Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 525

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 525
---
 identify the causes of that increase and measure the effectiveness of the implemented controls and improvements. At the same time, checks are run to verify that specific business continuity plans have been defined and implemented for processes identified as being highly critical in the event of any service disruption. The second course of action is based on experience. It consists of recording all losses incurred by the Institution in a database, which provides information about the operational risks encountered by each business line as well as their causes, so as to be able to take action to minimise these risks and detect potential weaknesses in processes that require action plans to be drawn up aimed at mitigating the associated risks. Recoveries are also recorded, which make it possible to reduce the extent of the loss either as a result of its direct management or by having an insurance policy that covers all or part of the resulting impacts. Furthermore, this information allows the consistency between estimated losses and actual losses to be determined, in terms of both frequency and severity, iteratively improving the estimates of exposure levels. Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: broadly speaking, this is defined as the current or future possibility of incurring losses due to the                                                                                                                              
 inadequate provision of financial services or any other activity carried out by the Institution, due to misconduct with customers (existing or potential), employees (in relation to human rights, equality, well-being, inclusion, and health & 
 safety in the workplace), shareholders and suppliers, markets, political parties or society in general, including cases of wilful misconduct or negligence.                                                                                      |

| – | Technology risk: technology risk (or information and communications technology (ICT) risk) is defined as the current                                                                                                                           
 or future risk of incurring losses due to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility, confidentiality or traceability of infrastructures, 
 applications and data, or would make it impossible for IT platforms to be changed at a reasonable cost and within a reasonable timeframe in response to the changing needs of the environment or the business.                                 |

It also includes security risks resulting from inadequate or failed internal processes or external events, including cyberattacks or inadequate physical security in data centres.

| – | Outsourcing risk: this is the current or future risk of losses arising as a result of suppliers failing to provide                                                                                                                                        
 subcontracted services or discontinuing their provision, weaknesses in their systems’ security, disloyal employees or a breach of applicable regulations. It also encompasses other related