Company: BBVXF
Filing Date: 2025-09-09
Form Type: 424B3
Source: 0001193125-25-198517
Chunk: 616

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-09
Form: 424B3
Chunk 616
---
 all or part of the resulting impacts. Furthermore, this information allows the consistency between estimated losses and actual losses to be determined, in terms of both frequency and severity, iteratively improving the estimates of exposure levels. Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: broadly speaking, this is defined as the current or future possibility of incurring losses due to the                                                                                                                              
 inadequate provision of financial services or any other activity carried out by the Institution, due to misconduct with customers (existing or potential), employees (in relation to human rights, equality, well-being, inclusion, and health & 
 safety in the workplace), shareholders and suppliers, markets, political parties or society in general, including cases of wilful misconduct or negligence.                                                                                      |

| – | Technology risk: technology risk (or information and communications technology (ICT) risk) is defined as the current                                                                                                                           
 or future risk of incurring losses due to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility, confidentiality or traceability of infrastructures, 
 applications and data, or would make it impossible for IT platforms to be changed at a reasonable cost and within a reasonable timeframe in response to the changing needs of the environment or the business.                                 |

It also includes security risks resulting from inadequate or failed internal processes or external events, including cyberattacks or inadequate physical security in data centres.

| – | Outsourcing risk: this is the current or future risk of losses arising as a result of suppliers failing to provide                                                                                                                                        
 subcontracted services or discontinuing their provision, weaknesses in their systems’ security, disloyal employees or a breach of applicable regulations. It also encompasses other related risks, such as concentration risk, country risk, legal        
 risk or compliance risk and includes the risk of losses arising from the use of third-party resources and/or means for the regular, ongoing and stable performance over time of certain business processes of the subcontracting company, which in itself 
 involves exposure to a series of inherent underlying risks, such as operational risk, (including conduct risk, risks related to Information and Communications Technology (ICT), reputational risk, concentration risk and vendor lock-in risk.           |

| – | Model risk: current or future risk of an institution incurring losses as a result of decisions largely based on the 
 outputs of internal models, due to errors in their development, implementation or use.                              |

| – | Tax risk: the probability of failing to achieve the objectives set out