Company: BBVXF
Filing Date: 2025-09-09
Form Type: 424B3
Source: 0001193125-25-198517
Chunk: 790

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-09
Form: 424B3
Chunk 790
---
 latent. Furthermore, the Institution is currently undergoing a process of transformation, based on the digitisation and automation of processes, which increases the reliance on systems and the exposure to risks associated with this change, including digital fraud. Technology risk therefore remains one of the key focus areas of Banco Sabadell Group’s risk management. It should be mentioned that this risk is not only applicable to the Group’s own systems and processes, but it is also applicable to suppliers, given the widespread use of third parties for support in technological and business processes, and this therefore represents a significant risk when it comes to managing outsourcing. On the topic of IT outsourcing, with regard to 2022 it is particularly worth noting the implementation of Project Dingle, which has concentrated the outsourcing of application development and testing in three key suppliers and which therefore requires a greater level of control and monitoring of those suppliers, while at the same time reducing the probability of experiencing cybersecurity incidents in this area. In order to holistically and adequately manage all risks related to technology and data, the Institution classifies and categorises these risks into eight categories, in line with the Guidelines on ICT and security risk management (EBA/GL/2019/04):

| – | IT security (cybersecurity): risk of unauthorised access to IT systems, and of there being an impact on the                                                                                                                    
 confidentiality, availability, integrity and traceability of the information (data and metadata) that they contain (including cyberattacks and deliberate action), as well as the potential repudiation of digital operations. |

A-655

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.                                                                                      |

| – | IT change: risk arising from errors in the change and development processes of information systems. |

| – | Data integrity: risk of data stored and processed by IT systems being incomplete, inaccurate or inconsistent. |

| – | IT outsourcing: risk that engaging a third party or another Group entity (intra-group outsourcing) to provide IT                                                                                      
 systems, their management or related services produces a negative effect on the Institution’s performance (including impacts on customers, as well as reputational, regulatory or financial impacts). |

| – | IT governance: risk arising from inadequate or insufficient management and use of technology, as well as a poor 
 alignment of these technologies and their intended uses with the business strategy.                             |

| – | Technological transformation: risk associated with inappropriate adoption or inefficient use of technology within the 
 organisation for the