Company: BBVXF
Filing Date: 2025-08-12
Form Type: DRS
Source: 0000950123-25-007520
Chunk: 862

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-08-12
Form: DRS
Chunk 862
---
 the management framework and of the reliability of the reported information, as well audits of the internal validation tests of the operational risk model. Operational risk is managed through two main courses of action: The first course of action is based on the analysis of processes, the identification of risks associated with those processes that may result in losses, and a qualitative assessment of the risks and the associated controls. The foregoing are carried out jointly between process managers and the central operational risk unit. This provides an assessment of the future exposure to risk in terms of expected and unexpected losses and also allows trends to be foreseen and the corresponding mitigating actions to be adequately planned. This is complemented by the identification, monitoring and active management of the risk through the use of key risk indicators. These allow warnings to be established, which alert the Institution to any increase in this exposure, and also enable it to identify the causes of that increase and measure the effectiveness of the implemented controls and improvements. At the same time, checks are run to verify that specific business continuity plans have been defined and implemented for processes identified as being highly critical in the event of any service disruption. In terms of the identified risks, a qualitative estimate is made of the reputational impact that they could cause if they were to materialise. The second course of action is based on experience. It consists of recording all losses incurred by the Institution in a database, which provides information about the operational risks encountered by each business line as well as their causes, so as to be able to take action to minimise these risks and detect potential weaknesses in processes that require action plans to be drawn up aimed at mitigating the associated risks. Recoveries are also recorded, which make it possible to reduce the extent of the loss either as a result of its direct management or by having an insurance policy that covers all or part of the resulting impacts. Furthermore, this information allows the consistency between estimated losses and actual losses to be determined, in terms of both frequency and severity, iteratively improving the estimates of exposure levels. Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: defined as the possibility, at present or in the future, of incurring losses as a result of the                                                                                                                                           
 inadequate provision of financial services, including cases of wilful misconduct or negligence. It is comprehensively managed using the elements defined in the methodological framework for operational risk and through the governance structures and 
 lines of defence defined therein.                                                                                                                                                                                                                       |

| – | Technology risk: technology risk (or information and communications technology (