Company: BBVXF
Filing Date: 2025-08-12
Form Type: DRS
Source: 0000950123-25-007520
Chunk: 623

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-08-12
Form: DRS
Chunk 623
---
 objectives at all levels, monitoring their achievement and implementing corrective 
 measures where necessary.                                                                                       |

| – | The existence of an adequate management and control environment for all risks. |

A-387

As confidentially submitted to the Securities and Exchange Commission on August 11, 2025. This Amendment No. 4 has not been publicly filed with the Securities and Exchange Commission and all information herein remains strictly confidential. Organisation The Group establishes an organisational model for assigning and coordinating risk control responsibilities based on the three lines of defence. This model is described, for each of the risks, in the various policies that make up the Group’s body of regulations, in which responsibilities specific to each of the three lines of defence are established. For each line of defence, the risk policies describe and assign responsibilities, as appropriate, to the following functions (or any other additional ones that ought to be considered):

| – | First line of defence: responsible for maintaining adequate and effective internal control and implementing                                                            
 corrective actions to rectify deficiencies in its processes and controls. The responsibilities attributed to this line under the Global Risk Framework are as follows: |

| • |     | Maintain effective internal controls and perform   
 day-to-day risk assessment and control procedures; |

| • |     | Identify, quantify, control and mitigate risks, complying with the established internal policies and procedures and 
 ensuring that activities are consistent with the established goals and objectives;                                  |

| • |     | Implement suitable processes to manage and mitigate material risks. |

| • |     | Participate in decision-making processes, identifying, assessing, controlling and mitigating the risks inherent in the 
 implementation of significant changes and one-off transactions.                                                        |

| • |     | Define the strategy for each risk. |

| – | Second line of defence: broadly speaking, the second line of defence ensures that the first line of defence is well                                                    
 designed and performs its assigned duties. It also puts forward suggestions for its continuous improvement. The core duties attributed to this line are the following: |

| • |     | Propose the Global Risk Framework, for risk management and control. |

| • |     | Participate in the decision-making process where it concerns the implementation of significant changes and one-off transactions. |

| • |     | Monitor the risk strategy approved by the Board of Directors through its approval of the RAS. |

| • |     | Keep the risk inventory up to date, justifying those not considered to be material, and review the inventory of 
 material risks.