Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 289

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 289
---
, the Board
Audit and Control Committee and the Board Remuneration Committee). There are also other Committees and Divisions with a significant level of involvement in the risk function.

A-63

The defined governance structure aims to ensure the adequate development and implementation of the Global Risk Framework and, therefore, the risk management and control activity within the Group, while at the same time it aims to facilitate:

| – | The participation and involvement of the Group’s governing bodies and Senior Management in decisions regarding 
 risks, and also in their supervision and control.                                                              |

| – | The alignment of targets and objectives at all levels, monitoring their achievement and implementing corrective 
 measures where necessary.                                                                                       |

| – | The existence of an adequate management and control environment for all risks. |

Organisation The Group establishes an organisational model for assigning and coordinating risk control responsibilities based on the three lines of defence. For each risk, the model draws on the various policies included in the Group’s body of regulations, which set out the specific responsibilities of each of the three lines of defence. For each line of defence, the risk policies describe and assign responsibilities, as appropriate, to the following functions (or any other additional ones that ought to be considered):

| – | First line of defence: responsible for maintaining adequate and effective internal control and implementing                                                            
 corrective actions to rectify deficiencies in its processes and controls. The responsibilities attributed to this line under the Global Risk Framework are as follows: |

| • |     | Maintain effective internal controls and systematically execute the control framework. |

| • |     | Identify, quantify, control and mitigate risks, complying with the established internal policies and procedures and 
 ensuring that activities are consistent with the established goals and objectives.                                  |

| • |     | Implement suitable processes to manage and mitigate material risks. |

| • |     | Participate in decision-making processes, identifying, assessing, controlling and mitigating the risks inherent in the 
 implementation of significant changes and one-off transactions.                                                        |

| • |     | Define the strategy for each risk. |

| – | Second line of defence: broadly speaking, the second line of defence ensures that the first line of defence is well                                                    
 designed and performs its assigned duties. It also puts forward suggestions for its continuous improvement. The core duties attributed to this line are the following: |

| • |     | Propose the Global Risk Framework, for risk management and control. |

| • |     | Participate in the decision-making process where it concerns the implementation of significant changes