Company: BBVXF
Filing Date: 2025-08-12
Form Type: DRS
Source: 0000950123-25-007520
Chunk: 677

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-08-12
Form: DRS
Chunk 677
---
 the need for special oversight and adjustment throughout 2023, reducing the likelihood of experiencing cybersecurity incidents in area with input from the aforesaid outsourced suppliers. In order to holistically and adequately manage all risks related to technology and data, the Institution classifies and categorises these risks into eight categories, in line with the Guidelines on ICT and security risk management (EBA/GL/2019/04):

| – | IT security (cybersecurity): risk of unauthorised access to IT systems, and of there being an impact on the                                                                                                                    
 confidentiality, availability, integrity and traceability of the information (data and metadata) that they contain (including cyberattacks and deliberate action), as well as the potential repudiation of digital operations. |

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.                                                                                      |

| – | IT change: risk arising from errors in the change and development processes of information systems. |

| – | Data integrity: risk of data stored and processed by IT systems being incomplete, inaccurate or inconsistent. |

| – | IT outsourcing: risk that engaging a third party or another Group entity (intragroup outsourcing) to provide IT                                                                                       
 systems, their management or related services produces a negative effect on the Institution’s performance (including impacts on customers, as well as reputational, regulatory or financial impacts). |

| – | IT governance: risk arising from inadequate or insufficient management and use of technology, as well as a poor 
 alignment of these technologies and their intended uses with the business strategy.                             |

A-428

As confidentially submitted to the Securities and Exchange Commission on August 11, 2025. This Amendment No. 4 has not been publicly filed with the Securities and Exchange Commission and all information herein remains strictly confidential.

| – | Technological transformation: risk associated with inappropriate adoption or inefficient use of technology within the 
 organisation for the development of new value propositions.                                                           |

| – | IT skills: risk arising from the insufficiency of adequate IT profiles (internal and/or external partners) to ensure 
 effective and efficient coverage of technological activities, processes and services.                                |

4.4.4.2 Tax risk With regard to tax risk, Banco Sabadell Group’s tax risk policies aim to establish the general guidelines for managing and controlling tax risk, specifying the applicable principles and critical parameters and covering all significant elements to systematically identify, assess and manage any risks that may affect the Group’s tax