Company: BBVXF
Filing Date: 2025-09-09
Form Type: 424B3
Source: 0001193125-25-198517
Chunk: 438

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-09
Form: 424B3
Chunk 438
---
 and deliberate action), as well as the potential repudiation of digital operations. |

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.                                                                                      |

| – | IT outsourcing: risk that engaging a third party, its management or related IT services produces a negative effect on     
 the Institution’s performance (including impacts on customers, as well as reputational, regulatory or financial impacts). |

| – | IT change: risk arising from the inability of the organisation to manage IT system changes in a timely and controlled                                                                                                                                   
 manner, in particular for large and complex change programmes that could potentially impact the availability and/or confidentiality of information or which could result in a failure to meet the business expectations that prompted those changes. In 
 addition, the continued use of obsolete IT systems, without the required upgrades, could jeopardise the IT activities of the organisation or the execution of strategic programmes with a strong IT component (e.g. digital transformation programmes). |

| – | IT data integrity: risk of the data stored and processed by IT systems being incomplete, inaccurate or inconsistent                                                                                                                                      
 across different IT systems, for example as a result of weak or absent IT controls during the different phases of the IT data life cycle (i.e. designing the data architecture, building the data model and/or data dictionaries, verifying data inputs, 
 controlling data extractions, transfers and processing, including rendered data outputs), impairing the ability to provide services and produce (risk) management and financial information in a correct and timely manner.                              |

| – | IT governance: risk arising from inadequate or insufficient management and use of technology, as well as a poor 
 alignment of these technologies and their intended uses with the business strategy.                             |

| – | Technological transformation: risk associated with inappropriate adoption or inefficient use of technology within the 
 organisation for the development of new value propositions.                                                           |

| – | IT skills: risk arising from the insufficiency of adequate IT profiles (internal and/or external partners) to ensure 
 effective and efficient coverage of technological activities, processes and services.                                |

A-203

4.4.4.2 Tax risk With regard to tax risk, Banco Sabadell Group’s tax risk policies aim to establish the general guidelines for managing and controlling tax risk, specifying the applicable principles and critical parameters and covering all significant elements to systematically identify, assess and manage any risks that may affect the Group’s tax strategy and fiscal objectives, meeting the requirements of the Spanish Capital Companies Act and