Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 653

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 653
---
 corrective 
 measures where necessary.                                                                                       |

| – | The existence of an adequate management and control environment for all risks. |

Organisation The Group establishes an organisational model for assigning and coordinating risk control responsibilities based on the three lines of defence. This model is described, for each of the risks, in the various policies that make up the Group’s body of regulations, in which responsibilities specific to each of the three lines of defence are established. For each line of defence, the risk policies describe and assign responsibilities, as appropriate, to the following functions (or any other additional ones that ought to be considered):

| – | First line of defence: responsible for maintaining adequate and effective internal control and implementing                                                            
 corrective actions to rectify deficiencies in its processes and controls. The responsibilities attributed to this line under the Global Risk Framework are as follows: |

| • |     | Maintain effective internal controls and perform   
 day-to-day risk assessment and control procedures; |

| • |     | Identify, quantify, control and mitigate risks, complying with the established internal policies and procedures and 
 ensuring that activities are consistent with the established goals and objectives;                                  |

| • |     | Implement adequate management and oversight processes to ensure compliance with regulations, focusing mainly on control 
 errors, inadequate processes and unforeseen events.                                                                     |

| – | Second line of defence: in general, the second line of defence ensures that the first line of defence is well                                                                    
 designed and performs its assigned duties. It also puts forward suggestions for its continuous improvement. The core responsibilities attributed to this line are the following: |

| • |     | Ensure the existence and promote the update of a Global Risk Framework, which establishes the core principles for 
 adequate risk management and control.                                                                             |

| • |     | Put forward the Institution’s Risk Appetite Statement (RAS) for approval, ensuring it is kept fully up to date at 
 all times and monitoring it on an ongoing basis.                                                                  |

| • |     | Supervise the risk management and control activities carried out by the first line of defence to ensure they conform to                                            
 the established policies and procedures, bearing in mind the functions specifically assigned this task, and identify areas for improvement within risk management. |

| • |     | Formulate independent opinions to lend support in decision-making processes. |

| • |     | Periodically analyse and report to the governance and management bodies on the risk profile of the Institution through 
 the RAS.                                                                                                               |

| • |     | Report to the Board Risk Committee on the