Popular (BPOP) Risk Analysis

In addition to the other information set forth in this report, you should carefully consider the risk factors discussed under “Part I - Item 1A - Risk Factors" in our 2025 Form 10-K. These factors could materially adversely affect our business, financial condition, liquidity, results of operations and capital position, and could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in this report. Also refer to the discussion in “Part I -

significant penalties and collateral consequences, and could result in higher compliance costs or restrictions on our

products and services in a timely and cost-effective manner, placing us at a competitive disadvantage and significantly

Deterioration in the values of real properties securing our commercial, mortgage loan and construction portfolios have in

If we are unable to meet constant technological changes and react quickly to meet new industry standards, including as a

cyber-attacks could cause substantial harm and have an adverse effect on our business and results of operations. Cybersecurity risks for large financial institutions such as Popular have increased significantly in recent years in part because of the proliferation of new technologies, such as mobile banking, cloud hosting, artificial intelligence and the ability to conduct instant financial transactions anywhere globally, as well as due to geopolitical conflicts and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, hacktivists and other parties. Cybersecurity threats are constantly evolving, especially given the advances in, and the rise of the use of, artificial intelligence and quantum computing, thereby increasing the difficulty of preventing, detecting and successfully defending against them. In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to transmit and store sensitive data. Notwithstanding our defensive measures and the significant resources we devote to protecting the security of our systems, there is no assurance that all of our security measures will be effective at all times,especially as the threats from cyber-attacks are continuous and severe. The risk of a security breach due to a cyber-attack is expected to increase as we continue to expand our digital capabilities, mobile banking and other internet-based product offerings,the use of the cloud for system development and hosting and internal use of internet-based products and applications. We continue to detect and identify attacks that are becoming more sophisticated and increasing in volume, as well as attackers that respond rapidly to changes in defensive countermeasures. The most significant cyber-attack risks that we or our critical service providers may face include, but are not limited to, e-fraud, denial-of-service (DDoS), ransomware, computer intrusion and the exploitation of software zero-day vulnerabilities that might result in disruption of services, in the exposure or loss of customer or proprietary data, and significant financial loss. These types of cyber-attacks have in the past resulted and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security numbers, and could present significant reputational, legal and regulatory costs to Popular if successful. Our customer-facing platforms are also routinely targeted by threat actors aiming to gain unauthorized access to our clients' accounts. Although we have implemented defensive measures designed to protect against such attacks, there is no assurance that these defensive measures will keep pace with threats that are continuous and growing in severity. For example, in 2022, certain customers were affected by brute force attacks on one of our platforms, which resulted in certain of our customers log-in credentials and information being exposed, resulting in fraudulent transfers or withdrawals. Popular customers have also been impacted by card skimming events in our ATM terminals. As a result, we have notified, and conducted additional remediation for,customers identified as affected by these incidents. Cyber-security risks have also been exacerbated by the discovery of zero-day vulnerabilities in widely distributed third party software, which have in the past affected and in the future could affect Popular's or any of its service provider's systems, as further detailed below. The increased use of remote access and third-party video conferencing solutions to enable work-from-home arrangements for employees has also increased our exposure to cyber-attacks, including through the use of deep fakes and brand impersonation. We expect the rise and use of artificial intelligence to exacerbate this risk. In addition, a third party could misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by Popular's customers or employees. Recent geopolitical conflicts have also exacerbated the risks related to supply-chain compromises and de-stabilizing activities of nation-state sponsored actors. A material compromise or circumvention of the security of our systems could have serious negative consequences for us,including significant disruption of our operations and those of our clients, customers and counterparties, misappropriation of confidential information of Popular or that of our clients, customers, counterparties or employees, or damage to computers or systems used by us or by our clients, customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, increased regulatory scrutiny and enforcement actions, customer dissatisfaction,significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us. Banking regulators increasingly scrutinize third-party relationships supporting critical activities. If our regulators determine that our oversight, contractual protections, or the performance and controls of our third-party providers (including critical providers) are inadequate, we could be required to implement enhanced controls, conduct independent reviews, restrict or terminate relationships, or undertake costly remediation or conversion activities, any of which could disrupt operations, increase expenses, or adversely affect our reputation and results of operations. The extent of a particular cyber-attack and the steps that we may need to take to investigate the attack may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an investigation is ongoing, Popular may not necessarily know the full extent of the harm caused by the cyber-attack, and that damage may continue to spread. These factors may inhibit our ability to provide rapid, full and reliable information about the cyber-attack to our clients, customers, counterparties and regulators, as well as the public. Moreover, we may be required under SEC rules or bank regulations to disclose information about a cybersecurity event before it has been resolved or fully investigated. Furthermore, it may not be clear how best to contain and remediate the potential harm caused by the cyber-attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Cyber-attacks could also cause interruptions in our operations and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel. We also rely on third parties for the performance of a significant portion of our information technology functions and the provision of information security, technology and business process services. As a result, a successful compromise or circumvention of the security of the systems of these third-party service providers could have serious negative consequences for us, including compromise of our systems, misappropriation of our confidential information or that of our clients, customers, counterparties or employees, or other negative implications identified above with respect to a cyber-attack on our systems. The most important of these third-party service providers for us is Evertec. As a result, we depend on Evertec to identify and remediate certain of our cybersecurity vulnerabilities. Cyber-attacks at third-party service providers are also becoming increasingly common, and, as a result,cybersecurity risks relating to our vendors, including Evertec have increased. Certain risks particular to Evertec and our dependence on third parties are discussed under "We rely on other companies to provide key components of our business infrastructure,including certain of our core financial transaction processing and information technology and security services, which exposes us to a number of operational risks that could have a material adverse effect on us" in the Operational Risks section of Item 1A in this Form 10-K. During 2023, personal information of Popular customers' data was compromised in a data breach incident that impacted MOVEit, the third-party file transfer platform used by one of our service providers. Popular notified, as required or otherwise deemed appropriate, customers identified as affected by the incident. Furthermore, during 2024, threat actors exploited a zero-day vulnerability in the Fortinet enterprise management server software used by Evertec, which migrated to one of Popular's domain controllers due to a shared network environment. While Evertec eventually determined that no BPPR customer information was exfiltrated as a result of this incident, the event underscores the risks inherent in Popular's dependency on Evertec. Although these incidents did not have a material effect on Popular, including its business strategy, results of operations or financial condition, and our third-party service providers agreed to cover external remediation costs associated therewith, a compromise of Popular information or the personal information of our customers maintained by third party vendors could result in significant regulatory consequences, reputational damage and financial loss to us. The success of our business depends in part on the continuing ability of these (and other) third parties to perform these functions and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties or at the third parties' suppliers or vendors (so-called "fourth party risk"). We may not be able to effectively directly monitor or mitigate fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform functions and services for us. As cyber threats continue to evolve, we also expect to expend significant additional resources to continue to modify or enhance our layers of defense or to investigate and remediate additional information security vulnerabilities or incidents. The obsolescence in our hardware or software limits our ability to mitigate vulnerabilities. System enhancements and updates also create risks associated with implementing new systems and integrating them with existing ones, including risks associated with supply chain compromises and the software development lifecycle of the systems used by us and our service providers. In addition,addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Moreover, our efforts to timely mitigate vulnerabilities and manage such risks, given the rise in number and urgency of required patches and third-party software, as well as the obsolescence in some of our hardware and software, may impact our day-to-day operations, the availability of our systems and delay the deployment of technology enhancements and innovation. If Popular's operational systems, or those of external parties on which Popular's businesses depend, are unable to meet the requirements of our businesses and operations or the standards of our regulators or other applicable data protection and privacy laws, or if they fail, have other significant shortcomings or are impacted by cyber-attacks, Popular could be materially and adversely affected.

The transition to new financial services technology providers, and the replacement of services currently provided to us by

financial condition will be adversely affected. Under regulatory capital adequacy requirements, and other regulatory requirements, Popular and our banking subsidiaries must meet requirements that include quantitative measures of assets, liabilities and certain off-balance sheet items, subject to qualitative judgments by regulators regarding components, risk weightings and other factors. If we fail to meet these minimum capital requirements and other regulatory requirements, our business and financial condition will be materially and adversely affected. If a financial holding company fails to maintain well-capitalized status under the regulatory framework, or is deemed not well managed under regulatory exam procedures, or if it experiences certain regulatory violations, its status as a financial holding company and its related eligibility for a streamlined review process for acquisition proposals, and its ability to offer certain financial products, may be compromised and its financial condition and results of operations could be adversely affected. The failure of any depository institution subsidiary of a financial holding company to maintain well-capitalized or well-managed status could have similar consequences. See "Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our business and operations" in the Legal and Regulatory Risks section of Item 1A in this Form 10-K.

acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other

the adoption of new technologies such as artificial intelligence which may put us at a competitive disadvantage. We operate in a highly competitive environment, in which we compete on the basis of a number of factors, including customer service, quality and variety of products and services, price, interest rates on loans and deposits, innovation, technology,ease of use, reputation, and transaction execution. While our main competition continues to come from other Puerto Rico banks and financial institutions, we face increased competition from non-Puerto Rico institutions, as emerging technologies and the growth of e-commerce have significantly reduced geographic barriers. These technologies have also made it easier for non-depositary institutions to offer products and services that were traditionally considered banking products and allowed non-traditional financial service providers and technology companies to provide electronic and internet-based financial solutions and services. In addition,nonbank firms may have a competitive advantage over traditional banks and bank holding companies such as Popular due to factors such as differences in regulation, funding models and tax treatment. We may also be unable to adopt or integrate new technologies that could reduce expenses and simplify our operations, including artificial intelligence, automation and algorithmic tools, at the pace of such competitors due to operational and compliance challenges and risks relating to data quality, internal controls, privacy and consumer protection, among others. Our failure to successfully adopt and integrate these new technologies in a timely and effective manner may impair our ability to compete effectively or to attract or retain business. Moreover, increased competition could create pressure to lower prices, fees, commissions or credit standards on our products and services, which could adversely affect our financial condition and results of operations. Increased competition could also create pressure to raise interest rates on deposits or increase deposit attrition, which could negatively impact our business, financial condition, liquidity results of operations or capital position.

or type of client. Our credit risk and credit losses can increase to the extent our loans are concentrated in borrowers engaged in the same or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by certain economic or market conditions. We have significant exposure to borrowers in certain economic sectors, such as residential and commercial real estate,hospitality and healthcare. Challenging economic or market conditions that affect the industries or types of clients to which we have significant exposure could result in higher credit losses and adversely affect our business, financial condition, liquidity, results of operations or capital position. We also have direct lending and investment exposure to Puerto Rico government entities, which have faced significant fiscal challenges. At December 31, 2025, our exposure to the Puerto Rico government consisted of $391 million in direct lending exposure to Puerto Rico municipalities and $209 million in loans insured or securities issued by Puerto Rico governmental entities but for which the principal source of repayment is non-governmental. We also have indirect lending exposure to the Puerto Rico government in the form of loans to private borrowers who are service providers, lessors, suppliers or have other relationships with the Puerto Rico government. While the overall fiscal situation of the Puerto Rico government has improved in recent years, including as a result of the government and certain of its instrumentalities having restructured their debt obligations, some Puerto Rico government entities, including certain municipalities, still face significant fiscal challenges. A deterioration in the fiscal situation of the Puerto Rico government and its instrumentalities, and in particular the fiscal situation of the Puerto Rico municipalities to which we have direct lending exposure, could result in higher credit losses and reserves for credit losses. For a discussion of risks related to the Corporation's credit exposure to the Puerto Rico and USVI governments, see the Geographic and Government Risk section in the MD&A section of this Form 10-K.