Due Diligence BBVA

Colombia has a due diligence process that covers different areas such as:

a) General Procurement Policies: We require our suppliers to comply with regulations such as:

• Dignified and adequate hiring of personnel.
• Respect for fundamental rights.
• Compliance with labor laws.
• Recognition of labor rights.
• Issues related to occupational health.
  

b) Internal regulations on the matter:

•  Supply Management: This procedure regulates the acquisition of goods and services, guided by the Local Standard for the Acquisition of Goods and Contracting of Services, to meet internal needs and achieve the entity's objectives.

Key aspects in the execution of the procedure:

•  Occupational Health and Safety Annexes (SGSST): The Procurement Associate II is responsible for including these annexes during negotiation and formalization, according to the requirements of the user area and as established in the contractors and suppliers program (available on the legal services SITE).
• Other contractual annexes: The user area must define additional annexes (e.g., confidentiality, security) when submitting the request, based on the technical specification. The Procurement Associate II guarantees their inclusion in the negotiation and formalization.

Commitment to BBVA's Code of Conduct:
BBVA's code of conduct is based on the following principles:

• Non-discrimination and financial inclusion: It seeks to avoid unjustified discrimination in access to products and services for clients, promoting policies that promote financial inclusion and financial education.

• Respect for people: Respect is demanded and promoted in the workplace, prohibiting discrimination based on any unjustified condition or circumstance (gender, race, age, etc.) for both employees and supplier personnel. Any form of harassment (sexual, labor, personal) and behaviors that generate an intimidating or offensive work environment are considered inadmissible.

• Respect for human rights: BBVA acts respecting the dignity and inherent rights of all people, in line with its General Sustainability Policy, the UN Guiding Principles on Business and Human Rights, the Universal Declaration of Human Rights and the ILO Conventions. These principles are integrated into the relationship with suppliers, ensuring transparency, compliance with labor and environmental requirements, and promotion of socially responsible products and services. BBVA is committed to ensuring compliance with all applicable laws and respect for internationally recognized human rights in all its interactions.
  

Occupational Health and Safety (OHS) Audit for BBVA Contractors:
Based on the OHS Standard and the Contractors and Suppliers Program, the OHS Management System carries out the following actions:

• Controls to suppliers on health issues: Implementation of a control procedure to ensure compliance with occupational health and safety regulations. This includes review of internal policies, verification of certifications, hazard matrices, audits of occupational risk management and demand for ARL certification on compliance with the SG-SST.
• List of audited suppliers: In 2024, occupational health and safety audits were carried out on suppliers AINECOL, DOMESA, HONOR & LAUREL and ELITE.
• Annual schedule: Supplier control activities are integrated into the Health and Safety Management Plan at Work. Two semi-annual reviews are scheduled with randomly selected suppliers, prioritizing those with higher risk.
  

Additional policies and regulations:
General Corporate Social Responsibility Policy:

Establishes respect for the dignity of people and their rights, adhering to national and international commitments such as the International Bill of Human Rights and the United Nations Global Compact.
 

"Labor Coexistence Committee Standard" of BBVA Colombia S.A.:

Establishes guidelines for processing labor harassment complaints, regulating the Labor Coexistence Committee (Law 1010/2006). There is an independent channel for sexual harassment. It includes campaigns and corrective measures. The Committee, with four representatives of employees and four of the company (two-year period), meets quarterly or when necessary, deciding by simple majority. The complaint procedure includes admission, transfer to the alleged aggressor, conciliation hearing, evaluation of evidence and closure in six to eight months. Confidentiality, responsibilities and indefinite validity of the standard are emphasized, with communication channels and a glossary.

"Standard for the attention and prevention of sexual harassment in BBVA Colombia":

The policy seeks a workplace free of sexual harassment, protecting all BBVA Colombia employees. It is based on the Constitution and laws such as 2365 of 2024, regulating sexual harassment in the workplace. Investigations can be external or internal (through reportesacososexual-col@bbva.com), detailing the complaint and investigation procedure by the Committee.

Commitment to labor practices
BBVA Colombia COLLECTIVE AGREEMENT 2024-2026:
Key Benefits for Non-Unionized Employees Valid from 01/01/2024 to 12/31/2026, automatically renewable.

Salary Aspects:

• 2024: 13% increase for Drivers, Assistants, Integral Advisors.
• 2025: CPI + 2.3% for the same positions.
• 2026: CPI + 2.5% for the same positions.
• Other positions: According to internal salary policy.  

Featured Benefits:

• - Disabilities: BBVA covers 100% of salary.
• - Night Surcharge: 40% on basic salary.
• - Aid (Transport, Food, Dinner and Night Transport): Annual increase (2025: legal/CPI + 2.3%; 2026: legal/CPI + 2.5%).
• - Educational Aid: For children (annual), and higher for children with special conditions (e.g., Down Syndrome, Autism).
• - Death Benefit: Covers parents, siblings, spouse/partner and children.
• - Optical Aid: For frames and lenses; aid for refractive surgeries ($2,743,000).
• - Maternity Aid: $1,189,804 (2024) and an additional daily hour of breastfeeding leave.
• - Seniority Bonus: Days of salary according to years of service.
• - Extra-legal Bonus: Four basic monthly salaries per year (June and December).
• - Retirement and Disability Bonus: $2,347,246 upon retirement due to pension.
• - Vacation Bonus: Equivalent to 23 days of basic salary (2024 cap: $2,845,444).
• - Teller Incentive: Monthly payment for Customer Service Window Assistants and Integral Advisors without discrepancies.
  
  

Special Permits:

- Bereavement: 6-7 business days.
- Domestic Calamity: Up to 4 paid days.
- Extra-legal Maternity Leave: 10 additional calendar days.
- Paternity Leave: 10 additional calendar days.

Insurance:
- Life: $53,000,000.
- Personal Risks: $55,000,000 (for value transport or pensioners due to disability from professional risks).
- Optional Health Plan: BBVA covers up to 85% of the premium (2025 cap: CPI + 2.3% on 2024 cap value).

Loans with Preferential Conditions:
- Studies: Undergraduate, Postgraduate (70% annual value, max. $10,012,000), MOOCs; interest-free and condonable.
- Domestic Calamity: 3% annual interest.
- Housing: 1st, 2nd and 3rd loan with adjusted annual amounts (e.g., 2025: 1st $172,000,000, 2nd and 3rd $146,000,000). Preferential rates; the first credit includes 10% aid for expenses.
 

Working Hours and Well-being:

• - 40 hours per week, 8 hours per day (cities with five-day work week).
• - One hour daily for lunch during continuous workday.
• - Promotes work-life balance and personal/professional life balance.
   

Procedures and Governance:

• - Disciplinary Process: Guarantees due process and defense.
• - Collective Agreement Committee: Quarterly meetings for benefit review and management.

Standard for work-life balance BBVA Colombia's standard for work-life balance establishes clear guidelines to guarantee work disconnection and respect for employees' rest times, seeking to promote well-being, health and productivity. It is applicable to all employees, including those in management and trusted positions (with specific exceptions), and prohibits work communications outside working hours, except in cases of force majeure.The standard also details situations that are not considered a violation of the right and the channels for filing complaints, with non-compliance potentially constituting workplace harassment.

BBVA Colombia's Commitment to Breastfeeding Initiatives and Benefits

BBVA Colombia, through its "Familias BBVA" program, actively promotes breastfeeding among its female employees, in line with the World Health Organization's recommendations for the well-being of mothers and babies.

1- "Love that Feeds" Program: A 54-minute online course, available on the BBVA Campus, divided into three modules. It addresses breastfeeding techniques, milk expression and supply, warning signs and complementary feeding. It has received positive evaluations for its informative content.

2- Labor Relations & Health Initiatives: Within the "Familias BBVA" program, several actions stand out:

• - Breastfeeding Kit: A kit is provided with elements that facilitate the transport and conservation of milk (30 kits delivered nationwide in 2024).
• - Personalized Accompaniment: Individual monitoring is carried out for each pregnant mother to ensure optimal working conditions.
• - Preventive Information: Pregnant employees are sent ergonomic and physical recommendations. Friendly Breastfeeding Room: The certification of this room is maintained, guaranteeing an adequate space for breastfeeding.

At BBVA, we consider the promotion of occupational safety and health fundamental, being a primary pillar and a basic objective that we seek to achieve through the continuous improvement of working conditions.

To this end, we have a Standard for Occupational Safety and Health and Prevention of Tobacco, Alcohol, and Psychoactive Substance Consumption. This standard aims to reflect our organizational model in terms of occupational risk prevention and to establish the functions of the Prevention Service. In addition to having the approval of the executive director.

This service provides advice and support to the company in relation to existing risks, covering aspects such as:

• Protect the safety and health of workers through the continuous improvement of the SGSST.
• Comply with current Colombian legislation on Occupational Safety and Health.
• Allocate technical, financial, and human resources for the SGSST.
• Promote worker participation in risk prevention training and healthy habits.
• Contribute to worker safety by controlling risks.
• Assign Occupational Safety and Health responsibilities throughout the organization for a healthy work environment.

During 2024, the process of nomination, selection, and definition of the members of the Joint Committee on Safety and Health at Work was carried out, who will represent employees for the 2024-2026 period.
Additionally, there is mandatory legal training that is presented with a more agile and personalized approach. Beyond being a requirement, this training is a key opportunity to strengthen employees' knowledge, protect the company's customers, and consolidate trust through its Radical Customer Perspective.
To promote continuous improvement, the bank conducts occupational health and safety risk and hazard assessments to identify potential causes of harm in the workplace, as well as procedures to investigate injuries, occupational diseases, illnesses, and work-related incidents. Likewise, it establishes specific health surveillance protocols as well as preventive health campaigns with the aim of preserving and caring for the health of its workers. BBVA prioritizes and integrates action and monitoring plans to address these risks, for example, plans to reduce accidents in Spain. These plans respond to eventual emergency situations, such as evaluation drills and local communications.

In order to ensure the effectiveness of management systems, the entity conducts internal inspections in the branches and offices of Banco BBVA Colombia.

Staff selection and attraction policy

Policy available in spanish. Review it here

BBVA Colombia's General Information Security and Cybersecurity Policy

The Policy, updated on May 22, 2025, protects the information and assets of the BBVA conglomerate in Colombia. It seeks to mitigate risks, guaranteeing the integrity, onfidentiality, availability, and authenticity of data, aligning with the EBA and Colombian regulations. Its pillars include integrity, prudence in risk management, a profitable and sustainable business, and legal compliance, focusing on an organizational framework, technical and organizational controls, alignment with the Group's strategy, and fostering a security culture. The management model is based on Group guidelines, a centralized operational model, and internal control with three lines of defense. The policy is mandatory for employees, suppliers, partners, and BBVA entities in Colombia, covering the entire lifecycle of information assets. Non-compliance may result in disciplinary sanctions.

Additionally, the policy defines specific roles and responsibilities, such as those of Corporate Security (policy executor) and the local CSO (policy responsible), and emphasizes the importance of coordination between internal and external actors, as well as communication with authorities and regulatory bodies. It includes a glossary of key terms related to information security and cybersecurity.

BBVA Group has established a global information security structure for all its geographies. This structure includes a CSO at the Holding level and functional execution units for the Data CISO and corporate functions. For the geography of Colombia, a CSO Country Leader Manager has been appointed.

BBVA Group's General Operational Resilience Policy

The policy, mandatory for the entire Group, ensures the integrity and reliability of systems and networks. It is governed by principles such as integrity, prudence, transparency, sustainability, legal compliance, availability, confidentiality, authenticity, and physical security. It includes identification of Critical Processes, third-party risk management, training, incident management, testing, and continuous improvement, with an ICT Risk Management Framework that details the risk cycle and the importance of backups.

The Business Continuity Management Framework identifies critical processes to ensure their maintenance and rapid recovery after interruptions, minimizing impacts. Internal regulation will be developed to manage continuity and operational crises. The Group will also establish processes for operational incidents that affect continuity and security, including an ICT process to detect, manage, and communicate relevant incidents to clients and authorities, classifying them by criticality.

Information Security and Cybersecurity Incident Management Standard V7

BBVA Colombia's policy defines a framework for security incident management, following the NIST SP 800-61 standard, to minimize impacts, classify incidents, and ensure compliance. It applies to all personnel and third parties with access to the Bank's systems. The principles emphasize rapid and effective management of any event that compromises systems, the entity, or clients.

The management phases include: prevention (team, plan, asset identification, tools, and awareness), detection (anomaly identification and mandatory reporting), analysis/containment/eradication/recovery (verification, root cause, resolution, vulnerability correction, and restoration), and post-incident (review, improvements, reports, and lessons learned).

Cyber incidents are classified by severity (Non-Significant, Significant, Severe) with sublevels (C to A+), based on systemic impact, service interruption, reputation, data loss, and economic impact. An escalation, notification, and internal and external communication plan (clients, regulators) is detailed.

Standard for Decision-Making and Relevant Follow-up in the Field of Information Security and Cybersecurity Management BBVA Colombia

This BBVA Colombia standard seeks to manage information security and cybersecurity, addressing concerns of the Financial Superintendency about possible conflicts of interest in Corporate Security. It establishes that key decisions must be approved by a different body, the Information Security and Cybersecurity Committee, which meets quarterly and supervises the implementation and effectiveness of the standard. It includes the approval of internal regulations, fraud parameters, controlled pilots, and risk monitoring. Corporate Security is responsible for presenting information to the Committee. The standard is governed by integrity, transparency, prudence, and legal compliance.

Additionally, internal and external audits are carried out annually to evaluate the corporate security structure.

The internal audit conducted in the first half of the year evaluated cybersecurity controls, focusing on protection against cyberattacks, intrusions, unauthorized access, theft, loss or misuse of information, and deficiency management.

E&Y's external audit report from November 2024 evaluates BBVA Colombia's General IT Controls (ITGCs). It focuses on the scope, methodology (with High, Medium, Low risk levels), and evaluation results. The areas evaluated include Program and Data Access, Change Management, and Computer Operations.