the expansion of resilience and recovery tests. In 2025, Santander Chile experienced two incidents related to DDoS attacks during the first quarter of the year, which resulted in a limited impact on certain services. Following these events, the Bank implemented and reinforced the appropriate mitigation and control measures. As a result, no further incidents of this nature have occurred. We do not believe that these events have had a material adverse effect on our operations. Our team remains vigilant and continues to enhance our cybersecurity controls to address evolving threats.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Our operational risk management and control model is based on a continuous process of identifying, evaluating, and mitigating sources of risk, regardless of whether they have materialized or not. Throughout the application of this process, risk management priorities are established appropriately, and internal controls are defined and executed to manage and mitigate the risk across the organization. For example, the internal cyber-security model, which is a part of our operational risk management and control model and is based on best practices and international standards, is periodically evaluated for its maturity level.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing. |
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | In turn, there is a group of supervisory bodies that include the Cybersecurity and Technology Risk Committee, who are responsible for ensuring adequate management of cybersecurity risks in line with business objectives and risk appetite; the Non-Financial Risk Committee, who is in charge of supervising and controlling the management of non-financial risks in order to prevent and mitigate operational losses. The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing.
|
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing. |
| Cybersecurity Risk Role of Management [Text Block] | The Bank has implemented a Cybersecurity Framework defining the governance, roles, responsibilities, and policies on preventing and confronting cybercrime. The Chief of Cybersecurity or CISO (Chief Information Security Officer) has been defined as the officer responsible for cybersecurity, embedded in the Bank’s Technology and Operations division, which is the front line of defense against cyber-security threats and data security. In addition, the Non-Financial Risk Department through Cyber & IT Risk (a specialized area) independently controls and supervises the Cyber Security Risk. Our CISO boasts 16 years of technology experience, including 12 years in cybersecurity at Grupo Santander and over 8 years in leadership roles. He has a proven track record in handling complex incidents, reducing impact and mitigating risks. With certifications such as CISM, CISSP, CCSP, and ITIL, our CISO is equipped to navigate the evolving cybersecurity landscape and protect our assets.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Bank has implemented a Cybersecurity Framework defining the governance, roles, responsibilities, and policies on preventing and confronting cybercrime. The Chief of Cybersecurity or CISO (Chief Information Security Officer) has been defined as the officer responsible for cybersecurity, embedded in the Bank’s Technology and Operations division, which is the front line of defense against cyber-security threats and data security. In addition, the Non-Financial Risk Department through Cyber & IT Risk (a specialized area) independently controls and supervises the Cyber Security Risk. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CISO boasts 16 years of technology experience, including 12 years in cybersecurity at Grupo Santander and over 8 years in leadership roles. He has a proven track record in handling complex incidents, reducing impact and mitigating risks. With certifications such as CISM, CISSP, CCSP, and ITIL, our CISO is equipped to navigate the evolving cybersecurity landscape and protect our assets. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Bank’s Board is involved in supervising cybersecurity matters in two instances: (i) First, the board of directors, which approves the cybersecurity framework, strategy and policies, and ensures that appropriate priority and resources are allocated to protect systems and information of the Bank, and (ii) the board’s Integral Risk Committee, which proposes the action framework and risk appetite for the Bank, and oversees risk management based on a comprehensive view of risks. Both the board and the board’s Integral Risk Committee discuss these matters on a quarterly basis and the CISO reports to the board on Santander Chile’s cybersecurity management, including the review of strategic indicators and objectives for the year, cyber incidents of the period (if any) and the status of vulnerabilities management. We are strongly aligned with Santander Group’s headquarters, who sets the guidelines and main initiatives to develop in these areas, regarding strategy, best practices, and experience-sharing. |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |