Company: BBVXF
Filing Date: 2025-09-05
Form Type: F-4/A
Source: 0001193125-25-196513
Chunk: 442

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-05
Form: F-4/A
Chunk 442
---
 and 11% to the Mexican peso. 4.4.4. Operational risk Operational risk is defined as the risk of incurring losses due to inadequate or failed internal processes, people and systems or due to external events. This definition includes but is not limited to compliance risk, model risk and Information and Communications Technology (ICT) risk and excludes strategic risk and reputational risk. The Group has an operational risk management framework in place, which encompasses different types of subrisks defined within operational risk, establishing a common and unified framework for management and control, which can be expanded to include material risks with particular features or which require greater management and control. The management of operational risk is decentralised and devolved to process managers throughout the organisation. These processes are detailed in the corporate process map. A-201

This framework establishes a first phase of identification, in which those responsible for each process must identify the operational risks associated with their processes, establish effective mitigating controls and systematically execute the control framework. The set of risks identified under their area, as well as their mitigating controls, form part of the map of operational risks. The second phase of the framework consists of the management of operational loss events by those responsible for each process, ensuring that each loss event (and its recoveries) is logged including detailed information and linking each event to a risk. There is a central operational risk unit that oversees the map of operational risks, providing support and giving advice to process managers to properly define the risks, ensuring the integrity and completeness of the loss event log and their correct entry against the corresponding risks and coordinating the map’s ongoing assessment process. The Board of Directors is directly involved in managing this risk, by (1) approving the Operational Risk Policy that defines the risk management framework, (2) defining the Group’s appetite for operational risk, and (3) monitoring the Group’s risk profile via the Board Risk Committee, through specific reports with information on the main operational risks (including, among others, ICT, conduct and fraud). Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: broadly speaking, this is defined as the current or future possibility of incurring losses due to the                                                                                                                              
 inadequate provision of financial services or any other activity carried out by the Institution, due to misconduct with customers (existing or potential), employees (in relation to human rights, equality, well-being, inclusion, and health & 
 safety in the workplace), shareholders and suppliers, markets, political parties or society in general, including cases of