Company: BBVXF
Filing Date: 2025-03-21
Form Type: 6-K
Source: 0000842180-25-000016
Chunk: 185

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-03-21
Form: 6-K
Chunk 185
---
 2024 |     | 4. RISK |     | P.209 |

4.6.1.2. Operational risk management model

Article 435 (1) a), c), d)

EU ORA a)

The operational risk management cycle at BBVA is similar to the one implemented for the rest of risks. Its elements are:

### Operational risk management parameters
Operational risk forms part of the risk appetite framework of the Group and includes three types of metrics and limits:

– Economic capital: calculated with the operational losses database of the Group, considering the corresponding intra-geographical diversification effects and the additional estimation of potential and emerging risks through stress scenarios. The economic

capital is regularly calculated for the main banks of the Group and simulation capabilities are available to anticipate the impact of changes on the risk profile or new potential events.

– ORI metrics (Operational Risk Indicator: operational risk losses vs. gross income) broken down by geography.

– Indicators on sources of risk: a more granular common scheme of metrics (indicators and limits) covering the main types of operational risk is implemented throughout the Group. These metrics make it possible to intensify the anticipatory management of risk and objectify the appetite to different sources of risk. The indicators are regularly reviewed and adjusted to capture the main current risks.

#### Operational risk admission
The main purposes of the operational risk admission phase are the following:

– To anticipate potential operational risk to which the Group may be exposed due to the release of new, or modification of businesses, products, activities, processes or systems or in relations with third parties (e.g. in the outsourcing of bank processes to third parties).

– To ensure that implementation and the roll out of initiatives is only performed once appropriate mitigation measures have been taken in each case, including external assurance of risks where deemed appropriate.

The Corporate Non-Financial Risk Management Policy sets out the specific operational risk admission framework through different Operational Risk Admission and Product Governance Committees, both at a corporate and Business Area level, that follow a delegation structure based on the risk level of proposed initiatives.

| PILLAR 3 2024 |     | 4. RISK |     | P.210 |

#### Operational risk monitoring
BBVA promotes the continuous monitoring by each Area of the due functioning and effectiveness of its control environment.

The purpose of this phase is to check that the operational risk profile of the Group is within the authorized limits. Operational risk monitoring considers 2 scopes:

– Monitoring the operational risk admission process, oriented toward checking