Company: BBVXF
Filing Date: 2025-02-21
Form Type: 20-F
Source: 0000842180-25-000010
Chunk: 35

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-21
Form: 20-F
Item: Item 3
Chunk 35
---
eral), in different currencies and subject to different regulatory regimes. Therefore, it relies on highly sophisticated information technology (“IT”) systems for data transmission, processing and storage. However, IT systems are vulnerable to various problems, such as hardware and software malfunctions, computer viruses, hacking, and physical damage to IT centers. BBVA’s exposure to these risks has increased significantly in recent years due to the Group’s implementation of its ambitious digital strategy. Currently, approximately 66% of new clients choose digital channels to start their relationship with BBVA. The Group suffers cybersecurity incidents and system failures from time to time, and any such incident or failure could have a material adverse effect on the Group’s business, financial condition and results of operations, and could harm its reputation.
Any attack, failure or deficiency in the Group’s systems could, among other things, lead to the misappropriation of funds of the Group’s clients or the Group itself and the unauthorized disclosure, destruction or use of confidential information or personal data, as well as prevent the normal operation of the Group, and impair its ability to provide services and carry out its internal management. In addition, any attack, failure or deficiency could result in the loss of customers and business opportunities, damage to computers and systems, violation of regulations regarding data protection and/or other regulations, exposure to litigation, fines, sanctions or interventions, loss of confidence in the Group’s security measures, damage to its reputation, reimbursements and compensation, and additional regulatory compliance expenses and could have a material adverse effect on the Group’s business, financial condition and results of operations. Furthermore, it is possible that such attacks, failures or deficiencies will not be detected on time or ever. The Group is likely to be forced to spend significant additional resources to improve its security measures in the future. As cyber-attacks are becoming increasingly sophisticated and difficult to prevent (including as a result of the use of artificial intelligence), the Group may not be able to anticipate or prevent all possible vulnerabilities, nor to implement preventive measures that are effective or sufficient.
Customers and other third parties to which the Group is significantly exposed, including the Group’s service providers (such as providers of data processing or cloud computing services to which the Group has outsourced certain services), face similar risks. Any attack, failure or deficiency that may affect such third parties could, among other things, adversely affect the Group’s ability to carry out operations or provide services to its clients or result in the unauthorized disclosure, destruction or use of confidential information or personal data. Furthermore, the Group may not be aware