Company: BBVXF
Filing Date: 2025-09-05
Form Type: F-4/A
Source: 0001193125-25-196513
Chunk: 800

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-05
Form: F-4/A
Chunk 800
---
 due under tax obligations, thus negatively affecting 
 shareholders and other stakeholders.                                                                                 |

| – | Compliance risk: defined as the risk of incurring legal or administrative penalties, significant financial losses or                            
 reputational damage as a result of an infringement of laws, regulations, internal rules or codes of conduct applicable to the Group’s activity. |

Reputational risk, understood as the possibility of incurring losses as a result of negative publicity related to the Institution’s practices and business, is also managed and controlled according to the methodological framework for operational risk, as this is a potentially significant source of reputational risk. This risk also considers the loss of trust in the Institution, which could affect its solvency. Senior Management and, in particular, the Board Risk Committee, have closely monitored the Group’s risk profile through specific reports containing information and indicators associated with the main operational risks (including those associated with technology, human error, conduct, processes, security and fraud) and reputational impacts that could potentially affect the Group’s different stakeholders (employees and partners, customers, suppliers, supervisors). No noteworthy impacts have been detected. Detailed information on the risks that the Group deems most material is provided below: 4.4.4.1 Technology risk In recent years, the importance, complexity and use of technology and data have increased even further in banking processes, especially in remote channels (online banking) as a result of the impact of Covid-19.Consequently, the reliance on information systems and their availability is a key factor, as the Bank is more exposed to cyberattacks just like the other operators in the sector. The conflict between Ukraine and Russia has brought with it the risk of becoming a target for cyberattacks, in reaction to the restrictions imposed on Russia and due to Ukraine’s de facto membership of NATO, requiring the introduction of back-upmeasures. At the present time, this risk related to this conflict is stable, though latent. Furthermore, the Institution is currently undergoing a process of transformation, based on the digitisation and automation of processes, which increases the reliance on systems and the exposure to risks associated with this change, including digital fraud. Technology risk therefore remains one of the key focus areas of Banco Sabadell Group’s risk management. It should be mentioned that this risk is not only applicable to the Group’s own systems and processes, but it is also applicable to suppliers, given the widespread use of third parties for support in technological and business processes, and this therefore represents a significant risk when it comes to managing outsourcing. On the topic of