Company: BBVXF
Filing Date: 2025-03-21
Form Type: 6-K
Source: 0000842180-25-000016
Chunk: 188

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-03-21
Form: 6-K
Chunk 188
---
acy of their control environment and executing mitigation plans for those risks in which control weaknesses are identified.

2.- Second line of defense: composed of:

(i) the Non-Financial Risk Units, in charge of designing and maintaining the Group's Operational Risk management model, and assessing the degree of application within the scope of the different Areas; and.

(ii) the Specialized Control Units, structured in alignment with the different risk types, define the General Mitigation, Control and Monitoring Framework for the risks in their respective areas, and carry out an independent assessment of the adequacy of the control environment implemented by the first line of defense.

The Non-Financial Risk Units and the Specialist Units are located in the Regulation and Internal Control area in order to ensure a coordinated action of the second line of defense and to preserve their independence with respect to the first line of defense.

3.- Third line of defense: performed by BBVA Internal Audit, which:

• Performs an independent review of the control model, verifying compliance with and effectiveness of established general policies.

• Provides independent information on the control environment to the Corporate Assurance Committees.

#### Corporate Assurance Committee Scheme
Corporate Assurance establishes a structure of committees, both at local and corporate level, to provide senior management with a comprehensive and homogeneous vision of the main non-financial risks and significant situations of the control environment.

Each geographical area has a Corporate Assurance Committee chaired by the Country Manager and whose main functions are:

– Facilitate agile and anticipatory decision-making for the mitigation or assumption of the main risks.

– Monitoring the changes in the non-financial risks and their alignment with the defined strategies and policies and the risk appetite.

– Analyzing and assessing controls and measures established to mitigate the impact of the risks identified, should they materialize.

– Making decisions about the proposals for risk taking that are conveyed by the working groups or that arise in the Committee itself

– Promoting transparency by promoting the proactive participation of the three lines of defense in discharging their responsibilities and the rest of the organization in this area

At the holding level there is a Global Corporate Assurance Committee, chaired by the Group's Chief Executive Officer. Its main functions are similar to those already described but applicable to the most important issues that are escalated from the geographies and the holding company areas.

The business and support areas have an Internal Control and Operational Risk Committee, whose purpose is to ensure the due implementation of the operational risk management model within its scope of action and drive active management of such risk, taking mitigation decisions when control weaknesses are identified and monitoring the same