The amounts shown in this report are presented in millions of euros; therefore, certain items shown without a balance could have a balance if smaller units had been used. In order to present the amounts in millions of euros, the balances have been rounded; therefore, the amounts shown in certain tables may not be the exact arithmetic sum of the preceding figures

The English language version of this report is a free translation from the original, which was prepared in Spanish. All possible care has been taken, to ensure that the translation is an accurate presentation of the original. However, in all matters of interpretation, views or opinion expressed in the original language version of the document in Spanish take precedence over the translation.

The strength of the BBVA Group's earnings has contributed to achieving a consolidated fully loaded CET1 ratio of 12.67% as of December 31, 2023, which allows it to maintain a large management buffer over the Group's CET1 requirement as of that date (8.79%), which is also above the Group's target management range of 11.5-12.0% CET1.

The fully loaded CET1 ratio increased by 6 basis points, mainly explained by the generation of earnings in the year (+233 basis points) which, net of shareholder remuneration and payment of convertible contingent instrument coupons (CoCos), generated a positive contribution of +106 basis points.

Following the latest SREP (Supervisory Review and Evaluation Process) decision, the ECB has informed the Group that, effective January 1, 2024, it must maintain at consolidated level a total capital ratio of 13.26% and a CET1 capital ratio of 9.10%1, including a Pillar 2 requirement at consolidated level of 1.68% (a minimum of 1.02% must be satisfied with CET1), of which 0.18% is determined on the basis of the ECB's prudential provisioning expectations, and must be satisfied by CET1.

The evolution of the CET1 fully loaded ratio through 2023 is presented below:

The Tier 2 fully loaded ratio stood at 2.25% which represents an increase of 46 basis points compared to 2022, mainly explained by the subordinated issuances by BBVA S.A, in June €750 million, one issuance of GBP 300 million in August and another of $750 million in November. In addition, BBVA Mexico issued $1.0 billion in June.

The composition of the fully loaded total capital ratio as of December 31, 2022 and December 31, 2023 is shown below:

With respect to phased-in ratios, in 2023 there is no difference with respect to fully loaded ratios given that the impact associated with the transitional adjustments associated with IFRS9 is zero.

The BBVA Group maintains a solid liquidity position in every geographical area in which it operates, with ratios well above the minimum required:

–The BBVA Group's liquidity coverage ratio (LCR) remained comfortably above 100% throughout the year 2023, the average ratio stood at 148%. For the calculation of this ratio, it is assumed that there is no transfer of liquidity among subsidiaries; i.e. no type of excess liquidity levels in foreign subsidiaries is being considered in the calculation of the consolidated ratio. When considering these excess liquidity levels, the average BBVA Group's LCR would stand at 190%.

–The net stable funding ratio (NSFR), defined as the result between the amount of stable funding available and the amount of stable funding required, demands banks to maintain a stable funding profile in relation to the composition of their assets and off-balance sheet activities. This ratio should be at least 100% at all times. The BBVA Group's NSFR ratio, stood at 131% as of December 31, 2023.

As of December 31, 2023, the breakdown of the punctual ratios in the main geographical areas where the Group operates is shown below:

As for the leverage ratio, as of December 31, 2023, the fully loaded ratio stood at 6.54% (the same as phased-in), above the minimum required ratio of 3.00 %.

The fully loaded and phased-in ratios as of December 31, 2022 and December 31, 2023 are shown below:

The following table shows the main regulatory metrics in accordance with Article 447 of the CRR:

The following sections detail matters relating to the Group's solvency. These are supplemented by information included in the Group's Consolidated Financial Statements and Management Report as of year 2023, which also contain the Group's main activity and profitability indicators.

As a Spanish credit institution, BBVA is subject to Directive 2013/36/EU of the European Parliament and of the Council dated June 26, 2013, on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms (the "CRD IV Directive”) which main amendment is Directive 2019/878/EU (the “CRD V Directive)”.

The major regulation governing the solvency of credit institutions is (EU) Regulation No. 575/2013 of the European Parliament and of the Council of June 26, 2013, on the prudential requirements for credit institutions and investment firms amending (EU) Regulation No 648/2012 ("CRR" and in conjunction with Directive CRD IV and any implementing measures of CRD IV, "CRD IV"), which is complemented by several binding Regulatory Technical Standards that are directly applicable to all EU member states, without the need to implement national measures. This Regulation was mainly amended by Regulation 2019/876/EU (“CRR2”) and Regulation 2020/873/EU (“Quick Fix”).

The CRD IV Directive was transposed to Spanish national law by means of the Royal Decree-Law 14/2013, of November 29 (“RD-L 14/2013”), Law 10/2014 of June 26, Royal Decree 84/2015, of February 13 (“RD 84/2015”), Bank of Spain Circular 2/2014 of January 31 and Circular 2/2016 of February 2 (“Bank of Spain Circular 2/2016”), which has been amended by Circular 3/2022 of March, 30.

During 2021, Directive 2019/878 was transposed into the Spanish legal system through the publication of Royal Decree-Law 7/2021, of April 27 (amending Law 10/2014), Royal Decree 970/2021, of November 8 (which modifies RDL 84/2015) and Circular 5/2021, of September 22 (which modifies Circular 2/2016).

In the Macroprudential field, Royal Decree 102/2019 was published in March 2019, establishing the Macroprudential Authority of the Financial Stability Board, establishing its legal regime. The aforementioned Royal Decree also develops certain aspects related to the macroprudential tools contained in Royal Decree-Law 22/2018. Among them, it provides that the Bank of Spain may adopt measures such as the countercyclical buffer for a given sector, sectoral limits on the concentration of exposures or the establishment of limits and conditions on the granting of loans and other operations. These measures are developed in Bank of Spain Circular 5/2021, of September 22.

Section 1.3 of this chapter includes the specific regulations governing the information requirements of the Prudential Relevance Report (Pillar 3).

During 2023, regulators have kept their previous lines of work, such as the implementation of the Basel III framework or the improvement of the bank recovery and resolution framework. In terms of sustainable finance, the developments have continued in promoting coordination between the different regulatory bodies, including risks related to environmental, social and governance (ESG) aspects in the prudential field and continuing to develop standards of reporting and disclosure requirements. Finally, the agenda in digital finance has been marked by the progress of the regulatory framework for crypto assets, data, artificial intelligence and the digital euro, among other issues.

At the global level, during 2023, the report published by the Basel Committee of Banking Supervision (BCBS) about financial turmoil is worthy of mention, in which it is concluded that three structural trends might have contributed indirectly to the bank failures: the increasing role of non-bank financial intermediation, the exposure to crypto assets concentrated in a small number of banks and the ability of clients to move their funds more quickly due to the increasing digitalization.

The BCBS also published a consultation on the review of the Core Principles for Effective Banking Supervision. This review mainly updates the core principles in order to reflect changes that have already been implemented to the regulatory framework through the Basel standards. Additionally, the BCBS has continued to evaluate the risks and vulnerabilities of the global banking system and to monitor the implementation of the Basel III regulatory reform. Additionally, the BCBS published a public consultation document related to banks´disclosure of their exposure to crypto assets and another one related to the climatic risk disclosure framework under Pillar 3.

In the European prudential area, the final agreement reached by the end of the year between the Council of the European Union (hereinafter, Council) and the European Parliament (hereinafter, EP), about the transposition of the international rules of capital requirements known as Basel III, is noteworthy. The proposal presented by the European Commission (hereinafter, Commission) by the end of 2021, the “Banking Package”, aims to boost the resilience of the banks that operate in the European Union (hereinafter, EU) and to strengthen its supervision and risk management, as well as to ease the transition toward climate neutrality. This package comprises the proposal for the Capital Requirements Directive (CRD VI, which amends the earlier CRD V) and the proposal for the Capital Requirements Regulation (CRR3, which amends the earlier CRR 2). In the agreement, regulators have agreed on how to implement the so-called “output floor”, which limits the variability of banks´ capital levels through internal models, as well as the provisional

transitions so that entities have enough time to adapt. Regulators have also agreed to include technical improvements in the areas of credit risk, market risk and operational risk. Likewise, the agreement includes a harmonized framework suitable for the members of the institutions´ management bodies and of the key functions´ holders. In this package a prudential provisional transition for crypto assets and for the definition of different ESG-related risks, and adjustments to improve banks´management of these risks, have also been agreed. Likewise, it has been decided to harmonize the minimum requirements for branches of third country banks and the supervision of their activities in the EU. The entry into force of these changes will be gradual and it is planned to take place from 2025 onwards. The EBA is already working to update the CRR3 implementation standards (in December it published two consultations on the requirements of supervisory information and the outreach of Pillar 3). Apart from the publications resulting from the future implementation of the banking package, the EBA published in December an update of the Guidelines on the specification and disclosure of systemic importance indicators, as well as modifications to the implementing technical standards of MREL and TLAC disclosure and reporting, which shall apply from June 2024.

Additionally, worthy of note are the publication from the European Banking Authority (EBA) of the proposal of modification of the reporting about interest rate risk in the investment portfolio and the publication of the public consultation about its project of technical standards of execution relative to the specific requirements of information presentation due to market risk. The EBA has also published its final RTS about securitization, in which conditions for the evaluation of the consistency of the underlying exposures are established in a number of simple, transparent and standardized (STS) securitization within the balance sheet.

Lastly, the ECB also published a consultation about the revised Guide of internal models, which clarifies how credit entities must include in their models climatic and environmental relevant risks. It also offers clarifications for the banks that wish to return to the standard method to calculate their risk-weighted assets.

In September 2023, the Bank of Spain (BdE, for its acronym in Spanish) adapted its methodology of minimum floors to evaluate the OSIE (Other Systemically Important Entities) capital buffers to the standard published by the ECB in December 2022 and which shall be applicable from January 1, 2024. The new standard pretends to homogenize the establishment of these buffers in Europe, raising the minimums.

In terms of the crisis management framework, at the global level, the FSB consultation on financial resources and tools that could be used for the resolution of the central counterparty entities is worthy of mention.

In Europe the Commission presented a crisis management and deposit insurance (CMDI) framework reform proposal with the purpose of: i) making it more proportional, efficient and consistent in the management of the resolution or liquidation of any bank in the EU, ensuring the adequate funding of the process, and (ii) improving the synergies between crisis management and depositor protection, taking measures to complete the European banking union . In order to meet these goals, it is proposed to extend the scope of the resolution, clarifying and homogenizing other essential concepts. Moreover, it is intended to reinforce and extend the functions of the deposit guarantee funds (DGF) to, among other objectives, ease its use in resolution. At the moment, the EP and the Council are debating about the legislative package.

For its part, the EBA has published the final document with the Guidelines on the overall recovery capacity (ORC) in recovery planning. The objective is to establish a consistent framework for the determination of the ORC in recovery plans and their respective assessments by the competent authorities. The EBA also published its final Guidelines directed towards the resolution authorities so that they publish their approach to applying the bail-in in order to provide more transparency to market participants.

In Spain, the BdE has made the revised EBA Guidelines on methods for the calculation of contributions to deposit guarantee funds its own.

In 2023, regulatory activity in ESG matter for the banking system continued to progress in line with the previous years.

At global level, it is important to highlight some initiatives driven by global institutions such as those of the International Sustainability Standards Board (ISSB), created in November 2021 by the International Financial Reporting Standards (IFRS) Foundation. In June 2023, the ISSB published the opening standards of disclosure about sustainability, IFRS S1 and IFRS S2. The IFRS S1 offers a number of disclosure requirements designed to enable companies to inform their investors about the sustainability-related risks and opportunities that they face in the short, medium and long term. The IFRS S2 establishes specific climate-related disclosures and it is designed to be used in conjunction with the IFRS S1. These standards include the recommendations of the Task Force on Climate-related Financial Disclosures (TCFD).

In respect of the European banking system, regulatory activity continued to progress, in line with the renewed strategy of 2021 of sustainable finance.

Europe has continued to integrate ESG concepts in the prudential regulation, in the supervision and in the reporting requirements. In respect of the sustainability reporting standards, the entry into force, in January 2023, of the Corporate Sustainability Reporting Directive (CSRD) is worthy of mention. The Directive introduces more detailed obligations about environmental, social and governance issues than the earlier Non-Financial Reporting Directive (NFRD). For its development, the first package of European Sustainability Reporting Standards (ESRS) has been approved, prepared by the European Financial Reporting Advisory Group (EFRAG), advising body to the Commission. It comprises twelve ESRS with high level of detail and which extensively describe both general and specific requirements about different sustainability factors, not only environmental, that entities shall observe when preparing information. In December, EFRAG published three implementation guides for consultation on materiality, value chain and datapoint analysis. The EC proposes to postpone the adoption of sectoral ESRS to June 30, 2026. In the same month, EFRAG and the Task Force on Nature-related Financial Disclosures (TNFD) signed an agreement of cooperation to tackle nature-related issues and improve the corporate transparency related to biodiversity and ecosystems.

On October 12, the EBA published its report on prudential treatment of environmental and social risks, after the discussion paper published in May 2022. This report reaffirms the need of maintaining a focus based on risks and the fact that at this point it does not consider necessary the introduction of adjustment factors that increase the capital requirement for brown exposures or that reduce it for green ones. On the contrary, it does propose a series of adjustments to the framework, with measures in the short and in the medium/long term.

In respect of taxonomy, in June 2023, the Commission announced a new measure package in order to boost and consolidate regulation on sustainable finance in the European Union. This package includes technical selection criteria to determine if an economic activity is aligned with the environmental goals of taxonomy that were pending: sustainable use and protection and recuperation of biodiversity and ecosystems. The estimated date for the application of these standards is January 1, 2024.

After the adoption of the Regulation on European green bonds by the European Parliament, in October 2023, the Council formally adopted the Regulation. The Regulation establishes uniform requisites for the bond issuers that wish to use the denomination “European green bond” or “EuGB” for their sustainable bonds from the environmental point of view. The Regulation also establishes a registration system and a supervision framework for the EuGB external verifiers.

In June 2023, European Supervision Authorities (EBA, EIOPA and ESMA, ESAs) made their Progress Reports on greenwashing public. These reports provide a high level definition of what is considered to be greenwashing, applicable to market participants within their respective competencies; banking, insurance and pensions and financial markets.

Final reports are expected by May 2024.

In December, an agreement was reached about the proposal of the Directive on corporate sustainability due diligence, proposed by the Commission in February 2022. This directive requires that companies of all sectors identify and prevent, end or mitigate the negative impact of their activities, as well as of their subsidiaries´ operations and of their supply chains, on human rights and the environment. Once the Directive is adopted, member States will have two years to integrate it into their national legislation.

Moreover, on 1 December, the Fit-for-55 climate risk scenario analysis exercise started. The deadline set to submit information to authorities is March 25, 2024. This is an exercise in which all the relevant banks will take part with a top-down approach, and whose results will be published in an aggregated form in the first quarter of 2025. The result of the exercise will not affect the annual evaluation process (SREP). The focus of the exercise will be on the transition risk rather than the physical risk.

In 2023, digitization continued to be a priority for European authorities, which have continued progressing in the implementation of the digital strategy defined by the Commission in 2020, and whose fundamental pillars are, among others, the strengthening of the use of data and the development and regulation of artificial intelligence.

In respect of the first pillar, the Commission adopted in July a new adequacy decision for the EU-United States transfer of data. In addition, the Council and the EP have finally reached an agreement on the new data Regulation concerning the access and deployment of data generated in the EU in all economic sectors, with special focus on the Internet of Things.

Another area which has drawn the most attention at the international level has been the development and regulation of artificial intelligence (AI). At the global level, the G7 leaders agreed in May an Action Plan to promote global interoperability among tools for a trustworthy AI. In this manner, they have embraced the main international guiding principles on IA and a voluntary code of conduct for AI developers, which will complement, at the international level, the standards that EU co-legislators are finalizing. In this international context, worthy of note is the EU-United States Joint Declaration of the Trade and Technology Council, where the commitment to develop a roadmap for a trustworthy AI and its risks management was restated, complementing the G7 process. At the European level, in December the political agreement regarding the new IA Regulation was reached, which will introduce specific

requirements for the systems that use this technology according to the generated risk.

One of the topics that has drawn the most attention from international bodies and regulators in 2023 has been crypto-assets. At the global level, the FSB published in July the international regulatory framework for the crypto-assets activities, with general recommendations for the regulation, supervision and surveillance of their activities, as well as a revision of the high level recommendations for global stablecoins. In addition, IOSCO submitted a series of recommendations about crypto-assets to consultation in order to address the worries concerning market integrity and investor protection.

At the European level, the EP and the Council reached an agreement in April and approved the new Regulation on Markets in Crypto-assets (MiCA), which imposes a series of obligations for the issuers and providers of crypto-assets services and which will come into force in 2024. Once the regulation has been officially approved, both the ESMA and the EBA are working on the secondary legislation of the MiCA.

Furthermore, the European project for the possible issuance of a digital euro - a digital central bank currency for retail use - also saw process in 2023. On the one hand, the Commission proposed in June a legal framework for the possible digital euro, in which its features and distribution model were set, and whose negotiation began in the last quarter of 2023. On the other hand, the ECB - with whom lies the final decision of issuing a digital euro - finalized in October the research phase on the digital euro and initiated a preparation phase that will lay the foundations for a possible digital euro and which will have an initial duration of two additional years. Then, the ECB Governing Council will decide whether to give or not the green light to the next preparation phased-in order to pave the way for the possible issuance.

Among the publications made by the European Securities and Markets Authority (ESMA), the following are worthy of mention: the final report on guidelines on MiFID II product governance requirements, the official translations of the guidelines on the new communication model for operations subject to EMIR introduced by EMIR Refit, and the final report on draft regulatory technical standards (RTS) to harmonize the central counterpart entities policies and procedures (CCP) to select, evaluate and revise the anti-cyclical margins measures.

In respect of the European Market Infrastructure Regulation (EMIR), the proposal of modification made by the Commission in December 2022 in order to reduce the risks that the high concentration of positions in some cameras outside the EU poses for the financial stability (Tier 2 central counterparties, CCP) remains on the table.

Although there is not consensus in the Council nor the EP yet, the main measures might mean the requirement to settle a percentage of transactions in UE CCP. The proposal also includes a CRD modification which might introduce Pillar Two standards for the matched positions in Tier 2 CCP.

With regard to the money laundering regulation, in Europe the EBA Guidelines on money laundering and terrorist financing risk factors (ML/RF) were published, as well as the Guidelines on policies and controls for the effective management of ML/TF risks when providing access to financial services. In addition, the Guidelines on ML/TF risk factors have been submitted to consultation in order to include the crypto-asset services providers (CASP).

Article 13 of the CRR establishes that the parent entities of the European Union are subject, based on their consolidated situation, to the disclosure requirements set by Part Eight of CRR.

The Prudential Relevance Report (Pillar 3) of the BBVA Group, corresponding to the year ended December 31, 2023, has been prepared in accordance with the requirements of Part Eight of the CRR.

The approval and certification policy of the information published in the PRR is described in the "General Policy for disclosure of economic-financial, non-financial and corporate information" approved by the governance bodies of Banco Bilbao Vizcaya Argentaria, SA. As described in abovementioned policy, the PRR has been supervised by the Audit Committee (in the session held on February 26, 2024), with additional approval by the Board of Directors (in its meeting held on February 28, 2024).

Likewise, it should be noted that the data disclosed in the PRR - Pillar 3, have been prepared in accordance with the internal processes and controls described in the "Standard for the preparation of periodic public information of Banco Bilbao Vizcaya Argentaria, S.A. and BBVA Group”. The aforementioned policies and standards guarantee that the information disclosed in the PRR - Pillar 3 is subject to the internal control framework defined by the Group, as well as to an adequate level of internal review.

This report provides the prudential information of BBVA Consolidated Group as of December 31, 2023 which has been prepared in accordance with the precepts contained in Part Eight of the CRR, complying with the guidelines published by EBA and the applicable technical implementation standards.

In addition, the main EBA guidelines that apply as of December 31, 2023 are highlighted below:

•Guidelines on materiality, proprietary information, and confidentiality, and on the frequency of disclosure of information according to Article 432, sections 1 and 2, and Article 433 of Regulation (EU) No. 575/2013 (EBA/GL/2014/14). These guidelines detail the process and the criteria to be followed regarding the principles of materiality, proprietary information, confidentiality and the right to omit information, and provide guidance for entities to assess the need to publish information more frequently than the annual one. These guidelines were adopted by the Bank of Spain Executive Commission in February 2015.

•Guidelines amending the EBA/GL/2018/01 guidelines on the uniform disclosure of information pursuant to Article 473a of Regulation (EU) No.

575/2013 (CRR) with regard to transitional provisions to mitigate the impact on own funds caused by the implementation of IFRS 9, aiming to guarantee compliance with the Quick Fix made to the CRR in response to the COVID-19 Pandemic (EBA/GL/2020/12). These guidelines are applicable from August 11, 2020 until the end of the transitional periods contemplated in articles 468 and 473 bis of the CRR (December 31, 2024 and December 31, 2022, respectively)

•Implementing Technical Standards published in June 2020 concerning reporting and disclosure of public information (EBA/ITS/2020/04, hereinafter “CRR2 EBA ITS”). These technical standards implement the changes introduced by CRR2.

In these technical implementation standards, the EBA, following the mandate of the European Commission in article 434a of the CRR2, implements the changes introduced by aforementioned regulation, integrating in a single document most of the disclosure requirements to the market that were disseminated in various guidelines published to date.

Additionally, these regulations also aim to unify, as far as possible, public information with the information reported to the Supervisor through integration in regulatory reporting and has meant in some cases the simplification of standard templates that could contain similar information, maintaining only those templates that include just complete and relevant information, such as those referring to the credit quality of the exposures.

Likewise, together with the aforementioned ITS, the EBA publishes for informative purposes a document called mapping tool that interrelates the quantitative information of most of the standard templates required in Pillar 3 with the regulatory reporting, which has been taken into account in the preparation of this report. The implementation of these standards may produce variations in the content and the way in which the information is presented with respect to previous periods.

•Guidelines on the specification and disclosure of systemic importance indicators (EBA/GL/2020/14), adopted by the Bank of Spain Executive Commission. These guidelines have been amended and subsequently adopted by Bank of Spain in 2022 by EBA/GL/2022/12 Guidelines.

•Guidelines on sound remuneration policies under Directive 2013/36/EU (EBA/GL/2021/04). These guidelines were adopted by the Bank of Spain Executive Commission in December 2021. In addition, as regards remuneration, the Guidelines on the benchmarking exercises on remuneration practices, the gender pay gap and approved higher ratios under Directive 2013/36/EU (EBA/GL/2022/06), adopted as its own by the Bank of Spain on December 21, 2022, also apply.

•Commission Implementing Regulation (EU) 2022/631 of 13 April 2022 amending the implementing technical standards laid down in Implementing Regulation (EU) 2021/637 as regards the disclosure of exposures to interest rate risk on positions not held in the trading book, published in the Official Journal of the European Union (OJUE) on April 19, 2022.

•Commission implementing regulation (EU) 2022/2453 of 30 November 2022 amending the implementing technical standards laid down in Implementing Regulation (EU) 2021/637 as regards the disclosure of environmental, social and governance risks, published in the Official Journal of the European Union (OJUE) on December 19, 2022.

Annex VIII.a of this report contains the correspondence of the articles of Part Eight of the CRR on disclosure of information that are applicable at the date of the report with the different sections of the document where the required information is found. Additionally, Annex VIII.b contains the correspondence of the articles of Annex II of the Commission Implementing Regulation (EU) 2022/2453 on ESG risk disclosure with the different sections of this report.

The aforementioned annex, together with the other annexes and the tables included in this report, are in an editable format in order to facilitate their treatment, following the recommendations of the EBA Guidelines. This document is called "Pillar 3 2023 - Tables & Annexes" and available in the Shareholders and Investors / Financial Information section of the Group's website.

2.1.1. Corporate name and scope of application

Banco Bilbao Vizcaya Argentaria, S.A. (hereinafter “the Bank”, “BBVA" or “BBVA, S.A.”) is a private-law entity subject to the laws and regulations governing banking entities operating in Spain. It carries out its activity through branches and agencies across the country and abroad.

The Bylaws and other public information are available for inspection at the Bank’s registered address (Plaza San Nicolás, 4 Bilbao) as noted on its web site (www.bbva.com).

Solvency regulations are applicable at a consolidated level for the whole Group.

2.1.2. Differences between the consolidated group for the purposes of solvency regulations and accounting criteria

The BBVA Group’s Consolidated Financial Statements are presented in compliance with IFRS-IASB (International Financial Reporting Standards as issued by the International Accounting Standards Board), as well as in accordance with the International Financial Reporting Standards endorsed by the European Union (hereinafter, “EU-IFRS”) applicable as of December 31, 2023, considering the Bank of Spain Circular 4/2017, as well as its successive amendments, and with any other legislation governing financial reporting which is applicable and with the format and mark-up requirements established in the EU Delegated Regulation 2019/815 of the European Commission.

On the basis of accounting criteria, companies are considered to form part of a consolidated group when the parent entity holds or can hold, directly or indirectly, control of them. An institution is understood to control a subsidiary when it is exposed, or is entitled to, variable returns as a result of its involvement in the subsidiary and has the capacity to influence those returns through the power it exercises over the subsidiary. For control to exist, the following aspects must be fulfilled:

a.Power: An investor has power over a subsidiary when it has current rights that provide it with the capacity to direct its relevant activities, i.e. those that significantly affect the returns of the subsidiary.

b.Returns: An investor is exposed, or is entitled to variable returns, as a result of its involvement in the subsidiary when the returns obtained by the investor for such involvement may vary based on the economic performance of the subsidiary. Investor returns can be positive only, negative only, or positive and negative at the same time.

c.Relationship between power and returns: An investor has control over a subsidiary when it not only has power over the subsidiary and is exposed, or is entitled to, variable returns for its involvement in the subsidiary, but it also has the capacity to use its power to influence the returns it obtains due to its involvement in the subsidiary.

Therefore, in drawing up the Consolidated Financial Statements of BBVA Group, all dependent companies and consolidating structured entities have been consolidated by applying the full consolidation method.

Associated companies, as well as joint ventures (those over which joint control arrangements are in place), are valued using the equity method.

The list of all the companies forming part of the Group is included in the appendices to the Consolidated Financial Statements of BBVA Group.

For the purposes of solvency regulations, the following subsidiaries form part of the consolidated group, as defined in Article 18 of the CRR:

•Credit institutions

•Investment firms

•Financial Institutions

A financial institution is a company, separate from other institutions (credit institution or investment firm), whose main activity may consist of acquiring holdings or performing one or more of the following activities:

•Loans, including in particular consumer finance, credit agreements relating to immovable property, recourse and non-recourse factoring, and financing of commercial transactions (including forfaiting)

•Financial leasing

•Payment services

•Issuing and managing other payment channels (e.g. traveler's checks and bank checks)

•Granting of guarantees and commitments

•Trading on their own account or on behalf of customers on any of the following instruments:

◦Money market instruments (checks, bills, certificates of deposit etc.)

◦Foreign currency

◦Financial futures and options

◦Foreign-exchange or interest-rate instruments

◦Marketable securities

•Participating in the issuance of securities and the provision of corresponding services

•Advising companies with regard to capital structure, industrial strategy and related matters, as well as advice and services for mergers and acquisitions of companies

•Brokerage in the interbank markets

•Managing or advising on equity management

•Custody and administration of marketable securities

•Issuance of electronic money

This definition includes financial holding companies, mixed financial holding companies, payment institutions and asset management firms, but excludes pure industrial holding companies, insurance companies, insurance holding companies and mixed insurance holding companies.

•Auxiliary services companies: A company whose main activity is holding or management of property, management of computing services or any other similar activity of an auxiliary nature with regard to the main activity of one or more institutions (credit institution or investment firm).

Therefore, for the purposes of calculating solvency requirements, and hence the drawing up of this Prudential Relevance Report, the scope of consolidating entities is different from the scope defined for the purposes of drawing up the Consolidated Financial Statements of BBVA Group.

The effect of the difference between the two regulations is mainly due to:

•Withdrawals from the balance made by entities (largely insurance companies regulated by the Solvency II regulatory framework) that are consolidated in the Consolidated Financial Statements of BBVA Group by the full consolidation method and consolidated for the purposes of solvency by applying the equity method.

•Entries to the balance contributed mainly by financial entities, consolidated by applying the equity method at the accounting level, but for the purposes of solvency, are proportionally integrated.

The list of entities that use different consolidation methods in their public and regulatory balance sheets is included in the table EU LI3 in Annex I.

2.1.3. Significant transactions in the Group in 2023

During the year 2023 no significant corporate transactions have been carried out.

2.1.4.Reconciliation of the Public Balance Sheet from the accounting perimeter to the regulatory perimeter

The following table includes an exercise in transparency to show the reconciliation process between the book balances reported in the public balance sheet (attached to the Consolidated Financial Statements of BBVA Group) and the book balances this report uses (regulatory perimeter), revealing the main differences between both perimeters.

The main differences between the public balance sheet and the regulatory balance sheet are due to withdrawals from the balance generated by insurance, real estate and financial entities that are consolidated through the application of the equity method for the amount of €-28,496 million; and balance entries generated by entities that are consolidated using the proportional integration method for an amount of €+1,182 million.

The following table also shows the risk to which each of the items on the regulatory balance sheet is exposed:

A summary table with the main sources of differences between the amount of exposures in regulatory terms (EAD) and the accounting balances according to the Financial Statements is below:

As the table shows, the main sources of difference between the accounting value on the balance sheet and the amount of exposure for regulatory purposes are the inclusion of off-balance sheet items after the conversion factor, the different treatment of the guarantees eligible as risk mitigation techniques and the regulatory treatment of derivative and securities financing transactions (inclusion of netting rules other than those applied in accounting value and the inclusion of the potential future exposure).

As of December 31, 2023, there are no entities in the Group with capital adequacy below their applicable minimum regulatory requirement.

The Group operates mainly in Spain, Mexico, Turkey and South America. The Group’s banking subsidiaries around the world are subject to supervision and regulation (with respect to issues such as compliance with a minimum level of regulatory capital) by a number of regulatory bodies.

The obligation to comply with these capital requirements may affect the capacity of these banking subsidiaries to transfer funds (e.g. via dividends) to the parent company.

In some jurisdictions in which the Group operates, the regulations lay down that dividends may only be paid with the funds available by regulation for this purpose.

In accordance with what is set out in the solvency regulations regarding the exemption from capital requirements compliance for Spanish credit institutions belonging to a consolidated group (at individual or sub-consolidated level) established in the aforementioned regulation, the Group obtained exemption from the supervisor on December 30, 2009 for Banco Occidental, S.A. (this exemption was ratified through ECB decision 1024/2013)

In addition, for Financiero de Crédito de Portugal (BBVA IFIC, S.A.), the ECB has decided not to apply prudential or liquidity requirements individually

Article 92 of the CRR establishes that credit institutions must maintain the following own funds requirements at all times:

a.Common Equity Tier 1 capital ratio of 4.5%, calculated as Common Equity Tier 1 capital expressed as a percentage on the total amount of risk-weighted assets.

b.Tier 1 capital ratio of 6%, calculated as the level of tier capital 1 expressed as a percentage of the total amount of risk-weighted assets.

c.Total capital ratio of 8%, calculated as the total own funds expressed as a percentage of the total amount of risk-weighted assets

Notwithstanding the application of the Pillar 1 requirement, CRD IV allows competent authorities to require credit institutions to maintain a level of own funds higher than the requirements of Pillar 1 to cover types of risk other than those already covered by the Pillar 1 requirement (this power of the competent authority is commonly referred to as "Pillar 2R" from “Requirement”).

Additionally, CRD IV also grants the power to these authorities to propose an additional indicative buffer that entities should maintain for optimal capitalization (Pillar 2G, for “Guidance”). The latter is non-binding and, therefore, is not part of the official requirement of the entities, which establishes the threshold of the Maximum Distributable Amount (MDA, for its acronym in English). However, not complying with this additional buffer could trigger the definition of additional supervision and control measures by the ECB.

Furthermore, from 2016 and in accordance with CRD IV, credit institutions must comply with the following combined requirement of capital buffers at all times: (i) the capital conservation buffer, (ii) the buffer for global systemically important banks (the "G-SIB" buffer), (iii) the entity-specific countercyclical capital buffer, (iv) the buffer for other systemically important banks ("D-SIB" buffer) and (v) the systemic risk capital buffer. The “combined capital buffer requirement” must be met with Common Equity Tier 1 capital (“CET1”) to cover both minimum capital required by “Pillar 1” and “Pillar 2".

Both the capital conservation buffer and the G-SIB buffer (where appropriate) will apply to credit institutions as it establishes a percentage greater than 0%.

The buffer for global systemically important banks applies to those institutions on the list of global systemically important banks, which is updated annually by the Financial Stability Board (“FSB”). Considering the fact that BBVA does not appear on that list, as at the report date, the G-SIB buffer does not apply to BBVA.

Detailed information on each of the quantitative indicators that form part of the evaluation process is available on the BBVA Group's website.

The Bank of Spain has extensive discretionary powers as regards the countercyclical capital buffer specific to each bank, the buffer for other systemically important financial institutions (which are those institutions considered to be systemically important domestic financial institutions “D-SIB”) and the buffer against systemic risk (to prevent or avoid systemic or macroprudential risk). The European Central Bank (ECB) has the powers to issue recommendations in this respect following the entry into force on November 4, 2014 of the Single Supervisory Mechanism (SSM).

With regard to minimum capital requirements, following the latest decision of the SREP (Supervisory Review and Evaluation Process), which comes into force as of January 1, 2024, the ECB has notified the Group of maintaining the Pillar 2 requirement at 1.68% (of which: 1.02% at least should be covered by CET1). In addition, the D-SIB buffer applicable to the Group since January, 1, 2024, will increase 25 basis points from 0.75% in force as of December 31, 2023.Therefore, BBVA must maintain a CET1 capital ratio of 9.10% and a total capital ratio of 13.26% at a consolidated level.

Thus, the consolidated overall capital requirement includes: i) the minimum capital requirement of Common Equity Tier 1 (CET1) of Pillar 1 (4.50%); ii) the capital requirement of Additional Tier 1 (AT1) of Pillar 1 (1.50%); iii) the capital requirement of Tier 2 of Pillar 1 (2.00%); iv) the CET1 requirement of Pillar 2 (1.02%), v) the capital requirement of Additional Tier 1 (AT1) of Pillar 2 (0.28%); vi) the capital requirement of Tier 2 of Pillar 2 (0.38%); vii) the capital conservation buffer (2.50% of CET1); viii) the capital buffer for Other Systemically Important Institutions (O-SIIs) (1.00% of CET1); and ix) the countercyclical buffer (CCyB) (0.08% of CET1)

The BBVA Group has set the objective of maintaining a fully loaded CET1 ratio at a consolidated level between 11.5% and 12.0%. At the end of the financial year 2023, the fully loaded CET1 ratio was above this target management range.

CET1 phased-in ratio reach 12.67% which represents 388 basis points over the minimum requirement of 8.79%.

The following table shows the CET1 ratio that would trigger restrictions on capital distribution capacity and the capital ratios as of December 2023:

The following table shows the distribution by geographical areas of the credit exposure for calculation of the countercyclical capital buffer. Countries where no buffer is established are grouped:

The countercyclical capital buffer requirement applicable to the BBVA Group is approximately 0.08%, which increased 4 basis points compared to December 2022. This requirement means that the Group must maintain an additional capital buffer of 302 million euros at the end of December 2023.

The growth is mainly due to the increase of the requirement in the United Kingdom (2%) from 1%, as well as the activation France (0.5%), territories where the Group has significant exposures, making both among the top 10 countries where the Group has the greatest exposure. The activation in the Netherlands (1%), Germany (0.75%) and Uruguay (0.25%) as well as the increase of 0.5% (up to 1%) in Romania, countries that together account for slightly more than 4% of the Group's total requirements has also affected, although to a lesser extent. Lastly, the requirement has been less affected by the activation or increase of the requirement in other less relevant geographies for the Group.

For the purposes of calculating minimum capital requirements, according to Regulation (EU) 575/2013 and subsequent amendments, which are applicable as of the report date, the elements and instruments of Tier 1 capital are defined as the sum of Common Equity Tier 1 capital (CET1) and additional Tier 1 capital (AT1), as defined in Part Two, Title I, Chapters I to III of the CRR, as well as their corresponding deductions, in accordance with Articles 36 and 56, respectively.

Also considered are the elements of Tier 2 capital defined in Part Two, Title I of Chapter IV, Section I of the CRR. The deductions defined as such in Section II of the same Chapter are also considered.

The level of Common Equity Tier 1 capital essentially comprises the following elements:

a.Capital and share premium: this includes the elements described in article 26 section 1, and 28 of the CRR and the EBA list referred to in Article 26 Section 3 of the CRR.

b.Accumulated gains: in accordance with Article 26. 1 c), the gains that may be used immediately and with no restriction to cover any risk or losses are included, in the event that they occur.

c.Other accumulated income and other reserves: in accordance with Article 26. 1, d) and e), this item primarily classifies the exchange-rate differences and the valuation adjustments associated with the portfolio of financial assets at fair value with changes to other comprehensive income.

d.Minority interests eligible as CET1: includes the sum of the Common Equity Tier 1 capital instruments of a subsidiary that arise in the process of its global consolidation and are attributable to natural or legal third persons other than companies included in the consolidation, calculated in accordance with Article 84 et seq. of the CRR.

e.Net profit of the year attributed to the Group: the independently verified profits are included, net of any possible expense or foreseeable dividend previously authorised by the supervisor (following the treatment set out in Article 5 of Decision (EU) 2015/656 of the ECB). As of December 31, 2023, it includes the prudential accrual of 0.39 cents/share as Shareholders remuneration related to 2023 Group results, which has been agreed by the Management Board on January, 29, 2024 (pending approval by the General Shareholders' Meeting to be held on March 15, 2024).

Furthermore, CET1 capital is adjusted mainly through the following deductions:

f.Additional value adjustments: this includes adjustments resulting from the prudent valuation of positions at fair value, as set out in Article 105 of the CRR.

g.Intangible assets: these are included net of the corresponding tax liabilities, as set out in Article 36.1 b) and Article 37 of the CRR. It mainly includes goodwill, software and other intangible assets. The amount shall be deducted from the amount of the accounting revaluation of the intangible assets of the subsidiaries derived from the consolidation of the subsidiaries attributable to persons other than the companies included in the consolidation. This includes the positive effect due to the prudent treatment of software following the publication of Delegated Regulation 2020/2176 of December 22.

h.Deferred tax assets: it includes deferred tax assets that rely on future profitability and do not rise from temporary differences (net of the corresponding tax liabilities when the conditions established in Article 38.3 of the CRR are met), as per Article 36.1 c) and Article 38 of the CRR, mainly loss carryforwards (LCFs).

i.Reserves at fair value related to losses or gains from cash flow hedging: includes value adjustments of cash flow hedging of financial instruments not valued at fair value, including expected cash flows in accordance with Article 33 a) of the CRR.

j.Negative amounts due to the calculation of the expected losses: the default provision on expected losses in exposure weighted by method based on internal ratings, calculated in accordance with Article 36.1 d) of the CRR, is included.

k.Profit and loss at fair value: these are derived from the entity’s own credit risk, in accordance with Article 33 b) of the CRR.

l.Direct, indirect and synthetic holdings of own instruments (treasury stock): includes the shares and other instruments eligible as capital that are held by any of the Group’s consolidating entities, together with those held by non-consolidating entities belonging to the economic Group, as set out in Article 36.1 f) and Article 42 of the CRR. It mainly includes the amount of the treasury stock up to the maximum limit authorized by the ECB to the BBVA Group and the financing of own treasury shares.

m.Securitisation: any instance of securitisation that receives a risk weight of 1.250% is included, as set out in Article 36.1 k) ii) of the CRR.

n.Other regulatory adjustments: other CET1 deductions are included according to the CRR, which were not recognised in the above headings, such as:

i.losses and gains at fair value arising from the entity's own credit risk related to derivative liabilities (DVA).

ii.the amount corresponding to the insufficient coverage of non-performing exposures, taking into account both Article 36.1.m) of the CRR and the supervisory expectations on prudential provisions for non-performing exposures published in the Appendix to the ECB Guide on non-performing loans for credit institutions published in March 2018.

iii.the adjustment for the transitional treatment of the impact of IFRS9. In this regard, it is worth mentioning that since 2018, the BBVA Group has applied the static and dynamic treatment of the impacts of IFRS 9, therefore, the phased-in capital and leverage ratios are calculated taking into account the transitional provisions defined in Article 473 bis of the CRR and its subsequent amendments to the aforementioned article introduced by Regulation 2020/873 of the Parliament and of the Council of June 24, 2020 in response to the COVID19 Pandemic, opting to apply section 7a of the aforementioned article in the calculation of the impact of the transitory treatment on phased-in risk-weighted assets. As of December 31, 2023 no adjustment is included for this transitional treatment.

iv.the amount of the deduction arise from significant holdings in financial institutions and deferred tax assets arising from temporary differences that exceed the 10% limit of the CET1, as well as the deduction for exceeding the joint limit of 17.65% of the CET1 according to Article 48.2 of the CRR.

In addition, as of December 31, 2023, the Group do not hold stakes in financial institutions that are excluded from the application of the previously mentioned limits (article 49 of the CRR) and, therefore, the standard template of the EBA EU INS1 shall not be applicable.

v.the execution of 781 million share buyback program, subject to obtaining the corresponding authorizations and the communication of the specific terms and conditions of the program prior to the beginning of its execution.

In addition, the Group includes as eligible own funds the AT1 capital, which is comprised of:

o.Capital instruments and share premium eligible as AT1: this item includes the perpetual contingent convertible securities that meet the conditions set out in Articles 51 and 52.1, 53 and 54 of the CRR.

p.Qualifying Tier 1 capital included in the consolidated additional capital issued by affiliates and held by third parties: this item includes the amount of additional Tier 1 capital from the subsidiaries, calculated in accordance with Article 85 and 86 of the CRR.

Finally, the Group also includes Tier 2 eligible capital as own funds, which includes the following elements:

q.Capital instruments and Tier 2 share premiums: includes funding that, for credit ranking purposes, comes behind all the common creditors. The issues, moreover, have to fulfil a number of conditions, which are laid out in Article 63 of the CRR, taking into account the transitory provisions established in Part Ten, Chapter 4 of the CRR

r.Eligible own funds instruments eligible as Tier 2 capital issued by subsidiaries and held by third parties: these instruments are included under Articles 87 and 88 of the CRR.

s.Credit risk adjustments: it includes the surplus resulting from comparing the provisions and expected credit losses related to exposures calculated under IRB approach with the limit of 0.6% of the risk-weighted exposure.

t.Tier 2 Regulatory adjustments: this mainly includes direct and indirect holdings of own Tier 2 capital instruments and the adjustment of the element described in letter s) derived from the transitional treatment of the impact of IFRS9.

Annex III outlines the main characteristics of capital instruments eligible for inclusion as additional Tier 1 and Tier 2 capital, in accordance with the standard template EU CCA.

The amount of total eligible capital, net of deductions, for the different items making up the capital base as of December 31, 2023 and 2022, respectively, is below, in accordance with the requirements for the disclosure of information related to regulatory own funds established

by the Implementing Technical Standards (EBA/ITS/2020/04) (Implementing Regulation 2021/637 of March 15, 2021):

The CET1 fully loaded ratio of the BBVA Group (hereinafter, the Group) stood at 12.67% at the end of December 2023, which allows maintaining a large management buffer over the Group's CET 1 requirement (8.79%) and over the Group's target management range established between 11.5-12% of CET 1. The phased-in CET 1 ratio was also 12.67%, given that there is no difference between the two ratios by the effect of the transitional adjustments of the IFRS9 impacts on solvency indicators.

The CET1 fully loaded ratio has increased by 6 basis points, mainly explained by the generation of earnings in the year (+233 basis points) which, net of shareholder remuneration and payment of convertible contingent instrument coupons (CoCos), generated a positive contribution of +106 basis points.

The Tier 2 fully loaded ratio stood at 2.25% which represents an increase of 46 basis points compared to 2022, mainly explained by the subordinated issuances by

BBVA S.A, in June €750 million, one issuance of GBP 300 million in August and another of $750 million in November. In addition, BBVA Mexico issued $1.0 billion in June.

As a consequence of the foregoing, the fully loaded total capital ratio stands at 16.58% as of December 2023, while the total phased-in ratio is also 16.58% as of the same date.

Following the latest SREP (Supervisory Review and Evaluation Process) decision, the ECB has informed the Group that, effective January 1, 2024, it must maintain at consolidated level a total capital ratio of 13.26% and a CET1 capital ratio of 9.10%2, including a Pillar 2 requirement at consolidated level of 1.68% (a minimum of 1.02% must be satisfied with CET1), of which 0.18% is determined on the basis of the ECB's prudential provisioning expectations, and must be satisfied by CET1.

The evolution of fully loaded CET1 ratio during the year 2023 is below:

The process of reconciliation between accounting own funds and regulatory own funds is shown below. Based on the shareholders’ equity reported in the Consolidated Financial Statements of BBVA Group and applying the

deductions and adjustments shown in the table below, reaching to the regulatory capital figure eligible for solvency purposes:

3.3.1. Entity risk profile

The BBVA Group has a general risk management and control model (hereinafter, the “Model”) that is appropriate for its business model, its organisation, the countries where it operates and its corporate governance system. This model allows the Group to carry out its activity within the risk management and control strategy and policy defined by the corporate bodies of BBVA and to adapt itself to a changing economic and regulatory environment, facing this management at a global level and aligned to the circumstances at all times. The Model establishes a suitable risk management system related to the risk profile and strategy of the entity.

The types of risk inherent in the business that make up the risk profile of the Group are as follows:

•Credit risk and dilution: Credit risk arises from the probability that one party to a financial instrument will fail to meet its contractual obligations for reasons of insolvency or inability to pay and cause a financial loss for the other party. This includes counterparty risk, issuer risk, liquidation risk and country risk.

•Counterparty risk: The credit risk corresponding to derivative instruments, repurchase and reverse repurchase transactions, securities or commodities lending or borrowing transactions and deferred settlement transactions.

•Credit Valuation Adjustment Risk (CVA): Its aim is to reflect the impact on the fair value of the counterparty’s credit risk, resulting from OTC derivative instruments which are not recognised credit derivatives for the purpose of reducing the amount of credit risk weighted exposure

•Market risk: Market risk originates in the possibility that there may be losses in the value of positions held due to movements in the market variables that affect the valuation of financial products and assets in the trading book. This includes risk with respect to the position in debt and equity instruments, exchange rate risk and commodity risk.

•Operational risk: a risk that may cause losses as a result of human error; inadequate or defective internal processes; inadequate conduct toward customers, in the markets or against the company; failures, interruptions or deficiencies in systems or communications; theft, loss or misuse of information, as well as deterioration of its quality; internal or external fraud including, in all cases, fraud resulting from cyber-attacks; theft or physical damage to assets or persons; legal risks; risks resulting from workforce and occupational health management; and inadequate service provided by suppliers. This definition includes legal risk, but excludes strategic and/or business risk and reputational risk.

•Structural risk: This is divided into structural interest-rate risk (movements in market interest rates that cause changes in an entity’s net interest income and book value) and structural exchange-rate risk (exposure to variations in exchange rates originating in the Group’s foreign companies and in the provision of funds to foreign branches financed in a different currency from that of the investment).

•Liquidity risk: Risk of an entity having difficulties in duly meeting its payment commitments, or where, to meet them, it has to resort to funding under burdensome terms which may harm the Group’s image or reputation.

•Reputational risk: Considered to be the potential loss in earnings as a result of events that may negatively affect the perception of the Group’s different stakeholders.

The following table shows the total capital requirements broken down by risk type as of quarter-end from December 31, 2022 to December 31, 2023:

In 2023, risk-weighted assets have grown by approximately €27 billion, mainly in credit risk, and to a lesser extent in operational risk. In credit risk, growth is concentrated in advanced approaches.

On the other hand, the exchange rate effect led to a reduction of around €14 billion, concentrated in Turkey and Argentina.

The evolution of RWAs by type of risk is explained in more detail in the respective sections of the report.

Total risk-weighted assets are shown below, broken down by type of risk (where credit risk includes counterparty risk) as of December 31, 2023 and December 31, 2022:

3.3.2. Breakdown of minimum capital requirements by risk type

This section provides an overview of risk-weighted assets and the minimum capital requirements established by Article 92 of the CRR.

The following table is a breakdown of risk-weighted assets and capital requirements broken down by risk type and exposure categories as of December 31, 2023, September 30, 2023 and December 31, 2022:

The full series of the capital requirements and RWA by risk type, during the year 2023, is available in the editable file "Pillar 3 2023 - Tables & Annexes".

The table below shows a comparison of institutions' own funds and capital and leverage ratios with and without the application of the transitional treatment of IFRS9 impact, and with and without the application of the transitional treatment in accordance with Article 468 of the CRR, according to the standard format set by EBA guidelines (EBA/GL/2018/01).

Since 2018 BBVA Group has applied the transitional treatment of IFRS9 impact. Therefore, phased-in capital ratios and leverage ratio are calculated taking into account the transitional provisions as defined by article 473a of the CRR and its subsequent amendments made by Regulation 2020/873 of the Parliament and Council of 24 June 2020 in response to the COVID-19 pandemic. The Group also applies paragraph 7a of the aforementioned article in calculating the impact of the transitional treatment on phased-in risk-weighted assets.

In addition, the Group decided not to apply the transitional treatment of unrealised gains and losses measured at fair value through other comprehensive income (hereinafter, unrealised gains and losses measured at FVTOCI) outlined in Article 1, Paragraph 6 of the aforementioned regulation amending Article 468 of the CRR. Therefore, the Group's own funds, and its capital adequacy and leverage ratios, reflect as of December, 31, 2022 the full impact of the aforementioned unrealised gains and losses measured at FVTOCI. This transitional provision ended on 1 January 2023.

As of December 31, 2023, the transitional provisions have no impact on the ratio, so fully loaded and phased-in are the same.

The Group carries out the internal capital assessment process in accordance with the Capital Requirements Directive 2013/36/EU and guidelines on the supervisory review and evaluation process (SREP) published by the European Banking Authority. In accordance with Article 108 of the Capital Requirements Directive (2013/36/EU), the Group complies with the obligations set out in Article 73 thereof on a consolidated basis. Furthermore, the document is structured on the basis of the ECB's guidance on the internal capital adequacy assessment process (ICAAP) of November 2018.

Within the framework of the internal capital assessment process, the Group assesses and quantifies all risk that could significantly affect its capital position and draws a conclusion on the capital adequacy from a holistic medium-term perspective.

The Group applies a proportionate approach that aims to ensure the entity's survival and continued compliance with all legal and internal requirements. In addition to regulatory and accounting perspectives, the Group bases its capital adequacy position analysis on a sound internal approach in which its capital position is assessed under an economic vision, which includes quantifying capital needs for risk covered in Pillar 1 of Basel and the needs due to risk not covered by Pillar 1.

The following are some of the points assessed in the internal capital assessment process:

•Business and strategy model, describing both the changes planned by the bank in the current business model and its underlying activities such as the relationship between the business strategy and internal capital assessment process.

•Internal governance, risk management and the control framework, reviewing the processes and mechanisms that ensure that the bank has a sound and integrated framework for managing present and future material risk.

•Risk appetite framework, describing the correspondence between this framework and the bank’s business strategy and model.

•Identification and assessment of risk (including credit, operational, market, liquidity and other structural risk) and quantification of the capital necessary to cover them, with a quantitative reconciliation between the Pillar 1 and Pillar 2 approaches.

•Planning capital under baseline and stress scenarios, projecting the capital base of the Group, the parent and its main subsidiaries over the next four years and analysing capital sufficiency in accordance with the regulatory requirements and the internal objectives set out by the entity for the close of the period, also dealing with the planned capital actions.

This internal capital assessment process concludes with submission to the supervisor of an annual report on the process. The report plays a key role in the review and evaluation methodology applied by the Single Supervisory Mechanism, and is an important element for determining capital requirements under Pillar 2.

The BBVA Group has a general risk management and control model (hereinafter, the “Model”) that is appropriate for its business model, its organization, the countries where it operates and its corporate governance system. This model allows the Group to carry out its activity within the management and risk control strategy and policy defined by the corporate bodies of BBVA where sustainability is specifically considered, and the alignment to a changing economic and regulatory environment, facing this management at a global level and aligned to the circumstances at all times.

The Model, for which the Group’s Chief Risk Officer (CRO) is responsible and that must be updated or reviewed at least annually, is fully applied in the Group and it comprises the following basic elements:

–Governance and organization

–Risk Appetite Framework

–Assessment, monitoring and reporting

–Infrastructure.

The Group promotes the development of a risk culture that ensures a consistent application of the Model in the Group, and that guarantees that the risks function is understood and internalized at all levels of the organization.

4.1.1. Governance and organisation

The risk governance model in the BBVA Group is characterized by a special involvement of its corporate bodies, both in setting the risk strategy and in monitoring and supervising its implementation on an ongoing basis.

Thus, and as explained below, the corporate bodies are responsible for approving the risk strategy and the general policies for the different types of risks. Global Risk Management (hereinafter, GRM) and Regulation & Internal Control (including, among other areas, Non-Financial Risks) are the functions responsible for its implementation and development, with the appropriate reporting to corporate bodies.

Responsibility for day-to-day management of risks falls on business and corporate areas, the activities of which adhere to the general policies, regulation, infrastructures and controls that, based on the framework set by corporate bodies, are defined by GRM and Regulation & Internal Control in their corresponding areas of responsibility.

To carry out this work adequately, the financial risks function in the BBVA Group has been set up as a single, global function and independent from business areas.

The head of the financial risks function at an executive level, is the Group's Chief Risk Officer, who is appointed by the Board of Directors as a member of its senior management, and reports directly on the development of the corresponding functions to the corporate bodies. The Chief Risk Officer, for the best fulfilment of the functions, is supported by a structure consisting of cross-cutting risk units in the corporate area and specific risk units in the Group's geographical and/or business areas.

In addition, and with regard to non-financial risks and internal control, the Group has a Regulation & Internal Control area independent from the rest of units and whose head (Head of Regulation & Internal Control) is also appointed by the Board of Directors of BBVA and reports directly to corporate bodies on the performance of its functions. This area is responsible for proposing and implementing non-financial risks policies and the Internal Control Model of the Group, and it is composed by, among other, the Non-Financial Risks, Regulatory Compliance and Risk Internal Control units.

The Risk Internal Control unit, within the Regulation & Internal Control area and, therefore, independent from the financial risks function (GRM), acts as a control unit for the activities carried out by GRM. In this regard, and without prejudice to the functions performed in this regard by the Internal Audit area, Risk Internal Control checks that the regulatory framework, the models and processes and established measures are sufficient and appropriate for each type of financial risk. It also monitors its implementation and operation, and confirms that those decisions taken by GRM are taken independently from the business lines and, in particular, that there's an adequate segregation of functions between units.

Governance and organizational structure are basic pillars for ensuring an effective risk management and control. This section summarizes the roles and responsibilities of the corporate bodies in the risks area, of the Group's Chief Risk Officer and, in general, of the risks function, its interrelation and the parent-subsidiary relationship model in this area and the group of committees, in addition to the Risk Internal Control unit.

According to the corporate governance system of BBVA, the Board of Directors of the Bank has certain reserved competencies, concerning management, through the implementation of the corresponding most relevant decisions, and concerning supervision and control, through the monitoring and supervision of implemented decisions and management of the Bank.

In addition, and to ensure adequate performance of the management and supervisory functions of the Board of Directors, the corporate governance system comprises different committees supporting the Board of Directors with regard to matters falling within their competence, and according to the specific charters of each committees.

For this purpose, a coordinated work scheme between these corporate bodies has been established.

With regard to risks, the Board of Directors' competencies are those relating to establishing the policy for controlling and managing risk and the oversight and control of its implementation.

In addition, and for an adequate performance of its duties, the Board of Directors is assisted by the Risk and Compliance Committee (CRC), on the issues detailed below, and by the Executive Committee (CDP), which is focused on the strategy, finance and business functions of the Group, for the purposes of which it monitors the risks of the Group. Additionally, and in a coordinated manner with the general supervision of financial and non-financial risks carried out by the Risk and Compliance Committee, the Audit Committee and the Technology and Cybersecurity Committee also assist the Board in the management and control of non-financial risks of an accounting, tax and reporting nature, and those of a technological nature, respectively.

The involvement of the corporate bodies of BBVA in the control and management of the risks of the Group is detailed below:

The Board of Directors is responsible for establishing the risk strategy of the Group and, in this role, it determines the control and risk management policy, through the following documents:

–The Risk Appetite Framework of the Group, which includes in the one hand the risk appetite statement of the Group, that is, the general principles governing the risk strategy of the Group and its target profile; and, on the other hand, and based on the above mentioned risk appetite statement, a set of quantitative metrics (core metrics, and their corresponding statements, and by type of risk metrics), reflecting the risk profile of the Group;

–the framework of management policies of the different types of risk to which the Bank is or could be exposed. They contain the basic lines for a consistent management and control of risks throughout the Group, and consistent with the Model and Risk Appetite Framework;

–and the General risk management and control model described above.

All of the above in coordination with the rest of prospective-strategic decisions of the Bank, which includes the Strategic Plan, the Annual Budget, the Capital Plan and the Liquidity & Funding Plan, in addition

to the rest of management objectives, whose approval is a responsibility of the Board of Directors.

In addition to defining the risk strategy, the Board of Directors, in the performance of its risks monitoring, management and control tasks, also monitors the evolution of the risks of the Group and of each main geographical and/or business area, ensuring compliance with the Risk Appetite Framework of the Group; and also supervising the internal information and control systems.

For the development of all these functions, the Board of Directors is supported by the CRC and the CDP, which are responsible for the functions detailed below.

The CRC is, according to its own charter, composed of non-executive directors and its main purpose is to assist the Board of Directors on the establishment and monitoring of the risk control and management policy of the Group.

For this purpose, it assists the Board of Directors in a variety of risk control and monitoring areas, in addition to its analysis functions, based on the strategic pillars established at all times by both the Board of Directors and the CDP, the proposals on the strategy, control and risk management of the Group, which are particularly specified in the Risk Appetite Framework and in the “Model”. After the analysis, the Risk Appetite Framework and Model proposal is submitted to the Board of Directors for consideration and, where appropriate, approval purposes.

In addition, the CRC proposes, in a manner consistent with the Risk Appetite Framework of the Group approved by the Board of Directors, the control and management policies of the different risks of the Group, and supervises the information and internal control systems.

With regard to the monitoring of the evolution of the risks of the Group and their degree of compliance with the Risk Appetite Framework and defined general policies, and without prejudice to the monitoring task carried out by the Board of Directors and the CDP, the CRC carries out monitoring and control tasks with greater frequency and receives information with a sufficient granularity to achieve an adequate performance of its duties.

The CRC also analyzes all measures planned to mitigate the impact of all identified risks, should they materialize, which must be implemented by the CDP or the Board of Directors, as the case may be.

The CRC also monitors the procedures, tools and measurement indicators of those risks established at a Group level in order to have a comprehensive view of the risks of BBVA and its Group, and monitors compliance with the regulation and supervisory requirements in terms of risks.

The CRC is also responsible for analyzing those project-related risks that are considered strategic for the Group or corporate transactions that are going to be submitted to the Board of Directors of the CDP, within its scope of competence.

In addition, it contributes to the setting of the remuneration policy, checking that it is compatible with an appropriate and effective management of risks and that it does not provide incentives to take risks breaching the level tolerated by the Bank.

Lastly, the CRC ensures the promotion of the risk culture in the Group.

In 2023, the CRC has held 22 meetings.

In order to have a comprehensive and complete vision of the progress of the Group's business and its business units, the CDP monitors the evolution of the risk profile and the core metrics defined by the Board of Directors, being aware of any potential deviation or breach of the metrics of the Risk Appetite Framework and implementing, when applicable, the appropriate measures, as explained in the Model.

In addition, the CDP is responsible for proposing the basis for developing the Risk Appetite Framework, which will be established in coordination with the rest of prospective/strategic decisions of the Bank and the rest of management objectives.

Lastly, the CDP is the committee supporting the Board of Directors in decisions related to business risk and reputational risk, according to the dispositions set out in its own charter.

In accordance with the provisions of the BBVA Group's General Corporate Governance Policy, for integrated management and supervision in the Group, the Group has a common management and control framework, consisting of basic guidelines (including strategic-prospective decisions) and General Policies, established by BBVA's corporate bodies for the Group.

For the purpose of transferring the risk strategy and its management and control model to the different subsidiaries of the BBVA Group and their corresponding specific risk units, a parent-subsidiary relationship model has been designed within the scope of risk management and control in the BBVA Group.

This relationship model implies a minimum catalog of decisions that must be adopted by the corporate bodies of the subsidiaries in terms of risks in order to provide them with an adequate governance model coordinated with the parent company. It will be the responsibility of the head of the Risk function (GRM) of each subsidiary to formulate the proposals that proceed to the

corresponding corporate body for its consideration and, where appropriate, approval, according to the scope of functions that apply.

The approval of these decisions by the corporate bodies of the subsidiaries obliges the risk units of the geographical areas to carry out a risk monitoring and control plan before their corporate bodies.

Notwithstanding the foregoing, it is considered necessary that certain decisions regarding risks reserved for the consideration of the corresponding corporate bodies of the subsidiary for their approval, are also subject to the approval of the corporate bodies of BBVA, in accordance with what is established regulations at all times.

In the specific case of BBVA, S.A., what is described in this document regarding the coordination of the local risk management function with the risk function of the parent company BBVA, S.A. is applicable (as in any subsidiary of the Group). And with regard to the decisions that the corporate bodies of the subsidiaries must adopt, in this case it is the responsibility of the head of the Risk function of BBVA, S.A. (GRM) formulate the proposals that proceed to the corresponding corporate body for its consideration and, where appropriate, approval, according to the scope of functions that apply.

The Group's Chief Risk Officer (CRO) is responsible for the management of all the financial risks of the Group with the necessary independence, authority, rank, experience, knowledge and resources. The CRO is appointed by the Board of Directors of BBVA and has direct access to its corporate bodies (Board of Directors, CDP and CRC), with the corresponding regular reporting on the risk situation in the Group.

The GRM area has a responsibility as the unit transversal to all the businesses of the BBVA Group. This responsibility is part of the structure of the BBVA Group, which is formed by subsidiaries based in different jurisdictions, which have autonomy and must comply with their local regulations, but always according to the risk management and control scheme designed by BBVA as the parent company of the BBVA Group.

The Chief Risk Officer of the BBVA Group is responsible for ensuring that the risks of BBVA Group, within the scope of its functions, are managed according to the established model, assuming, among other, the following responsibilities:

–Prepare, in coordination with the rest of areas responsible for risks monitoring and control, and propose to corporate bodies the risk strategy of the BBVA Group, which includes the Risk Appetite statement of the BBVA Group, core (and their respective statements) and by type of risk metrics, and the Model.

–Ensure the necessary coordination to define and prepare the proposals for the Appetite Framework of the Group companies, and make sure they are applied correctly.

–Define, in coordination with the rest of areas responsible for risks monitoring and control, and propose to corporate bodies the general policies for each type of risk within its scope of responsibility and, as part these, to establish the required specific regulation.

–Prepare, in coordination with the rest of areas responsible for risks monitoring and control, and propose for approval, or approving if within its competence, the risk limits for the geographical areas, business areas and/or legal entities, which shall be consistent with the defined Risk Appetite Framework; it is also responsible for the monitoring, supervision and control of risk limits within its scope of responsibility.

–Submit to the Risk and Compliance Committee the information required to carry out its supervisory and control functions.

–Regular reporting to the corresponding corporate bodies on the situation of those risks of the BBVA Group within its scope of responsibility.

–Identify and assess the material risks faced by the BBVA Group within its scope of responsibility, with an effective management of those risks and, where necessary, with the implementation of the required mitigation measures.

–Early warning to the relevant corporate bodies and the Chief Executive Officer of any material risk within its scope of responsibility that could compromise the solvency of the BBVA Group.

–Ensure, within its scope of responsibility, the integrity of measurement techniques and management information systems and, in general, the provision of models, tools, systems, structures and resources to implement the risk strategy defined by the corporate bodies.

–Promote the risk culture of the BBVA Group to ensure the consistency of the Model in the different countries where it operates, strengthening the cross-cutting model of the risks function.

For decision-making, the Group’s Chief Risk Officer has a governance structure for the role that culminates in a support forum, the Global Risk Management Committee (GRMC), which is established as the main executive-level committee on the risks within its remit. Its purpose is to develop the strategies, policies, regulations and infrastructures needed to identify, assess, measure and manage the material risks within its remit that the Group faces in its business activity. This committee is composed by the Chief Risk Officer, who chairs the

meetings, and the heads of Core Services and Cross Services in the Corporate Area of GRM, of the Front for “South America and Turkey”, and “Risk Internal Control”; and by the heads of GRM in the three most important geographical units and in CIB. The purpose of the GRMC is to propose and challenge, among other issues, the internal regulatory framework of GRM and the infrastructures required to identify, assess, measure and manage the risks faced by the Group in carrying out its businesses and to approve risk limits.

The GRMC carries out its functions assisted by various support committees which include:

–Global Credit Risk Management Committee: It is responsible for analyzing and decision-making related to wholesale credit risk admission.

–Wholesale Credit Risk Management Committee: It is responsible for analyzing and making decisions related to wholesale credit risk admission in specific customer segments of BBVA Group, as well as being informed of the relevant decisions adopted by members of the committee within their scope of decision-making at corporate level.

–Work Out Committee: Its purpose is to analyze and make decisions regarding the admission of wholesale credit risks of customers classified in Watch List, doubtful risk or write-offs in accordance with the criteria established in the Group, as well as to be informed of the decisions adopted by the person in charge of the Work Out process in its area of responsibility; it will also include the approval of proposals on entries, exits and modifications in Watch List, entries and exits in doubtful, unlikely to pay and pass to write-offs; as well as the approval of other proposals that must be seen in this Committee according to the established thresholds and criteria.

–Global Portfolio Management Committee: The executive authority responsible for managing the limits by asset class for credit risk, equities and real estate not for own use, structural risks, insurance and pension risk and asset management; and by business area and at group level established in the risk limits planning exercise, which aims to achieve an optimal combination and composition of portfolios under the restrictions imposed by the Risk Appetite Framework, which allows maximizing the risk- adjusted return on regulatory and economic capital when appropriate. Additionally, it takes into account the concentration and asset quality objectives of the portfolio, as well as the prospects and strategic needs of the BBVA Group.

–Risk Models Management Committee: It ensures an appropriate decision-making process regarding the planning, development, implementation, use, validation and monitoring of the models required to achieve an appropriate management of the Model Risk in the BBVA Group.

–Global Market and Counterparty Risk Committee: its purpose is to formalize, supervise and communicate the trading risk monitoring in all Global Markets business units, as well as coordinating and approving the key decisions of the Market and Counterparty Risk activity. It is also responsible for the analysis and decision making (opinion on the risk profile of the proposal, the mitigants and the risk-return ratio) with respect to the most relevant transactions in the different geographies in which Global Markets is present.

–Retail Credit Risk Committee: it ensures for the analysis, discussion and decision support on all issues regarding the retail credit risk management that impact or potentially do in the practices, processes and corporate metrics established in the General Policies, Rules and Operating Frameworks.

Also:

–GRM Continuity Committee: this committee operates under the provisions of the Corporate Continuity Committee for the different Areas. Its purpose is to analyze and make decisions about exceptional crisis situations, with the aim of managing continuity and the restoration of critical GRM processes, minimizing the impact of its operations through the Continuity Plan, which covers crisis management and Recovery Plans.

–The Corporate Committee for Admission of Operational Risk and Product Governance (CCAROyGP) aims to ensure the adequate evaluation of initiatives with significant risk (new business, product, outsourcing, process transformation, new systems, etc.) from the perspective of operational risk and approval of the proposed control environment.

The risks function is comprised of risk units from the corporate area, which carry out cross-cutting functions, and of risk units of the geographical/business areas.

–The risk units of the corporate area develop and submit to the Group's Chief Risk Officer the different elements required to define the proposal for the Group's Risk Appetite Framework, the general policies, the regulation and global infrastructures within the operating framework approved by corporate bodies; they ensure their application and report directly or through the Group's Chief Risk Officer to the corporate bodies of BBVA. With regard to non-financial risks and reputational risk, which are

entrusted to the Regulation & Internal Control and Communications areas respectively, the corporate units of GRM will coordinate, with the corresponding corporate units of those areas, the development of the elements that should be integrated into the Appetite Framework of the Group.

–The risk units of the business and/or geographical areas develop and submit to the Chief Risk Officer of the geographical and/or business areas the Risk Appetite Framework proposal applicable in each geographical and/or business area, independently and always according to the Group's Risk Appetite Framework. In addition, they ensure the application of general policies and the rest of the internal regulations, with the necessary adaptations, when applicable, to local requirements, providing the appropriate infrastructures for risk management and control purposes, within the global risk infrastructure framework defined by the corporate areas, and reporting to the corresponding corporate bodies and senior management, as applicable. With regard to Non-financial risks, which are integrated in the Regulation & Internal Control area, the local risk units will coordinate, with the unit responsible for those risks, the development of the elements that should be integrated into the local Risk Appetite Framework.

Thus, the local risk units work with the risk units of the corporate area with the aim of adapting themselves to the risk strategy at Group level and pooling all the information required to monitor the evolution of their risks.

As previously mentioned, the risks function has a decision-making process supported by a structure of committees, and also a top-level committee, the GRMC, whose composition and functions are described in the section "Chief Risk Officer of the Group."

Each geographical and/or business area has its own risk management committee(s), with objectives and contents similar to those of the corporate area. These committees perform their duties consistently and in line with general risk policies and corporate rules, and its decisions are reflected in the corresponding minutes.

Under this organizational scheme, the risks function ensures the integration and application throughout the Group of the risk strategy, the regulatory framework, the infrastructures and standardized risk controls. It also benefits from the knowledge and proximity to customers in each geographical and/or business area, and conveys the corporate risk culture to the Group's different levels. Moreover, this organization enables the risks function to conduct and report to the corporate bodies an integrated monitoring and control of the risks of the entire Group.

The risks function is cross-cutting, i.e. it is present in all of the Group's geographical and/or business areas through specific risk units. Each of these units is headed by a Chief Risk Officer for the geographical and/or business area who, within the relevant scope of responsibility, carries out risk management and control functions and is responsible for applying the Model, the general policies and corporate rules approved at Group level in a consistent manner, adapting them if necessary to local requirements and with the subsequent reporting to local corporate bodies.

The Chief Risk Officers of the geographical and/or business areas have functional reporting to the Group's Chief Risk Officer and hierarchical reporting to the head of their geographical and/or business area. This dual reporting system aims to ensure the independence of the local risks function from the operational functions and enable its alignment with the Group's general policies and goals related to risks.

The Group has a specific Risk Internal Control unit, within the Regulation & Internal Control area, that, among other tasks, independently challenges and control the regulation and governance structure in terms of financial risks and its implementation and deployment in GRM, in addition to the challenge of the development and implementation of financial risks control and management processes. It is also responsible for the validation of risk models.

For this purpose, it has 3 subunits: RIC-Processes, Risks Technical Secretariat and Risk Internal Validation.

–RIC-Processes. It is responsible for challenging an appropriate development of the functions of GRM units, and for reviewing that the functioning of financial risk management and control processes is appropriate and in line with the corresponding regulation, identifying potential opportunities for improvement and contributing to the design of the action plans to be implemented by the responsible units. In addition, it is the Risk Control Specialist (RCS) in the Group's Internal Control Model and, therefore, establishes the general mitigation and control frameworks for its risk area and contrasts them with those actually implemented.

–Risks Technical Secretariat. It is responsible for the definition, design and management of the principles, policies, criteria and processes through which the regulatory risk framework is developed, processed, reported and disclosed to the countries; and for the coordination, monitoring and assessment of its consistency and completeness. In addition, it coordinates the definition and structure of the most relevant GRM Committees, and monitors their proper functioning, in order to ensure that all risk

decisions are taken through an adequate governance and structure, ensuring their traceability. It also provides to the CRC the technical support required in terms of financial risks for a better performance of its functions.

–Risk Internal Validation. It is responsible for validating the risks models. In this regard, it effectively challenges the relevant models used to manage and control the risks faced by the Group, as an independent third party from those developing or using the models in order to ensure its accuracy, robustness and stability. This review process is not restricted to the approval process, or to the introduction of changes in the models; it is a plan to make a regular assessment of those models, with the subsequent issue of recommendations and actions to mitigate identified weaknesses.

The Head of Risk Internal Control of the Group is responsible for the function and reports about his activities and work plans to the Head of Regulation & Internal Control and to the CRC, with the corresponding support in the issues required, and, in particular, challenging that GRM's reports submitted to the Committee are aligned with the criteria established at the time.

In addition, the risk internal control function is global and transversal, it includes all types of financial risks and has specific units in all geographical and/or business areas, with functional reporting to the Head of Risk Internal Control of the Group.

The Risk Internal Control function must ensure compliance with the general risks strategy defined by the Board of Directors, with adequate proportionality and continuity. In order to comply with the control activity within its scope. Risk Internal Control is member of GRM's top-level committees (sometimes even assuming the Secretariat role), independently verifying the decisions that may be taken and, specifically, the decisions related to the definition and application of internal GRM regulation.

Furthermore, the control activity is developed within a homogeneous methodological framework at a Group level, covering the entire life cycle of financial risk management and carried out under a critical and analytical approach.

The Risk Internal Control team reports the results of its control function to the corresponding heads and teams, promoting the implementation of corrective measures and submitting these assessments and the resolution commitments in a transparent manner to the established levels.

Lastly, and notwithstanding the control responsibility that GRM teams have in the first instance, Risk Internal Control teams promote a control culture in GRM, conveying the importance of having robust processes.