Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 312

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 16K
Chunk 312
---
ITEM 16K. CYBERSECURITY
Cybersecurity Risk Management
Risk Management and Strategy
At BBVA, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and is designed to facilitate coordination across different departments of the Group in the handling of such cybersecurity threats and incidents. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and, as later explained in greater detail, informing management and our Board of Directors of material cybersecurity threats and incidents. Our cybersecurity risk management program is regularly updated to align with industry best practices established by internationally accepted security standards and its effectiveness in mitigating the risks that the Group is exposed to is periodically assessed.
For BBVA, cybersecurity is not only a strategic priority, but also one of the main elements in the digital transformation of the Bank. BBVA’s Corporate Security Area is responsible for ensuring adequate information security management by establishing security policies, procedures and controls that bolster the security of the Group’s global infrastructures, digital channels and payment methods following a holistic and threat intelligence-led approach, where a program has been designed for each of the four fundamental pillars of BBVA’s security strategy: cybersecurity, data protection, physical security and security in business processes and fraud management, with the aim to reduce the risks identified in the risk taxonomy defined by the Group. 
As cyberattacks evolve and become more sophisticated, the Group has strengthened its prevention and monitorization efforts. During the past few years, cybersecurity and information security measures have been reinforced with the aim to ensure an adequate protection of BBVA’s information and the assets supporting business processes. Security measures adopted in the past few years include measures intended to: (i) ensure end-to-end protection of business processes, considering logical and physical security, privacy and fraud management concerns, (ii) ensure compliance with the security and privacy by design principles; and (iii) improve client access control and authentication services related to online services, from a security and user experience perspective, including by enhancing the use of facial biometrics, behavioral biometrics, advanced analytics models and the implementation of dynamic Card Verification Values (CVV).
Further, system monitoring capabilities, as well as incident prevention, detection and response capabilities have also been strengthened through the use of integrated information sources