Company: BBVXF
Filing Date: 2025-09-09
Form Type: 424B3
Source: 0001193125-25-198517
Chunk: 788

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-09
Form: 424B3
Chunk 788
---
 are run to verify that specific business continuity plans have been defined and implemented for processes identified as being highly critical in the event of any service disruption. In terms of the identified risks, a qualitative estimate is made of the reputational impact that they could cause if they were to materialise. The second course of action is based on experience. It consists of recording all losses incurred by the Institution in a database, which provides information about the operational risks encountered by each business line as well as their causes, so as to be able to take action to minimise these risks and detect potential weaknesses in processes that require action plans to be drawn up aimed at mitigating the associated risks. Recoveries are also recorded, which make it possible to reduce the extent of the loss either as a result of its direct management or by having an insurance policy that covers all or part of the resulting impacts. Furthermore, this information allows the consistency between estimated losses and actual losses to be determined, in terms of both frequency and severity, iteratively improving the estimates of exposure levels. Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: defined as the possibility, at present or in the future, of incurring losses as a result of the                                                                                                                                           
 inadequate provision of financial services, including cases of wilful misconduct or negligence. It is comprehensively managed using the elements defined in the methodological framework for operational risk and through the governance structures and 
 lines of defence defined therein.                                                                                                                                                                                                                       |

| – | Technology risk: technology risk (or information and communications technology (ICT) risk) is defined as the current                                                                                                                                
 or future risk of incurring losses due to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility or security of these infrastructures and data, or make it 
 impossible for IT platforms to be changed at a reasonable cost and within a reasonable timeframe in response to the changing needs of the environment or the business.                                                                              |

It also includes security risks resulting from inadequate or failed internal processes or external events, including cyberattacks or inadequate physical security in data centres. A-654

| – | Outsourcing risk: the possibility of incurring losses as a result of suppliers failing to provide subcontracted                                                                                                                           
 services or discontinuing their provision, weaknesses in their systems’ security, disloyal employees or a breach of applicable regulations. It also includes other related risks such as concentration risk, country risk, legal risk and 
 compliance risk.                                                                                                                                                                                                                          |

| – |