Company: BBVXF
Filing Date: 2025-02-14
Form Type: 6-K
Source: 0001193125-25-027348
Chunk: 86

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-14
Form: 6-K
Chunk 86
---
 the strategy for security and data protection, availability and business continuity, among other matters. Within the context of these plans and projects, the Committee was informed on technological trends and other issues pertaining to new technologies, applications, IT systems and best practices that affect or may affect the Group’s technology strategy or plans. The Committee also received regular information on the metrics in place to monitor the progress made in the execution of the defined technology strategy. Monitoring of technology risk and management of cybersecurity To complement the functions regarding risk oversight performed by the Risk and Compliance Committee, and due to the technical and specialized nature of technology risks, the Committee received regular reports on the management, monitoring and mitigation of this type of risk. The Committee received information on the annual analysis and assessment that the second line of defense conducts on the main technology risks, such as information security, fraud, availability and business continuity. An independent analysis was also performed in 2024 by an external third party, the findings of which were reported to the Committee, as well as the plans and projects carried out to mitigate these risks across the Group, which were monitored through a specific set of metrics. In addition, and in relation to operational resilience, the Committee conducted a special follow-upon the new regulatory framework and requirements that were to be applied in the Group, together with the plans defined for their implementation, including the analysis of the Operational Resilience General Policy, which was subsequently submitted to the Board for approval. The Committee likewise received information on the cybersecurity strategy and the main projects and initiatives defined in that area, including stress tests on cyber resilience, financial crime prevention strategy and cybersecurity strategy. Lastly, at each of its meetings, the Committee received information on the main cybersecurity incidents that have occurred at industry level and those significant incidents that have affected BBVA Group, along with any material reliability incidents that have occurred in the BBVA Group. It also received regular reports on external and internal audits carried out on the main technology risks with critical or significant weaknesses. This English version is a translation of the original in Spanish for information purposes only. In case of discrepancy the original in Spanish shall prevail.

Annual Corporate Governance Report of BBVA .90.. 7. Annual assessment of the Board and its Committees (C.1.17 and C.1.18) BBVA’s Board of Directors conducts an annual assessment of its structure, size and composition, as well as the quality and efficiency of its functioning, based on the report submitted by the Appointments and Corporate Governance Committee. The Board also assesses the functioning of its Committees