Company: BBVXF
Filing Date: 2025-02-14
Form Type: 6-K
Source: 0001193125-25-027348
Chunk: 107

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-14
Form: 6-K
Chunk 107
---
 out the following activities throughout the year: reviewing the Group’s exposures to the main IT risks, including information security and cybersecurity risks, as well as the procedures put in place by the executive area to monitor and control these exposures; reviewing the policies and systems in place for evaluating, controlling and managing the Group’s IT risks and infrastructure, including response and recovery plans against cyberattacks; overseeing the Group’s technological continuity plans; monitoring compliance risks associated with information technology and drawing up plans for their prevention and mitigation; and monitoring cybersecurity events that may have a signifi cant impact on the Group. This English version is a translation of the original in Spanish for information purposes only. In case of discrepancy the original in Spanish shall prevail.

Annual Corporate Governance Report of BBVA .110.. B.Executive scope As indicated, the corporate bodies are responsible for approving the risk strategy and the general policies for the various types of financial and non-financialrisks, while the Global Risk Management (GRM) and Regulation & Internal Control areas are responsible, respectively, for the implementation and development, reporting to the corporate bodies. Thus, responsibility for day-to-dayrisk management lies with the businesses areas and corporate units, which, when carrying out their activities, comply with the general policies, regulations, infrastructures and controls which, based on the framework established by the corporate bodies, are defined by GRM and Regulation & Internal Control within their respective remits. In order to carry out this task properly, the Global Risk Management area operates as a single, global function that is independent of the business areas to ensure sound management and control over financial risks. The GRM area is headed up by the Group Chief Risk Officer (CRO), who reports to the corporate bodies on the performance of their duties. In performing their functions, the Chief Risk Officer relies on a support structure comprising Group-wide risk units in the corporate level, and specific risk units at the Group’s geographic and/or business areas. For decision-making, the Group’s Chief Risk Officer relies on a governance structure for the function consisting of various committees tasked with risk management and control. This structure supports the corporate bodies in decision-making and in exercising oversight and control over management. Moreover, as regards non-financialrisks and internal control, the Group has a Regulation and Internal Control area, as a global, Group-wide area that is independent from the rest of the units and whose Head is also appointed by BBVA’s Board of Directors and reports to the corporate bodies on the performance of their functions. This area is responsible for proposing and implementing,