Company: BBVXF
Filing Date: 2025-08-12
Form Type: DRS
Source: 0000950123-25-007520
Chunk: 475

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-08-12
Form: DRS
Chunk 475
---
 physical security in data centres.                                                                                                                                                                   |

| – | Outsourcing risk: current or future risk of incurring losses as a result of using resources and/or media of a third                                                                                                                             
 party for the standard, ongoing and stable performance over time of certain processes of the outsourcing company, which in itself entails exposure to a series of underlying risks, such as operational risk, including conduct risk, ICT risk, 
 reputational risk, concentration risk and lock-in risk.                                                                                                                                                                                         |

| – | Model risk: current or potential future loss an institution may incur, as a consequence of decisions that could be          
 principally based on the output of internal models, due to errors in the development, implementation or use of such models. |

| – | Tax risk: the possibility of failing to achieve the objectives set out in Banco Sabadell’s tax strategy from a 
 dual perspective due to either internal or external factors:                                                   |

| • |     | On one hand, the possibility of failing to fulfil tax obligations, potentially resulting in a failure to pay taxes that 
 are due, or the occurrence of any other event that could potentially prevent the Bank from achieving its goals.         |

| • |     | On the other hand, the possibility of paying taxes not actually due under tax obligations, thus negatively affecting 
 shareholders and other stakeholders.                                                                                 |

| – | Compliance risk: defined as the possibility of incurring legal or regulatory sanctions, material financial loss or                                
 loss to reputation as a result of failing to comply with laws, regulations, internal rules and codes of conduct applicable to banking activities. |

Detailed information on the following risks is given here below. A-202

As confidentially submitted to the Securities and Exchange Commission on August 11, 2025. This Amendment No. 4 has not been publicly filed with the Securities and Exchange Commission and all information herein remains strictly confidential. 4.4.4.1 ICT risk In recent years, the importance, complexity and use of technology and data have increased even further in banking processes, especially in remote channels (online banking) as a result of the impact of Covid-19and the growing use of outsourced cloud services. Consequently, the reliance on information systems and their availability is a key factor, as the Group and its critical service suppliers are more exposed to cyberattacks just like the other operators in the sector. The ongoing geopolitical conflicts have brought with them the risk of becoming a target for cyberattacks, generating the need to introduce back-upmeasures. This risk has been stabilised but remains