Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 348

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 348
---
 second phase of the framework consists of the management of operational loss events by those responsible for each process, ensuring that each loss event (and its recoveries) is logged including detailed information and linking each event to a risk. There is a central operational risk unit that oversees the map of operational risks, providing support and giving advice to process managers to properly define the risks, ensuring the integrity and completeness of the loss event log and their correct entry against the corresponding risks and coordinating the map’s ongoing assessment process. The Board of Directors is directly involved in managing this risk, by (1) approving the Operational Risk Policy that defines the risk management framework, (2) defining the Group’s appetite for operational risk, and (3) monitoring the Group’s risk profile via the Board Risk Committee, through specific reports with information on the main operational risks (including, among others, ICT, conduct and fraud). Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: broadly speaking, this is defined as the current or future possibility of incurring losses due to the                                                                                                                              
 inadequate provision of financial services or any other activity carried out by the Institution, due to misconduct with customers (existing or potential), employees (in relation to human rights, equality, well-being, inclusion, and health & 
 safety in the workplace), shareholders and suppliers, markets, political parties or society in general, including cases of wilful misconduct or negligence.                                                                                      |

| – | Information and Communications Technology (ICT) risk: defined as the current or future risk of incurring losses due                                                                                                                                
 to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility, confidentiality and traceability of those infrastructures, tools and data, or due to the       
 inability to change IT platforms within a reasonable timeframe and at a reasonable cost when the environment or business requirements change. This also includes security risks resulting from inadequate or failed internal processes or external 
 events, including cyberattacks, or inadequate physical security in data centres.                                                                                                                                                                   |

| – | Outsourcing risk: current or future risk of incurring losses as a result of using resources and/or media of a third                                                                                                                             
 party for the standard, ongoing and stable performance over time of certain processes of the outsourcing company, which in itself entails exposure to a series of underlying risks, such as operational risk, including conduct risk, ICT risk, 
 reputational risk, concentration risk and lock-in risk.                                                                                                                                                                                         |

| – | Model risk: current or