Company: BBVXF
Filing Date: 2025-03-21
Form Type: 6-K
Source: 0000842180-25-000016
Chunk: 187

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-03-21
Form: 6-K
Chunk 187
---
 the consistency of the Group's operational risks map. To that end, a corporate tool of the Group is used.

The analysis of operational losses and their trends may reveal the materialization of risks that have not been adequately identified, evaluated or mitigated, thus allowing feedback to the RCSA exercise while promoting mitigation measures to prevent their future occurrence.

As a result of the monitoring activities, a risk assessment is produced, both, at consolidated and local level, allowing to focus management and mitigation efforts.

#### Operational risk mitigation
The Group promotes the proactive mitigation of the non-financial risks to which it is exposed and which are identified in the monitoring activities.

In order to rollout common monitoring and anticipated mitigation practices throughout the Group, several cross-sectional plans are being promoted related to relevant events, lived by the Group or by the industry, self-assessments and recommendations from auditors and supervisors in different geographies, thereby analyzing the best practices at the selected topics and fostering comprehensive action plans to strengthen and standardize the control environment.

#### Assurance of operational risk
Assurance is one of the possible options for managing the operational risk to which the Group is exposed, and mainly has two potential purposes:

– Coverage of extreme situations linked to recurrent events that are difficult to mitigate or can only be partially mitigated by other means.

– Coverage of non-recurrent events that could have significant financial impact, if they occurred.

| PILLAR 3 2024 |     | 4. RISK |     | P.211 |

The Group has a general framework that regulates this area, and allows systematizing risk assurance decisions, aligning insurance coverage with the risks to which the Group is exposed and reinforcing governance in the decision-making process of arranging insurance policies.

4.6.1.3. Operational risk governance

Article 435 (1) b)

EU ORA a)

BBVA Group's operational risk governance model is based on two components:

– Three-line defense control model, in line with industry best practices, and which guarantees compliance with the most advanced operational risk internal control standards.

– Scheme of Corporate Assurance Committees and Internal Control and Operational Risk Committees in the different business and support areas.

#### Three lines of defense control model
1.- First line of defense: composed of the Business and Support Areas in charge of managing operational risks in their products, activities, processes and systems, including those present in activities that depend on third parties.

The Areas integrate operational risk management into their day-to-day activities, identifying and evaluating operational risks, carrying out controls, assessing the adequ