Company: BBVXF
Filing Date: 2025-09-05
Form Type: F-4/A
Source: 0001193125-25-196513
Chunk: 444

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-05
Form: F-4/A
Chunk 444
---
ourced cloud services. Consequently, the reliance on information systems and their availability is a key factor, as the Group and its critical service suppliers are more exposed to cyberattacks just like the other operators in the sector. The ongoing geopolitical conflicts have brought with them the risk of becoming a target for cyberattacks, generating the need to introduce back-upmeasures. This risk has been stabilised but remains an ever-present threat. Furthermore, the Group is currently undergoing a process of transformation, based on the digitalisation and automation of processes, which increases the reliance on systems and the exposure to risks associated with this change, including digital fraud. ICT risk therefore remains one of the key focus areas of Banco Sabadell Group’s risk management. It should be mentioned that this risk is not only applicable to the Group’s own systems and processes, but it is also applicable to suppliers, given the widespread use of third parties for support in technological and business processes, and this therefore represents a material risk when it comes to managing outsourcing. On the topic of IT outsourcing, in 2022 a project was implemented in Spain, concentrating the number of application development, maintenance and testing providers in a small group of main industry-leading suppliers, thus requiring a greater level of supplier control and monitoring and the need for special oversight and adjustment throughout 2023 and 2024, reducing with this small number of leading providers the likelihood of experiencing cybersecurity incidents in this area. In order to holistically and adequately manage all risks related to technology and data, the Institution classifies these risks into eight categories, in line with the Guidelines on ICT and security risk management (EBA/GL/2019/04):

| – | IT security (cybersecurity): risk of unauthorised access to IT systems, and of there being an impact on the                                                                                                                    
 confidentiality, availability, integrity and traceability of the information (data and metadata) that they contain (including cyberattacks and deliberate action), as well as the potential repudiation of digital operations. |

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.                                                                                      |

| – | IT outsourcing: risk that engaging a third party, its management or related IT services produces a negative effect on     
 the Institution’s performance (including impacts on customers, as well as reputational, regulatory or financial impacts). |

| – | IT change: risk arising from the inability of the organisation to manage IT system changes in a timely and controlled                                                                                                                                   
 manner, in particular for