Company: BBVXF
Filing Date: 2025-08-12
Form Type: DRS
Source: 0000950123-25-007520
Chunk: 863

Company: BANCO BILBAO VIZCAYA ARGENTARIA, S.A.
Filing Date: 2025-08-12
Form: DRS
Chunk 863
---
ICT) risk) is defined as the current                                                                                                                                
 or future risk of incurring losses due to inadequacies or failures of technical infrastructures’ hardware and software, which could compromise the availability, integrity, accessibility or security of these infrastructures and data, or make it 
 impossible for IT platforms to be changed at a reasonable cost and within a reasonable timeframe in response to the changing needs of the environment or the business.                                                                              |

It also includes security risks resulting from inadequate or failed internal processes or external events, including cyberattacks or inadequate physical security in data centres. A-654

As confidentially submitted to the Securities and Exchange Commission on August 11, 2025. This Amendment No. 4 has not been publicly filed with the Securities and Exchange Commission and all information herein remains strictly confidential.

| – | Outsourcing risk: the possibility of incurring losses as a result of suppliers failing to provide subcontracted                                                                                                                                      
 services or discontinuing their provision, weaknesses in their systems’ security, disloyal employees or a breach of applicable regulations. It also includes other related risks such as concentration risk, country risk, legal risk and compliance 
 risk.                                                                                                                                                                                                                                                |

| – | Model risk: the possibility of incurring losses due to decisions made using inadequate models. |

| – | Tax risk: the probability of failing to achieve the objectives set out in Banco Sabadell’s tax strategy from a 
 dual perspective due to either internal or external factors:                                                   |

| • |     | On one hand, the probability of failing to fulfil tax obligations, potentially resulting in a failure to pay taxes that 
 are due, or the occurrence of any other event that could potentially prevent the Bank from achieving its goals.         |

| • |     | On the other hand, the probability of paying taxes not actually due under tax obligations, thus negatively affecting 
 shareholders and other stakeholders.                                                                                 |

| – | Compliance risk: defined as the risk of incurring legal or administrative penalties, significant financial losses or                            
 reputational damage as a result of an infringement of laws, regulations, internal rules or codes of conduct applicable to the Group’s activity. |

Reputational risk, understood as the possibility of incurring losses as a result of negative publicity related to the Institution’s practices and business, is also managed and controlled according to the methodological framework for operational risk, as this is a potentially significant source of reputational risk. This risk also considers the loss of trust in the Institution, which could affect its solvency. Senior Management and, in