Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 526

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 526
---
 risks, such as concentration risk, country risk, legal        
 risk or compliance risk and includes the risk of losses arising from the use of third-party resources and/or means for the regular, ongoing and stable performance over time of certain business processes of the subcontracting company, which in itself 
 involves exposure to a series of inherent underlying risks, such as operational risk, (including conduct risk, risks related to Information and Communications Technology (ICT), reputational risk, concentration risk and vendor lock-in risk.           |

| – | Model risk: current or future risk of an institution incurring losses as a result of decisions largely based on the 
 outputs of internal models, due to errors in their development, implementation or use.                              |

| – | Tax risk: the probability of failing to achieve the objectives set out in Banco Sabadell’s tax strategy from a 
 dual perspective due to either internal or external factors:                                                   |

A-338

| • |     | On one hand, the probability of failing to fulfil tax obligations, potentially resulting in a failure to pay taxes that 
 are due, or the occurrence of any other event that could potentially prevent the Bank from achieving its goals.         |

| • |     | On the other hand, the probability of paying taxes not actually due under tax obligations, thus negatively affecting 
 shareholders and other stakeholders.                                                                                 |

| – | Compliance risk: defined as the risk of incurring legal or administrative penalties, significant financial losses or                        
 reputational damage as a result of an infringement of laws, regulations, internal rules or codes of conduct applicable to banking activity. |

Senior Management and, in particular, the Board Risk Committee, monitor the Group’s risk profile through specific reports containing information and indicators associated with the main operational risks (including those associated with technology, human error, conduct, processes, security and fraud). No noteworthy impacts have been detected in 2023. Detailed information on the risks that the Group deems most material is provided below: 4.4.4.1 Technology risk In recent years, the importance, complexity and use of technology and data have increased even further in banking processes, especially in remote channels (online banking) as a result of the impact of COVID-19and the growing use of cloud services. Consequently, the reliance on information systems and their availability is a key factor, as the Bank is more exposed to cyberattacks just like the other operators in the sector. The ongoing geopolitical conflicts have brought with them the risk of becoming a target for cyberattacks, generating the need to introduce back