Company: BBVXF
Filing Date: 2025-09-09
Form Type: 424B3
Source: 0001193125-25-198517
Chunk: 436

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-09-09
Form: 424B3
Chunk 436
---
 with information on the main operational risks (including, among others, ICT, conduct and fraud). Within operational risk, the following risks are also managed and controlled:

| – | Conduct risk: broadly speaking, this is defined as the current or future possibility of incurring losses due to the                                                                                                                              
 inadequate provision of financial services or any other activity carried out by the Institution, due to misconduct with customers (existing or potential), employees (in relation to human rights, equality, well-being, inclusion, and health & 
 safety in the workplace), shareholders and suppliers, markets, political parties or society in general, including cases of wilful misconduct or negligence.                                                                                      |

| – | Information and Communications Technology (ICT) risk: defined as the current or future risk of incurring losses due                                                                                                                                
 to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility, confidentiality and traceability of those infrastructures, tools and data, or due to the       
 inability to change IT platforms within a reasonable timeframe and at a reasonable cost when the environment or business requirements change. This also includes security risks resulting from inadequate or failed internal processes or external 
 events, including cyberattacks, or inadequate physical security in data centres.                                                                                                                                                                   |

| – | Outsourcing risk: current or future risk of incurring losses as a result of using resources and/or media of a third                                                                                                                             
 party for the standard, ongoing and stable performance over time of certain processes of the outsourcing company, which in itself entails exposure to a series of underlying risks, such as operational risk, including conduct risk, ICT risk, 
 reputational risk, concentration risk and lock-in risk.                                                                                                                                                                                         |

| – | Model risk: current or potential future loss an institution may incur, as a consequence of decisions that could be          
 principally based on the output of internal models, due to errors in the development, implementation or use of such models. |

| – | Tax risk: the possibility of failing to achieve the objectives set out in Banco Sabadell’s tax strategy from a 
 dual perspective due to either internal or external factors:                                                   |

| • |     | On one hand, the possibility of failing to fulfil tax obligations, potentially resulting in a failure to pay taxes that 
 are due, or the occurrence of any other event that could potentially prevent the Bank from achieving its goals.         |

| • |     | On the other hand, the possibility of paying taxes not actually due under tax obligations, thus negatively affecting 
 shareholders and