Popular, Inc.: Form 10-K for the period ended Dec 31, 2024

Filed with the SEC on Mar 3, 2025 and accepted by EDGAR at Mar 3, 2025, 13:29 ET.

Share this page

Link

Story card, 1080 × 1920

Business

As filed, 88,075 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

General:

Popular is a diversified, publicly-owned financial holding company, registered under the Bank Holding Company Act of 1956, as

amended (the “BHC Act”), and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the

“Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the largest

financial institution based in Puerto Rico, with consolidated assets of $73.0 billion, total deposits of $64.9 billion and stockholders’

equity of $5.6 billion at December 31, 2024. At December 31, 2024, we ranked among the 50 largest U.S. bank holding companies

based on total assets according to information gathered and disclosed by the Federal Reserve Board.

We operate in two principal markets:

Puerto Rico: We provide retail, mortgage and commercial banking services through our principal banking subsidiary, Banco

Popular de Puerto Rico (“Banco Popular” or “BPPR”), as well as auto and equipment leasing and financing, broker-dealer and

insurance services through specialized subsidiaries. BPPR’s deposits are insured under the Deposit Insurance Fund (“DIF”) of

the Federal Deposit Insurance Corporation (“FDIC”). The banking operations of BPPR are primarily based in Puerto Rico,

where BPPR has the largest retail banking franchise.

Mainland United States: We provide retail, mortgage and commercial banking services through our New York-chartered

banking subsidiary, Popular Bank (“PB” or “Popular U.S.”), which has branches in New York, New Jersey and Florida; as well

as investment and insurance services, and commercial direct financing leases through specialized subsidiaries. PB’s deposits

are insured under the DIF of the FDIC.

BPPR also conducts banking operations in the U.S. Virgin Islands, the British Virgin Islands and New York. In addition to

BPPR’s commercial banking operations in New York that include direct loan origination and participating loans originated by

PB, BPPR offers or holds financial products on a National scale in the U.S. market, including personal loans previously

originated under the E-Loan brand, purchased personal loans originated by third parties, and gathering insured institutional

deposits via online deposit gathering platforms. In the U.S. and British Virgin Islands, BPPR offers a range of banking products,

including loans and deposits to both retail and commercial customers.

For further information about the Corporation’s results segregated by its reportable segments, see “Reportable Segment Results” in

the Management’s Discussion and Analysis of Financial Condition and Results of Operations section (“MD&A”) and Note 36 to the

Consolidated Financial Statements included in this Form 10-K.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial. Commercial loans are comprised of (i) commercial and industrial (“C&I”) loans and leases to commercial customers

for use in normal business operations and to finance working capital needs, equipment purchases or other projects, (ii) commercial

real estate (“CRE”) loans (excluding construction loans) for income-producing real estate properties as well as owner-occupied

properties, and (iii) multifamily loans with residential buildings with five or more living units. C&I loans are underwritten individually

and usually secured with the assets of the company and the personal guarantee of the business owners. CRE loans consist of loans

for income-producing real estate properties and the financing of owner-occupied facilities if there is real estate as collateral. Non-

owner-occupied CRE loans are generally made to finance office and industrial buildings, healthcare facilities, and retail shopping

centers and are repaid through cash flows related to the operation, sale or refinancing of the property. Multifamily loans, in certain

cases, result from the conversion of the Bank’s construction financing to permanent financing and are repaid through the cash flow,

sale or refinance of the properties.

(2) Mortgage. Mortgage loans include residential mortgage loans to consumers for the purchase or refinancing of a residence and

also include residential construction loans made to individuals for the construction of refurbishment of their residence.

(3) Consumer. Consumer loans are mainly comprised of unsecured personal loans, credit cards, and automobile loans, and to a

lesser extent home equity lines of credit (“HELOCs”) and other loans made by banks to individual borrowers.

(4) Construction. Construction loans are CRE loans to companies, community or homeowners’ associations, or developers used for

the construction of a commercial or residential property for which repayment will be generated by the sale or permanent financing of

the property. Our construction loan portfolio primarily consists of retail, residential (land and condominiums), office and warehouse

product types.

(5) Lease Financings. Lease financings are offered by BPPR and are primarily comprised of automobile loans/leases made through

automotive dealerships.

Business Concentration

Since our business activities are currently concentrated primarily in Puerto Rico, our results of operations and financial

condition are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real

estate markets. The concentration of our operations in Puerto Rico exposes us to greater risk than other banking companies with a

wider geographic base. Our asset and revenue composition by geographical area is presented in Note 36 to the Consolidated

Financial Statements included in this Form 10-K.

Our loan portfolio is diversified by loan category. However, approximately 55% of our loan portfolio at December 31, 2024 consisted

of real estate-related loans, including residential mortgage loans, construction loans and commercial loans secured by commercial

real estate. The table below presents the distribution of our loan portfolio by loan category at December 31, 2024.

Loan category

(Dollars in millions)

BPPR

PB

Credit Administration and Credit Policies

Interest from our loan portfolios is our principal source of revenue. Whenever we make loans, we expose ourselves to credit risk. Credit risk is controlled and monitored through active asset quality management, including the use of lending standards, thorough review of potential borrowers and through active asset quality administration.

Business activities that expose us to credit risk are managed within the Board of Director’s Risk Management policy,

and the Credit Risk Tolerance Limits policy, which establishes limits that consider factors such as maintainin g a prudent balance

of risk-taking across diversified risk types and business units, compliance with regulator y guidance, and controlling the exposure

to lower credit quality assets.

We maintain comprehensive credit policies for all lines of business in order to mitigate credit risk. Our credit policies are

approved by our Board of Directors. These policies set forth, among other things,

the objectives, scope and responsibilities of the

credit management cycle. Our internal written procedures establish

underwriting standards and procedures for monitoring and

evaluating loan portfolio quality and require prompt identificatio n and quantificatio n of asset quality deterioration or potential

loss

to provide for the adequacy of the allowance for credit losses. These written procedures establish various approval and lending

limit levels, ranging

from bank branch or departmen t officers to managerial and senior management levels. Approval levels are

primarily determined by the amount, type of loan and risk characteristics of the credit facility.

Our credit policies and procedures establish documentation requirements for each loan and related collateral type,

when applicable, during the underwriting, closing and monitoring phases. For commercial and construction loans, during the

initial loan underwriting process, the credit policies require, at a minimum, historical financial statements or tax returns of the

borrower, an analysis of financial information contained in a credit approval package, a risk rating determination and reports

from credit agencies and appraisal s for real estate-related loans when applicable . The credit policies also set forth the required

closing documentation depending on the loan and the collateral type.

Although we originat e most of our loans internally in both the Puerto Rico and mainlan d United States markets, we

occasionally purchase or participate in loans originated by other financial institutions. When we purchase or participate in

loans originated by others, we conduct the same underwriting analysis of the borrower s and apply the same criteria as we do

for loans originated by us. This also includes a review of the applicable legal documentation.

Refer to the Credit Risk section of the MD&A included in this Form 10-K for information related to management

committees and divisions with responsibilities for establishing policies and monitoring the Corporation’s credit risk.

Loan extensions , renewals and restructurings

Loans with satisfactory credit profiles can be extended, renewed or restructured . Some commercia l loan facilities are

structured as lines of credit, which are mainly one year in term and therefore are required to be renewed annually. Other facilities

may be restructure d or extended from time to time based upon changes in the borrower’s business needs, use of funds, timing

of completion of projects and other factors. If the borrower is not deemed to have financial difficulties , extensions, renewals

and restructurings are done in the normal course of busines s and the loans continue to be recorde d as performing.

We evaluate various factors to determine if a borrower is experiencing financial difficulties. Indicators that the

borrower is experiencing financial difficultie s include, for example: (i) the borrower is currently in default on any of its debt or it is

probable tha t the borrower would be in payment default on any of its debt in th e foreseeable future without the modification ; (ii)

the borrower has declare d or is in the process of declarin g bankruptcy; (iii) there is significan t doubt as to whether the borrower

will continue to be a going concern; (iv) the borrower has securities that have been delisted, are in the process of being

delisted, or are under threa t of bein g delisted from an exchange ; (v) based on estimates and projection s that only encompass

the current business capabilities , the borrower forecasts that its entity-specifi c cash flows will be insufficien t to service the

debt (both interest and principal) in accordance with the contractual terms of the existing agreement through maturity; and

(vi) absent the current modification, the borrower cannot obtain funds from sources other than the existing creditors at an

effective interest rate equal to the current market interest rate for similar debt for a non-troubled debtor.

We have specialized workout officers who handle the majority of commercial loans that are past due 90 days and

over, borrowers experiencing financial difficulties , and loans that are considered problem loans based on their risk profile. As a

general policy, we do not advance additional money to borrowers who have loans that are 90 days past due or over. In

commercial and construction loans, certain exceptions may be approved under certain circumstances, including (i) when past due status is administrativ e in nature, such as expiration of a loan facility before the new documentatio n is executed, and not as a result of paymen t or credit issues; (ii) to improve our collateral position or otherwise maximize recovery or mitigate potential future losses; and (iii) with respect to certain entities that, although related through common ownership, are not cross defaulted nor cross-collateralized and are performing satisfactorily under their respective loan facilities. Such advances are underwritten and approved following our credit policy guidelines and limits, which are dependent on the borrower’s financial condition, collateral and guarantee, among others.

In addition to the legal lending limit established under applicable state banking law, discusse d in detail below, business

activities that expose the Corporation to credit risk are managed within guidelines described in the Credit Risk Tolerance Limits

policy. Limits are defined for loss and credit performance metrics, portfolio composition and concentration, and industry and name-

level,

which

monitors lending concentration to a single borrower or a group of related borrowers, including specific lending

limits based on industr y or other criteria, such as a percentage of the banks’ capital.

Refer to Note 2 and Note 8 to the Consolidated Financial Statements included in this Form 10-K, for additional information

on loan modifications to borrowers with financial difficulties.

Competition

The financial services industry in which we operate is highly competitive. In Puerto Rico, our primary market, the

banking business is highly competitive with respect to originatin g loans, acquiring deposits and providing other banking

services. Most of our direct competitio n for our products and services comes from commercial banks and credit unions.

The principal competitors for BPPR include locally based commercial banks and a few large U.S. and foreign banks with

operations in Puerto Rico.

We also compete with specialized players in th e local financial industry that are not subjec t to the same regulatory

restrictions as domestic banks and bank holdin g companies. Those competitors include brokerage firms, mortgage companies,

insurance companies, automobile and equipment finance companies, local and federal credit unions (locally known as

“cooperativas”), credit car d companies, consumer finance companies, institutional lenders, and other financial and non-financia l

institutions and entities. Credit unions generally provide basic consume r financial services and collectively represent a significant

portion of the market with a lower cost structure and fewer regulatory constraints.

In the United States we continue to face substantial competitive pressure as our footprint resides in the two large

metropolitan markets of New York City / Northern New Jersey and the greater Miami area. There is a large number of banks in both

markets, including community, regional, and national ones, most of which have more resources than us.

In both Puerto Rico and the United States, the primary factors in competing for business include pricing, convenience

of branch locations and other delivery methods, range of products offered, and the level of service delivered. We must compete

effectively along all these parameters to be successful. We experience pricing pressure as some of our competitors seek to

increase market share by reducing prices for services or the rates charged on loans, increasing the interest rates offered on

deposits or offering more flexible terms. Increased competition could require that we increase the rates offered on deposits and

lower the rates charged on loans, which could adversely affect our profitability.

Economic factors, along with legislative and technological changes, have an ongoing impact on the competitive

environment within the financia l services industry. We work to anticipat e and adap t to dynamic competitive conditions whether

through developing and marketing innovative products and services, adopting or developin g new technologie s that differentiat e

our products and services, cross-marketing, or providing personalized banking services. We strive to distinguish ourselves

from other banks and financial services providers in our marketplace by providin g a high level of service to enhance customer

loyalty and to attrac t and retain business. However, we can provide no assurance as to the effectiveness of these efforts on

our future business or results of operations, and as to our continued ability to anticipate and adapt to changing

conditions, and to sufficientl y improve our services and/or banking products, in order to successfully compete in our primary

service areas.

Transformation Initiatives:

The Corporation launched a significant, multi-year, broad-based technological and business process transformation during the

second half of 2022 which continued during 2024. The needs and expectations of our clients, as well as the competitive

landscape, have evolved, compelling us to make important investments in our technological infrastructure and adopt more agile

practices. During 2024, the Corporation made meaningful progress in the modernization of our customer channels and

enhancement of our customers' experience. The Corporation believes these investments will result in an enhanced digital

experience for our clients, as well as better technology and more efficient processes for our employees, and make us a more

efficient and profitable company. The Corporation had anticipated to reach a target of 14% return on tangible common equity

(ROTCE) by the fourth quarter of 2025. However, due to a variety of drivers, including the impact of the shift to higher-cost

deposits in 2024, and lower than expected loan growth in the U.S., the Corporation now expects to achieve at least a 12%

ROTCE by the end of 2025. Our technology and business transformation will be a significant priority for the Corporation over the

next years. Refer to the Overview section of Management’s Discussion and Analysis included in this Form 10-K for information

on recent significant events that have impacted or will impact our current and future operations.

Human Capital Management

Popular seeks to embody our purpose of “putting people at the center of progress” throughout its human capital management.

Attracting, developing and retaining top talent in an environment that promotes wellness, inclusion, respect, learning and

transparency are fundamental pillars of our long-term strategy. As of December 31, 2024, Popular had 9,406 employees, none

of whom were represented by a collective bargaining group.

Nurturing Well -Being: Employee Health & Financial Security

Popular believes that the health and financial wellness of our employees is essential to effectively serve our customers and

contribute positively to the communities where we operate. Our health and wellness program includes health, pharmacy, vision

and dental insurance, as well as other wellness initiatives. Our programs seek to ensure that healthcare is both accessible and

affordable for our employees, with Popular covering up to 80% of health insurance premiums, a figure that surpasses regional

benchmarks. In 2024, we prioritized mental health by emphasizing the importance of addressing our employees’ emotional

needs and launching an internal campaign featuring short videos on wellness. We also shared valuable information on the

importance of sleep hygiene. Additionally, the Corporation promotes employee health and wellbeing by encouraging annual

physical exams and maintaining a health and wellness center at its Puerto Rico-based corporate offices staffed with healthcare

providers, where employees can complete their physical exam, receive acute care or visit a nutritionist or psychologist free of

charge. Our health and wellness center received over 15,561 visits from employees during 2024.

Popular also seeks to foster work-life balance by providing paid time off benefits to our employees, including community service

leave, paid parental leave and flexible work arrangements. Our hybrid work model, accessible to approximately half of our

workforce, underscores our commitment to flexible work environments. Moreover, we continuously offer activities and workshops

centered on physical fitness and personal financial management.

Popular further provides a 401(k) savings and investment plan, in which 98% of employees participate. Popular matches $0.50

for every dollar the employee contributes to the 401(k) plan, up to 8% of their salary. Moreover, Popular offers a profit -sharing

plan, contingent upon the achievement of pre-set financial goals, to further align employee compensation with its collective

success. The profit-sharing plan allows employees to receive up to 8% of their eligible compensation (capped at $70,000), of

which the first 4% is paid in cash and anything beyond such percent is paid to the employee’s savings and investment plan

account. Moreover, Popular regularly evaluates employees’ base compensation to better compete with the salaries paid in

similar positions in other companies. In 2024, we invested more than $13 million in enhancing our employees’ compensation.

Empowering Growth: Our Commitment to Talent Developmen

t

We are committed to fostering the continuous development and upskilling of our employees and believe this is fundamental to

maintaining our competitive edge. Towards that end, Popular provides development opportunities aimed at strengthening our

employees’ knowledge, abilities and skills to support their personal growth which, in turn, seeks to enhance Popular’s business

strategies and organizational competencies. Our 40,000 square foot Development Center in San Juan, Puerto Rico and our

satellite facilities in New York, South Florida, and the Virgin Islands offer year-round training sessions, activities and workshops.

More than 4,100 employees participated in corporate academy voluntary courses, new employee orientations, health coordinator

certifications, and manager onboarding courses. These courses offer instructor-led training experiences for employees to learn

and apply critical core and technical skills. Our commitment to continuous learning is further supported by offering our

employees access to LinkedIn Learning, which provides an extensive library of over 16,000 e-learning courses.

Our focus on training and development has provided internal growth opportunities to our workforce. As a result, the

Corporation’s internal mobility rate in 2024 was 44%. This included employees who applied or were selected for vacancies, were

promoted, or had lateral movements. Additionally, we continued strengthening key skills across accelerated development

programs focused on data science, analytics, process excellence and program management. During 2024, we engaged 303

participants in such programs, further advancing the organization’s talent. In 2024, Popular also strategically aligned employee

performance appraisals with the company's cultural framework, by transitioning to evaluate our new values and behaviors

instead of organizational competencies. This shift supports the development of a culture that prioritizes the company’s core

values and desired behaviors.

Our organizational effectiveness strategy was crucial in enhancing organizational development through targeted initiatives. By

implementing activities like assessments, team integration activities, new manager integration facilitations, and team alignment

sessions, we aim to cultivate a cohesive and adaptable workforce.

Enhancing Leadership Continuity through Strategic Succession Planning

Popular’s business strategy further takes into account succession planning to ensure effective leadership transitions. Succession

plans for senior management are developed by the CEO and presented to the Board of Directors. Popular’s succession planning

also leverages our Executive Talent Management Program to identify high-potential and high-performing managers, providing

them with learning opportunities to enhance their skills and prepare them for senior management positions.

Employee Experience

Popular aims to provide an exceptional employee experience that inspires our employees to deliver outstanding service to our

customers and communities. We recognize the dynamic nature of our employees’ needs and expectations and have a robust

approach to measuring and understanding their journey. Our employee engagement and experience survey program includes

biannual pulse surveys, an annual complete survey, and additional surveys that measure the end-to-end employee journey. We

believe that these insights contributed to our ability to maintain a stable turnover rate at 8.6% as of the end of 2024.

Furthermore, our employee experience efforts are reflected in an employee loyalty score of 81%, which positions us above the

50th percentile of the Qualtrics global benchmark and above the average benchmark of the financial industry.

Board Oversight in Human Capital

The Talent and Compensation Committee of the Corporation’s Board of Directors has oversight responsibility for the

Corporation’s human capital management. As part of its responsibilities, the Talent and Compensation Committee reviews and

advises management on the Corporation’s general compensation philosophy, programs and policies, and on the Corporation’s

talent acquisition and development, workforce engagement succession planning and culture, among other human capital topics.

We encourage you to review our Corporate Sustainability Report published on www.popular.com (http://www.popular.com) for more detailed information

regarding the Corporation’s human capital management programs and initiatives. The information on the Corporation’s website,

including the Corporation’s Corporate Sustainability Report, is not, and will not be deemed to be, a part of this Form 10-K or

incorporated into any of the Corporation’s filings with the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America

(“PNA”) and their respective subsidiaries. Such laws and regulations are continually under review by Congress and state

legislatures and federal and state regulatory agencies. Any change in the laws and regulations applicable to Popular and its

subsidiaries could have a material effect on the business of Popular and its subsidiaries. We will continue to assess our businesses

and risk management and compliance practices to conform to developments in the regulatory environment.

General

Popular and PNA are bank holding companies subject to consolidated supervision and regulation by the Federal Reserve

Board under the Bank Holding Company Act of 1956 (as amended, the “BHC Act”). BPPR and PB are subject to supervision and

examination by applicable federal and state banking agencies including, in the case of BPPR, the Federal Reserve Board and the

Office of the Commissioner of Financial Institutions of Puerto Rico (the “Office of the Commissioner”), and, in the case of PB, the

Federal Reserve Board and the New York State Department of Financial Services (the “NYSDFS”). Popular’s broker-dealer /

investment adviser subsidiary, Popular Securities, LLC (“PS”) and investment advisor subsidiary Popular Asset Management LLC

(“PAM”) are subject to regulation by the SEC, the Financial Industry Regulatory Authority (“FINRA”), and the Securities Investor

Protection Corporation, among others. Other of our non-bank subsidiaries conduct reinsurance and insurance producer and agency

activities, which are subject to other federal, state and Puerto Rico laws and regulations as well as licensing and regulation by the

Puerto Rico Office of the Commissioner of Insurance and, for one insurance agency subsidiary, the NYSDFS.

Enhanced Prudential Standards

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), as modified by the

Economic Growth, Regulatory Relief, and Consumer Protection Act and the federal banking regulators’ 2019 “Tailoring Rules,”

banking organizations are categorized based on status as a U.S. G-SIB, size and four other risk-based indicators. Among bank

holding companies with $100 billion or more in total consolidated assets, the most stringent standards apply to U.S. G-SIBs, which

are subject to Category I standards and the least stringent standards apply to Category IV organizations, which have between $100

billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and which are also

not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk

management requirements. As of December 31, 2024, Popular had total consolidated assets of $73.0 billion.

Transactions with Affiliates

BPPR and PB are subject to restrictions that limit the amount of extensions of credit and certain other “covered

transactions” (as defined in Section 23A of the Federal Reserve Act) between BPPR or PB, on the one hand, and Popular, PNA or

any of our other non-banking subsidiaries, on the other hand, and that impose collateralization requirements on such credit

extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that

affiliate would exceed 10% of the bank’s capital stock and surplus or the aggregate amount of the bank’s covered transactions with

all non-bank affiliates would exceed 20% of the bank’s capital stock and surplus. In addition, any transaction between BPPR or PB,

on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, is required to be carried out on an

arm’s length basis.

Source of Financial Strength

The Dodd-Frank Act requires bank holding companies, such as Popular and PNA, to act as a source of financial and

managerial strength to their subsidiary banks. Popular and PNA are expected to commit resources to support their subsidiary banks,

including at times when Popular and PNA may not be in a financial position to provide such resources. Any capital loans by a bank

holding company to any of its subsidiary depository institutions are subordinated in right of payment to depositors and to certain

other indebtedness of such subsidiary depository institution. In the event of a bank holding company’s bankruptcy, any commitment

by the bank holding company to a federal banking agency to maintain the capital of a subsidiary depository institution will be

assumed by the bankruptcy trustee and entitled to a priority of payment. BPPR and PB are currently the only insured depository

institution subsidiaries of Popular and PNA.

Resolution Planning and Resolution-Related Requirements

bank holding company with $250 billion or more in total consolidated assets (or that is a Category III firm based on

certain risk-based indicators described in the Tailoring Rules) is required to report periodically to the FDIC and the Federal Reserve

Board such company’s plan for its rapid and orderly resolution in the event of material financial distress or failure. In addition,

insured depository institutions with total assets of $50 billion or more are required to submit to the FDIC periodic contingency plans

for resolution in the event of the institution’s failure. In June 2024, the FDIC finalized amendments to the resolution planning

requirements for insured depository institutions with $50 billion or more in total assets. The amendments require insured depository

institutions with between $50 billion and $100 billion in assets to submit informational filings on a three-year cycle, with an interim

supplement updating key information submitted in the off years. These amendments became effective October 1, 2024, and BPPR’s

first submission under the new rule is due by April 1, 2026.

On August 29, 2023, the Federal Reserve Board, FDIC and Office of the Comptroller of the Currency (“OCC”) issued a

proposed rule that would require bank holding companies and insured depository institutions with $100 billion or more in

consolidated assets (as well as their insured depository institution affiliates) to maintain minimum amounts of eligible long-term debt

(generally, debt that is unsecured, has a maturity greater than one year from issuance and satisfies additional criteria), subject to a

three-year phase-in period. The proposal would also apply “clean holding company” requirements to Category II through IV bank

holding companies, which would, among other things, prohibit prohibit those holding companies from entering into derivatives and

certain other financial contracts with third parties.

As of December 31, 2024, Popular, PNA, BPPR and PB’s total assets were below the thresholds for applicability of these

rules, except that BPPR is subject to the FDIC’s resolution planning requirements applicable to insured depository institutions with

more than $50 billion but less than $100 billion in assets.

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of

the FDIC, and BPPR and PB are subject to FDIC deposit insurance assessments to maintain the DIF. Deposit insurance

assessments are based on the average consolidated total assets of the insured depository institution minus the average tangible

equity of the institution during the assessment period. For larger depository institutions with over $10 billion in assets, such as BPPR

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among other measures, that seeks to capture

both the probability that an individual large institution will fail and the magnitude of the impact on the DIF if such a failure occurs. The

FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately

captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30

basis points on an annualized basis. After the effect of potential base-rate adjustments, the total base assessment rate could range

from 1.5 to 40 basis points on an annualized basis.

In October 2022, the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis

points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the Federal Deposit Insurance Act

(“FDIA”), established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35

percent within eight years. The increased assessment is intended to improve the likelihood that the DIF reserve ratio would reach

the required minimum by the statutory deadline of September 30, 2028.

As of December 31, 2024, BPPR and PB had a DIF average total asset less average tangible equity assessment base of

approximately $67 billion.

On November 16, 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF

resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution test under the FDIA in

connection with the receiverships of Silicon Valley Bank and Signature Bank. The FDIC estimated in approving the rule that those

assessed losses total approximately $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will

affect the amount of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an

insured depository institution reported in its Consolidated Reports of Condition and Income (“Call Report”) at December 31, 2022,

excluding the first $5 billion in estimated uninsured deposits. For a holding company that has more than one insured depository

institution subsidiary, such as Popular, the $5 billion exclusion is allocated among the company’s insured depository institution

subsidiaries in proportion to each insured depository institution’s estimated uninsured deposits. The special assessments are

collected at an annual rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters, with the

first assessment period having begun January 1, 2024. Because the estimated loss pursuant to the systemic risk determination will

be periodically adjusted, the FDIC retains the ability to cease collection early, extend the special assessment collection period and

impose a final shortfall special assessment on a one-time basis. In June 2024, due to the increase in the estimate of losses, the

FDIC announced that it projects that the special assessment will be collected for an additional two quarters beyond the initial eight-

quarter collection period, at a lower rate.

Brokered Deposits

The FDIA and regulations adopted thereunder restrict the use of brokered deposits and the rate of interest payable on

deposits for institutions that are less than well capitalized. Popular does not believe the brokered deposits regulations have had or

will have a material effect on the funding or liquidity of BPPR and PB.

Capital Adequacy

Popular, PNA, BPPR and PB are each required to comply with applicable capital adequacy standards established by the

federal banking agencies (the “Capital Rules”), which implement the Basel III framework set forth by the Basel Committee on

Banking Supervision (the “Basel Committee”) as well as certain provisions of the Dodd-Frank Act.

Among other matters, the Capital Rules: (i) impose a capital measure called “Common Equity Tier 1” (“CET1”) and the

related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1

capital” instruments meeting certain revised requirements; and (iii) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital. Under the Capital Rules, for most banking organizations, including Popular, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the

“leverage ratio”).

The Capital Rules also impose a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-

weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking

institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face

constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and eligible retained income

(that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income). Popular, BPPR and PB are

therefore required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of

(i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to

risk-weighted assets of at least 10.5%.

Pursuant to the Capital Rules, the effects of certain accumulated other comprehensive income or loss (“AOCI”) items

included in stockholders’ equity (for example, marks-to-market of securities held in the available for sale portfolio) are not excluded

from regulatory capital ratios; however, banking organizations that are not subject to Categories I or II standards under the

framework for banking organizations with $100 billion or more in assets, including Popular, BPPR and PB, may make a one-time

permanent election to continue to exclude these items. Popular, BPPR and PB have made this election in order to avoid significant

variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their available for sale

securities portfolios. On July 27, 2023, the federal banking regulators proposed revisions to the Capital Rules to implement the

Basel Committee’s 2017 standards, described below, and make other changes to the Capital Rules, including the ability of banking

organizations in Categories III and IV to elect not to recognize most elements of AOCI in regulatory capital. The proposal introduces

revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes.

However, the revised capital requirements of the proposed rule would not apply to Popular, BPPR, or PB because they have less

than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements. The

Federal Reserve has indicated that it expects to work with the other federal banking regulators on a revised proposal in 2025.

The Capital Rules preclude certain hybrid securities, such as trust preferred securities, from inclusion in bank holding

companies’ Tier 1 capital. Trust preferred securities no longer included in Popular’s Tier 1 capital may nonetheless be included as a

component of Tier 2 capital. Popular has not issued any trust preferred securities since May 19, 2010. As of December 31, 2024,

Popular has $193 million of trust preferred securities outstanding which no longer qualify for Tier 1 capital treatment, but instead

qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions from and adjustments to CET1. Banking organizations that are

not subject to Category I or II standards are subject to rules that provide for simplified capital requirements relating to the threshold

deductions for certain mortgage servicing assets, deferred tax assets, investments in the capital of unconsolidated financial

institutions and inclusion of minority interests in regulatory capital.

Failure to meet capital guidelines could subject Popular and its depository institution subsidiaries to a variety of

enforcement remedies, including the termination of deposit insurance by the FDIC and to certain restrictions on our business. Refer

to “Prompt Corrective Action” below for further discussion.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-

crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk

(including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable

commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital.

Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to Category I and Category II

banking organizations and not to Popular, BPPR and PB.

In December 2018, the federal banking agencies approved a final rule modifying their regulatory capital rules and

providing an option to phase in over a period of three years the day-one regulatory capital effects of the Current Expected Credit

Loss (“CECL”) model of ASU 2016-13. The final rule also revised the agencies’ other rules to reflect the update to the accounting

standards. Popular has availed itself of the option to phase in over a period of three years the day one effects on regulatory capital

from the adoption of CECL. In 2020, federal bank regulators adopted a rule that allowed banking organizations to elect to delay

temporarily the estimated effects of adopting CECL on regulatory capital until January 2022 and subsequently to phase in the

effects through January 2025. Our 2024 regulatory capital ratios reflect this election to phase in the effects of CECL, but future

regulatory capital ratios will include the full impact from CECL now that the phase-in period has ended.

Refer to the Consolidated Financial Statements in this Form 10-K., Note 20 and Table 10 of Management’s Discussion

and Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer to the Consolidated Financial Statements in this

Form 10-K Note 2 for more information regarding CECL.

Prompt Corrective Action

The FDIA requires, among other things, the federal banking agencies to take prompt corrective action in respect of

insured depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital tiers: “well

capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized”. A

depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain

other factors.

An insured depository institution will be deemed to be (i) “well capitalized” if the institution has a total risk-based capital

ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage

ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a

specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0%

or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0%

or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than

8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%;

(iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less

than 3%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized”

if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be

downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an

unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. An insured

depository institution’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the

capital category may not constitute an accurate representation of the institution’s overall financial condition or prospects for other

purposes.

The FDIA generally prohibits an insured depository institution from making any capital distribution (including payment of a

dividend) or paying any management fee to its holding company, if the depository institution would thereafter be undercapitalized.

Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition,

undercapitalized depository institutions are subject to growth limitations and are required to submit capital restoration plans. A

depository institution’s holding company must guarantee the capital restoration plan, up to an amount equal to the lesser of 5% of

the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency, when the

institution fails to comply with the plan. The federal banking agencies may not accept a capital restoration plan without determining,

among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s

capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions,

including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation

of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a

receiver or conservator.

The capital-based prompt corrective action provisions of the FDIA apply to the FDIC-insured depository institutions such

as BPPR and PB, but they are not directly applicable to holding companies such as Popular and PNA, which control such

institutions. As of December 31, 2024, both BPPR and PB met the quantitative requirements for ‘well capitalized’ status.

Restrictions on Dividends and Repurchases

The principal sources of funding for Popular and PNA have included dividends received from their banking and non-

banking subsidiaries, asset sales and proceeds from the issuance of debt and equity. Various statutory provisions limit the amount

of dividends an insured depository institution may pay to its holding company without regulatory approval. A member bank must

obtain the approval of the Federal Reserve Board for any dividend, if the total of all dividends declared by the member bank during

the calendar year would exceed the total of its net income for that year, combined with its retained net income for the preceding two

years, after considering those years’ dividend activity, less any required transfers to surplus or to a fund for the retirement of any

preferred stock. During the year ended December 31, 2024, BPPR declared cash dividends of $600 million, a portion of which was

used by Popular for the payments of the cash dividends on its outstanding common stock. At December 31, 2024, BPPR needed to

obtain prior approval of the Federal Reserve Board before declaring a dividend in excess of $318 million due to its retained income,

declared dividend activity and transfers to statutory reserves over the three year’s ended December 31, 2024. In addition, a member

bank may not declare or pay a dividend in an amount greater than its undivided profits as reported in its Report of Condition and

Income, unless the member bank has received the approval of the Federal Reserve Board. A member bank also may not permit any

portion of its permanent capital to be withdrawn unless the withdrawal has been approved by the Federal Reserve Board. Pursuant

to these requirements, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the

NYSDFS.

During the year ended December 31, 2024, PB declared cash dividends of $50 million, a portion of which was used by

Popular for the payments of the cash dividends on its outstanding common stock.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common stock only out

of net income available to common shareholders over the past year and only if the prospective rate of earnings retention appears

consistent with the organization’s current and expected future capital needs, asset quality and overall financial condition. Moreover,

under Federal Reserve Board policy, a bank holding company should not maintain dividend levels that place undue pressure on the

capital of depository institution subsidiaries or that may undermine the bank holding company’s ability to be a source of strength to

its banking subsidiaries. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve

reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or

that could result in a material adverse change to the bank holding company’s capital structure.

The Federal Reserve Board also restricts the ability of banking organizations to conduct stock repurchases. In certain

circumstances, a banking organization’s repurchases of its common stock may be subject to a prior approval or notice requirement

under other regulations or policies of the Federal Reserve. Any redemption or repurchase of preferred stock or subordinated debt is

subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation organized under the

laws of the Commonwealth of Puerto Rico are subject to a withholding tax of 10% instead of the 30% applied to other “foreign”

corporations. Accordingly, dividends from current or accumulated earnings and profits paid by PNA to Popular, Inc. sourced from the

U.S. operations of PB are subject to a 10% tax withholding.

A corporation organized under the laws of the Commonwealth of Puerto

Rico that is engaged in a U.S. trade or business is generally subject to a branch profits tax of 30% on its earnings and profits for the

taxable year that are “effectively connected” with such U.S. trade or business, adjusted as provided by U.S. federal income tax law.

Accordingly, to the extent BPPR’s U.S. operations generate effectively connected earnings and profits that are not reinvested in

such U.S. operations (and that are not otherwise adjusted as provided by U.S. federal income tax law), such effectively connected

earnings and profits will generally be subject to a branch profits tax of 30%.

Refer to Part II, Item 5, “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of

Equity Securities” for further information on Popular’s distribution of dividends and repurchases of equity securities.

See “Puerto Rico Regulation” below for a description of certain restrictions on BPPR’s ability to pay dividends under

Puerto Rico law.

Interstate Branching

The Dodd-Frank Act amended the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Interstate

Banking Act”) to authorize national banks and state banks to branch interstate through

de novo

branches. For purposes of the

Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as other state

banks.

Activities and Acquisitions

In general, the BHC Act limits the activities permissible for bank holding companies to the business of banking, managing

or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to

be properly incidental thereto. A company that meets management and capital standards and whose subsidiary depository

institutions meet management, capital and Community Reinvestment Act (“CRA”) standards may elect to be treated as a financial

holding company and engage in a substantially broader range of nonbanking financial activities, including securities underwriting

and dealing, insurance underwriting and making merchant banking investments in nonfinancial companies.

In order for a bank holding company to elect to be treated as a financial holding company, (i) all of its depository institution

subsidiaries must be well capitalized (as described above) and well managed and (ii) it must file a declaration with the Federal

Reserve Board that it elects to be a “financial holding company.” As noted above, a bank holding company electing to be a financial

holding company must itself be and remain well capitalized and well managed. The Federal Reserve Board’s regulations applicable

to bank holding companies separately define “well capitalized” for bank holding companies, such as Popular, to require maintaining

a tier 1 capital ratio of at least 6% and a total capital ratio of at least 10%. Popular and PNA have elected to be treated as financial

holding companies. A depository institution is deemed to be “well managed” if, at its most recent inspection, examination or

subsequent review by the appropriate federal banking agency (or the appropriate state banking agency), the depository institution

received at least a “satisfactory” composite rating and at least a “satisfactory” rating for the management component of the

composite rating. If, after becoming a financial holding company, the company fails to continue to meet any of the capital or

management requirements for financial holding company status, the company must enter into a confidential agreement with the

Federal Reserve Board to comply with all applicable capital and management requirements. If the company does not return to

compliance within 180 days, the Federal Reserve Board may extend the agreement or may order the company to divest its

subsidiary banks or the company may discontinue, or divest investments in companies engaged in, activities permissible only for a

bank holding company that has elected to be treated as a financial holding company. In addition, if a depository institution subsidiary

controlled by a financial holding company does not maintain a CRA rating of at least “satisfactory,” the financial holding company will

be subject to restrictions on certain new activities and acquisitions.

The Federal Reserve Board may in certain circumstances limit our ability to conduct activities and make acquisitions that

would otherwise be permissible for a financial holding company. Furthermore, a financial holding company must obtain prior written

approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets.

In addition, we are required to obtain prior Federal Reserve Board approval before engaging in certain banking and other financial

activities both in the United States and abroad.

The “Volcker Rule” adopted as part of the Dodd-Frank Act restricts the ability of Popular and its subsidiaries, including

BPPR and PB as well as non-banking subsidiaries, to sponsor or invest in “covered funds,” including private funds, or to engage in

certain types of proprietary trading. Popular and its subsidiaries generally do not engage in the businesses subject to the Volcker

Rule; therefore, the Volcker Rule does not have a material effect on our operations.

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in recent years has been aimed at combating money

laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA PATRIOT Act”) strengthened the ability of the U.S.

government to help prevent, detect and prosecute international money laundering and the financing of terrorism. Title III of the USA

PATRIOT Act imposed significant compliance and due diligence obligations, created new crimes and penalties and expanded the

extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements

could have serious legal and reputational consequences for the institution.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amended the Bank Secrecy Act (the “BSA”), is intended to

comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based

approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate

priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for

testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including

a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial

Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and

countering the financing of terrorism policy required under AMLA. The priorities include: corruption, cybercrime, terrorist financing,

fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Federal regulators regularly examine BSA/Anti-Money Laundering and sanctions compliance to enhance their adequacy

and effectiveness, and the frequency and extent of such examinations and related remedial actions have been increasing.

Community Reinvestment Act

The CRA requires banks to help serve the credit needs of their communities, including extending credit to low- and

moderate-income individuals and geographies. Should Popular or our bank subsidiaries fail to serve adequately the community,

potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries

and affiliates, expand into new financial activities and merge with or purchase other financial institutions. On October 24, 2023, the

OCC, the Federal Reserve Board, and the FDIC jointly issued a final rule to modernize the federal banking agencies’ CRA

regulations and respond to changes in the banking industry. Among other items, the final rule introduces new tests under which the

performance of banks will be assessed and includes data collection and reporting requirements, many of which are applicable only

to banks with over $10 billion in assets, such as BPPR and PB. The effective date of the final rule was April 1, 2024; however, banks

are not required to begin complying with certain provisions of the final rule until January 1, 2026, with data reporting requirements

becoming applicable on January 1, 2027. The final rule has been challenged in federal court and is currently stayed as to the

plaintiff trade associations while the court considers the validity of the rule.

Interchange Fees Regulation

The Federal Reserve Board has established standards for debit card interchange fees and prohibited network exclusivity

arrangements and routing restrictions. The maximum permissible interchange fee that an issuer may receive for an electronic debit

transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. Additionally, the

Federal Reserve Board allows for an upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee if the

issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards.

In October 2023, the Federal Reserve Board proposed amendments to its rules on interchange fees. The proposed

changes would establish a maximum permissible interchange fee of no more than 14.4 cents per transaction plus four basis points

multiplied by the value of the transaction. The fraud prevention adjustment would be increased to 1.3 cents per transaction. The

proposed rule would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card

issuers.

Consumer Financial Protection Act of 2010

The Consumer Financial Protection Bureau (the “CFPB”) supervises “covered persons” (broadly defined to include any

person offering or providing a consumer financial product or service and any affiliated service provider) for compliance with federal

consumer financial laws. The CFPB also has the broad power to prescribe rules applicable to a covered person or service provider

identifying as unlawful, unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a

consumer financial product or service, or the offering of a consumer financial product or service. We are subject to examination and

regulation by the CFPB.

On October 22, 2024, the CFPB finalized a new rule to implement Section 1033 of the Consumer Financial Protection Act

that requires a provider of payment accounts or products, such as a bank, to make data available to consumers upon request

regarding the products or services they obtain from the provider. Any such data provider also has to make such data available to

third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security

standards, for the purpose of such third parties providing the consumer with financial products or services requested by the

consumer. Data required to be made available under the rule includes transaction information, account balance, account and routing

numbers, terms and conditions, upcoming bill information, and certain account verification data. The rule is intended to give

consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of

consumer financial products or services. For banks with at least $10 billion and less than $250 billion in total assets, compliance

with the rule’s requirements is required beginning on April 1, 2027.

On December 12, 2024, the CFPB finalized a rule that significantly reforms the regulatory framework governing overdraft

practices applicable to banks such as BPPR and PB that have more than $10 billion in assets. The rule has an effective date of

October 1, 2025. The rule modifies or eliminates several long-standing exclusions from requirements generally applicable to

consumer credit that previously exempted certain overdraft practices. The rule also generally requires banks to restructure many

overdraft fees, overdraft lines of credit, and other overdraft practices as separate consumer credit accounts that would be subject to

those requirements. These changes to the regulatory framework could result in BPPR and PB, among other things, facing higher

compliance costs in charging overdraft fees, experiencing a decreased ability to recover amounts extended as overdraft protection,

reducing the availability of overdraft protection, and/or charging lower overdraft fees.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department Office of Foreign Assets Control (“OFAC”) administers economic sanctions that affect

transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting countries take

many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or

investment in a sanctioned country; and (ii) a blocking of assets in which the government of the sanctioned country or other specially

designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the United

States or the possession or control of U.S. persons outside of the United States). Blocked assets (e.g., property and bank deposits)

cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these

sanctions could have serious legal and reputational consequences, including denial by federal regulators of proposed merger,

acquisition, restructuring, or other expansionary activity.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of the Gramm-Leach-Bliley Act of 1999 generally prohibit financial institutions, including us, from

disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing)

unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing

among affiliates for marketing purposes and governs the use and provision of information to consumer reporting agencies.

The federal banking regulators have also issued guidance and rules regarding cybersecurity that are intended to enhance

cyber risk management standards among financial institutions. A financial institution is expected to establish lines of defense and to

maintain risk management processes that are designed to address the risk posed by compromised customer credentials. A financial

institution’s management is expected to maintain sufficient business continuity planning processes for the rapid recovery,

resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution

is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding

network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail

to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. In November

2021, the U.S. federal bank regulatory agencies issued a final rule requiring banking organizations, including Popular, PNA, BPPR

and PB, to notify their primary federal banking regulator within 36 hours of determining that a “notification incident” has occurred. A

notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially

disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the

viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires

specific and immediate notifications by bank service providers that become aware of similar incidents.

State and foreign regulators have also been increasingly active in implementing privacy and cybersecurity standards and

regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and

providing detailed requirements with respect to these programs, including data encryption requirements. In New York, the NYSDFS

requires financial institutions regulated by the NYSDFS, including PB, to, among other things, (i) establish and maintain a

cybersecurity program designed to enhance the confidentiality, integrity and availability of their information systems; (ii) implement

and maintain a written cyber security policy setting forth policies and procedures for the protection of their information systems and

nonpublic information; and (iii) designate a Chief Information Security Officer.

On November 1, 2023, the NYSDFS adopted

amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The

amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack

vectors, (ii) enhanced requirements for privileged accounts, (iii) enhanced notification obligations, (iv) expansion of cyber

governance practices and (v) additional cybersecurity requirements for larger companies.

On July 6, 2023, the SEC adopted new rules that would require registrants, such as Popular, to (i) report material cybersecurity incidents on Form 8-K and, (ii) disclose in Annual Report on Form 10-K cybersecurity policies and procedures and governance practices, including at the board and management levels.

Many states and foreign governments have also recently implemented or modified their data breach notification and data

privacy requirements. The California Consumer Privacy Act (“CCPA”) imposes privacy compliance obligations with regard to the

collection, use and disclosure of personal information of California residents, and the November 2020 amendment to the CCPA

creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered

by the law and certain rights relating to personal information. The substantive obligations under the 2020 amendment to the CCPA

became effective on January 1, 2023. In European Union, the General Data Protection Regulation heightens privacy compliance

obligations and imposes strict standards for reporting data breaches. We expect this trend to continue and are continually

monitoring developments in the jurisdictions in which we operate.

See “Puerto Rico Regulation” below for a description of legislations and regulations on information privacy and

cybersecurity in Puerto Rico.

Climate-Related and ESG Developments

In recent years, federal, state and international lawmakers and regulators have increased their focus on financial

institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other

environmental, social and governance (“ESG”) matters. For example, on October 24, 2023, the Federal Reserve, FDIC, and OCC

finalized interagency guidance on principles for climate-related financial risk management applicable to regulated financial

institutions with more than $100 billion in total consolidated assets. The principles are intended to support efforts by large financial

institutions to focus on key aspects of climate-related financial risk management and cover six areas: (1) governance; (2) policies,

procedures, and limits; (3) strategic planning; (4) risk management; (5) data, risk measurement, and reporting; and (6) scenario

analysis. On December 21, 2022, the NYSDFS proposed guidance on climate-related financial risk management applicable to

NYSDFS-regulated banking and mortgage organizations, including PB. The proposed guidance would address material financial

risks related to climate change faced by these organizations in the context of risk assessment, risk management, and risk appetite

setting. California recently enacted climate-related disclosure laws requiring certain companies doing business in California to make

certain climate-related disclosures, including but not limited to greenhouse gas emissions data and climate-related risks. In addition,

certain states have enacted, or have proposed to enact, “anti-ESG” statutes, regulations or policies, including statutes that prohibit

financial institutions from denying or canceling products or services to a person, or otherwise discriminating against a person in

making available products or services, on the basis of social credit scores and certain other factors.

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation

arrangements of banking organizations, such as Popular, that are not “large, complex banking organizations.” Deficiencies will be

incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take

other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or

related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the

organization is not taking prompt and effective measures to correct the deficiencies.

The Federal Reserve Board, OCC and FDIC have issued comprehensive final guidance on incentive compensation

policies intended to discourage excessive risk-taking in the incentive compensation policies of banking organizations in order to not

undermine the safety and soundness of such organizations. The guidance, which covers all employees that have the ability to

materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a

banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond

the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk

management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s

board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking

agencies and the SEC, to adopt rules prohibiting incentive-based payment arrangements that encourage inappropriate risks by

providing excessive compensation or that could lead to a material financial loss at specified regulated entities having at least $1

billion in total assets (including Popular, PNA, BPPR and PB). The U.S. financial regulators proposed revised rules in 2016, which

have not been finalized.

In October 2022, the SEC adopted a final rule requiring securities exchanges to adopt rules mandating, in the case of a

restatement, the recovery or “clawback” of excess incentive-based compensation paid to current or former executive officers and

requiring listed issuers to disclose any recovery analysis where recovery is triggered by a restatement. The excess compensation

would be based on the amount the executive officer would have received had the incentive-based compensation been determined

using the restated financials. The Nasdaq Stock Market’s listing standards pursuant to the SEC’s rule became effective October 2,

2023. Popular’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1.

Regulation of Broker-Dealers

Our subsidiary, PS, is a registered broker-dealer with the SEC and subject to regulation and examination by the SEC as

well as FINRA and other self-regulatory organizations. These regulations cover a broad range of issues, including capital

requirements; sales and trading practices; use of client funds and securities; the conduct of directors, officers and employees;

record-keeping and recording; supervisory procedures to prevent improper trading on material non-public information; qualification

and licensing of sales personnel; and limitations on the extension of credit in securities transactions. In addition to federal

registration, state securities commissions require the registration of certain broker-dealers. PS is registered with 35 U.S. state and

territory securities commissions.

Regulation of Reinsurers, Insurance Producers and Agents

Popular’s subsidiaries that are engaged in insurance agency and producer activities are subject to regulatory supervision

by the Puerto Rico Office of the Commissioner of Insurance and to insurance laws and regulations requiring licensing of insurance

producers and agents. Popular’s reinsurance subsidiaries are subject to licensure and regulatory supervision by the Puerto Rico

Office of the Commissioner of Insurance and to insurance laws and regulations requiring, among other things, minimum capital and

solvency standards, financial reporting, restrictions on the amount of dividends payable, record keeping and examinations.

Puerto Rico Regulation

As a commercial bank organized under the laws of Puerto Rico, BPPR is subject to supervision, examination and

regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended

(the “Banking Law”).

Section 27 of the Banking Law requires that at least ten percent (10%) of the yearly net income of BPPR be credited

annually to a reserve fund. The apportionment must be done every year until the reserve fund is equal to the total of paid-in capital

on common and preferred stock. During 2024, $52.8 million was transferred to the statutory reserve account.

Section 27 of the Banking Law also provides that when the expenditures of a bank are greater than its receipts, the

excess of the former over the latter must be charged against the undistributed profits of the bank, and the balance, if any, must be

charged against the reserve fund. If the reserve fund is not sufficient to cover such balance in whole or in part, the outstanding

amount must be charged against the capital account and no dividend may be declared until capital has been restored to its original

amount and the reserve fund to 20% of the original capital.

Section 16 of the Banking Law requires every bank to maintain a legal reserve that, except as otherwise provided by the

Office of the Commissioner, may not be less than 20% of its demand liabilities, excluding government deposits (federal, state and

municipal) that are secured by collateral. If a bank is authorized to establish one or more bank branches in a state of the United

States or in a foreign country, where such branches are subject to the reserve requirements of that state or country, the Office of the

Commissioner may exempt said branch or branches from the reserve requirements of Section 16. Pursuant to an order of the

Federal Reserve Board dated November 24, 1982, BPPR has been exempted from the reserve requirements of the Federal

Reserve System with respect to deposits payable in Puerto Rico. Accordingly, BPPR is subject to the reserve requirement

prescribed by the Banking Law. During 2024, BPPR was in compliance with the statutory reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to any one person, firm, partnership or corporation, up to an

aggregate amount of fifteen percent (15%) of the paid-in capital and reserve fund of the bank. As of December 31, 2024, the legal

lending limit for BPPR under this provision was approximately $349 million. In the case of loans which are secured by collateral

worth at least 25% more than the amount of the loan, the maximum aggregate amount of such secured loans is increased to one

third of the paid-in capital of the bank, plus its reserve fund. In no event may the total of unsecured and secured loans to any one

person, firm, partnership or corporation exceed an aggregate amount of 33 1/3% of the paid-in capital and reserve fund of the bank.

If the institution is well capitalized and had been rated 1 in the last examination performed by the Office of the Commissioner or any

regulatory agency, its legal lending limit shall also include 15% of 50% of its undivided profits and for loans secured by collateral

worth at least 25% more than the amount of the loan, the capital of the bank shall also include 33 1/3% of 50% of its undivided

profits. Institutions rated 2 in their last regulatory examination may include this additional component in their legal lending limit only

with the previous authorization of the Office of the Commissioner. There are no restrictions under Section 17 on the amount of loans

that are wholly secured by bonds, securities and other evidence of indebtedness of the Government of the United States or Puerto

Rico, or by current debt bonds, not in default, of municipalities or instrumentalities of Puerto Rico. During 2024, BPPR was in

compliance with the lending limit requirements of Section 17 of the Banking Law.

Section 14 of the Banking Law authorizes a bank to conduct certain financial and related activities directly or through

subsidiaries, including finance leasing of personal property and originating and servicing mortgage loans. BPPR engages in finance

leasing through its wholly-owned subsidiary, Popular Auto, LLC, which is organized and operates in Puerto Rico. The origination

and servicing of mortgage loans is conducted by Popular Mortgage, a division of BPPR.

With respect to information privacy, Puerto Rico law requires businesses to implement information security controls to

protect consumers’ personal information from breaches, as well as to provide notice of any breach to affected customers. In 2024

Puerto Rico enacted the Cybersecurity Act of the Commonwealth of Puerto Rico, which establishes cybersecurity standards for

government entities and their contractors, including certain reporting and certification obligations. As a depositary of government

funds, BPPR could be considered a “contractor” under the statute; however, the Puerto Rico Innovation and Technology Service

has not yet adopted implementing regulation which we expect to address applicability and any exceptions to the statute’s

requirements. In addition, as noted above in “Regulation of Reinsurers, Insurance Producers and Agents”, Popular’s reinsurance

subsidiaries are subject to licensure and regulatory supervision by the Puerto Rico Office of the Commissioner of Insurance and to

insurance laws and regulations.

Available Information

We maintain an Internet website at www.popular.com (http://www.popular.com). Via the “Investor Relations” link at our website, our annual reports

on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to such reports filed or furnished

pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available, free of

charge, as soon as reasonably practicable after such forms are electronically filed with, or furnished to, the SEC. The SEC also

maintains an internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information

regarding issuers that file electronically with the SEC. You may obtain copies of our filings on the SEC site.

We have adopted a written code of ethics that applies to all directors, officers and employees of Popular, including our

principal executive officer and senior financial officers, in accordance with Section 406 of the Sarbanes-Oxley Act of 2002 and the

rules of the SEC promulgated thereunder. Our Code of Ethics is available on our corporate website, www.popular.com (http://www.popular.com), in the

section entitled “Corporate Governance.” In the event that we make changes to, or provide waivers from, the provisions of this Code

of Ethics that the SEC requires us to disclose, we intend to disclose these events on our corporate website in such section. In the

Corporate Governance section of our corporate website, we have also posted the charters for our Audit Committee, Talent and

Compensation Committee, Risk Management Committee, Corporate Governance and Nominating Committee and Technology

Committee, as well as our Corporate Governance Guidelines. In addition, information concerning purchases and sales of our equity

securities by our executive officers and directors is posted on our website.

All website addresses given in this document are for information only and are not intended to be active links or to

incorporate any website information into this Form 10-K.

Risk factors

As filed, 79,777 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

We, like other financial institutions, face risks inherent to our business, financial condition, liquidity, results of operations

and capital position. These risks could cause our actual results to differ materially from our historical results or the results

contemplated by the forward-looking statements contained in this report.

The risks described in this report are not the only risks we face. Additional risks and uncertainties not currently known by

us or that we currently deem to be immaterial, or that are generally applicable to all financial institutions, may also materially

adversely affect our business, financial condition, liquidity, results of operations or capital position.

ECONOMIC AND MARKET RISKS

Weakness in the economy, particularly in Puerto Rico, where a significant portion of our business is concentrated, has

adversely impacted us in the past and may adversely impact us in the future.

We have been, and will continue to be, impacted by global and local economic and market conditions, including weakness

in the economy, disruptions and volatility in the financial markets, inflation, monetary, trade and fiscal policies, public policy,

geopolitical conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated in

Puerto Rico, which accounted for approximately 77% of our assets and 80% of our deposits as of December 31, 2024 and 79% of

our revenues for the year ended December 31, 2024. As a result, our financial condition and results of operations are highly

dependent on the general trends of the Puerto Rico economy and other conditions affecting Puerto Rico consumers and

businesses. The concentration of our operations in Puerto Rico exposes us to greater risks than other banking companies with a

wider geographic base.

Puerto Rico has faced significant economic and fiscal challenges in the past, including a severe recession that began in

2007 and persisted for over a decade and an acute fiscal crisis that led the Puerto Rico government to file for a form of federal

bankruptcy protection in 2017. Puerto Rico’s fiscal and economic challenges have in the past adversely affected our customers,

resulting in higher delinquencies, charge-offs and increased losses for us. While Puerto Rico’s economy has been gradually

recovering and the Puerto Rico government emerged from bankruptcy in 2022, Puerto Rico still faces significant economic and

fiscal challenges.

Puerto Rico’s economy is closely tied to the U.S. economy, as well as highly reliant on U.S. public policy and funding

decisions. Puerto Rico has historically received significant federal support for a wide range of government programs and services,

including healthcare, education, infrastructure and social assistance programs. More recently, Puerto Rico has received significant

federal stimulus, disaster relief and reconstruction funding, which has served as a major driver of economic activity. Reductions in

federal funding for Puerto Rico or delays in disbursements could significantly impact Puerto Rico’s economy and hinder

reconstruction efforts, including the restoration and improvement of critical infrastructure. The Trump Administration is conducting a

review of federal funding, and we believe that the amount of federal funding to programs that have benefited the Puerto Rico

economy could be reduced, perhaps significantly. Beyond direct funding, broader shifts in U.S. policy, such as changes to tax or

trade policies, and shifts in policies of other governments in response, could also adversely impact the Puerto Rico economy. A

weakening of the Puerto Rico economy or other adverse economic conditions affecting Puerto Rico consumers and businesses

could result in decreased demand for our products or services, deterioration in the credit quality of our customers, higher

delinquencies, charge-offs or increased losses, all of which could adversely affect our business, financial condition, liquidity, results

of operations or capital position.

We are also exposed to risks related to the state of the local economies of the other markets in which we do business,

such as New York and Florida, as well as to the state of the global and U.S. economy and financial markets. Evolving geopolitical

tensions, the introduction or escalation of tariffs, inflationary pressures and other political or economic shifts may lead to increased

market volatility and disruption. These factors could, in turn, adversely impact our business, financial condition, liquidity, results of

operations or capital position.

Changes in interest rates and credit spreads can adversely impact our financial condition, including our investment

portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments.

Our business and financial performance are impacted by market interest rates and movements in those rates. Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

a material impact on our results of operations and the values of our assets and liabilities, including our investment portfolio. Interest

rates are highly sensitive to many factors over which we have no control and which we may not be able to anticipate adequately,

including general economic conditions and the monetary and tax policies of various governmental bodies, particularly the Federal

Reserve Board. Changes in these policies, including changes in interest rates, impact various aspects of our business, including

loan originations, the speed of prepayments, loan delinquencies, the value of our investments, the rates we receive on our loans

and investment securities, our ability to maintain and generate deposits and the rates we pay on our deposits and other funding

sources. The effects of these changes may be amplified if we are unable to effectively manage the sensitivity of our assets and

liabilities to market interest rate changes.

The rapid rise in interest rates in 2022 resulted in approximately $2.5 billion in unrealized mark-to-market losses on available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with a fair value of approximately $6.5 billion (par value of $7.4 billion), and with accumulated unrealized losses of $873 million, from our available-for-sale portfolio to our held-to-maturity portfolio. While the size of our unrealized mark-to-market losses on available-for- sale securities had been reduced to $1.3 billion as of December 31, 2024, if interest rates were to again rise rapidly or for a prolonged period, we may accumulate significant additional mark-to-market losses on investment securities in our available-for-sale portfolio, which may adversely affect our tangible capital and impact our ability to return capital to our stockholders.

For a discussion of the Corporation’s interest rate sensitivity, please refer to the “Risk Management” section of the MD&A

in this Form 10-K.

BUSINESS RISKS

Negative changes in the financial condition of our clients have adversely impacted us in the past and may adversely

impact us in the future.

A significant portion of our business involves lending money, which exposes us to credit risk and risk of loss if borrowers

do not repay their loans, leases, credit cards or other credit obligations. The performance of these credit portfolios significantly

affects our financial condition and results of operations. We have in the past been adversely affected by negative changes in the

financial condition of our clients due to weakness in the Puerto Rico and U.S. economy. If the current economic environment were to

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels of credit losses

and reserves for credit losses.

We are exposed to increased credit risks and credit losses to the extent our clients are concentrated by industry segment

or type of client.

Our credit risk and credit losses can increase to the extent our loans are concentrated in borrowers engaged in the same

or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by certain economic or market

conditions. We have significant exposure to borrowers in certain economic sectors, such as residential and commercial real estate,

hospitality and healthcare. Challenging economic or market conditions that affect the industries or types of clients to which we have

significant exposure could result in higher credit losses and adversely affect our business, financial condition, liquidity, results of

operations or capital position.

We also have direct lending and investment exposure to Puerto Rico government entities, which have faced significant

fiscal challenges. At December 31, 2024, our exposure to the Puerto Rico government consisted of $336 million in direct lending

exposure to Puerto Rico municipalities and $220 million in loans insured or securities issued by Puerto Rico governmental entities

but for which the principal source of repayment is non-governmental. and indirect lending exposure to the Puerto Rico government

in the form of loans to private borrowers who are service providers, lessors, suppliers or have other relationships with the Puerto

Rico government. While the overall fiscal situation of the Puerto Rico government has improved in recent years, including as a result

of the government and certain of its instrumentalities having restructured their debt obligations, some Puerto Rico government

entities, including certain municipalities, still face significant fiscal challenges. A deterioration in the fiscal situation of the Puerto Rico

government and its instrumentalities, and in particular the fiscal situation of the Puerto Rico municipalities to which we have direct

lending exposure, could result in higher credit losses and reserves for credit losses. For a discussion of risks related to the

Corporation’s credit exposure to the Puerto Rico and USVI governments, see the Geographic and Government Risk section in the

MD&A section of this Form 10-K.

Deterioration in the values of real properties securing our commercial, mortgage loan and construction portfolios have in

the past resulted, and may in the future result, in increased credit losses and harm our results of operations.

As of December 31, 2024, approximately 55% of our loan portfolio consisted of loans secured by real estate collateral

(comprised of 29% in commercial loans, 22% in residential mortgage loans and 3% in construction loans). The value of the collateral

securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy

of some of the markets we serve has in the past resulted in significant declines in the value of the real properties securing our loan

portfolio, leading to increased credit losses. If the value of the real estate properties securing our loan portfolio declines again in the

future, we may be required to increase our provisions for loan losses and allowance for loan losses. Any such increase could have

an adverse effect on our financial condition and results of operations. For more information on the credit quality of our construction,

commercial and mortgage portfolio, see the Credit Risk section of the MD&A included in this Form 10-K.

Defective and repurchased loans may harm our business and financial condition.

In connection with the sale and securitization of mortgage loans, we are required to make a variety of customary

representations and warranties regarding Popular and the loans being sold or securitized. Our obligations with respect to these

representations and warranties are generally outstanding for the life of the loan, and they relate to, among other things, compliance

with laws and regulations, underwriting standards, the accuracy of information in the loan documents and loan file and the

characteristics and enforceability of the loan. A loan that does not comply with the secondary market’s requirements may take

longer to sell, impact our ability to securitize the loans or pledge the loans as collateral for borrowings, or be unsalable or salable

only at a significant discount. Moreover, if any such loan is sold before we detect non-compliance, we may be obligated to

repurchase the loan and bear any associated loss directly, or we may be obligated to indemnify the purchaser against any loss. We

seek to minimize repurchases and losses from defective loans by correcting flaws, if possible, and selling or re-selling such loans.

However, if we were to suffer significant losses from defective and repurchased loans, our results of operations and financial

condition could be materially impacted.

If we are unable to maintain or grow our deposits, we may be subject to paying higher funding costs and our net interest

income may decrease.

We rely primarily on bank deposits as a low cost and stable source of funding for our lending and investment activities and

the operation of our business. Therefore, our funding costs are largely dependent on our ability to maintain and grow our deposits.

As our competitors have raised the interest rates they pay on deposits, our funding costs have increased, as we have had to

increase the rates we pay to our depositors to avoid losing deposits and to procure new ones. Rising interest rates have also led

customers to move their funds to alternative investments that pay higher interest rates. Additionally, periods of market stress or lack

of market or customer confidence in financial institutions may result in a loss of customer deposits, especially to the extent those

deposits are in excess of the FDIC-insured limit of $250,000. As of December 31, 2024, we had $13 billion of total deposits (other

than collateralized public funds, which represent public deposit balances from governmental entities in the U.S. and its territories,

including Puerto Rico and the United States Virgin Islands, that are collateralized based on such jurisdictions’ applicable collateral

requirements) in excess of the FDIC-insured limit. If deposits decrease, we may need to rely on more expensive sources of funding,

which would negatively impact our interest rate margin and net interest income. In addition, a reduction in our deposits would

decrease our earning assets, which would also negatively affect our net interest income.

We have a significant amount of deposits from the Puerto Rico government, its instrumentalities and municipalities ($19.5

billion, or approximately 30% of our total deposits, as of December 31, 2024), and the amount of these deposits may fluctuate

depending on the financial condition and liquidity of these entities, as well as on our ability to maintain these customer relationships.

Under the terms of BPPR’s deposit pricing agreement with the Puerto Rico government, most public fund deposit rates are market

linked with a lag minus a specified spread. Therefore, as market rates rise, we are required to sequentially increase the rates we

pay our public deposits. If the mix of our deposits shifts towards a higher proportion of higher-cost deposits for any reason, our

funding costs would increase and our net interest income would be expected to decrease.

OPERATIONAL RISKS

We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks, which

could cause substantial harm and have an adverse effect on our business and results of operations.

Cybersecurity risks for large financial institutions such as Popular have increased significantly in recent years in part

because of the proliferation of new technologies, such as mobile banking, cloud hosting, artificial intelligence and the ability to

conduct instant financial transactions anywhere globally, as well as due to geopolitical conflicts and the increased sophistication

and activities of organized crime, hackers, terrorists, nation-states, hacktivists and other parties. The risk of cyber-attacks is

expected to increase with the evolution and emergence of new technologies such as artificial intelligence and quantum computing.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our

operations and to transmit and store sensitive data. Notwithstanding our defensive measures and the significant resources we

devote to protecting the security of our systems, there is no assurance that all of our security measures will be effective at all times,

especially as the threats from cyber-attacks are continuous and severe. The risk of a security breach due to a cyber-attack is

expected to increase as we continue to expand our mobile banking and other internet-based product offerings, the use of the cloud

for system development and hosting and internal use of internet-based products and applications.

We continue to detect and identify attacks that are becoming more sophisticated and increasing in volume, as well as

attackers that respond rapidly to changes in defensive countermeasures. The most significant cyber-attack risks that we or our critical service providers may face include, but are not limited to, e-fraud, denial-of-service (DDoS), ransomware, computer intrusion and the exploitation of software zero-day vulnerabilities that might result in disruption of services, in the exposure or loss of customer or proprietary data, and significant financial loss. Loss from e-fraud occurs when cybercriminals compromise our systems or the systems of our customers and extract funds from customer’s credit cards or bank accounts, including through brute force, password spraying and credential stuffing attacks directed at gaining unauthorized access to individual accounts. Denial-of-service attacks intentionally disrupt the ability of legitimate users, including customers and employees, to access networks, websites and online resources. Computer intrusion attempts, either direct or through social engineering (pretext calls), supply chain compromise, email, text or voice messages, including using brand impersonation (regularly referred to as phishing, vishing, smishing and quishing), have resulted in and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security numbers, and could present significant reputational, legal and regulatory costs to Popular if successful.

Our customer-facing platforms are also routinely attacked by threat actors aiming to gain unauthorized access to our

clients’ accounts. Although we have implemented defensive measures designed to protect against such attacks, there is no

assurance that these defensive measures will keep pace with threats that are continuous and growing in severity. For example,

certain customers have been affected by brute force attacks on one of our platforms, which resulted in certain of our customers log-

in credentials and information being exposed and accounts being taken over, resulting in fraudulent transfers or withdrawals.

Popular customers have also been impacted by card skimming events in our ATM terminals. As a result, we have notified, and

conducted additional remediation for, customers identified as affected by these incidents. Cyber-security risks have also been

recently exacerbated by the discovery of zero-day vulnerabilities in widely distributed third party software, which have in the past

affected and in the future could affect Popular’s or any of its service provider’s systems, as further detailed below.

The increased use of remote access and third-party video conferencing solutions to enable work-from-home

arrangements for employees and facilitate the use of digital channels by our customers, has also increased our exposure to cyber-

attacks, including through the use of deep fakes and brand impersonation. In addition, a third party could misappropriate confidential

information obtained by intercepting signals or communications from mobile devices used by Popular’s customers or employees.

Recent geopolitical conflicts have also exacerbated the risks related to supply-chain compromises and de-stabilizing activities of

nation-state sponsored actors. Although we are regularly targeted by unauthorized threat-actor activity, we have not, to date,

experienced any material losses as a result of cyber-attacks.

A material compromise or circumvention of the security of our systems could have serious negative consequences for us,

including significant disruption of our operations and those of our clients, customers and counterparties, misappropriation of

confidential information of Popular or that of our clients, customers, counterparties or employees, or damage to computers or

systems used by us or by our clients, customers and counterparties, and could result in violations of applicable privacy and other

laws, financial loss to us or to our customers, increased regulatory scrutiny and enforcement actions, customer dissatisfaction,

significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us.

The extent of a particular cyber-attack and the steps that we may need to take to investigate the attack may not be

immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an

investigation is ongoing, Popular may not necessarily know the full extent of the harm caused by the cyber-attack, and that damage

may continue to spread. These factors may inhibit our ability to provide rapid, full and reliable information about the cyber-attack to

our clients, customers, counterparties and regulators, as well as the public. Moreover, new regulations may require us to disclose

information about a cybersecurity event before it has been resolved or fully investigated. Furthermore, it may not be clear how best

to contain and remediate the potential harm caused by the cyber-attack, and certain errors or actions could be repeated or

compounded before they are discovered and remediated. Cyber-attacks could also cause interruptions in our operations and result

in the incurrence of significant costs, including those related to forensic analysis and legal counsel.

We also rely on third parties for the performance of a significant portion of our information technology functions and the

provision of information security, technology and business process services. As a result, a successful compromise or circumvention

of the security of the systems of these third-party service providers could have serious negative consequences for us, including

compromise of our systems, misappropriation of our confidential information or that of our clients, customers, counterparties or

employees, or other negative implications identified above with respect to a cyber-attack on our systems. The most important of

these third-party service providers for us is Evertec. As a result, we depend on Evertec to identify and remediate certain of our

cybersecurity vulnerabilities. Cyber-attacks at third-party service providers are also becoming increasingly common, and, as a result,

cybersecurity risks relating to our vendors, including Evertec have increased. Certain risks particular to Evertec and our dependence

on third parties are discussed under “We rely on other companies to provide key components of our business infrastructure, including certain of our core financial transaction processing and information technology and security services, which exposes us to a number of operational risks that could have a material adverse effect on us” in the Operational Risks section of Item 1A in this

Form 10-K. During 2021, we determined that, as a result of the widely reported breach of Accellion, Inc.’s File Transfer Appliance

tool, which was being used at the time of such breach by a U.S.-based third-party advisory services vendor of Popular, personal

information of certain Popular customers was compromised. During 2023, personal information of Popular customers’ data was

compromised in a data breach incident that impacted MOVEit, the third-party file transfer platform used by one of our service

providers. In both instances, Popular notified, as required or otherwise deemed appropriate, customers identified as affected by the

incident. Furthermore, during 2024, threat actors exploited a zero-day vulnerability in the Fortinet enterprise management server

software used by Evertec, which migrated to one of Popular's domain controllers due to a shared network environment. While

Evertec determined that no BPPR customer information was exfiltrated as a result of this incident, the event underscores the risks

inherent in Popular’s dependency on Evertec. Although these incidents did not have a material effect on Popular, including its

business strategy, results of operations or financial condition, and our third-party service providers agreed to cover external

remediation costs associated therewith, a compromise of Popular information or the personal information of our customers

maintained by third party vendors could result in significant regulatory consequences, reputational damage and financial loss to us.

The success of our business depends in part on the continuing ability of these (and other) third parties to perform these functions

and services in a timely and satisfactory manner, which performance could be disrupted or otherwise adversely affected due to

failures or other information security events originating at the third parties or at the third parties’ suppliers or vendors (so-called

“fourth party risk”). We may not be able to effectively directly monitor or mitigate fourth-party risk, in particular as it relates to the use

of common suppliers or vendors by the third parties that perform functions and services for us.

As cyber threats continue to evolve, we also expect to expend significant additional resources to continue to modify or

enhance our layers of defense or to investigate and remediate additional information security vulnerabilities or incidents. The

obsolescence in our hardware or software limits our ability to mitigate vulnerabilities. System enhancements and updates also

create risks associated with implementing new systems and integrating them with existing ones, including risks associated with

supply chain compromises and the software development lifecycle of the systems used by us and our service providers. In addition,

addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our

information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate

vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat

actors. Moreover, our efforts to timely mitigate vulnerabilities and manage such risks, given the rise in number and urgency of

required patches and third-party software, as well as the obsolescence in some of our hardware and software, may impact our day-

to-day operations, the availability of our systems and delay the deployment of technology enhancements and innovation.

If Popular’s operational systems, or those of external parties on which Popular’s businesses depend, are unable to meet

the requirements of our businesses and operations or bank regulatory standards, or if they fail, have other significant shortcomings

or are impacted by cyber-attacks, Popular could be materially and adversely affected.

Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters,

acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other

consequences that could have a material adverse effect on our financial condition and results of operations.

significant portion of our operations are located in the Caribbean and Florida, a region susceptible to hurricanes,

earthquakes and other similar events. In 2017, Puerto Rico, USVI and BVI were severely impacted by Hurricanes Irma and María,

which resulted in significant disruption to our operations and adversely affected our clients in these markets, and in 2022, Hurricane

Fiona impacted the southwest area of Puerto Rico, adversely affecting our customers in that region. Other types of unforeseen or

catastrophic events, including pandemics, epidemics, man-made disasters, or acts of violence or war, or the fear that such events

could occur in the future, could also adversely impact our operations and financial results. For example, in 2020, the COVID-19

pandemic severely impacted global health, financial markets, consumer spending and global economic conditions, and caused

significant disruption to businesses worldwide, including our business and those of our customers, service providers and suppliers.

Future unforeseen or catastrophic events, and actions taken by governmental authorities and other third parties in response to such

events, could adversely affect our operations, cause economic and market disruption, adversely impact the ability of borrowers to

timely repay their loans, or affect the value of any collateral held by us, any of which could have a material adverse effect on our

business, financial condition or results of operations. The frequency, severity and impact of future unforeseen or catastrophic events

is difficult to predict. While we maintain insurance against natural disasters and other unforeseen events, including coverage for

business interruption, the insurance may not be sufficient to cover all of the damage from any such event, and there is no insurance

against the disruption that a catastrophic event could produce to the markets that we serve and the potential negative impact to

economic activity.

Climate change could have a material adverse impact on our business operations and that of our clients and customers.

Our business and the activities and operations of our clients and customers may be disrupted by global climate change.

Potential physical risks from climate change include the increase in the frequency and severity of weather events, such as storms

and hurricanes, and long-term shifts in climate patterns, such as sustained higher and lower temperatures, sea level rise, heat

waves and droughts, among others. Our geographic concentration in localities, including Puerto Rico, the U.S.V.I., B.V.I. and

Florida, particularly susceptible to risks arising from climate change, including severe hurricanes and sea level rise, heighten the

threat we face from climate change. Additionally, the impact of climate change in the markets that we operate and in other global

markets may have the effect of increasing the costs or reducing the availability of insurance needed for our business operations.

Climate change may also create transitional risks resulting from a shift to a low-carbon economy. These transition risks may include

changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to

mitigate the effects of climate change. Changes in the legal and regulatory landscape may additionally increase our compliance

costs. These climate-driven changes could have a material adverse impact on asset values and on our business and financial

performance and those of our clients and customers.

We rely on other companies to provide key components of our business infrastructure, including certain of our core

financial transaction processing and information technology and security services, which exposes us to a number of

operational risks that could have a material adverse effect on us.

Third parties provide key components of our business operations, such as data processing, information security, recording

and monitoring transactions, online banking interfaces and services, Internet connections and network access. The most important

of these third-party service providers for us is Evertec. We are dependent on Evertec for the provision of essential services to our

business, including certain of our core financial transaction processing and information technology and security services. As a result,

we are particularly exposed to the operational risks of Evertec, including those related to its security architecture and potential

breakdowns or failures of Evertec’s systems or internal controls environment.

Over the course of our relationship with Evertec, we have experienced interruptions and delays in key services provided

by Evertec, as well as cyber events, as a result of system breakdowns, their exposure to zero-day vulnerabilities, misconfigurations,

human error, application obsolescence and dependency on shared infrastructure components and shared environments, which

have in certain cases also led to exposure of Popular information and BPPR customer information. In particular, the current level of

obsolescence in the hardware and software used by Evertec to service us exposes us to heightened operational and cybersecurity

risks, including system outages. Our ability to cure legacy obsolescence in the hardware and software we procure from Evertec, to

expand our oversight over security services being provided by Evertec, as well as to effect the segregation of our shared

infrastructure, is expected to be lengthy and complex, which exacerbates our exposure to resulting operational, including

cybersecurity, risks. See “The transition to new financial services technology providers, and the replacement of services currently

provided to us by Evertec, will be lengthy and complex” in the Operational Risks section of Item 1A in this Form 10-K below.

While we select third-party vendors carefully and have increased our oversight of these relationships, our oversight is

constrained by the level of our ongoing visibility into our vendor’s systems and operations, and we do not have direct control over

their actions, assets or services. Any problems caused by these vendors, including those resulting from disruptions in the services

provided, vulnerabilities in or breaches of the vendor’s systems or environments, failure of the vendor to handle current or higher

volumes, failure of the vendor to provide services for any reason or poor performance of services, failure of the vendor to notify us of

a reportable event in a timely manner, our vendors’ misuse of artificial intelligence and other automatic decision making

technologies, could adversely affect our ability to deliver products and services to our customers and otherwise conduct our

business, disrupt our operations, result in potential liability to clients and customers, result in the imposition of fines, penalties or

judgments by our regulators, lead to exposure of our information or that of our customers or harm to our reputation, any of which

could materially and adversely affect us. The inability of our third-party service providers to timely address cybersecurity threats may

further exacerbate these risks. Financial or operational difficulties of a third-party vendor could also hurt our operations if those

difficulties interfere with the vendor’s ability to serve us. Replacing these third-party vendors, when possible, could also create

significant delay and expense. Accordingly, the use of third parties creates an unavoidable inherent risk to our business operations.

The transition to new financial services technology providers, and the replacement of services currently provided to us by

Evertec, will be lengthy and complex.

Switching from one vendor of core bank processing and related technology and security services to one or more new

vendors is a complex process that carries business and financial risks. The implementation cycle for such a transition can be

lengthy and require significant financial and management resources from us. Such a transition can also increase costs (including conversion costs) and expose us and our clients to business disruption, as well as operational and cybersecurity risks. Upon the transition of all or a portion of existing services provided by Evertec to new financial services technology providers, either (i) at the end of the term of the Second Amended and Restated Master Services Agreement (the “MSA”) and related agreements or (ii) earlier upon the termination of any service for convenience under the MSA, these transition risks could result in an adverse effect on our business, financial condition and results of operations. Although Evertec has agreed to provide certain transition assistance to us in connection with the termination of the MSA, we are ultimately dependent on their ability to provide those services in a responsive and competent manner, as well as to retain experienced personnel to provide the services. Furthermore, we may require transition assistance from Evertec beyond the term of the MSA, delaying and lengthening any transition process away from Evertec while increasing related costs.

Under the MSA, we are able to terminate services for convenience with 180 days’ prior notice. We expect to exercise

during the term of the MSA the right to terminate certain services for convenience and to transition such services to other service

providers prior to the expiration of the MSA, subject to complying with the revenue minimums contemplated in the MSA and certain

other conditions. In practice, in order to switch to a new provider for a particular service, we will have to commence procuring and

working on a transition process for such service significantly in advance of its termination and, in any case, much earlier than the

automatic renewal notice date or the expiration date of the MSA, and such process may extend beyond the current term of the MSA.

Furthermore, if we are unsuccessful or decide not to complete the transition after expending significant funds and management

resources, it could also result in an adverse effect on our business, financial condition and results of operations.

LEGAL AND REGULATORY RISKS

Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our

business and operations.

We are subject to extensive and evolving regulation under U.S. federal, state and Puerto Rico laws that govern almost all

aspects of our operations and limit the businesses in which we may be engaged, including regulation, supervision and examination

by federal, state and foreign banking authorities. These laws and regulations have expanded significantly over an extended period

of time and are primarily intended for the protection of consumers, borrowers and depositors. Compliance with these laws and

regulations has resulted, and will continue to result, in significant costs. Additionally, the new federal administration is pursuing a

regulatory agenda significantly different from that of the previous administration, including the possible reversal of rules promulgated

under the past administration and shifts in rulemaking, supervision, examination and enforcement priorities. The implementation of

that agenda is happening rapidly and is constantly evolving. The potential impact of any such changes cannot be predicted at this

time.

Additional laws and regulations may be enacted or adopted in the future, and the application, interpretation or

enforcement of laws and regulations may in the future be changed (including through executive orders), in ways that could

significantly affect our powers, authority and operations and which could have a material adverse effect on our financial condition

and results of operations. In particular, we could be adversely impacted by changes in laws and regulations, or changes in the

application, interpretation or enforcement of laws and regulations, that proscribe or institute more stringent restrictions on certain

financial services activities, impose monetary fines or other penalties on institutions that fail to comply with applicable laws and

regulations, or impose new requirements relating to the impact of business activities on ESG concerns, the management of risks

associated with those concerns and the extent to which ESG-related objectives are taken into account in financing and other

business activities and decision-making, such as the offering of products intended to achieve ESG-related objectives. For example,

certain states have enacted, or have proposed to enact, statutes that prohibit financial institutions from denying or canceling

products or services to a person, or otherwise discriminating against a person in making available products or services, on the basis

of social credit scores and certain other factors. In addition, new laws or regulations could require significant system and process

changes that require systems upgrades and could limit our ability to meet adoption timeframes or pursue our innovation roadmap. If

we do not appropriately comply with current or future laws or regulations, adapt to the changing interpretation of existing laws or

regulations, or if we fail to meet supervisory expectations, we may be subject to fines, penalties or judgements, or to material

regulatory restrictions on our business, which could also materially and adversely affect our business, financial condition, liquidity,

results of operations or capital position.

In 2023, the federal banking regulators proposed revisions to the U.S. capital rules and new long-term debt requirements

for banking organizations with $100 billion or more in assets. Higher capital requirements or new long-term debt requirements could

increase interest and noninterest expense for banking organizations subject to those requirements. In addition, during 2023, the

federal banking regulators indicated that they are considering revisions to liquidity requirements applicable to banking organizations

with $100 billion or more in light of the failures of three large banks in March and May 2023. Any such revisions could require large banks to change the size and composition of their liquidity portfolios, which could have adverse effects on net interest income and net interest margin.

These proposals and anticipated proposals reflect a trend of increasingly stringent regulatory requirements for banking

organizations with assets of $100 billion or more, relative to smaller banking organizations, as well as less differentiation in the

requirements applicable among banking organizations with $100 billion or more in assets. Although Popular currently has less than

$100 billion in assets, actual, anticipated or potential changes in regulatory requirements for banking organizations with at least

$100 billion in assets could result in Popular deciding not to pursue growth opportunities that would result in its assets approaching

or exceeding that threshold, or if Popular’s assets do exceed that threshold, a need for Popular to increase its regulatory capital,

issue substantial amounts of long-term debt or incur other significant expenses in order to satisfy applicable regulatory

requirements.

Our participation (or lack of participation) in certain governmental programs, such as the Paycheck Protection Program

(“PPP”) enacted in response to the COVID-19 pandemic, also exposes us to increased legal and regulatory risks. We have also

been and could continue to be exposed to adverse action for the violation of applicable legal requirements or the improper conduct

of our employees in connection with such loans. For example, on January 24, 2023, Popular Bank consented to the imposition of an

order from the Federal Reserve Board requiring it to pay a $2.3 million civil money penalty to settle certain findings arising from

Popular Bank’s approval of six Payment Protection Program loans.

We are from time to time subject to information requests, investigations and other regulatory enforcement proceedings

from departments and agencies of the U.S. and Puerto Rico governments, including those that investigate compliance with

U.S. sanctions and consumer protection laws and regulations, which may expose us to significant penalties and collateral

consequences, and could result in higher compliance costs or restrictions on our operations.

We from time-to-time self-report compliance matters to, or receive requests for information from, departments and

agencies of the U.S. and Puerto Rico governments, including with respect to compliance with consumer protection laws and

regulations. For example, BPPR has in the past received requests for information, such as subpoenas and civil investigative

demands from U.S. government regulators, including concerning add-ons on consumer products, real estate appraisals and

residential and construction loans in Puerto Rico. BPPR has also self-identified and reported to applicable regulators compliance

matters related to U.S. sanctions, as well as mortgage, credit reporting and other consumer lending practices.

Incidents of this nature and investigations or examinations by governmental authorities have resulted in the past, and may

in the future result, in judgments, settlements, fines, enforcement actions, penalties or other sanctions adverse to the Corporation,

which could materially and adversely affect the Corporation’s business, financial condition, results of operations or capital position or

cause serious reputational harm. Any such settlements or orders that we enter into, or that regulatory authorities impose on us could

require enhancements to our procedures and controls and entail significant operational and compliance costs. Furthermore, issues

or delays in satisfying the requirements of a regulatory settlement or action on a timely basis could result in additional penalties and

enforcement actions, which could be significant. In connection with the resolution of regulatory proceedings, enforcement authorities

may seek admissions of wrongdoing and, in some cases, criminal pleas, which could lead to increased exposure to private litigation,

loss of clients or customers, and restrictions on offering certain products or services. In addition, responding to information-gathering

requests, investigations and other regulatory proceedings, regardless of the ultimate outcome of the matter, could be time-

consuming, expensive and divert management attention from our business.

Financial services institutions such as Popular have been subject to heightened expectations and regulatory scrutiny in

recent years. Our regulators’ oversight is not limited to banking and financial services laws but extends to other significant laws

such as those related to anti money laundering, anti-bribery and anti-corruption laws. Further, regulators in the performance of their

supervisory and enforcement duties, have significant discretion and power to prevent or remedy what they deem to be unsafe and

unsound practices or violations of laws by banks and bank holding companies. Therefore, the outcome of any investigative or

enforcement action, which may take years and be material to Popular, may be difficult to predict or estimate.

Complying with economic and trade sanctions programs and anti-money laundering laws and regulations can increase our

operational and compliance costs and risks. If we, and our subsidiaries, affiliates or third-party service providers, are

found to have failed to comply with applicable economic and trade sanctions programs and anti-money laundering laws

and regulations, we could be exposed to fines, sanctions and penalties, and other regulatory actions, as well as

governmental investigations.

As a federally regulated financial institution, we must comply with regulations and economic and trade sanctions and

embargo programs administered by the Office of Foreign Assets Control (“OFAC”) of the U.S. Treasury, as well as anti-money

laundering laws and regulations, including those under the Bank Secrecy Act.

Economic and trade sanctions regulations and programs administered by OFAC prohibit U.S.-based entities from entering

into or facilitating unlicensed transactions with, for the benefit of, or in some cases involving the property and property interests of,

persons, governments or countries designated by the U.S. government under one or more sanctions regimes, and also prohibit

transactions that provide a benefit that is received in a country designated under one or more sanctions regimes. We are also

subject to a variety of reporting and other requirements under the Bank Secrecy Act, including the requirement to file suspicious

activity and currency transaction reports, that are designed to assist in the detection and prevention of money laundering, terrorist

financing and other criminal activities. In addition, as a financial institution we are required to, among other things, identify our

customers, adopt formal and comprehensive anti-money laundering programs, scrutinize or altogether prohibit certain transactions

of special concern, and be prepared to respond to inquiries from U.S. law enforcement agencies concerning our customers and their

transactions. Failure by the Corporation, its subsidiaries, affiliates or third-party service providers to comply with these laws and

regulations could have serious legal and reputational consequences for the Corporation, including the possibility of regulatory

enforcement or other legal action, including significant civil and criminal penalties. We also incur higher costs and face greater

compliance risks in structuring and operating our businesses to comply with these requirements. The markets in which we operate

heighten these costs and risks.

We have established risk-based policies and procedures and employed software designed to assist us and our personnel

in complying with these applicable laws and regulations. Even if the appropriate controls are in place, there can be no assurance

that our policies and procedures will prevent us from blocking and rejecting all applicable transactions of our customers or our

customers’ customers that may involve a sanctioned person, government or country. Any failure to detect and prevent any such

transaction could result in a violation of applicable laws and regulations and adversely affect our reputation, business, financial

condition and results of operations.

From time to time we have identified and voluntarily self-disclosed to OFAC transactions that were not timely identified,

blocked or rejected by our policies, controls and procedures for screening transactions that might violate the regulations and

economic and trade sanctions programs administered by OFAC. For example, during the second quarter of 2022, BPPR entered

into a settlement agreement with OFAC with respect to certain transactions processed on behalf of two employees of the

Government of Venezuela, in apparent violation of U.S. sanctions against Venezuela. Popular agreed to pay approximately

$256,000 to settle the apparent violations, which had been self-disclosed to OFAC. There can be no assurances that any failure to

comply with U.S. sanctions and embargoes, or with anti-money laundering laws and regulations, will not result in material fines,

sanctions or other penalties being imposed on us.

Furthermore, if the policies, controls, and procedures of one of the Corporation’s third-party service providers, together

with our third-party oversight of such providers, do not prevent it from violating applicable laws and regulations in transactions in

which it engages, such violations could adversely affect its ability to provide services to us.

We are subject to regulatory capital adequacy requirements, and if we fail to meet these requirements our business and

financial condition will be adversely affected.

Under regulatory capital adequacy requirements, and other regulatory requirements, Popular and our banking subsidiaries

must meet requirements that include quantitative measures of assets, liabilities and certain off-balance sheet items, subject to

qualitative judgments by regulators regarding components, risk weightings and other factors. If we fail to meet these minimum

capital requirements and other regulatory requirements, our business and financial condition will be materially and adversely

affected. If a financial holding company fails to maintain well-capitalized status under the regulatory framework, or is deemed not

well managed under regulatory exam procedures, or if it experiences certain regulatory violations, its status as a financial holding

company and its related eligibility for a streamlined review process for acquisition proposals, and its ability to offer certain financial

products, may be compromised and its financial condition and results of operations could be adversely affected. The failure of any

depository institution subsidiary of a financial holding company to maintain well-capitalized or well-managed status could have

similar consequences.

In addition, federal regulators have proposed revisions to increase capital requirements for banking organizations with

$100 billion or more in assets. If adopted, such standards may in the future affect us. See “Our businesses are highly regulated, and

the laws and regulations that apply to us have a significant impact on our business and operations” in the Legal and Regulatory

Risks section of Item 1A in this Form 10-K.

Increases in FDIC insurance premiums may have a material adverse effect on our earnings.

Substantially all the deposits of BPPR and PB are subject to insurance up to applicable limits by the FDIC’s deposit

insurance fund (“DIF”) and, as a result, BPPR and PB are subject to FDIC deposit insurance assessments. On October 18, 2022,

the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first

quarterly assessment period of 2023. In addition, in November 2023, the FDIC finalized a rule that imposes a special assessment to

recover the costs to the DIF resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution

test under the FDIA in connection with the receiverships of Silicon Valley Bank and Signature Bank. The exact amount of this

assessment will be determined when the FDIC terminates the related receiverships considered in the final rule. Accordingly, the final

special assessment amount and collection period may change as the estimated cost is periodically adjusted or if the total amount

collected varies. For example, in June 2024, due to an increased estimate of losses, the FDIC announced that it projects that the

special assessment will be collected for an additional two quarters beyond the initial eight-quarter collection period, at a lower rate.

We are generally unable to control the amount of premiums or additional assessments that we are required to pay for

FDIC insurance. If there are additional bank or financial institution failures, our level of non-performing assets increases, or our risk

profile changes or our capital position is impaired, we may be required to pay even higher FDIC premiums. Any future additional

increases in FDIC premiums, assessment rates or special assessments may materially adversely affect our results of operations.

See the “Supervision and Regulation—FDIC Insurance” discussion in Item 1. Business of this Form 10-K for additional information

related to the FDIC’s deposit insurance assessments applicable to BPPR and PB.

The resolution of pending litigation and regulatory proceedings, if unfavorable to us, could have material adverse financial

effects or cause us significant reputational harm, which, in turn, could seriously harm our business prospects.

We face legal risks in our businesses, and the volume of claims and amount of damages and penalties claimed in

litigation and regulatory proceedings against financial institutions remains high. We are involved in a number of litigation, arbitration

and regulatory proceedings in the ordinary course of our business. Substantial legal liability or significant regulatory action against

us could have material adverse financial effects or cause significant reputational harm to us or other adverse consequences, which

in turn could seriously harm our business prospects. For further information relating to our legal risk, see Note 24 - “Commitments &

Contingencies”, to the Consolidated Financial Statements in this Form 10-K.

LIQUIDITY RISKS

We are subject to liquidity risks arising from market events or disruptions and instances of low investor and depositor

confidence. Furthermore, actions by the rating agencies or decreases in our capital levels may have adverse effects on our

liquidity and business, including by raising the cost of our obligations or affecting our ability to borrow.

We must maintain adequate liquidity and funding sources to support our operations, fund customer deposit withdrawals,

repay borrowings and debt, comply with our financial obligations, fund planned capital distributions and meet regulatory

requirements. The Corporation’s most significant source of funds are bank deposits, including customer deposits and brokered

deposits. In addition to deposits, sources of liquidity include secured borrowing arrangements, such as those with the Federal

Reserve Bank of New York and the Federal Home Loan Bank of New York (“FHLBNY”), unpledged securities from our investment

portfolio, the capital markets and proceeds from loan sales or securitizations.

Popular’s liquidity and ability to fund and operate its business could be materially adversely affected by a variety of

conditions and factors, some of which are out of Popular’s control. For example, market events or disruptions, such as periods of

market stress and low investor confidence in financial institutions could result in deposit withdrawals, especially to the extent those

deposits are in excess of the FDIC-insured limit of $250,000. As of December 31, 2024, we had $13 billion of total deposits (other

than collateralized public funds, which represent public deposit balances from governmental entities in the U.S. and its territories,

including Puerto Rico and the United States Virgin Islands, that are collateralized based on such jurisdictions’ applicable collateral

requirements) in excess of the FDIC-insured limit. We may also suffer outflows of customer deposits due to competition from other

banks or alternative investments. In addition, in periods of stress, we may not be able to access existing funding sources, access

the capital markets or to sell or securitize loans or other assets, or to access such sources or to sell or securitize assets on favorable

terms.

In addition, actions by the rating agencies could raise the cost of our borrowings, since lower rated securities are usually

required by the market to pay higher rates than obligations of higher credit quality. Our credit ratings were reduced substantially in

2009 and, although one of the three major rating agencies upgraded our senior unsecured rating back to “investment grade” during

2021, the remaining two rating agencies have not upgraded their current “non-investment grade” rating. The market for non- investment grade securities is much smaller and less liquid than for investment grade securities. If we were to attempt to issue preferred stock or debt securities into the capital markets, it is possible that there would not be sufficient demand to complete a transaction or that the cost could be substantially higher than for more highly rated securities. If Popular is unable to access the capital markets on favorable terms, our liquidity may be adversely affected.

Changes in our ratings and capital levels could affect our relationships with some creditors and limit our access to funding.

For example, having negative tangible capital may impact our ability to access some sources of wholesale funding. The Federal

Housing Finance Agency restricts the FHLBNY from lending to members of the FHLBNY with negative tangible capital unless the

member’s primary banking regulator makes a written request to the FHLBNY to maintain access to borrowings. Both BPPR and PB

have secured borrowing facilities with the FHLBNY and could borrow up to $3.2 billion and $1.5 billion respectively as of December

31, 2024, of which $0.1 billion and $0.4 billion respectively were used. Losing access to the FHLBNY borrowing facilities could

adversely impact liquidity at the banking subsidiaries. Additionally, if BPPR or PB cease to be well-capitalized, the FDIA and

regulations adopted thereunder would restrict their ability to accept brokered deposits and limit the rate of interest payable on

deposits.

Our banking subsidiaries also have recourse obligations under certain agreements with third parties, including servicing

and custodial agreements, that include ratings covenants. Upon failure to maintain the required credit ratings, the third parties could

have the right to require us to engage a substitute fund custodian and increase collateral levels securing recourse obligations.

Collateral pledged by us to secure recourse obligations approximated $23.9 million on December 31, 2024. While management

expects that we would be able to meet any additional collateral requirements if and when needed, the requirements to post collateral

under certain agreements or the loss of custodian funds could reduce our liquidity resources and impact our results of operations.

As a holding company, we depend on dividends and distributions from our subsidiaries for liquidity.

As a bank holding company, we depend primarily on dividends from our banking and other operating subsidiaries to fund

our cash needs, including to capitalize our subsidiaries. Our banking subsidiaries, BPPR and PB, are limited by law in their ability to

make dividend payments and other distributions to us based on their earnings, dividend history, and capital position. Based on its

current financial condition, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the

NYSDFS. A failure by our banking subsidiaries to generate sufficient income and free cash flow to make dividend payments to us

may affect our ability to fund our cash needs, which could have a negative impact on our financial condition, liquidity, results of

operation or capital position. Such failure could also affect our ability to pay dividends to our stockholders and to repurchase shares

of our common stock. We have in the past suspended dividend payments on our common stock and preferred stock during times of

economic uncertainty, and there can be no assurance that we will be able to continue to declare dividends to our stockholders in

any future periods.

An impact on the tangible capital levels of our operating subsidiaries, could also limit the amount of capital we may

upstream to the holding company. Tangible capital levels have in the past been, and may in the future be, adversely affected by the

impact of rapidly rising interest rates on investment securities in our available-for-sale portfolio. For a discussion of risks related to

changes in interest rates, see “Changes in interest rates and credit spreads can adversely impact our financial condition, including

our investment portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments” in Item 1A of this Form 10-K.

We also depend on dividends from our banking and other operating subsidiaries to pay debt service on outstanding debt

and to repay maturing debt. Our ability to declare such dividends would be subject to regulatory requirements and could require the

prior approval of the Federal Reserve Board.

STRATEGIC RISKS

Potential acquisitions of businesses or loan portfolios could increase some of the risks that we face, and may be delayed

or prohibited due to regulatory constraints.

To the extent permitted by our applicable regulators, we may pursue strategic acquisition opportunities. Acquiring other

businesses, however, involves various risks, including potential exposure to unknown or contingent liabilities of the target company,

exposure to potential asset quality issues of the target company, potential disruption to our business, the possible loss of key

employees and customers of the target company, and difficulty in estimating the value of the target company. If we pay a premium

over book or market value in connection with an acquisition, some dilution of our tangible book value and net income per common

share may occur. Furthermore, failure to realize the expected revenue increases, cost savings, increases in geographic or product presence, or other projected benefits from an acquisition could have a material adverse effect on our business, financial condition and results of operations.

Similarly, acquiring loan portfolios involves various risks. When acquiring loan portfolios, management makes

assumptions and judgments about the collectability of the loans, including the creditworthiness of borrowers and the value of the

real estate and other assets serving as collateral for the repayment of secured loans. In estimating the extent of the losses, we

analyze the loan portfolio based on historical loss experience, volume and classification of loans, volume and trends in

delinquencies and nonaccruals, local economic conditions, and other pertinent information. If our assumptions are incorrect,

however, our actual losses could be higher than estimated and increased loss reserves may be required, which would negatively

affect our results of operations.

Finally, certain acquisitions by financial institutions, including us, are subject to approval by a variety of federal and state

regulatory agencies. Regulatory approvals could be delayed, impeded, restrictively conditioned or denied. We may fail to pursue,

evaluate or complete strategic and competitively significant acquisition opportunities as a result of our inability, or perceived or

anticipated inability, to obtain regulatory approvals in a timely manner, under reasonable conditions or at all. Difficulties associated

with potential acquisitions that may result from these factors could have a material adverse effect on our business, financial

condition and results of operations.

We have embarked on a broad-based multi-year, technological and business process transformation. The failure to

achieve the goals of the transformation project, the inability to maintain expenses related to our transformation program

within current estimates or delays in executing our plans may materially and adversely affect our business, competitive

position, financial condition, results of operations, or cause reputational harm.

The Corporation has embarked on a broad-based multi-year, technological and business process transformation. As part

of this transformation, we are making significant investments in technology, talent and new digital and data capabilities in order to

provide our customers with more personalized and accessible services, increase employee performance and satisfaction with more

agile work processes, and generate sustainable profitable growth and value for our shareholders.

We may not succeed in executing the transformation program, may fail to properly estimate costs of the same, or may experience

delays in executing our plans, which may in turn cause the Corporation to incur costs exceeding our current estimates or disrupt our

operations, including our technological services to our customers, or fall short of our projected earnings or expense reduction targets

driven by these efforts. To the extent that these disruptions persist over time and/or recur, this could negatively impact our

competitive position, require additional expenditures, and/or harm our relationships with our customers and thus may materially

adversely affect our business, financial condition, results of operations, or cause reputational harm.

We face significant and increasing competition in the rapidly evolving financial services industry.

We operate in a highly competitive environment, in which we compete on the basis of a number of factors, including

customer service, quality and variety of products and services, price, interest rates on loans and deposits, innovation, technology,

ease of use, reputation, and transaction execution. While our main competition continues to come from other Puerto Rico banks and

financial institutions, we face increased competition from non-Puerto Rico institutions, as emerging technologies and the growth of

e-commerce have significantly reduced geographic barriers. These technologies have also made it easier for non-depositary

institutions to offer products and services that were traditionally considered banking products and allowed non-traditional financial

service providers and technology companies to provide electronic and internet-based financial solutions and services. Increased

competition could create pressure to lower prices, fees, commissions or credit standards on our products and services, which could

adversely affect our financial condition and results of operations. Increased competition could also create pressure to raise interest

rates on deposits or increase deposit attrition, which could negatively impact our business, financial condition, liquidity results of

operations or capital position.

If we are unable to meet constant technological changes and react quickly to meet new industry standards, including as a

result of our continued dependence on Evertec, we may be unable to enhance our current services and introduce new

products and services in a timely and cost-effective manner, placing us at a competitive disadvantage and significantly

affecting our business, financial condition, liquidity, results of operations or capital position.

To compete effectively, we need to constantly enhance and modify our products and services and introduce new products

and services to attract and retain clients or to match products and services offered by our competitors, including technology

companies and other nonbank firms that are engaged in providing similar products and services. Our ability to compete effectively

will depend in part on our ability to react quickly to meet new industry standards and use new technology, such as artificial intelligence, to satisfy customer demands, as well as to create additional efficiencies in our operations. Popular expects that it will continue to depend on Evertec’s technology services to operate and control current products and services and to implement future products and services, making our success dependent on Evertec’s ability to timely complete and introduce these enhancements and new products and services in a cost-effective manner.

Some of our competitors rely on financial services technology and outsourcing companies that are much larger than

Evertec, serve a greater number of clients than Evertec, and may have better technological capabilities and product offerings than

Evertec. Furthermore, financial services technology companies typically make capital investments to develop and modify their

product and service offerings to facilitate their customers’ compliance with the extensive and evolving regulatory and industry

requirements, and, in most cases, such costs are borne by the technology provider. Because of our contractual relationship with

Evertec, and because Popular is the sole customer of certain of Evertec’s services and products, we have in the past borne the full

cost of such developments and modifications and may be required to do so in the future, subject to the terms of the MSA.

Moreover, the terms, speed, scalability, and functionality of certain of Evertec’s technology services are not competitive

when compared to offerings from its competitors. Evertec’s failure to sufficiently invest in and upscale its technology and services

infrastructure to meet the rapidly changing technology demands of our industry may result in us being unable to meet customer

expectations and attract or retain customers. Furthermore, Evertec’s strategy and investments may also be refocused away from

Popular towards other strategic initiatives. Any such impact could, in turn, reduce Popular’s revenues, place us in a competitive

disadvantage and significantly affect our business, financial condition, liquidity, results of operations or capital position. While we

have over time narrowed the scope of services which we are dependent on Evertec to obtain, in exchange for releases from

exclusivity restrictions that limited our ability to engage other third-party providers of financial technology services, we agreed to

extensions of certain existing commercial agreements with Evertec and, as a result, have prolonged the duration of our exposure to

the risks presented by Evertec’s technological capabilities and its failures to enhance its products and services and otherwise meet

evolving demands. We may also be exposed to heightened business risks in connection with our dependency on Evertec with

respect to BPPR’s merchant acquiring business, which exclusivity was extended until 2035, and with respect to the ATH Network,

which commitment BPPR extended until 2030, in light of the pace of technology changes and competition in the payments industry.

The ability to attract and retain qualified employees is critical to our success.

Our success depends, in large part, on our ability to attract and retain qualified employees. Competition for qualified

candidates, especially in the area of information technology, is intense and has increased recently as a result of a tighter labor

market. Increased competition may lead to difficulties in attracting or retaining qualified employees, which may, in turn, lead to

significant challenges in the execution of our business strategies and have an adverse effect on the quality of the service we provide

to the customers and communities we serve. Such challenges could adversely affect our business, operations and financial

condition. In addition, increased competition may lead to higher compensation packages and more flexible work arrangements. We

may also be required to hire employees outside of our market areas for certain positions that require specific expertise, which could

result in employment and tax compliance-related expenses, challenges and risks. In addition, flexible work arrangements, such as

remote or hybrid work models, have led to other workplace challenges, including fewer opportunities for face-to-face interactions or

to promote a cohesive corporate culture and heightened cybersecurity, information security and other operational risks.

Our ability to attract and retain qualified employees is also impacted by regulatory limitations on our compensation

practices, such as clawback requirements of incentive compensation, which may not affect other institutions with which we compete

for talent. The scope and content of regulators’ policies on executive compensation continue to develop and are likely to continue

evolving. Such policies and limitations on our compensation practices could adversely affect our ability to attract, retain and motivate

talented senior leaders in support of our long-term strategy.

OTHER RISKS

An impairment of our goodwill, deferred tax assets or amortizable intangible assets could adversely affect our financial

condition and results of operations.

As of December 31, 2024, we had approximately $803 million, $926 million and $143 million, respectively, of goodwill, net

deferred tax assets and amortizable intangible assets, including capitalized software costs, recorded on our balance sheet.

Under GAAP, goodwill is tested for impairment at least annually and amortizable intangible assets are tested for

impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Factors that may be

considered a change in circumstances, indicating that the carrying value of the goodwill or amortizable intangible assets may not be

recoverable, include a decline in Popular’s stock price related to a deterioration in global or local economic conditions, declines in our market capitalization, reduced future earnings estimates, and interest rate changes. The goodwill impairment evaluation process requires us to make estimates and assumptions with regards to the fair value of our reporting units. Actual values may differ significantly from these estimates. Such differences could result in future impairment of goodwill that would, in turn, negatively impact our results of operations and the reporting unit where the goodwill is recorded.

The determination of whether a deferred tax asset is realizable is based on weighting all available evidence. The

realization of deferred tax assets, including carryforwards and deductible temporary differences, depends upon the existence of

sufficient taxable income of the same character during the carryback or carryforward period. The analysis considers all sources of

taxable income available to realize the deferred tax asset, including the future reversal of existing taxable temporary differences,

future taxable income exclusive of reversing temporary differences and carryforwards, taxable income in prior carryback years and

tax-planning strategies. Changes in these factors may affect the realizability of our deferred tax assets in our Puerto Rico and U.S.

operations.

If our goodwill, deferred tax assets or amortizable intangible assets become impaired, we may be required to record a

significant charge to earnings, which could adversely affect our financial condition and results of operations.

We could experience unexpected losses if the estimates or assumptions we use in preparing our financial statements are

incorrect or differ materially from actual results.

In preparing our financial statements pursuant to U.S. GAAP, we are required to make estimates and assumptions that

are often based on subjective and complex judgments about matters that are inherently uncertain. For example, we use estimates

and assumptions to determine our allowance for credit losses, our liability for contingent litigation losses, and the fair value of certain

of our assets and liabilities, such as debt securities, loans held for sale, MSRs, intangible assets and deferred tax assets. If such

estimates or assumptions are incorrect or differ materially from actual results, we could experience unexpected losses or other

adverse impacts, some of which could be significant.

For further information on other risks faced by Popular please refer to the MD&A section of this Form 10-K.

Cybersecurity

As filed, 14,570 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

The Corporation assesses, identifies and manages cybersecurity risk as part of the Corporation’s overall risk management

framework, alongside associated information security, anti-money laundering and counterterrorism, operational, fraud, regulatory,

legal and reputational risks, among others.

The Corporation has established three management committees that oversee and monitor different aspects of cybersecurity risk.

The Enterprise Risk Management Committee (the “ERM Committee”), chaired by the Chief Risk Officer, oversees and

monitors the risks included in the Risk Appetite Statement (the “RAS”) of the Corporation’s Risk Management Policy,

including cybersecurity risks.

The Information Technology and Cyber Risk Committee (“ITCRC”), chaired by the Chief Security Officer and the Chief

Information and Digital Strategy Officer, oversees and monitors information technology (“IT”), privacy and cybersecurity

risks, mitigating actions and controls, applicable regulatory developments, key risks metrics, and IT and cyber incidents

that may result in operational, compliance and reputational risks.

The Operational Risk Committee (“ORCO”), chaired by the Chief Risk Officer, oversees and monitors operational risk

management activities to ensure the development and consistent application of operational risk policies, processes and

procedures that measure, limit and manage the Corporation's operational risks while maintaining the effectiveness and

efficiency of the operating and business processes. As part of its responsibilities, ORCO oversees business continuity

matters, as well as operational losses stemming from any cybersecurity or fraud events.

The ITCRC and ORCO meet at least quarterly and report on cybersecurity and other matters to the ERM Committee.

The Board has also established a Board-level Risk Management Committee (“RMC”), which is responsible for the oversight of the

Corporation’s overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit

and manage the Corporation’s risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides

an overview of Popular’s cybersecurity threat risk management and strategy processes, which includes summaries of escalated

incidents and incident remediation status. Our Chief Security Officer, Chief Information and Digital Strategy Officer, Chief

Information Security Officer (“CISO”), Chief Risk Officer and the Financial and Operational Risk Management Division (the “FORM

Division”) Manager generally participate in such meetings. The RMC is also responsible for (i) overseeing the development,

implementation and maintenance of the Corporation’s information security program (the “Information Security Program”); (ii)

approving the Corporation’s risk management program and any related policies and controls; (iii) overseeing the implementation by

the Corporation’s management of the Corporation’s risk management program and any related policies, procedures and controls;

and (iv) reviewing reports regarding selected topics such as cyber.

The Board in turn also receives briefings on cybersecurity matters and risks, including an annual presentation from the Chief

Security Officer and the CISO on the Information Security Program.

In addition, as part of the Board’s director education plan,

members of the Board take, on an annual basis, a cybersecurity training that provides the Board with an overview of cybersecurity

principles and regulations that are relevant to our institution and the Board’s oversight function.

To identify, assess and manage risks from cybersecurity threats, the Corporation has established a three lines of defense

framework. The first line of defense is composed of business line management that identifies and manages the risks associated with

business activities, including cybersecurity risk. The second line of defense is made up of members of the Corporation’s Corporate

Risk Management Group and the Corporate Security Group (the “CSG”) who, among other things, measure and report on the

Corporation’s risk activities. In such line of defense, the FORM Division, within the Corporate Risk Management Group, is

responsible for (i) establishing baseline metrics that measure, monitor, limit and manage the framework that identifies and manages

multiple and cross-enterprise risks, including cybersecurity risks; and (ii) articulating the RAS and supporting metrics, including

those related to operational risk, business continuity, disaster recovery and third-party management oversight processes.

Meanwhile, Popular’s Cyber Security Division (the “CSD”), which is headed by the CISO and reports to the CSG, is responsible for

the development of strategies, policies and programs to assess and mitigate cybersecurity risks. Members of the CSD (including the

CISO) and FORM Division report on and escalate cybersecurity, IT and privacy risks to management committees, such as the

ITCRC, ORCO and ERM Committee, and, if appropriate, to the RMC and the Board of Directors, as required under relevant policies

and procedures. Lastly, the third line of defense consists of the Corporate Auditing Division, which independently provides

assurance regarding the effectiveness of the risk framework and reports directly to the Audit Committee of the Board.

Popular monitors various vectors of threats and utilizes open-source intelligence forums and communities such as the Financial

Services Information Sharing and Analysis Center and the Cybersecurity and Infrastructure Security Agency, among others, to

receive threat intelligence feeds which are reviewed by the CSD. As cybersecurity threats are identified, they are evaluated to

assess the level of exposure and the potential risk to Popular. The ITCRC and the ERM Committee discuss and track the threats

identified in internal assessments and scans or in third-party reports. Depending on the evolution and materiality of the threat, these

are escalated to the RMC as appropriate.

The CSD develops the Information Security Program, which considers and evaluates risks posed by cybersecurity threats, events

and activities impacting the industry and the Corporation. The Information Security Program outlines the Corporation’s overall

strategy and governance to protect the confidentiality, integrity and availability of information and prevent access by unauthorized

personnel, and is based on standards and controls set by the National Institute of Standards and Technology (“NIST”), including the

NIST’s Framework for Improving Critical Infrastructure Cybersecurity. Popular currently leverages the Cyber Assessment Tool (the

“CAT”), a tool based on NIST standards and controls developed by the Federal Financial Institutions Examination Council (“FFIEC”),

in order to measure the Corporation’s cybersecurity preparedness and maturity levels. The CAT assessment results are integrated

into the overall Information Security Program evaluation. In 2025, we will transition to the Cyber Risk Institute (“CRI”) Profile 2.0

assessment framework, following the announcement by the FFIEC of the sunset of the CAT in 2025. The CRI Profile was produced

through public-private collaboration and is a list of assessment questions curated based on the intersection of global regulations and

cyber standards, such as the International Standards Organization (ISO) and the NIST.

The CSD also manages the Incident Response Program (“IRP”) of the Corporation and is in charge of overseeing, assessing and

managing cyber incidents. The IRP outlines the measures Popular must take to prepare for, detect, respond to and recover from

cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate

incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

The Corporation also undertakes the below listed additional activities in its effort to maintain regulatory compliance, identify, assess

and manage its material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents:

Conduct tabletop exercises that simulate cybersecurity incidents to raise awareness and enhance Popular’s responsive

measures;

Assess how business and corporate strategies, new products, technology deployments, external events and the evolution of

threats impact the Corporation’s information security controls in order to determine if they require any additional resources,

technology or processes;

Discuss cybersecurity risks with law enforcement, peer groups, industry forums and trade associations;

Provide training to all Popular employees upon hiring and annually thereafter on cybersecurity and customer data handling

and use requirements;

Offer training and awareness campaigns to customers and employees based on their role;

Conduct phishing simulations for employees, with escalation protocols for employees that fail such tests to enhance

awareness and responsiveness to such possible threats;

Offer learning and development opportunities to employees who handle and manage cybersecurity matters;

Carry cyber insurance to provide protection against potential losses arising from cybersecurity incidents; and

Monitor emerging legal and regulatory requirements and implement changes to our processes, policies and statements, as

necessary.

Popular engages third parties to assist in certain cybersecurity matters.

In particular, Popular uses the expertise of third parties to

perform specialized assessments to test its systems, such as periodic penetration testing, that provide insights into the effectiveness

of its controls. Popular also engages third parties to provide computer forensics and investigations services as needed to assess

and address actual or potential cybersecurity incidents. In addition, Popular hires third parties to provide the first level security

monitoring of Popular’s external and internal networks.

Popular’s Outsourced Risk Management Policy outlines the management of risks associated with the Corporation’s use of third-

party service providers, and the CSG assesses the impact and level of cybersecurity and privacy risk of such providers. Popular

performs due diligence on third parties and monitors third parties that have access to its systems, data or facilities that house such

systems or data on a periodic basis, and based on due diligence results, determines how often vendor assessments are performed

on such third party. Popular also conducts periodic application and vendor assessments for third-party providers and their products.

Furthermore, Popular requires third parties that have access to its systems, data or facilities that house such systems or data to take

a training on cybersecurity at least annually.

Under the heading “We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks,

which could cause substantial harm and have an adverse effect on our business and results of operations.” and “We rely on other

companies to provide key components of our business infrastructure, including certain of our core financial transaction processing

and information technology and security services, which exposes us to a number of operational risks that could have a material

adverse effect on us.”, included as part of our risk factor disclosures in Item 1A in this Form 10-K, which disclosures are

incorporated by reference herein,

we describe whether and how risks from identified cybersecurity threats, including as a result of

any previous cybersecurity incidents, could have materially affected or are reasonably likely to materially affect us, including our

business strategy, results of operations, or financial condition.

The CSG operates under the direction of the Chief Security Officer. The Chief Security Officer has over 36 years of experience,

including over 12 years of professional experience in information technology and cybersecurity matters such as the oversight of the

Information Security Program and the design and execution of the information security audit plan of the Corporation.

She is a

Certified Public Accountant that also holds a Juris Doctor degree and FINRA administered Series 7 and Series 27 certifications. She

holds the title of Executive Vice President and Chief Security Officer and has been in her role since 2018. Prior to that, she served

as Senior Vice President and General Auditor of the Corporation from November 2012 to April 2018. Before 2012, she served in

various risk related functions of the Corporation and as the Chief Operating Officer and Chief Financial Officer of Popular’s broker

dealer business.

The CISO has over 26 years of work experience in various roles in major financial institutions involving leading top-level

cybersecurity governance strategy and initiatives, integrating security governance into the overall business strategy and advising

boards of directors on cyber risks and cybersecurity standards.

He has been a certified information security professional since 2007.

He holds the title of CISO and Cybersecurity Division Manager and has been in this role since 2019.

The Corporate Risk Management Group operates under the direction of the Chief Risk Officer. The Chief Risk Officer has over 31

years of work experience.

He holds the title of Executive Vice President and Chief Risk Officer and has been in his role since 2011.

Prior to joining the Corporation, he served for 17 years as Chief Financial Officer, Head of Retail Bank and Mortgage Operations,

Head of Commercial and Construction Mortgage and Head of Interest Rate Risk, among other positions, for other banks. He holds

a BS with a major in Computer Engineering and an MBA with majors in Finance and Accounting.

The FORM Division Manager has over 29 years of work experience.

She holds the title of Senior Vice President and FORM Division

Manager and has been in her role since March 2022. Prior to that she held positions for 16 years as Operational and IT Risk

Director, Head of ERM and Operational Risk, and Chief Information Security Officer for other banks. She also held positions in

Internal Audit and IT Management for other industries throughout her career. She holds a BBA with majors in Accounting and

Information Systems, and a Master of Science in Information Technology Management.

Properties

As filed, 1,765 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

As of December 31, 2024, BPPR operated 162 branches, of which 68 were owned and 94 were leased premises, and PB

operated 40 branches of which 3 were owned and 37 were on leased premises. Also, the Corporation had 579 ATMs operating in

Puerto Rico, 24 in the Virgin Islands and 99 in the U.S. Mainland. The principal properties owned by Popular for banking operations

and other services are described below. Our management believes that each of our facilities is well maintained and suitable for its

purpose.

Puerto Rico

Popular Center, the twenty-story Popular and BPPR headquarters building, located at 209 Muñoz Rivera Avenue, Hato Rey, Puerto

Rico.

Popular Center North Building, a three-story building, on the same block as Popular Center.

Popular Street Building, a parking and office building located at Ponce de León Avenue and Popular Street, Hato Rey, Puerto Rico.

Cupey Center Complex, one building, three-stories high, two buildings, two-stories high each, and two buildings three-stories high

each located in Cupey, Río Piedras, Puerto Rico.

Old San Juan Building, a twelve-story structure located in Old San Juan, Puerto Rico.

Guaynabo Corporate Office Park Building, a two-story building located in Guaynabo, Puerto Rico.

Altamira Building, a nine-story office building located in Guaynabo, Puerto Rico.

El Señorial Center, a four-story office building and a two-story branch building located in Río Piedras, Puerto Rico.

Ponce de León 167 Building, a five-story office building located in Hato Rey, Puerto Rico.

U.S. & British Virgin Islands

BPPR Virgin Islands Center, a three-story building located in St. Thomas, U.S. Virgin Islands.

Popular Center -Tortola, a four-story building located in Tortola, British Virgin Islands.

Legal proceedings

As filed, 145 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

For a discussion of Legal proceedings, see Note 23, “Commitments and Contingencies”, to the Consolidated Financial Statements

in this Form 10-K.

Market risk

As filed, 229 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

The information regarding the market risk of our investments appears under the caption “Risk Management”, on page 80

within Management’s Discussion and Analysis of Financial Condition and Results of Operations in this Form 10-K.

Controls and procedures

As filed, 1,615 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the

effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the

Exchange Act) as of the end of the period covered by this report. Based on such evaluation, our Chief Executive Officer and Chief

Financial Officer have concluded that, as of the end of such period, our disclosure controls and procedures are effective in

recording, processing, summarizing and reporting, on a timely basis, information required to be disclosed by Popular in the reports

that we file or submit under the Exchange Act and such information is accumulated and communicated to management, as

appropriate, to allow timely decisions regarding required disclosures.

Assessment on Internal Control over Financial Reporting

Information relating to our assessment on internal control over financial reporting is presented under the captions “Report

of Management on Internal Control Over Financial Reporting” and “Report of Independent Registered Public Accounting Firm”

located on pages 108 and 109 of this Form 10-K.

Changes in Internal Control over Financial Reporting

There have been no changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f)

and 15d-15(f) under the Exchange Act) that occurred during the quarter ended December 31, 2024, that have materially affected, or

are reasonably likely to materially affect, our internal control over financial reporting.

Figures reported in this filing

Standardized line items from the XBRL in this filing, for the period ended 2024-12-31. Comparative periods it repeats are left out.

Figures reported in this filing
Line item	Period	Value	XBRL concept
Interest expense	12 months2024-01-01 to 2024-12-31	$1.39bn	us-gaap:InterestExpense
Income tax	12 months2024-01-01 to 2024-12-31	$182.4m	us-gaap:IncomeTaxExpenseBenefit
Net income	12 months2024-01-01 to 2024-12-31	$614.2m	us-gaap:NetIncomeLoss
Diluted EPS	12 months2024-01-01 to 2024-12-31	$8.56	us-gaap:EarningsPerShareDiluted
Basic EPS	12 months2024-01-01 to 2024-12-31	$8.56	us-gaap:EarningsPerShareBasic
Diluted shares (weighted)	12 months2024-01-01 to 2024-12-31	71,623,702 shares	us-gaap:WeightedAverageNumberOfDilutedSharesOutstanding
Operating cash flow	12 months2024-01-01 to 2024-12-31	$674.7m	us-gaap:NetCashProvidedByUsedInOperatingActivities
Capital expenditure	12 months2024-01-01 to 2024-12-31	$213.4m	us-gaap:PaymentsToAcquirePropertyPlantAndEquipment
Dividends paid	12 months2024-01-01 to 2024-12-31	$180.5m	us-gaap:PaymentsOfDividends
Share repurchases	12 months2024-01-01 to 2024-12-31	$217.3m	us-gaap:PaymentsForRepurchaseOfCommonStock
Total assets	At period end2024-12-31	$73.05bn	us-gaap:Assets
Total liabilities	At period end2024-12-31	$67.43bn	us-gaap:Liabilities
Shareholders' equity	At period end2024-12-31	$5.61bn	us-gaap:StockholdersEquity

Source: SEC EDGAR, the filing index for accession 0001193125-25-043848. Last ingested by Listed: Nov 9, 2026, 17:41 ET. Listed shows no prices and gives no investment advice.

Business

General:

Lending Activities

Business Concentration

Loan category

(Dollars in millions)

BPPR

PB

POPULAR

Credit Administration and Credit Policies

Loan extensions , renewals and restructurings

Competition

Transformation Initiatives:

Human Capital Management

Nurturing Well -Being: Employee Health & Financial Security

Empowering Growth: Our Commitment to Talent Developmen

t

Enhancing Leadership Continuity through Strategic Succession Planning

Employee Experience

Board Oversight in Human Capital

Regulation and Supervision

General

Enhanced Prudential Standards

Transactions with Affiliates

Source of Financial Strength

Resolution Planning and Resolution-Related Requirements

FDIC Insurance

Brokered Deposits

Capital Adequacy

Prompt Corrective Action

Restrictions on Dividends and Repurchases

Interstate Branching

de novo

Activities and Acquisitions

Anti-Money Laundering Initiative and the USA PATRIOT Act

Community Reinvestment Act

Interchange Fees Regulation

Consumer Financial Protection Act of 2010

Office of Foreign Assets Control Regulation

Protection of Customer Personal Information and Cybersecurity

Climate-Related and ESG Developments

Incentive Compensation

Regulation of Broker-Dealers

Regulation of Reinsurers, Insurance Producers and Agents

Puerto Rico Regulation

Available Information

Risk factors

ECONOMIC AND MARKET RISKS

Weakness in the economy, particularly in Puerto Rico, where a significant portion of our business is concentrated, has

adversely impacted us in the past and may adversely impact us in the future.

Changes in interest rates and credit spreads can adversely impact our financial condition, including our investment

portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments.

BUSINESS RISKS

Negative changes in the financial condition of our clients have adversely impacted us in the past and may adversely

impact us in the future.

We are exposed to increased credit risks and credit losses to the extent our clients are concentrated by industry segment

or type of client.

Deterioration in the values of real properties securing our commercial, mortgage loan and construction portfolios have in

Defective and repurchased loans may harm our business and financial condition.

If we are unable to maintain or grow our deposits, we may be subject to paying higher funding costs and our net interest

income may decrease.

OPERATIONAL RISKS

We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks, which

Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters,

acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other

We rely on other companies to provide key components of our business infrastructure, including certain of our core

financial transaction processing and information technology and security services, which exposes us to a number of

operational risks that could have a material adverse effect on us.

The transition to new financial services technology providers, and the replacement of services currently provided to us by

Evertec, will be lengthy and complex.

LEGAL AND REGULATORY RISKS

Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our

business and operations.

We are from time to time subject to information requests, investigations and other regulatory enforcement proceedings

from departments and agencies of the U.S. and Puerto Rico governments, including those that investigate compliance with

U.S. sanctions and consumer protection laws and regulations, which may expose us to significant penalties and collateral

Complying with economic and trade sanctions programs and anti-money laundering laws and regulations can increase our

operational and compliance costs and risks. If we, and our subsidiaries, affiliates or third-party service providers, are

found to have failed to comply with applicable economic and trade sanctions programs and anti-money laundering laws