Company: BBVXF
Filing Date: 2025-02-27
Form Type: F-4/A
Source: 0001193125-25-037317
Chunk: 699

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-02-27
Form: F-4/A
Chunk 699
---
 No noteworthy impacts have been detected. Detailed information on the risks that the Group deems most material is provided below: 4.4.4.1 Technology risk In recent years, the importance, complexity and use of technology and data have increased even further in banking processes, especially in remote channels (online banking) as a result of the impact of Covid-19.Consequently, the reliance on information systems and their availability is a key factor, as the Bank is more exposed to cyberattacks just like the other operators in the sector. The conflict between Ukraine and Russia has brought with it the risk of becoming a target for cyberattacks, in reaction to the restrictions imposed on Russia and due to Ukraine’s de facto membership of NATO, requiring the introduction of back-upmeasures. At the present time, this risk related to this conflict is stable, though latent. Furthermore, the Institution is currently undergoing a process of transformation, based on the digitisation and automation of processes, which increases the reliance on systems and the exposure to risks associated with this change, including digital fraud. Technology risk therefore remains one of the key focus areas of Banco Sabadell Group’s risk management. It should be mentioned that this risk is not only applicable to the Group’s own systems and processes, but it is also applicable to suppliers, given the widespread use of third parties for support in technological and business processes, and this therefore represents a significant risk when it comes to managing outsourcing. On the topic of IT outsourcing, with regard to 2022 it is particularly worth noting the implementation of Project Dingle, which has concentrated the outsourcing of application development and testing in three key suppliers and which therefore requires a greater level of control and monitoring of those suppliers, while at the same time reducing the probability of experiencing cybersecurity incidents in this area. In order to holistically and adequately manage all risks related to technology and data, the Institution classifies and categorises these risks into eight categories, in line with the Guidelines on ICT and security risk management (EBA/GL/2019/04):

| – | IT security (cybersecurity): risk of unauthorised access to IT systems, and of there being an impact on the                                                                                                                    
 confidentiality, availability, integrity and traceability of the information (data and metadata) that they contain (including cyberattacks and deliberate action), as well as the potential repudiation of digital operations. |

A-566

| – | IT availability (technological resilience): risk of critical services provided to customers and employees becoming 
 affected by systems failures.