Popular, Inc.: Form 10-K for the period ended Dec 31, 2025

Filed with the SEC on Mar 2, 2026 and accepted by EDGAR at Mar 2, 2026, 17:18 ET.

Share this page

Link

Story card, 1080 × 1920

Business

As filed, 88,654 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

General:

Popular is a diversified, publicly-owned financial holding company, registered under the Bank Holding Company Act of 1956, as

amended (the “BHC Act”), and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the

“Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the largest

financial institution based in Puerto Rico, with consolidated assets of $75.3 billion, total deposits of $66.2 billion and stockholders’

equity of $6.2 billion at December 31, 2025. At December 31, 2025, we ranked among the 50 largest U.S. bank holding companies

based on total assets according to information gathered and disclosed by the Federal Reserve Board.

We operate in two principal markets:

Puerto Rico: We provide retail, mortgage and commercial banking services, as well as auto and equipment leasing and

financing through our principal banking subsidiary, Banco Popular de Puerto Rico (“Banco Popular” or “BPPR”), and broker-

dealer and insurance services through specialized subsidiaries. BPPR’s deposits are insured under the Deposit Insurance

Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”). The banking operations of BPPR are primarily based in

Puerto Rico, where BPPR has the largest retail banking franchise.

Mainland United States: We provide retail and commercial banking services, as well as equipment leasing and financing,

through our New York -chartered banking subsidiary, Popular Bank (“PB” or “Popular U.S.”), which has branches in New York,

New Jersey, and Florida. PB’s deposits are insured under the DIF of the FDIC.

BPPR also conducts banking operations in the U.S. Virgin Islands, the British Virgin Islands and New York. In addition to

BPPR’s commercial banking operations in New York that include direct loan origination and participating loans originated by

PB, BPPR offers or holds financial products on a national scale in the U.S. market, including personal loans previously

originated under the E-Loan brand, purchased personal loans originated by third parties, and gathering insured institutional

deposits via online deposit gathering platforms. In the U.S. and British Virgin Islands, BPPR offers a range of banking products,

including loans and deposits to both retail and commercial customers.

For further information about the Corporation’s results segregated by its reportable segments, see “Reportable Segment Results” in

the Management’s Discussion and Analysis of Financial Condition and Results of Operations section (“MD&A”) and Note 36 to the

Consolidated Financial Statements included in this Form 10-K.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial. Commercial loans are comprised of (i) commercial and industrial (“C&I”) loans and leases to commercial customers

for use in normal business operations and to finance working capital needs, equipment purchases or other projects, (ii) commercial

real estate (“CRE”) loans (excluding construction loans) for income-producing real estate properties as well as owner-occupied

properties, and (iii) multifamily loans with residential buildings with five or more living units. C&I loans are underwritten individually

and usually secured with the assets of the company and the personal guarantee of the business owners. CRE loans consist of loans

for income-producing real estate properties and the financing of owner-occupied facilities if there is real estate as collateral. Non-

owner-occupied CRE loans are generally made to finance office and industrial buildings, healthcare facilities, and retail shopping

centers and are repaid through cash flows related to the operation, sale or refinancing of the property. Multifamily loans, in certain

cases, result from the conversion of the Bank’s construction financing to permanent financing and are repaid through the cash flow,

sale or refinance of the properties.

(2) Mortgage. Mortgage loans include residential mortgage loans to consumers for the purchase or refinancing of a residence and also include residential construction loans made to individuals for the construction of refurbishment of their residence.

(3) Consumer. Consumer loans are mainly comprised of unsecured personal loans, credit cards, and automobile loans, and to a

lesser extent home equity lines of credit (“HELOCs”) and other loans made by banks to individual borrowers.

(4) Construction. Construction loans are CRE loans to companies or developers used for the construction of a commercial or

residential property for which repayment will be generated by the sale or permanent financing of the property. Our construction loan

portfolio primarily consists of residential land development, multifamily housing, and condominium projects.

(5) Lease Financings. Lease financings are offered by BPPR and are primarily comprised of automobile loans/leases made through

automotive dealerships.

Business Concentration

Since our business activities are currently concentrated primarily in Puerto Rico, our results of operations and financial

condition are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real

estate markets. The concentration of our operations in Puerto Rico exposes us to greater risk than other banking companies with a

wider geographic base. Our asset and revenue composition by geographical area is presented in Note 36 to the Consolidated

Financial Statements included in this Form 10-K.

Our loan portfolio is diversified by loan category. However, 52% of our loan portfolio at December 31, 2025 consisted of real estate-

related loans, including residential mortgage loans, construction loans and commercial loans secured by commercial real estate.

The table below presents the distribution of our loan portfolio by loan category at December 31, 2025.

Loan category

(Dollars in millions)

BPPR

PB

Credit Administration and Credit Policies

Interest from our loan portfolios is our principal source of revenue. Whenever we make loans, we expose ourselves to

credit risk. Credit risk is controlled and monitored through active asset quality management, including the use of lending

standards, thorough review of potential borrowers and through active asset quality administration.

Business activities that expose us to credit risk are managed within the Board of Director’s Risk Management policy,

and the Credit Risk Tolerance Limits policy, which establishes limits that consider factors such as maintainin g a prudent balance

of risk-taking across diversified risk types and business units, compliance with regulator y guidance, and controlling the exposure

to lower credit quality assets.

We maintain comprehensive credit policies for all lines of business in order to mitigate credit risk. Our credit policies are

approved by our Board of Directors. These policies set forth, among other things,

the objectives, scope and responsibilities of the

credit management cycle. Our internal written procedures establish

underwriting standards and procedures for monitoring and

evaluating loan portfolio quality and require prompt identificatio n and quantificatio n of asset quality deterioration or potential

loss

to provide for the adequacy of the allowance for credit losses. These written procedures establish various approval and lending

limit levels, ranging

from bank branch or departmen t officers to managerial and senior management levels. Approval levels are

primarily determined by the amount, type of loan and risk characteristics of the credit facility.

Our credit policies and procedures establish documentation requirements for each loan and related collateral type,

when applicable, during the underwriting, closing and monitoring phases. For commercial and construction loans, during the

initial loan underwriting process, the credit policies require, at a minimum, historical financial statements or tax returns of the

borrower, an analysis of financial information contained in a credit approval package, a risk rating determination and reports

from credit agencies and appraisal s for real estate-related loans when applicable . The credit policies also set forth the required

closing documentation depending on the loan and the collateral type.

Although we originate most of our loans internally in both the Puerto Rico and mainland United States markets, we

occasionally purchase or participate in loans originated by other financial institutions. When we purchase or participate in loans

originated by others, we ensure that those loans meet our underwriting standards and are consistent with our risk appetite.

Refer to the Credit Risk section of the MD&A included in this Form 10-K for information related to management

committees and divisions with responsibilities for establishing policies and monitoring the Corporation’s credit risk.

Loan extensions , renewals and restructurings

Loans with satisfactory credit profiles can be extended, renewed or restructured . Some commercia l loan facilities are

structured as lines of credit, which are mainly one year in term and therefore are required to be renewed annually. Other facilities

may be restructure d or extended from time to time based upon changes in the borrower’s business needs, use of funds, timing

of completion of projects and other factors. If the borrower is not deemed to have financial difficulties , extensions, renewals

and restructurings are done in the normal course of busines s and the loans continue to be recorde d as performing.

We evaluate various factors to determine if a borrower is experiencing financial difficulties. Indicators that the

borrower is experiencing financial difficultie s include, for example: (i) the borrower is currently in default on any of its debt or it is

probable tha t the borrower would be in payment default on any of its debt in th e foreseeable future without the modification ; (ii)

the borrower has declare d or is in the process of declarin g bankruptcy; (iii) there is significan t doubt as to whether the borrower

will continue to be a going concern; (iv) the borrower has securities that have been delisted, are in the process of being

delisted, or are under threa t of bein g delisted from an exchange ; (v) based on estimates and projection s that only encompass

the current business capabilities , the borrower forecasts that its entity-specifi c cash flows will be insufficien t to service the

debt (both interest and principal) in accordance with the contractual terms of the existing agreement through maturity; and

(vi) absent the current modification, the borrower cannot obtain funds from sources other than the existing creditors at an

effective interest rate equal to the current market interest rate for similar debt for a non-troubled debtor.

We have specialized workout officers who handle the majority of commercial loans that are past due 90 days and

over, borrowers experiencing financial difficulties , and loans that are considered problem loans based on their risk profile. As a

general policy, we do not advance additional money to borrowers who have loans that are 90 days past due or over. In

commercial and construction loans, certain exceptions may be approved under certain circumstances, including (i) when past

due status is administrativ e in nature, such as expiration of a loan facility before the new documentatio n is executed, and not as

a result of paymen t or credit issues; (ii) to improve our collateral position or otherwise maximize recovery or mitigate potential

future losses; and (iii) with respect to certain entities that, although related through common ownership, are not cross defaulted nor cross-collateralized and are performing satisfactorily under their respective loan facilities. Such advances are underwritten and approved following our credit policy guidelines and limits, which are dependent on the borrower’s financial condition, collateral and guarantee, among others.

In addition to the legal lending limit established under applicable state banking law, discusse d in detail below, business

activities that expose the Corporation to credit risk are managed within guidelines described in the Credit Risk Tolerance Limits

policy. Limits are defined for loss and credit performance metrics, portfolio composition and concentration, and industry and name-

level,

which

monitors lending concentration to a single borrower or a group of related borrowers, including specific lending

limits based on industr y or other criteria, such as a percentage of the banks’ capital.

Refer to Note 2 and Note 8 to the Consolidated Financial Statements included in this Form 10-K, for additional information

on loan modifications to borrowers with financial difficulties.

Competition

The financial services industry in which we operate is highly competitive. In Puerto Rico, our primary market, the

banking business is highly competitive with respect to originatin g loans, acquiring deposits and providing other banking

services. Most of our direct competitio n for our products and services comes from commercial banks and credit unions.

The principal competitors for BPPR include locally based commercial banks and a few large U.S. and foreign banks with

operations in Puerto Rico.

We also compete with specialized players in th e local financial industry that are not subject to the same regulatory

restrictions as domestic banks and bank holdin g companies. Those competitors include brokerage firms, mortgage companies,

insurance companies, automobile and equipment finance companies, local and federal credit unions (locally known as

“cooperativas”), credit car d companies, consumer finance companies, institutional lenders, and other financial and non-financia l

institutions and entities. Credit unions generally provide basic consume r financial services and collectively represent a significant

portion of the market with a lower cost structure and fewer regulatory constraints.

While our main competition continues to come from other Puerto Rico banks and financial institutions, we face increased

competition from non-Puerto Rico institutions, as emerging technologies and the growth of e-commerce have significantly reduced

geographic barriers. These technologies have also made it easier for non-depositary institutions to offer products and services that

were traditionally considered banking products and have allowed non-traditional financial service providers and technology

companies to provide electronic and internet-based financial solutions and services. In addition, nonbank firms may have a

competitive advantage over traditional banks and bank holding companies, such as Popular, due to factors such as differences in

regulation, funding models and tax treatment.

In the United States we continue to face substantial competitive pressure as our footprint resides in the two large

metropolitan markets of New York City / Northern New Jersey and the greater Miami area. There are a large number of banks in

both markets, including community, regional, and national ones, most of which have more resources than us.

In both Puerto Rico and the United States, the primary factors in competing for business include pricing, convenience

of branch locations and other delivery methods, range of products offered, and the level of service delivered. We must compete

effectively along all these parameters to be successful. We experience pricing pressure as some of our competitors seek to

increase market share by reducing prices for services or the rates charged on loans, increasing the interest rates offered on

deposits or offering more flexible terms. Increased competition could require that we increase the rates offered on deposits and

lower the rates charged on loans, which could adversely affect our profitability.

Economic factors, along with legislative and technological changes, have an ongoing impact on the competitive

environment within the financia l services industry. We work to anticipat e and adap t to dynamic competitive conditions whether

through developing and marketing innovative products and services, adopting or developin g new technologie s that differentiat e

our products and services, cross-marketing, or providing personalized banking services. We strive to distinguish ourselves

from other banks and financial services providers in our marketplace by providin g a high level of service to enhance customer

loyalty and to attrac t and retain business. However, we can provide no assurance as to the effectiveness of these efforts on

our future business or results of operations, and as to our continued ability to anticipate and adapt to changing conditions, and to sufficientl y improve our services and/or banking products, in order to successfully compete in our primary service areas.

Transformation Initiatives

The Corporation continues its broad-based , multi-year, technological and business process transformation, which was launched

in 2022. As part of this transformation, we are making significant investments in technology, talent and new digital and data

capabilities in order to provide our customers with more personalized and accessible services, increase employee performance

and satisfaction with more agile work processes, and generate sustainable profitable growth and value for our shareholders.

During 2025, the Corporation continued to make meaningful progress in the modernization of our customer channels and

enhancement of our customers' experience. For example, we started the rollout of a commercial cash management solution and

deployed a new consumer credit origination platform in Puerto Rico and the Virgin Islands. We also continued to invest in our

physical retail network and executed a series of efficiency initiatives, including exiting our U.S. mortgage business, optimizing

mortgage servicing operations in Puerto Rico, and transforming our Enterprise Resource Planning (ERP) platform to a modern

cloud-based solution implemented in January 2026 .

In connection with the Corporation’s transformation initiatives, the Corporation is working to achieve a sustainable return on

tangible common equity (“ROTCE”) of 14% over the long term. The Corporation made progress towards this goal in 2025,

achieving 13% ROTCE for the full year.

Refer to the Overview section of Management’s Discussion and Analysis included in this Form 10-K for information on recent

significant events that have impacted or will impact our current and future operations.

Human Capital Management

Popular seeks to embody our values and behaviors throughout our human capital management practices. Attracting, developing,

and retaining top talent in an environment that promotes wellness, inclusion, respect, continuous learning, and transparency are

fundamental pillars of the Corporation’s long-term strategy. As of December 31, 2025, Popular employed 9,427 individuals, none

of whom were represented by a collective bargaining group.

Nurturing Well -Being: Employee Health & Financial Security

Popular believes that the health and financial wellness of our employees is fundamental to delivering high-quality service to our

customers and contributing positively to the communities in which we operate. Accordingly, the Corporation offers a

comprehensive health and wellness program that includes medical, pharmacy, vision, and dental insurance, as well as additional

wellness initiatives.

Our programs are designed to ensure that healthcare is both accessible and affordable for our employees, with Popular covering

up to 78% of health insurance premiums, a figure that surpasses regional benchmarks. In 2025, we strengthened our health and

wellness offerings by opening a state-of-the-art fitness center in our San Juan, Puerto Rico campus, to encourage an active and

balanced lifestyle. As of December 2025, the fitness center had a total of 2,030 members, including active employees, eligible

family members and retirees.

Additionally, the Corporation promotes employee health and well-being by encouraging annual physical examinations and

operating a comprehensive health and wellness center at its Puerto Rico corporate offices, staffed with healthcare providers and

enhanced by the addition of an on-site psychologist to provide mental health support. The center received over 15,000 visits

from employees during 2025.

Popular also seeks to foster work-life balance by offering paid time off benefits to our employees, including community service

leave, paid parental leave, and flexible work arrangements. Our hybrid work model, available to approximately half of our

workforce, is designed to strike an appropriate balance between employee flexibility and business needs, reinforcing our

commitment to a flexible and productive work environment. In addition, we regularly offer activities and workshops focused on

physical fitness and personal financial management.

Popular further offers a 401(k) savings and investment plan, in which 98% of employees participate. Under the plan, Popular matches $0.50 for every dollar contributed by an employee, up to 8% of the employee’s salary. Moreover, Popular maintains a profit-sharing plan, contingent upon the achievement of pre-established financial goals, to further align employee compensation with the Corporation’s overall performance. Under the profit-sharing plan, employees may receive up to 8% of their eligible compensation (capped at $70,000), with the first 4% paid in cash and any amount above that threshold paid to the employee’s savings and investment plan account. Additionally, Popular regularly reviews employees’ base compensation to remain competitive with market salaries for comparable positions.

Empowering Growth: Our Commitment to Talent Developmen

t

We are committed to fostering the continuous development and upskilling of our employees and believe this is fundamental to

maintaining our competitive advantage. Towards that end, Popular offers development opportunities designed to strengthen our

employees’ knowledge, capabilities and skills, supporting their personal growth while enhancing Popular’s business strategies

and organizational effectiveness.

Our 40,000 square foot development center in San Juan, Puerto Rico, and our satellite facilities in New York, South Florida, and

the Virgin Islands, offer year-round training sessions, activities and workshops. In 2025, there were approximately 6,700

registered participations in corporate academy voluntary courses, new employee orientations, health coordinator certifications,

and manager onboarding programs—an increase of approximately 2,500 compared to the participation levels in 2024. These

courses offer instructor-led training experiences for employees to develop and apply critical core and technical skills. Our

commitment to continuous learning is further supported through employee access to LinkedIn Learning, which provides an

extensive library of over 16,000 e-learning courses, enabling employees to pursue self-directed learning aligned with both

professional development goals and business needs.

Our focus on training and development has provided internal growth opportunities for our workforce. As a result, the

Corporation’s internal mobility rate in 2025 was 47%, reflecting employees who applied for or were selected for open positions,

received promotions, or made lateral moves within the organization. Additionally, we continued strengthening key skills across

accelerated development programs focused on data science, agile methodologies, analytics, process efficiency, and product

management. During 2025, approximately 400 employees participated in these programs, further enhancing the organization’s

talent.

During 2025, Popular successfully implemented the Executive Development Program, engaging over 80 executive leaders in a

comprehensive initiative focused on strengthening key behaviors, including agility, accountability, collaboration, and leadership

mindset, aligned with our company values. In addition, we introduced the Middle Management Development Program, a two-

year development journey for over 1,700 leaders designed to reinforce alignment with the Corporation’s values and expected

behaviors while fostering sustainable organizational transformation. Furthermore, we provided our leaders with advanced tools

to support more effective and impactful performance discussions.

Our organizational effectiveness strategy was crucial in advancing organizational development through targeted initiatives,

including assessments, team integration activities, new manager integration facilitations, and team alignment sessions. These

efforts are designed to foster a cohesive, agile, and adaptable workforce capable of supporting the Corporation’s evolving

business objectives.

Enhancing Leadership Continuity through Strategic Succession Planning

Popular’s business strategy integrates succession planning to ensure effective and orderly leadership transitions. Succession

plans for senior management are developed by the Chief Executive Officer and presented to the Board of Directors. Popular’s

succession planning also leverages our Executive Talent Management Program to identify high-potential and high-performing

managers, providing them with targeted learning opportunities to enhance their skills and prepare them for future senior

management positions.

Employee Experience

Popular is committed to providing an exceptional employee experience that inspires our employees to deliver outstanding

service to our customers and communities. We recognize the evolving nature of our employees’ needs and expectations and

have a robust approach to measuring and understanding their journey. Our employee engagement and experience survey

program includes biannual pulse surveys, an annual enterprise-wide survey, and additional surveys that assess the end -to-end

employee journey. We believe that these insights contributed to our ability to maintain a stable employee turnover rate of 8.5%

as of the end of 2025. Furthermore, our employee-experience efforts are reflected in record participation rate of 77% and a

sustained employee-loyalty score of 81%, positioning us above the 50th percentile of the Qualtrics global benchmark and above

the financial services industry average benchmark.

Board Oversight in Human Capital

The Talent and Compensation Committee of the Corporation’s Board of Directors has oversight responsibility for the

Corporation’s human capital management practices. As part of its responsibilities, the Talent and Compensation Committee

reviews and advises management on the Corporation’s overall compensation philosophy, programs and policies, and on the

Corporation’s talent acquisition and development, workforce engagement, succession planning, and corporate culture, among

other human capital matters.

We encourage you to review our Corporate Sustainability Report published on www.popular.com (http://www.popular.com) for more detailed information

regarding the Corporation’s human capital management programs and initiatives. The information on the Corporation’s website,

including the Corporation’s Corporate Sustainability Report, is not, and will not be deemed to be, a part of this Form 10-K or

incorporated into any of the Corporation’s filings with the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America

(“PNA”) and their respective subsidiaries. Such laws and regulations are continually under review by Congress and state

legislatures and federal and state regulatory agencies. Any change in the laws and regulations applicable to Popular and its

subsidiaries could have a material effect on the business of Popular and its subsidiaries. We will continue to assess our businesses

and risk management and compliance practices to conform to developments in the regulatory environment.

General

Popular and PNA are bank holding companies subject to consolidated supervision and regulation by the Federal Reserve

Board under the Bank Holding Company Act of 1956 (as amended, the “BHC Act”). BPPR and PB are subject to supervision and

examination by applicable federal and state banking agencies including, in the case of BPPR, the Federal Reserve Board and the

Office of the Commissioner of Financial Institutions of Puerto Rico (the “Office of the Commissioner”), and, in the case of PB, the

Federal Reserve Board and the New York State Department of Financial Services (the “NYSDFS”). Popular’s broker-dealer /

investment adviser subsidiary, Popular Securities, LLC (“PS”) and investment adviser subsidiary Popular Asset Management LLC

(“PAM”) are subject to regulation by the SEC, the Financial Industry Regulatory Authority (“FINRA”), and the Securities Investor

Protection Corporation, among others. Other of our non-bank subsidiaries conduct reinsurance and insurance producer and agency

activities, which are subject to other federal, state and Puerto Rico laws and regulations as well as licensing and regulation by the

Puerto Rico Office of the Commissioner of Insurance and, for one insurance agency subsidiary, the NYSDFS.

Enhanced Prudential Standards

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), as modified by the

Economic Growth, Regulatory Relief, and Consumer Protection Act and the federal banking regulators’ 2019 “Tailoring Rules,”

banking organizations are categorized based on status as a U.S. G-SIB, size and four other risk-based indicators. Among bank

holding companies with $100 billion or more in total consolidated assets, the most stringent standards apply to U.S. G-SIBs, which

are subject to Category I standards, and the least stringent standards apply to Category IV organizations, which have between $100

billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and which are also

not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk

management requirements. As of December 31, 2025, Popular had total consolidated assets of $75.3 billion.

Transactions with Affiliates

BPPR and PB are subject to restrictions that limit the amount of extensions of credit and certain other “covered

transactions” (as defined in Section 23A of the Federal Reserve Act) between BPPR or PB, on the one hand, and Popular, PNA or

any of our other non-banking subsidiaries, on the other hand, and that impose collateralization requirements on such credit

extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that

affiliate would exceed 10% of the bank’s capital stock and surplus or the aggregate amount of the bank’s covered transactions with

all non-bank affiliates would exceed 20% of the bank’s capital stock and surplus. In addition, any transaction between BPPR or PB,

on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, is required to be carried out on an

arm’s length basis.

Source of Financial Strength

The Dodd-Frank Act requires bank holding companies, such as Popular and PNA, to act as a source of financial and

managerial strength to their subsidiary banks. Popular and PNA are expected to commit resources to support their subsidiary banks,

including at times when Popular and PNA may not be in a financial position to provide such resources. Any capital loans by a bank

holding company to any of its subsidiary depository institutions are subordinated in right of payment to depositors and to certain

other indebtedness of such subsidiary depository institution. In the event of a bank holding company’s bankruptcy, any commitment

by the bank holding company to a federal banking agency to maintain the capital of a subsidiary depository institution will be

assumed by the bankruptcy trustee and entitled to a priority of payment. BPPR and PB are currently the only insured depository

institution subsidiaries of Popular and PNA.

Resolution Planning and Resolution-Related Requirements

bank holding company with $250 billion or more in total consolidated assets (or that is a Category III firm based on

certain risk-based indicators described in the Tailoring Rules) is required to report periodically to the FDIC and the Federal Reserve

Board such company’s plan for its rapid and orderly resolution in the event of material financial distress or failure. In addition,

insured depository institutions with total assets of $50 billion or more are required to submit to the FDIC periodic contingency plans

for resolution in the event of the institution’s failure. In June 2024, the FDIC finalized amendments to the resolution planning

requirements for insured depository institutions with $50 billion or more in total assets. The amendments require insured depository

institutions with between $50 billion and $100 billion in assets to submit informational filings on a three-year cycle, with an interim

supplement updating key information submitted in the off years. These amendments became effective October 1, 2024, and BPPR’s

first submission under the new rule is due by April 1, 2026.

On August 29, 2023, the Federal Reserve Board, FDIC and Office of the Comptroller of the Currency (“OCC”) issued a

proposed rule that would require bank holding companies and insured depository institutions with $100 billion or more in

consolidated assets (as well as their insured depository institution affiliates) to maintain minimum amounts of eligible long-term debt

(generally, debt that is unsecured, has a maturity greater than one year from issuance and satisfies additional criteria), subject to a

three-year phase-in period. The proposal would also apply “clean holding company” requirements to Category II through IV bank

holding companies, which would, among other things, prohibit those holding companies from entering into derivatives and certain

other financial contracts with third parties. As of December 31, 2025, Popular, PNA, BPPR and PB’s total assets were below the

thresholds for applicability of these rules, except that BPPR is subject to the FDIC’s resolution planning requirements applicable to

insured depository institutions with more than $50 billion but less than $100 billion in assets.

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of

the FDIC, and BPPR and PB are subject to FDIC deposit insurance assessments to maintain the DIF. Deposit insurance

assessments are based on the average consolidated total assets of the insured depository institution minus the average tangible

equity of the institution during the assessment period. For larger depository institutions with over $10 billion in assets, such as BPPR

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among other measures, that seeks to capture

both the probability that an individual large institution will fail and the magnitude of the impact on the DIF if such a failure occurs. The

FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately

captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30

basis points on an annualized basis. Taking into account the adjustments the FDIC may make to the base rate, the total base

assessment rate could range from 1.5 to 40 basis points on an annualized basis.

In October 2022, the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis

points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the Federal Deposit Insurance Act

(“FDIA”), established a plan in September 2020 to restore the DIF reserve ratio to meet or exceed the statutory minimum of 1.35

percent within eight years. The increased assessment is intended to improve the likelihood that the DIF reserve ratio would reach

the required minimum by the statutory deadline of September 30, 2028.

As of December 31, 2025, BPPR and PB had a DIF average total asset less average tangible equity assessment base of

$69 billion.

On November 16, 2023, the FDIC finalized a rule that imposes a special assessment to recover the costs to the DIF

resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution test under the FDIA in

connection with the receiverships of Silicon Valley Bank and Signature Bank. The FDIC estimated in approving the rule that those

assessed losses total $16.3 billion. The rule provides that this loss estimate will be periodically adjusted, which will affect the amount

of the special assessment. Under the rule, the assessment base is the estimated uninsured deposits that an insured depository

institution reported in its Consolidated Reports of Condition and Income (“Call Report”) at December 31, 2022, excluding the first $5

billion in estimated uninsured deposits. For a holding company that has more than one insured depository institution subsidiary,

such as Popular, the $5 billion exclusion is allocated among the company’s insured depository institution subsidiaries in proportion

to each insured depository institution’s estimated uninsured deposits. The special assessments were to be collected at an annual

rate of approximately 13.4 basis points per year (3.36 basis points per quarter) over eight quarters, with the first assessment period

having begun January 1, 2024. In June 2024, due to the increase in the estimate of losses, the FDIC announced that it projected

that the special assessment would be collected for an additional two quarters beyond the initial eight quarter collection period, at a

lower rate. In December 2025, the FDIC reduced the rate at which the assessment is collected, with an invoice payment date of

March 30, 2026, from 3.36 basis points to 2.97 basis points, and also reduced the collection period back to eight quarters.

Brokered Deposits

The FDIA and regulations adopted thereunder restrict the use of brokered deposits and the rate of interest payable on

deposits for institutions that are less than well capitalized. Popular does not believe the brokered deposits regulations have had or

will have a material effect on the funding or liquidity of BPPR and PB.

Capital Adequacy

Popular, PNA, BPPR and PB are each required to comply with applicable capital adequacy standards established by the

federal banking agencies (the “Capital Rules”), which implement the Basel III framework set forth by the Basel Committee on

Banking Supervision (the “Basel Committee”) as well as certain provisions of the Dodd-Frank Act.

Among other matters, the Capital Rules: (i) impose a capital measure called “Common Equity Tier 1” (“CET1”) and the

related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1

capital” instruments meeting certain revised requirements; and (iii) mandate that most deductions/adjustments to regulatory capital

measures be made to CET1 and not to the other components of capital. Under the Capital Rules, for most banking organizations,

including Popular, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most

common form of Tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject

to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the

“leverage ratio”).

The Capital Rules also impose a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-

weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking

institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face

constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and eligible retained income

(that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income). Popular, BPPR and PB are

therefore required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of

(i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%.

Pursuant to the Capital Rules, the effects of certain accumulated other comprehensive income or loss (“AOCI”) items

included in stockholders’ equity (for example, marks-to-market of securities held in the available for sale portfolio) are not excluded

from regulatory capital ratios; however, banking organizations that are not subject to Categories I or II standards under the

framework for banking organizations with $100 billion or more in assets, including Popular, BPPR and PB, may make a one-time

permanent election to continue to exclude these items. Popular, BPPR and PB have made this election in order to avoid significant

variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their available for sale

securities portfolios. On July 27, 2023, the federal banking regulators proposed revisions to the Capital Rules to implement the

Basel Committee’s 2017 standards, described below, and make other changes to the Capital Rules, including the ability of banking

organizations in Categories III and IV to elect not to recognize most elements of AOCI in regulatory capital. The proposal introduces

revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes.

However, the revised capital requirements of the proposed rule would not apply to Popular, BPPR, or PB because they have less

than $100 billion in total consolidated assets and trading assets and liabilities below the threshold for market risk requirements. The

federal banking regulators have subsequently indicated that they expect to issue a revised proposal, the timing and contents of

which are uncertain.

The Capital Rules preclude certain hybrid securities, such as trust preferred securities, from inclusion in bank holding

companies’ Tier 1 capital. Trust preferred securities not included in Popular’s Tier 1 capital may nonetheless be included as a

component of Tier 2 capital. Popular has not issued any trust preferred securities since May 19, 2010. As of December 31, 2025,

Popular has $193 million of trust preferred securities outstanding which no longer qualify for Tier 1 capital treatment, but instead

qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions from and adjustments to CET1. Banking organizations that are

not subject to Category I or II standards are subject to rules that provide for simplified capital requirements relating to the threshold

deductions for certain mortgage servicing assets, deferred tax assets, investments in the capital of unconsolidated financial

institutions and inclusion of minority interests in regulatory capital.

Failure to meet capital guidelines could subject Popular and its depository institution subsidiaries to a variety of

enforcement remedies, including the termination of deposit insurance by the FDIC and to certain restrictions on our business. Refer

to “Prompt Corrective Action” below for further discussion.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-

crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk

(including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable

commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital.

Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to Category I and Category II

banking organizations and not to Popular, BPPR and PB.

In 2020, federal bank regulators adopted a rule that allowed banking organizations to elect to delay temporarily the

estimated effects of adopting the Current Expected Credit Loss (“CECL”) model of ASU 2016-13 on regulatory capital until January

2022 and subsequently to phase in the effects through January 2025. The Corporation’s capital ratios at December 31, 2025 reflect

the full phased in impact from the adoption of CECL.

Refer to the Consolidated Financial Statements in this Form 10-K., Note 20 and Table 10 of Management’s Discussion

and Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer to the Consolidated Financial Statements in this

Form 10-K Note 2 for more information regarding CECL.

Prompt Corrective Action

The FDIA requires, among other things, the federal banking agencies to take prompt corrective action in respect of

insured depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital tiers: “well

capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized”. A

depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain

other factors.

An insured depository institution will be deemed to be (i) “well capitalized” if the institution has a total risk-based capital

ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage

ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a

specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0%

or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0%

or greater and is not “well capitalized”; (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than

8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%;

(iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less

than 3%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized”

if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be

downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an

unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. An insured

depository institution’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the

capital category may not constitute an accurate representation of the institution’s overall financial condition or prospects for other

purposes.

The FDIA generally prohibits an insured depository institution from making any capital distribution (including payment of a

dividend) or paying any management fee to its holding company, if the depository institution would thereafter be undercapitalized.

Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition,

undercapitalized depository institutions are subject to growth limitations and are required to submit capital restoration plans. A

depository institution’s holding company must guarantee the capital restoration plan, up to an amount equal to the lesser of 5% of

the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency, when the

institution fails to comply with the plan. The federal banking agencies may not accept a capital restoration plan without determining,

among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s

capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions,

including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation

of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a

receiver or conservator.

The capital-based prompt corrective action provisions of the FDIA apply to the FDIC-insured depository institutions such

as BPPR and PB, but they are not directly applicable to holding companies such as Popular and PNA, which control such

institutions. As of December 31, 2025, both BPPR and PB met the quantitative requirements for ‘well capitalized’ status.

Restrictions on Dividends and Repurchases

The principal sources of funding for Popular and PNA have included dividends received from their banking and non-

banking subsidiaries, asset sales and proceeds from the issuance of debt and equity. Various statutory provisions limit the amount

of dividends an insured depository institution may pay to its holding company without regulatory approval. A member bank must

obtain the approval of the Federal Reserve Board for any dividend, if the total of all dividends declared by the member bank during

the calendar year would exceed the total of its net income for that year, combined with its retained net income for the preceding two

years, after considering those years’ dividend activity, less any required transfers to surplus or to a fund for the retirement of any

preferred stock. During the year ended December 31, 2025, BPPR declared cash dividends of $575 million, a portion of which was

used by Popular for the payments of the cash dividends on its outstanding common stock. At December 31, 2025, BPPR needed to

obtain prior approval of the Federal Reserve Board before declaring a dividend in excess of $191 million due to its retained income,

declared dividend activity and transfers to statutory reserves over the three years ended December 31, 2025. In addition, a member

bank may not declare or pay a dividend in an amount greater than its undivided profits as reported in its Report of Condition and

Income, unless the member bank has received the approval of the Federal Reserve Board. A member bank also may not permit any

portion of its permanent capital to be withdrawn unless the withdrawal has been approved by the Federal Reserve Board. Pursuant

to these requirements, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the

NYSDFS.

During the year ended December 31, 2025, Popular received cash dividends of $23 million from Popular International

Bank, Inc. (“PIBI”) and $22 million from its other non-banking subsidiaries.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common stock only out of net income available to common shareholders over the past year and only if the prospective rate of earnings retention appears consistent with the organization’s current and expected future capital needs, asset quality and overall financial condition. Moreover, under Federal Reserve Board policy, a bank holding company should not maintain dividend levels that place undue pressure on the capital of depository institution subsidiaries or that may undermine the bank holding company’s ability to be a source of strength to its banking subsidiaries. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company’s capital structure.

The Federal Reserve Board also restricts the ability of banking organizations to conduct stock repurchases. In certain

circumstances, a banking organization’s repurchases of its common stock may be subject to a prior approval or notice requirement

under other regulations or policies of the Federal Reserve. Any redemption or repurchase of preferred stock or subordinated debt is

subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation organized under the

laws of the Commonwealth of Puerto Rico are subject to a withholding tax of 10% instead of the 30% applied to other “foreign”

corporations. Accordingly, dividends from current or accumulated earnings and profits paid by PNA to Popular, Inc. sourced from the

U.S. operations of PB are subject to a 10% tax withholding.

A corporation organized under the laws of the Commonwealth of Puerto

Rico that is engaged in a U.S. trade or business is generally subject to a branch profits tax of 30% on its earnings and profits for the

taxable year that are “effectively connected” with such U.S. trade or business, adjusted as provided by U.S. federal income tax law.

Accordingly, to the extent BPPR’s U.S. operations generate effectively connected earnings and profits that are not reinvested in

such U.S. operations (and that are not otherwise adjusted as provided by U.S. federal income tax law), such effectively connected

earnings and profits will generally be subject to a branch profits tax of 30%.

Refer to Part II, Item 5, “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of

Equity Securities” for further information on Popular’s distribution of dividends and repurchases of equity securities.

See “Puerto Rico Regulation” below for a description of certain restrictions on BPPR’s ability to pay dividends under

Puerto Rico law.

Interstate Branching

The Dodd-Frank Act amended the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Interstate

Banking Act”) to authorize national banks and state banks to branch interstate through

de novo

branches. For purposes of the

Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as other state

banks.

Activities and Acquisitions

In general, the BHC Act limits the activities permissible for bank holding companies to the business of banking, managing

or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to

be properly incidental thereto. A company that meets management and capital standards and whose subsidiary depository

institutions meet management, capital and Community Reinvestment Act (“CRA”) standards may elect to be treated as a financial

holding company and engage in a substantially broader range of nonbanking financial activities, including securities underwriting

and dealing, insurance underwriting and making merchant banking investments in nonfinancial companies.

In order for a bank holding company to elect to be treated as a financial holding company, (i) all of its depository institution

subsidiaries must be well capitalized (as described above) and well managed and (ii) it must file a declaration with the Federal

Reserve Board that it elects to be a “financial holding company.” As noted above, a bank holding company electing to be a financial

holding company must itself be and remain well capitalized and well managed. The Federal Reserve Board’s regulations applicable

to bank holding companies separately define “well capitalized” for bank holding companies, such as Popular, to require maintaining

a tier 1 capital ratio of at least 6% and a total capital ratio of at least 10%. Popular and PNA have elected to be treated as financial

holding companies. A depository institution is deemed to be “well managed” if, at its most recent inspection, examination or

subsequent review by the appropriate federal banking agency (or the appropriate state banking agency), the depository institution

received at least a “satisfactory” composite rating and at least a “satisfactory” rating for the management component of the

composite rating. If, after becoming a financial holding company, the company fails to continue to meet any of the capital or

management requirements for financial holding company status, the company must enter into a confidential agreement with the

Federal Reserve Board to comply with all applicable capital and management requirements. If the company does not return to compliance within 180 days, the Federal Reserve Board may extend the agreement or may order the company to divest its subsidiary banks or the company may discontinue, or divest investments in companies engaged in, activities permissible only for a bank holding company that has elected to be treated as a financial holding company. In addition, if a depository institution subsidiary controlled by a financial holding company does not maintain a CRA rating of at least “satisfactory,” the financial holding company will be subject to restrictions on certain new activities and acquisitions.

The Federal Reserve Board may in certain circumstances limit our ability to conduct activities and make acquisitions that

would otherwise be permissible for a financial holding company. Furthermore, a financial holding company must obtain prior written

approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets.

In addition, we are required to obtain prior Federal Reserve Board approval before engaging in certain banking and other financial

activities both in the United States and abroad.

The “Volcker Rule” adopted as part of the Dodd-Frank Act restricts the ability of Popular and its subsidiaries, including

BPPR and PB as well as non-banking subsidiaries, to sponsor or invest in “covered funds,” including private funds, or to engage in

certain types of proprietary trading. Popular and its subsidiaries generally do not engage in the businesses subject to the Volcker

Rule; therefore, the Volcker Rule does not have a material effect on our operations.

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in recent years has been aimed at combating money

laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA PATRIOT Act”) strengthened the ability of the U.S.

government to help prevent, detect and prosecute international money laundering and the financing of terrorism. Title III of the USA

PATRIOT Act imposed significant compliance and due diligence obligations, created new crimes and penalties and expanded the

extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements

could have serious legal and reputational consequences for the institution.

The Anti-Money Laundering Act of 2020 (“AMLA”), which amended the Bank Secrecy Act (the “BSA”), is intended to

comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based

approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate

priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for

testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including

a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and

protections. Many of the statutory provisions in the AMLA require additional rulemakings, reports and other measures, and the

impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial

Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and

countering the financing of terrorism policy required under AMLA. The priorities include: corruption, cybercrime, terrorist financing,

fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Federal regulators regularly examine BSA/Anti-Money Laundering and sanctions compliance to enhance their adequacy

and effectiveness, and the frequency and extent of such examinations and related remedial actions have been increasing.

Community Reinvestment Act

The CRA requires banks to help serve the credit needs of their communities, including extending credit to low- and

moderate-income individuals and geographies. Should Popular or our bank subsidiaries fail to serve adequately the community,

potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries

and affiliates, expand into new financial activities and merge with or purchase other financial institutions.

Interchange Fees Regulation

The Federal Reserve Board has established standards for debit card interchange fees and prohibited network exclusivity

arrangements and routing restrictions. The maximum permissible interchange fee that an issuer may receive for an electronic debit

transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. Additionally, the

Federal Reserve Board allows for an upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee if the

issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards.

In October 2023, the Federal Reserve Board proposed amendments to its rules on interchange fees. If adopted, the proposed changes would establish a maximum permissible interchange fee of no more than 14.4 cents per transaction plus four basis points multiplied by the value of the transaction. The fraud prevention adjustment would be increased to 1.3 cents per transaction. The proposed changes would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card issuers.

Consumer Financial Protection Act of 2010

The Consumer Financial Protection Bureau (the “CFPB”) supervises “covered persons” (broadly defined to include any

person offering or providing a consumer financial product or service and any affiliated service provider) for compliance with federal

consumer financial laws. The CFPB also has the broad power to prescribe rules applicable to a covered person or service provider

identifying as unlawful, unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a

consumer financial product or service, or the offering of a consumer financial product or service. We are subject to examination and

regulation by the CFPB. During 2025, the CFPB reduced its staff by over 80%. The reduction in force is the subject of litigation, and

the staffing cuts are currently stayed pending the federal circuit court’s en banc rehearing of the case. The impact of these

developments on banking organizations subject to CFPB regulation and supervision, including us, is uncertain. The Consumer

Financial Protection Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted

at the federal level and, in certain circumstances, permits state attorneys general to enforce compliance with both the state and

federal laws and regulations. States and state attorneys general may increase regulatory, investigative and enforcement activity with

respect to consumer protection, in response to changes in regulation, supervision and enforcement of consumer protection laws by

federal regulators.

On October 22, 2024, the CFPB finalized a new rule to implement Section 1033 of the Consumer Financial Protection Act

that requires a provider of payment accounts or products, such as a bank, to make data available to consumers upon request

regarding the products or services they obtain from the provider. Any such data provider also has to make such data available to

third parties, with the consumer’s express authorization and through an interface that satisfies formatting, performance and security

standards, for the purpose of such third parties providing the consumer with financial products or services requested by the

consumer. Data required to be made available under the rule includes transaction information, account balance, account and routing

numbers, terms and conditions, upcoming bill information, and certain account verification data. The rule is intended to give

consumers control over their financial data, including with whom it is shared, and encourage competition in the provision of

consumer financial products or services. For banks with at least $10 billion and less than $250 billion in total assets, compliance

with the rule’s requirements is required beginning on April 1, 2027. The rule is the subject of litigation, which is currently stayed while

the CFPB considers revisions to the rule.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department Office of Foreign Assets Control (“OFAC”) administers economic sanctions that affect

transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting countries take

many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or

investment in a sanctioned country; and (ii) a blocking of assets in which the government of the sanctioned country or other specially

designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the United

States or the possession or control of U.S. persons outside of the United States). Blocked assets (e.g., property and bank deposits)

cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these

sanctions could have serious legal and reputational consequences, including denial by federal regulators of proposed merger,

acquisition, restructuring, or other expansionary activity.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of the Gramm-Leach-Bliley Act of 1999 generally prohibit financial institutions, including us, from

disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing)

unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing

among affiliates for marketing purposes and governs the use and provision of information to consumer reporting agencies.

The federal banking regulators have also issued guidance and rules regarding cybersecurity that are intended to enhance

cyber risk management standards among financial institutions. A financial institution is expected to establish lines of defense and to

maintain risk management processes that are designed to address the risk posed by compromised customer credentials. A financial

institution’s management is expected to maintain sufficient business continuity planning processes for the rapid recovery,

resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. In November

2021, the U.S. federal bank regulatory agencies issued a final rule requiring banking organizations, including Popular, PNA, BPPR

and PB, to notify their primary federal banking regulator within 36 hours of determining that a “notification incident” has occurred. A

notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially

disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the

viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires

specific and immediate notifications by bank service providers that become aware of similar incidents.

State and foreign regulators have also been increasingly active in implementing privacy and cybersecurity standards and

regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and

providing detailed requirements with respect to these programs, including data encryption requirements. In New York, the NYSDFS

requires financial institutions regulated by the NYSDFS, including PB, to, among other things, (i) establish and maintain a

cybersecurity program designed to enhance the confidentiality, integrity and availability of their information systems; (ii) implement

and maintain a written cyber security policy setting forth policies and procedures for the protection of their information systems and

nonpublic information; and (iii) designate a Chief Information Security Officer.

On November 1, 2023, the NYSDFS adopted

amendments to its cybersecurity regulations that represent a significant update to the regulation of cybersecurity practices. The

amendments generally fall within the following five categories: (i) increased mandatory controls associated with common attack

vectors, (ii) enhanced requirements for privileged accounts, (iii) enhanced notification obligations, (iv) expansion of cyber

governance practices and (v) additional cybersecurity requirements for larger companies.

On July 6, 2023, the SEC adopted new rules that would require registrants, such as Popular, to (i) report material

cybersecurity incidents on Form 8-K and, (ii) disclose in Annual Report on Form 10-K cybersecurity policies and procedures and

governance practices, including at the board and management levels.

Many states and foreign governments have also recently implemented or modified their data breach notification and data

privacy requirements. The California Consumer Privacy Act (“CCPA”) imposes privacy compliance obligations with regard to the

collection, use and disclosure of personal information of California residents, and the November 2020 amendment to the CCPA

creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered

by the law and certain rights relating to personal information. The substantive obligations under the 2020 amendment to the CCPA

became effective on January 1, 2023. In the European Union, the General Data Protection Regulation heightens privacy compliance

obligations and imposes strict standards for reporting data breaches. We continue to monitor these developments to comply with

applicable requirements.

See “Puerto Rico Regulation” below for a description of legislations and regulations on information privacy and

cybersecurity in Puerto Rico.

Climate-Related and ESG Developments

In recent years, certain lawmakers and regulators in and outside the United States have increased their focus on financial

institutions’ and other companies’ risk oversight, disclosures and practices in connection with climate change and other

environmental, social and governance (“ESG”) matters. For example, in 2023, the NYSDFS issued guidance on climate-related

financial risk management applicable to NYSDFS-regulated banking and mortgage organizations, including PB. The guidance

addresses material financial risks related to climate change faced by these organizations in the context of risk assessment, risk

management, and risk appetite setting. In 2023, California enacted climate-related disclosure laws requiring certain companies

doing business in California to make certain climate-related disclosures beginning in 2026, including but not limited to greenhouse

gas emissions data and climate-related risks. On the other hand, certain states have enacted, or have proposed to enact, “anti-

ESG” statutes, regulations or policies, including statutes that prohibit financial institutions from denying or canceling products or

services to a person, or otherwise discriminating against a person in making available products or services, on the basis of social

credit scores and certain other factors. Additionally, in August 2025, President Trump signed Executive Order 14331, “Guaranteeing

Fair Banking Access for All Americans,” which states that it is the policy of the United States that no American should be denied

access to financial services because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The

Executive Order directs the Treasury Secretary and federal banking regulators to address politicized or unlawful debanking

activities.

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation

arrangements of banking organizations, such as Popular, that are not “large, complex banking organizations.” Deficiencies will be

incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take

other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or

related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the

organization is not taking prompt and effective measures to correct the deficiencies.

The Federal Reserve Board, OCC and FDIC have issued comprehensive final guidance on incentive compensation

policies intended to discourage excessive risk-taking in the incentive compensation policies of banking organizations in order to not

undermine the safety and soundness of such organizations. The guidance, which covers all employees that have the ability to

materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a

banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond

the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk

management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s

board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking

agencies and the SEC, to adopt rules prohibiting incentive-based payment arrangements that encourage inappropriate risks by

providing excessive compensation or that could lead to a material financial loss at specified regulated entities having at least $1

billion in total assets (including Popular, PNA, BPPR and PB). The U.S. financial regulators proposed revised rules in 2016, which

have not been finalized.

In October 2022, the SEC adopted a final rule requiring securities exchanges to adopt rules mandating, in the case of a

restatement, the recovery or “clawback” of excess incentive-based compensation paid to current or former executive officers and

requiring listed issuers to disclose any recovery analysis where recovery is triggered by a restatement. The excess compensation

would be based on the amount the executive officer would have received had the incentive-based compensation been determined

using the restated financials. The Nasdaq Stock Market’s listing standards pursuant to the SEC’s rule became effective October 2,

2023. Popular’s clawback policy adopted in accordance with these listing standards is included as Exhibit 97.1.

Regulation of Broker-Dealers

Our subsidiary, PS, is a registered broker-dealer with the SEC and subject to regulation and examination by the SEC as

well as FINRA and other self-regulatory organizations. These regulations cover a broad range of issues, including capital

requirements; sales and trading practices; use of client funds and securities; the conduct of directors, officers and employees;

record-keeping and recording; supervisory procedures to prevent improper trading on material non-public information; qualification

and licensing of sales personnel; and limitations on the extension of credit in securities transactions. In addition to federal

registration, state securities commissions require the registration of certain broker-dealers. PS is registered with 35 U.S. state and

territory securities commissions.

Regulation of Reinsurers, Insurance Producers and Agents

Popular’s subsidiaries that are engaged in insurance agency and producer activities are subject to regulatory supervision

by the Puerto Rico Office of the Commissioner of Insurance and to insurance laws and regulations requiring licensing of insurance

producers and agents. Popular’s reinsurance subsidiaries are subject to licensure and regulatory supervision by the Puerto Rico

Office of the Commissioner of Insurance and to insurance laws and regulations requiring, among other things, minimum capital and

solvency standards, financial reporting, restrictions on the amount of dividends payable, record keeping and examinations.

Puerto Rico Regulation

As a commercial bank organized under the laws of Puerto Rico, BPPR is subject to supervision, examination and

regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended

(the “Banking Law”).

Section 27 of the Banking Law requires that at least ten percent (10%) of BPPR’s annual retained earnings be transferred annually to a statutory reserve fund. The apportionment must be done every year until the reserve fund is equal to the total of paid- in capital on common and preferred stock. Under Regulation 9680 of the Puerto Rico Banking Law, dated July 22, 2025, Banks may be exempted from the requirement to transfer such funds to the statutory reserve fund if they are well capitalized, have obtained a rating of 1 or 2 in the last examination performed by the Office of the Commissioner or an applicable regulatory agency and have accumulated at least 50% of the paid in capital for their common and preferred stock in their reserve fund.

Section 27 of the Banking Law also provides that when the expenditures of a bank are greater than its receipts, the

excess of the former over the latter must be charged against the undistributed profits of the bank, and the balance, if any, must be

charged against the statutory reserve fund. If the statutory reserve fund is not sufficient to cover such balance in whole or in part, the

outstanding amount must be charged against the capital account and no dividend may be declared until capital has been restored to

its original amount and the statutory reserve fund to 20% of the original capital.

Section 16 of the Banking Law requires every bank to maintain a legal reserve that, except as otherwise provided by the

Office of the Commissioner, may not be less than 20% of its demand liabilities, excluding government deposits (federal, state and

municipal) that are secured by collateral. If a bank is authorized to establish one or more bank branches in a state of the United

States or in a foreign country, where such branches are subject to the reserve requirements of that state or country, the Office of the

Commissioner may exempt said branch or branches from the reserve requirements of Section 16. Pursuant to an order of the

Federal Reserve Board dated November 24, 1982, BPPR has been exempted from the reserve requirements of the Federal

Reserve System with respect to deposits payable in Puerto Rico. Accordingly, BPPR is subject to the reserve requirement

prescribed by Section 16 of the Banking Law. During 2025, BPPR was in compliance with the legal reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to any one person, firm, partnership or corporation, up to an

aggregate amount of fifteen percent (15%) of the paid-in capital and reserve fund of the bank. In the case of loans which are

secured by collateral worth at least 25% more than the amount of the loan, the maximum aggregate amount of such secured loans

is increased to one third of the paid-in capital of the bank and its reserve fund. In no event may the total of unsecured and secured

loans to any one person, firm, partnership or corporation exceed an aggregate amount of 33 1/3% of the paid-in capital and reserve

fund of the bank. If the institution is well capitalized and had been rated 1 or 2 in the last examination performed by the Office of the

Commissioner or an applicable regulatory agency, its legal lending limit shall also include 15% of 100% of its undivided profits and

for loans secured by collateral worth at least 25% more than the amount of the loan, the capital of the bank shall also include 33

1/3% of 100% of its undivided profits. Institutions rated 3 in their last regulatory examination may include this additional component

in their legal lending limit only with the previous authorization of the Office of the Commissioner. There are no restrictions under

Section 17 on the amount of loans that are wholly secured by bonds, securities and other evidence of indebtedness of the

Government of the United States or Puerto Rico, or by current debt bonds, not in default, of municipalities or instrumentalities of

Puerto Rico. As of December 31, 2025, the legal lending limit for BPPR under this provision was $723 million. During 2025, BPPR

was in compliance with the lending limit requirements of Section 17 of the Banking Law.

Section 14 of the Banking Law authorizes a bank to conduct certain financial and related activities, including finance

leasing of personal property and originating and servicing mortgage loans, directly or through subsidiaries. BPPR engages in

finance leasing and conducts the origination and servicing of mortgage loans through its Popular Auto and Popular Mortgage

divisions, respectively.

With respect to information privacy, Puerto Rico law requires businesses to implement information security controls to

protect consumers’ personal information from breaches, as well as to provide notice of any breach to affected customers. In 2024

Puerto Rico enacted the Cybersecurity Act of the Commonwealth of Puerto Rico, which establishes cybersecurity standards for

government entities and their contractors, including certain reporting and certification obligations. As a depositary of government

funds, BPPR could be considered a “contractor” under the statute; however, the Puerto Rico Innovation and Technology Service

has not yet adopted implementing regulation which we expect to address applicability and any exceptions to the statute’s

requirements. In addition, as noted above in “Regulation of Reinsurers, Insurance Producers and Agents,” Popular’s reinsurance

subsidiaries are subject to licensure and regulatory supervision by the Puerto Rico Office of the Commissioner of Insurance and to

insurance laws and regulations.

Available Information

We maintain an Internet website at www.popular.com (http://www.popular.com). Via the “Investor Relations” link at our website, our annual reports

on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to such reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available, free of charge, as soon as reasonably practicable after such forms are electronically filed with, or furnished to, the SEC. The SEC also maintains an internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. You may obtain copies of our filings on the SEC site.

We have adopted a written code of ethics that applies to all directors, officers and employees of Popular, including our

principal executive officer and senior financial officers, in accordance with Section 406 of the Sarbanes-Oxley Act of 2002 and the

rules of the SEC promulgated thereunder. Our Code of Ethics is available on our corporate website, www.popular.com (http://www.popular.com), in the

section entitled “Corporate Governance.” In the event that we make changes to, or provide waivers from, the provisions of this Code

of Ethics that the SEC requires us to disclose, we intend to disclose these events on our corporate website in such section. In the

Corporate Governance section of our corporate website, we have also posted the charters for our Audit Committee, Talent and

Compensation Committee, Risk Management Committee, Corporate Governance and Nominating Committee and Technology

Committee, as well as our Corporate Governance Guidelines. In addition, information concerning purchases and sales of our equity

securities by our executive officers and directors is posted on our website.

All website addresses given in this document are for information only and are not intended to be active links or to

incorporate any website information into this Form 10-K.

Risk factors

As filed, 80,371 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

We, like other financial institutions, face risks inherent to our business, financial condition, liquidity, results of operations

and capital position. These risks could cause our actual results to differ materially from our historical results or the results

contemplated by the forward-looking statements contained in this report.

The risks described in this report are not the only risks we face. Additional risks and uncertainties not currently known by

us or that we currently deem to be immaterial, or that are generally applicable to all financial institutions, may also materially

adversely affect our business, financial condition, liquidity, results of operations or capital position.

ECONOMIC AND MARKET RISKS

Weakness in the economy, particularly in Puerto Rico, where a significant portion of our business is concentrated, has

adversely impacted us in the past and may adversely impact us in the future.

We have been, and will continue to be, impacted by global and local economic and market conditions, including weakness

in the economy, disruptions and volatility in the financial markets, inflation, monetary, trade and fiscal policies, public policy,

geopolitical conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated in

Puerto Rico, which accounted for 77% of our assets and 79% of our deposits as of December 31, 2025 and 80% of our revenues for

the year ended December 31, 2025. As a result, our financial condition and results of operations are highly dependent on the

general trends of the Puerto Rico economy and other conditions affecting Puerto Rico consumers and businesses. The

concentration of our operations in Puerto Rico exposes us to greater risks than other banking companies with a wider geographic

base.

Puerto Rico has faced significant economic and fiscal challenges in the past, including a severe recession that began in

2007 and persisted for over a decade and an acute fiscal crisis that led the Puerto Rico government to file for a form of federal

bankruptcy protection in 2017. Puerto Rico’s fiscal and economic challenges have in the past adversely affected our customers,

resulting in higher delinquencies, charge-offs and increased losses for us. While Puerto Rico’s economy has been gradually

recovering and the Puerto Rico government emerged from bankruptcy in 2022, Puerto Rico still faces significant economic and

fiscal challenges.

Puerto Rico’s economy is closely tied to the U.S. economy, as well as highly reliant on U.S. public policy and funding

decisions. Puerto Rico has historically received significant federal support for a wide range of government programs and services,

including healthcare, education, infrastructure and social assistance programs. More recently, Puerto Rico has received significant

federal stimulus, disaster relief and reconstruction funding, which has served as a major driver of economic activity. Reductions in

federal funding to programs that have benefited the Puerto Rico economy or delays in disbursements could significantly impact

Puerto Rico’s economy and hinder reconstruction efforts, including the restoration and improvement of critical infrastructure. In

addition, given that Puerto Rico’s Medicaid program is funded through federal block grants, absent federal legislative action, annual

Medicaid funding for Puerto Rico is projected to drop significantly during the 2027-2028 fiscal year, which would require the Puerto

Rico government to cover substantial program costs and potentially place significant strain on its finances. Beyond direct funding,

broader shifts in U.S. policy, such as changes to tax or trade policies, and shifts in policies of other governments in response, could

also adversely impact the Puerto Rico economy. A weakening of the Puerto Rico economy or other adverse economic conditions

affecting Puerto Rico consumers and businesses could result in decreased demand for our products or services, deterioration in the

credit quality of our customers, higher delinquencies, charge-offs or increased losses, all of which could adversely affect our

business, financial condition, liquidity, results of operations or capital position.

We are also exposed to risks related to the state of the local economies of the other markets in which we do business,

such as New York and Florida, as well as to the state of the global and U.S. economy and financial markets. Evolving geopolitical

tensions, the introduction or escalation of tariffs, inflationary pressures and other political or economic shifts may lead to increased

market volatility and disruption. These factors could, in turn, adversely impact our business, financial condition, liquidity, results of

operations or capital position.

Changes in interest rates and credit spreads can adversely impact our financial condition, including our investment

portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments.

Our business and financial performance are impacted by market interest rates and movements in those rates. Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

a material impact on our results of operations and the values of our assets and liabilities, including our investment portfolio. Interest

rates are highly sensitive to many factors over which we have no control and which we may not be able to anticipate adequately,

including general economic conditions and the monetary and tax policies of various governmental bodies, particularly the Federal

Reserve Board. Changes in these policies, including changes in interest rates, impact various aspects of our business, including

loan originations, the speed of prepayments, loan delinquencies, the value of our investments, the rates we receive on our loans

and investment securities, our ability to maintain and generate deposits and the rates we pay on our deposits and other funding

sources. The effects of these changes may be amplified if we are unable to effectively manage the sensitivity of our assets and

liabilities to market interest rate changes.

The rapid rise in interest rates in 2022 resulted in $2.5 billion in unrealized mark-to-market losses on available-for-sale

securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with a fair value of

$6.5 billion (par value of $7.4 billion), and with accumulated unrealized losses of $873 million, from our available-for-sale portfolio to

our held-to-maturity portfolio. While the size of our unrealized mark-to-market losses on available-for-sale securities had been

reduced to $0.9 billion as of December 31, 2025, if interest rates were to again rise rapidly or for a prolonged period, we may

accumulate significant additional mark-to-market losses on investment securities in our available-for-sale portfolio, which may

adversely affect our tangible capital and impact our ability to return capital to our stockholders.

For a discussion of the Corporation’s interest rate sensitivity, please refer to the “Risk Management” section of the MD&A

in this Form 10-K.

BUSINESS RISKS

Negative changes in the financial condition of our clients have adversely impacted us in the past and may adversely

impact us in the future.

A significant portion of our business involves lending money, which exposes us to credit risk and risk of loss if borrowers

do not repay their loans, leases, credit cards or other credit obligations. The performance of these credit portfolios significantly

affects our financial condition and results of operations. We have in the past been adversely affected by negative changes in the

financial condition of our clients due to weakness in the Puerto Rico and U.S. economy. If the current economic environment were to

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels of credit losses

and reserves for credit losses.

We are exposed to increased credit risks and credit losses to the extent our clients are concentrated by industry segment

or type of client.

Our credit risk and credit losses can increase to the extent our loans are concentrated in borrowers engaged in the same

or similar activities or in borrowers who as a group may be uniquely or disproportionately affected by certain economic or market

conditions. We have significant exposure to borrowers in certain economic sectors, such as residential and commercial real estate, hospitality and healthcare. Challenging economic or market conditions that affect the industries or types of clients to which we have significant exposure could result in higher credit losses and adversely affect our business, financial condition, liquidity, results of operations or capital position.

We also have direct lending and investment exposure to Puerto Rico government entities, which have faced significant

fiscal challenges. At December 31, 2025, our exposure to the Puerto Rico government consisted of $391 million in direct lending

exposure to Puerto Rico municipalities and $209 million in loans insured or securities issued by Puerto Rico governmental entities

but for which the principal source of repayment is non-governmental. We also have indirect lending exposure to the Puerto Rico

government in the form of loans to private borrowers who are service providers, lessors, suppliers or have other relationships with

the Puerto Rico government. While the overall fiscal situation of the Puerto Rico government has improved in recent years, including

as a result of the government and certain of its instrumentalities having restructured their debt obligations, some Puerto Rico

government entities, including certain municipalities, still face significant fiscal challenges. A deterioration in the fiscal situation of the

Puerto Rico government and its instrumentalities, and in particular the fiscal situation of the Puerto Rico municipalities to which we

have direct lending exposure, could result in higher credit losses and reserves for credit losses. For a discussion of risks related to

the Corporation’s credit exposure to the Puerto Rico and USVI governments, see the Geographic and Government Risk section in

the MD&A section of this Form 10-K.

Deterioration in the values of real properties securing our commercial, mortgage loan and construction portfolios have in

the past resulted, and may in the future result, in increased credit losses and harm our results of operations.

As of December 31, 2025, 55% of our loan portfolio consisted of loans secured by real estate collateral (comprised of

29% in commercial loans, 22% in residential mortgage loans and 4% in construction loans). The value of the collateral securing

such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy of some

of the markets we serve has in the past resulted in significant declines in the value of the real properties securing our loan portfolio,

leading to increased credit losses. If the value of the real estate properties securing our loan portfolio declines again in the future,

we may be required to increase our provisions for loan losses and allowance for loan losses. Any such increase could have an

adverse effect on our financial condition and results of operations. For more information on the credit quality of our construction,

commercial and mortgage portfolio, see the Credit Risk section of the MD&A included in this Form 10-K.

Defective and repurchased loans may harm our business and financial condition.

In connection with the sale and securitization of mortgage loans, we are required to make a variety of customary

representations and warranties regarding Popular and the loans being sold or securitized. Our obligations with respect to these

representations and warranties are generally outstanding for the life of the loan, and they relate to, among other things, compliance

with laws and regulations, underwriting standards, the accuracy of information in the loan documents and loan file and the

characteristics and enforceability of the loan. A loan that does not comply with the secondary market’s requirements may take

longer to sell, impact our ability to securitize the loans or pledge the loans as collateral for borrowings, or be unsalable or salable

only at a significant discount. Moreover, if any such loan is sold before we detect non-compliance, we may be obligated to

repurchase the loan and bear any associated loss directly, or we may be obligated to indemnify the purchaser against any loss. We

seek to minimize repurchases and losses from defective loans by correcting flaws, if possible, and selling or re-selling such loans.

However, if we were to suffer significant losses from defective and repurchased loans, our results of operations and financial

condition could be materially impacted.

If we are unable to maintain or grow our deposits, we may be subject to paying higher funding costs and our net interest

income may decrease.

We rely primarily on bank deposits as a low cost and stable source of funding for our lending and investment activities and

the operation of our business. Therefore, our funding costs are largely dependent on our ability to maintain and grow our deposits.

As our competitors have raised the interest rates they pay on deposits, our funding costs have increased, as we have had to

increase the rates we pay to our depositors to avoid losing deposits and to procure new ones. Rising interest rates have also led

customers to move their funds to other financial institutions or to alternative investments that pay higher interest rates. Additionally,

periods of market stress or lack of market or customer confidence in financial institutions may result in a loss of customer deposits,

especially to the extent those deposits are in excess of the FDIC-insured limit of $250,000. As of December 31, 2025, we had $14

billion of total deposits (other than collateralized public funds, which represent public deposit balances from governmental entities in

the U.S. and its territories, including Puerto Rico and the United States Virgin Islands, that are collateralized based on such

jurisdictions’ applicable collateral requirements) in excess of the FDIC-insured limit. If deposits decrease, we may need to rely on more expensive sources of funding, which would negatively impact our interest rate margin and net interest income. In addition, a reduction in our deposits would decrease our earning assets, which would also negatively affect our net interest income.

We have a significant amount of deposits from the Puerto Rico government, its instrumentalities and municipalities ($19.4

billion, or 29% of our total deposits, as of December 31, 2025), and the amount of these deposits may fluctuate depending on the

financial condition and liquidity of these entities, as well as on our ability to maintain these customer relationships. Under the terms

of BPPR’s deposit pricing agreement with the Puerto Rico government, most public fund deposit rates are market linked with a lag

minus a specified spread. Therefore, as market rates rise, we are required to sequentially increase the rates we pay our public

deposits. If the mix of our deposits shifts towards a higher proportion of higher-cost deposits for any reason, our funding costs would

increase and our net interest income would be expected to decrease.

OPERATIONAL RISKS

We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks. Future

cyber-attacks could cause substantial harm and have an adverse effect on our business and results of operations.

Cybersecurity risks for large financial institutions such as Popular have increased significantly in recent years in part

because of the proliferation of new technologies, such as mobile banking, cloud hosting, artificial intelligence and the ability to

conduct instant financial transactions anywhere globally, as well as due to geopolitical conflicts and the increased sophistication and

activities of organized crime, hackers, terrorists, nation-states, hacktivists and other parties. Cybersecurity threats are constantly

evolving, especially given the advances in, and the rise of the use of, artificial intelligence and quantum computing, thereby

increasing the difficulty of preventing, detecting and successfully defending against them.

In the ordinary course of business, we rely on electronic communications and information systems to conduct our

operations and to transmit and store sensitive data. Notwithstanding our defensive measures and the significant resources we

devote to protecting the security of our systems, there is no assurance that all of our security measures will be effective at all times,

especially as the threats from cyber-attacks are continuous and severe. The risk of a security breach due to a cyber-attack is

expected to increase as we continue to expand our digital capabilities, mobile banking and other internet-based product offerings,

the use of the cloud for system development and hosting and internal use of internet-based products and applications.

We continue to detect and identify attacks that are becoming more sophisticated and increasing in volume, as well as

attackers that respond rapidly to changes in defensive countermeasures. The most significant cyber-attack risks that we or our

critical service providers may face include, but are not limited to, e-fraud, denial-of-service (DDoS), ransomware, computer intrusion

and the exploitation of software zero-day vulnerabilities that might result in disruption of services, in the exposure or loss of

customer or proprietary data, and significant financial loss. These types of cyber-attacks have in the past resulted and may continue

to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security numbers, and

could present significant reputational, legal and regulatory costs to Popular if successful.

Our customer-facing platforms are also routinely targeted by threat actors aiming to gain unauthorized access to our

clients’ accounts. Although we have implemented defensive measures designed to protect against such attacks, there is no

assurance that these defensive measures will keep pace with threats that are continuous and growing in severity. For example, in

2022, certain customers were affected by brute force attacks on one of our platforms, which resulted in certain of our customers log-

in credentials and information being exposed, resulting in fraudulent transfers or withdrawals. Popular customers have also been

impacted by card skimming events in our ATM terminals. As a result, we have notified, and conducted additional remediation for,

customers identified as affected by these incidents. Cyber-security risks have also been exacerbated by the discovery of zero-day

vulnerabilities in widely distributed third party software, which have in the past affected and in the future could affect Popular’s or

any of its service provider’s systems, as further detailed below.

The increased use of remote access and third-party video conferencing solutions to enable work-from-home

arrangements for employees has also increased our exposure to cyber-attacks, including through the use of deep fakes and brand

impersonation. We expect the rise and use of artificial intelligence to exacerbate this risk. In addition, a third party could

misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by Popular’s

customers or employees. Recent geopolitical conflicts have also exacerbated the risks related to supply-chain compromises and de-

stabilizing activities of nation-state sponsored actors.

A material compromise or circumvention of the security of our systems could have serious negative consequences for us,

including significant disruption of our operations and those of our clients, customers and counterparties, misappropriation of confidential information of Popular or that of our clients, customers, counterparties or employees, or damage to computers or systems used by us or by our clients, customers and counterparties, and could result in violations of applicable privacy and other laws, financial loss to us or to our customers, increased regulatory scrutiny and enforcement actions, customer dissatisfaction, significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us. Banking regulators increasingly scrutinize third-party relationships supporting critical activities. If our regulators determine that our oversight, contractual protections, or the performance and controls of our third-party providers (including critical providers) are inadequate, we could be required to implement enhanced controls, conduct independent reviews, restrict or terminate relationships, or undertake costly remediation or conversion activities, any of which could disrupt operations, increase expenses, or adversely affect our reputation and results of operations.

The extent of a particular cyber-attack and the steps that we may need to take to investigate the attack may not be

immediately clear, and it may take a significant amount of time before such an investigation can be completed. While such an

investigation is ongoing, Popular may not necessarily know the full extent of the harm caused by the cyber-attack, and that damage

may continue to spread. These factors may inhibit our ability to provide rapid, full and reliable information about the cyber-attack to

our clients, customers, counterparties and regulators, as well as the public. Moreover, we may be required under SEC rules or bank

regulations to disclose information about a cybersecurity event before it has been resolved or fully investigated. Furthermore, it may

not be clear how best to contain and remediate the potential harm caused by the cyber-attack, and certain errors or actions could be

repeated or compounded before they are discovered and remediated. Cyber-attacks could also cause interruptions in our operations

and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel.

We also rely on third parties for the performance of a significant portion of our information technology functions and the

provision of information security, technology and business process services. As a result, a successful compromise or circumvention

of the security of the systems of these third-party service providers could have serious negative consequences for us, including

compromise of our systems, misappropriation of our confidential information or that of our clients, customers, counterparties or

employees, or other negative implications identified above with respect to a cyber-attack on our systems. The most important of

these third-party service providers for us is Evertec. As a result, we depend on Evertec to identify and remediate certain of our

cybersecurity vulnerabilities. Cyber-attacks at third-party service providers are also becoming increasingly common, and, as a result,

cybersecurity risks relating to our vendors, including Evertec have increased. Certain risks particular to Evertec and our dependence

on third parties are discussed under “We rely on other companies to provide key components of our business infrastructure,

including certain of our core financial transaction processing and information technology and security services, which exposes us to

a number of operational risks that could have a material adverse effect on us” in the Operational Risks section of Item 1A in this

Form 10-K. During 2023, personal information of Popular customers’ data was compromised in a data breach incident that impacted

MOVEit, the third-party file transfer platform used by one of our service providers. Popular notified, as required or otherwise deemed

appropriate, customers identified as affected by the incident. Furthermore, during 2024, threat actors exploited a zero-day

vulnerability in the Fortinet enterprise management server software used by Evertec, which migrated to one of Popular's domain

controllers due to a shared network environment. While Evertec eventually determined that no BPPR customer information was

exfiltrated as a result of this incident, the event underscores the risks inherent in Popular’s dependency on Evertec. Although these

incidents did not have a material effect on Popular, including its business strategy, results of operations or financial condition, and

our third-party service providers agreed to cover external remediation costs associated therewith, a compromise of Popular

information or the personal information of our customers maintained by third party vendors could result in significant regulatory

consequences, reputational damage and financial loss to us. The success of our business depends in part on the continuing ability

of these (and other) third parties to perform these functions and services in a timely and satisfactory manner, which performance

could be disrupted or otherwise adversely affected due to failures or other information security events originating at the third parties

or at the third parties’ suppliers or vendors (so-called “fourth party risk”). We may not be able to effectively directly monitor or

mitigate fourth-party risk, in particular as it relates to the use of common suppliers or vendors by the third parties that perform

functions and services for us.

As cyber threats continue to evolve, we also expect to expend significant additional resources to continue to modify or

enhance our layers of defense or to investigate and remediate additional information security vulnerabilities or incidents. The

obsolescence in our hardware or software limits our ability to mitigate vulnerabilities. System enhancements and updates also

create risks associated with implementing new systems and integrating them with existing ones, including risks associated with

supply chain compromises and the software development lifecycle of the systems used by us and our service providers. In addition,

addressing certain information security vulnerabilities, such as hardware-based vulnerabilities, may affect the performance of our

information technology systems. The ability of our hardware and software providers to deliver patches and updates to mitigate

vulnerabilities in a timely manner can introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Moreover, our efforts to timely mitigate vulnerabilities and manage such risks, given the rise in number and urgency of required patches and third-party software, as well as the obsolescence in some of our hardware and software, may impact our day- to-day operations, the availability of our systems and delay the deployment of technology enhancements and innovation.

If Popular’s operational systems, or those of external parties on which Popular’s businesses depend, are unable to meet

the requirements of our businesses and operations or the standards of our regulators or other applicable data protection and privacy

laws, or if they fail, have other significant shortcomings or are impacted by cyber-attacks, Popular could be materially and adversely

affected.

We rely on other companies to provide key components of our business infrastructure, including certain of our core

financial transaction processing and information technology and security services, which exposes us to a number of

operational risks that could have a material adverse effect on us.

Third parties provide key components of our business operations, such as data processing, information security, recording

and monitoring transactions, online banking interfaces and services, Internet connections and network access. The most important

of these third-party service providers for us is Evertec due in large part to its role as a service provider to BPPR, our principal

banking subsidiary. We are dependent on Evertec for the provision of essential services to our business, including certain of BPPR’s

core financial transaction processing and information technology and security services. As a result, we are particularly exposed to

the operational risks of Evertec, including those related to its security architecture and potential breakdowns or failures of Evertec’s

systems or internal controls environment.

Over the course of our relationship with Evertec, we have experienced interruptions and delays in key services provided

by Evertec, as well as cyber events, as a result of system breakdowns, their exposure to zero-day vulnerabilities, misconfigurations,

human error, application obsolescence and dependency on shared infrastructure components and shared environments, which

have in certain cases also led to exposure of Popular information and BPPR customer information. In particular, the current level of

obsolescence in the hardware and software used by Evertec to service us exposes us to heightened operational and cybersecurity

risks, including system outages. Our ability to cure legacy obsolescence in the hardware and software we procure from Evertec, to

expand our oversight over security services being provided by Evertec, as well as to effect the segregation of our shared

infrastructure, is expected to be lengthy and complex, which exacerbates our exposure to resulting operational, including

cybersecurity, risks. See “The transition to new financial services technology providers, and the replacement of services currently

provided to us by Evertec, will be lengthy and complex” in the Operational Risks section of Item 1A in this Form 10-K below.

While we select third-party vendors carefully and have increased our oversight of these relationships, our oversight is

constrained by the level of our ongoing visibility into our vendor’s systems and operations, and we do not have direct control over

their actions, assets or services. Any problems caused by these vendors, including those resulting from disruptions in the services

provided, vulnerabilities in or breaches of the vendor’s systems or environments, failure of the vendor to handle current or higher

volumes, failure of the vendor to provide services for any reason or poor performance of services, failure of the vendor to notify us of

a reportable event in a timely manner, or our vendors’ misuse of artificial intelligence and other automatic decision making

technologies, could adversely affect our ability to deliver products and services to our customers and otherwise conduct our

business, disrupt our operations, result in potential liability to customers and counterparties, result in the imposition of fines,

penalties or judgments by our regulators, lead to exposure of our information or that of our customers or harm to our reputation, any

of which could materially and adversely affect us. The inability of our third-party service providers to timely address cybersecurity

threats may further exacerbate these risks. Financial or operational difficulties of a third-party vendor could also hurt our operations

if those difficulties interfere with the vendor’s ability to serve us. Replacing these third-party vendors, when possible, could also

create significant delay and expense. Accordingly, the use of third parties creates an unavoidable inherent risk to our business

operations.

The transition to new financial services technology providers, and the replacement of services currently provided to us by

Evertec, will be lengthy and complex.

Switching from one vendor of core financial transaction processing and related technology and security services to one or

more new vendors is a complex process that carries business and financial risks. The implementation cycle for such a transition

would be lengthy and require significant financial and management resources from BPPR and Popular. Such a transition can also

increase costs (including conversion costs), impede or disrupt business or technological initiatives, and expose us and our clients to

business disruption, as well as operational and cybersecurity risks. As we transition all or a portion of the existing services provided

by Evertec to new financial services technology providers, either (i) at the end of the term of the Second Amended and Restated

Master Services Agreement (the “MSA”) and related agreements or (ii) earlier upon the termination of any service for convenience under the MSA, these transition risks could result in an adverse effect on our business, financial condition and results of operations.

Although Evertec has agreed to provide certain transition assistance to us in connection with the termination of the MSA, we are

ultimately dependent on their ability to provide those services in a responsive and competent manner, as well as their ability to retain

experienced personnel to provide the services. A successful transition will also depend on our ability to retain personnel who have

relevant experience and expertise. Furthermore, we may require transition assistance from Evertec beyond the term of the MSA,

potentially delaying and lengthening any transition process away from Evertec while increasing related costs and risks of disruption

to us and our clients.

Under the MSA, we are able to terminate services for convenience with 180 days’ prior notice. We expect to exercise

during the term of the MSA the right to terminate certain services for convenience and to transition such services to other service

providers prior to the expiration of the MSA, subject to complying with the revenue minimums contemplated in the MSA and certain

other conditions. In practice, in order to switch to a new provider for a particular service, we will have to commence procuring and

working on a transition process for such service significantly in advance of its termination and, in any case, much earlier than the

expiration date of the MSA, and such process may extend beyond the current term of the MSA. Furthermore, if we are unsuccessful

or decide not to complete the transition after expending significant funds and management resources, it could also result in an

adverse effect on our business, financial condition and results of operations.

Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters,

acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other

consequences that could have a material adverse effect on our financial condition and results of operations.

A significant portion of our operations are located in the Caribbean and Florida, a region susceptible to hurricanes,

earthquakes and other similar events. In 2017, Puerto Rico, USVI and BVI were severely impacted by Hurricanes Irma and María,

which resulted in significant disruption to our operations and adversely affected our clients in these markets, and in 2022, Hurricane

Fiona impacted the southwest area of Puerto Rico, adversely affecting our customers in that region. Other types of unforeseen or

catastrophic events, including pandemics, epidemics, man-made disasters, or acts of violence or war, or the fear that such events

could occur in the future, could also adversely impact our operations and financial results. For example, in 2020, the COVID-19

pandemic severely impacted global health, financial markets, consumer spending and global economic conditions, and caused

significant disruption to businesses worldwide, including our business and those of our customers, service providers and suppliers.

Future unforeseen or catastrophic events, and actions taken by governmental authorities and other third parties in response to such

events, could adversely affect our operations, cause economic and market disruption, adversely impact the ability of borrowers to

timely repay their loans, or affect the value of any collateral held by us, any of which could have a material adverse effect on our

business, financial condition or results of operations. The frequency, severity and impact of future unforeseen or catastrophic events

is difficult to predict. While we maintain insurance against natural disasters and other unforeseen events, including coverage for

business interruption, the insurance may not be sufficient to cover all of the damage from any such event, and there is no insurance

against the disruption that a catastrophic event could produce to the markets that we serve and the potential negative impact to

economic activity.

Climate change could have a material adverse impact on our business operations and that of our clients and customers.

Our business and the activities and operations of our clients and customers may be disrupted by global climate change.

Potential physical risks from climate change include the increase in the frequency and severity of weather events, such as storms

and hurricanes, and long-term shifts in climate patterns, such as sustained higher and lower temperatures, sea level rise, heat

waves and droughts, among others. Our geographic concentration in localities, including Puerto Rico, the U.S.V.I., B.V.I. and

Florida, particularly susceptible to risks arising from climate change, including severe hurricanes and sea level rise, heighten the

threat we face from climate change. Additionally, the impact of climate change in the markets that we operate and in other global

markets may have the effect of increasing the costs or reducing the availability of insurance needed for our business operations.

Climate change may also create transitional risks resulting from a shift to a low-carbon economy. These transition risks may include

changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to

mitigate the effects of climate change. Changes in the legal and regulatory landscape may additionally increase our compliance

costs. These climate-driven changes could have a material adverse impact on asset values and on our business and financial

performance and those of our clients and customers.

LEGAL AND REGULATORY RISKS

Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our

business and operations.

We are subject to extensive and evolving regulation under U.S. federal, state and Puerto Rico laws that govern almost all

aspects of our operations and limit the businesses in which we may be engaged, including regulation, supervision and examination

by federal, state and foreign banking authorities. These laws and regulations have expanded significantly over an extended period

of time and are primarily intended for the protection of consumers, borrowers and depositors. Compliance with these laws and

regulations has resulted, and will continue to result, in significant costs. Additionally, the current federal administration is pursuing a

policy and regulatory agenda significantly different from that of the previous administration, including the reversal of rules

promulgated under the past administration and shifts in rulemaking, supervision, examination and enforcement priorities. The

implementation of that agenda is happening rapidly and is constantly evolving. The potential impact of any such changes cannot be

predicted.

Additional laws and regulations may be enacted or adopted in the future, and the application, interpretation or

enforcement of laws and regulations may in the future be changed (including through executive orders), in ways that could

significantly affect our powers, authority and operations and which could have a material adverse effect on our financial condition

and results of operations. In particular, we could be adversely impacted by changes in laws and regulations, or changes in the

application, interpretation or enforcement of laws and regulations, that proscribe or institute more stringent restrictions on certain

financial services activities, impose monetary fines or other penalties on institutions that fail to comply with applicable laws and

regulations, or impose new requirements. In addition, new laws or regulations could require significant system and process changes

that require systems upgrades and could limit our ability to meet adoption timeframes or pursue our innovation roadmap. If we do

not appropriately comply with current or future laws or regulations, adapt to the changing interpretation of existing laws or

regulations, or if we fail to meet supervisory expectations, we may be subject to fines, penalties or judgements, or to material

regulatory restrictions on our business, which could also materially and adversely affect our business, financial condition, liquidity,

results of operations or capital position.

Our participation (or lack of participation) in certain governmental programs, such as the Paycheck Protection Program

(“PPP”) enacted in response to the COVID-19 pandemic, also exposes us to increased legal and regulatory risks. We have also

been and could continue to be exposed to adverse action for the violation of applicable legal requirements or the improper conduct

of our employees in connection with such loans. For example, on January 24, 2023, Popular Bank consented to the imposition of an

order from the Federal Reserve Board requiring it to pay a $2.3 million civil money penalty to settle certain findings arising from

Popular Bank’s approval of six Payment Protection Program loans.

In addition, due to divergent policies and stakeholder viewpoints regarding climate and sustainability matters, we are at

increased risk of being subject to conflicting legal and regulatory requirements and stakeholder expectations regarding climate and

sustainability matters. For example, certain states have enacted or proposed laws addressing climate change and other

sustainability issues, including climate-related disclosure requirements. On the other hand, certain states have enacted or proposed

laws or regulations or taken other actions to prohibit the consideration of environmental and social factors in state investments and

contracting. In addition, in August 2025, President Trump signed Executive Order 14331, “Guaranteeing Fair Banking Access for All

Americans,” which states that it is the policy of the United States that no American should be denied access to financial services

because of their constitutionally or statutorily protected beliefs, affiliations, or political views. The Executive Order directs the

Treasury Secretary and federal banking regulators to address politicized or unlawful debanking activities. These, as well as other

laws, regulations, guidance and expectations, many of which may have broad and extraterritorial application, have in the past

subjected and may in the future subject us to additional requirements or different and conflicting requirements and expectations in

the various jurisdictions in which we operate, which could negatively affect our business and brand.

We are from time to time subject to information requests, investigations and other regulatory enforcement proceedings

from departments and agencies of the U.S., Puerto Rico, New York and other state governments, including those that

investigate compliance with U.S. sanctions and consumer protection laws and regulations, which may expose us to

significant penalties and collateral consequences, and could result in higher compliance costs or restrictions on our

operations.

We from time-to-time self-report compliance matters to, or receive requests for information from, departments and

agencies of the U.S., Puerto Rico, New York and other state governments, including with respect to compliance with consumer

protection laws and regulations. For example, BPPR has in the past received requests for information, such as subpoenas and civil

investigative demands from U.S. government regulators, including concerning add-ons on consumer products, real estate appraisals

and residential and construction loans in Puerto Rico. BPPR has also self-identified and reported to applicable regulators

compliance matters related to U.S. sanctions, as well as mortgage, credit reporting and other consumer lending practices.

Incidents of this nature and investigations or examinations by governmental authorities have resulted in the past, and may

in the future result, in judgments, settlements, fines, enforcement actions, penalties or other sanctions adverse to the Corporation,

which could materially and adversely affect the Corporation’s business, financial condition, results of operations or capital position or

cause serious reputational harm. Any such settlements or orders that we enter into, or that regulatory authorities impose on us could

require enhancements to our procedures and controls and entail significant operational and compliance costs. Furthermore, issues

or delays in satisfying the requirements of a regulatory settlement or action on a timely basis could result in additional penalties and

enforcement actions, which could be significant. In connection with the resolution of regulatory proceedings, enforcement authorities

may seek admissions of wrongdoing and, in some cases, criminal pleas, which could lead to increased exposure to private litigation,

loss of clients or customers, and restrictions on offering certain products or services. In addition, responding to information-gathering

requests, investigations and other regulatory proceedings, regardless of the ultimate outcome of the matter, could be time-

consuming, expensive and divert management attention from our business.

Financial services institutions such as Popular have been subject to heightened expectations and regulatory scrutiny in

recent years. Our regulators’ oversight is not limited to banking and financial services laws but extends to other significant laws

such as those related to anti money laundering, anti-bribery and anti-corruption laws. Further, regulators in the performance of their

supervisory and enforcement duties, have significant discretion and power to prevent or remedy what they deem to be unsafe and

unsound practices or violations of laws by banks and bank holding companies. Therefore, the outcome of any investigative or

enforcement action, which may take years and be material to Popular, may be difficult to predict or estimate.

Complying with economic and trade sanctions programs and anti-money laundering laws and regulations can increase our

operational and compliance costs. If we, and our subsidiaries, affiliates or third-party service providers, are found to have

failed to comply with applicable economic and trade sanctions programs and anti-money laundering laws and regulations,

we could be exposed to fines, sanctions and penalties, and other regulatory actions, as well as governmental

investigations.

As a federally regulated financial institution, we must comply with regulations and economic and trade sanctions and

embargo programs administered by the Office of Foreign Assets Control (“OFAC”) of the U.S. Treasury, as well as anti-money

laundering laws and regulations, including those under the Bank Secrecy Act.

Economic and trade sanctions regulations and programs administered by OFAC prohibit U.S.-based entities from entering

into or facilitating unlicensed transactions with, for the benefit of, or in some cases involving the property and property interests of,

persons, governments or countries designated by the U.S. government under one or more sanctions regimes, and also prohibit

transactions that provide a benefit that is received in a country designated under one or more sanctions regimes. We are also

subject to a variety of reporting and other requirements under the Bank Secrecy Act, including the requirement to file suspicious

activity and currency transaction reports, that are designed to assist in the detection and prevention of money laundering, terrorist

financing and other criminal activities. In addition, as a financial institution we are required to, among other things, identify our

customers, adopt formal and comprehensive anti-money laundering programs, scrutinize or altogether prohibit certain transactions

of special concern, and be prepared to respond to inquiries from U.S. law enforcement agencies concerning our customers and their

transactions. Failure by the Corporation, its subsidiaries, affiliates or third-party service providers to comply with these laws and

regulations could have serious legal and reputational consequences for the Corporation, including the possibility of regulatory

enforcement or other legal action, including significant civil and criminal penalties. We also incur higher costs and face greater

compliance risks in structuring and operating our businesses to comply with these requirements. The markets in which we operate

heighten these costs and risks.

We have established risk-based policies and procedures and employed software designed to assist us and our personnel

in complying with these applicable laws and regulations. Even if the appropriate controls are in place, there can be no assurance

that our policies and procedures will prevent us from blocking and rejecting all applicable transactions of our customers or our

customers’ customers that may involve a sanctioned person, government or country. Any failure to detect and prevent any such

transaction could result in a violation of applicable laws and regulations and adversely affect our reputation, business, financial

condition and results of operations.

From time to time we have identified and voluntarily self-disclosed to OFAC transactions that were not timely identified,

blocked or rejected by our policies, controls and procedures for screening transactions that might violate the regulations and

economic and trade sanctions programs administered by OFAC. For example, during the second quarter of 2022, BPPR entered

into a settlement agreement with OFAC with respect to certain transactions processed on behalf of two employees of the

Government of Venezuela, in apparent violation of U.S. sanctions against Venezuela. Popular agreed to pay $256,000 to settle the

apparent violations, which had been self-disclosed to OFAC. There can be no assurances that any failure to comply with U.S.

sanctions and embargoes, or with anti-money laundering laws and regulations, will not result in material fines, sanctions or other

penalties being imposed on us.

Furthermore, if the policies, controls, and procedures of one of the Corporation’s third-party service providers, together

with our third-party oversight of such providers, do not prevent it from violating applicable laws and regulations in transactions in

which it engages, such violations could adversely affect its ability to provide services to us.

We are subject to regulatory capital adequacy requirements, and if we fail to meet these requirements our business and

financial condition will be adversely affected.

Under regulatory capital adequacy requirements, and other regulatory requirements, Popular and our banking subsidiaries

must meet requirements that include quantitative measures of assets, liabilities and certain off-balance sheet items, subject to

qualitative judgments by regulators regarding components, risk weightings and other factors. If we fail to meet these minimum

capital requirements and other regulatory requirements, our business and financial condition will be materially and adversely

affected. If a financial holding company fails to maintain well-capitalized status under the regulatory framework, or is deemed not

well managed under regulatory exam procedures, or if it experiences certain regulatory violations, its status as a financial holding

company and its related eligibility for a streamlined review process for acquisition proposals, and its ability to offer certain financial

products, may be compromised and its financial condition and results of operations could be adversely affected. The failure of any

depository institution subsidiary of a financial holding company to maintain well-capitalized or well-managed status could have

similar consequences.

See “Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our

business and operations” in the Legal and Regulatory Risks section of Item 1A in this Form 10-K.

Increases in FDIC insurance premiums may have a material adverse effect on our earnings.

Substantially all the deposits of BPPR and PB are subject to insurance up to applicable limits by the FDIC’s deposit

insurance fund (“DIF”) and, as a result, BPPR and PB are subject to FDIC deposit insurance assessments. On October 18, 2022,

the FDIC finalized a rule that increased initial base deposit insurance assessment rates by 2 basis points, beginning with the first

quarterly assessment period of 2023. In addition, in November 2023, the FDIC finalized a rule that imposes a special assessment to

recover the costs to the DIF resulting from the FDIC’s use, in March 2023, of the systemic risk exception to the least-cost resolution

test under the FDIA in connection with the receiverships of Silicon Valley Bank and Signature Bank. The exact amount of this

assessment will be determined when the FDIC terminates the related receiverships considered in the final rule. Accordingly, the final

special assessment amount and collection period may change as the estimated cost is periodically adjusted or if the total amount

collected varies. For example, in December 2025, the FDIC reduced the rate at which the assessment is collected for the eighth

quarter of the collection period, with an invoice payment date of March 30, 2026, due to its updated estimate of losses.

We are generally unable to control the amount of premiums or additional assessments that we are required to pay for

FDIC insurance. If there are additional bank or financial institution failures, our level of non-performing assets increases, or our risk

profile changes or our capital position is impaired, we may be required to pay even higher FDIC premiums. Any future additional

increases in FDIC premiums, assessment rates or special assessments may materially adversely affect our results of operations.

See the “Supervision and Regulation—FDIC Insurance” discussion in Item 1. Business of this Form 10-K for additional information

related to the FDIC’s deposit insurance assessments applicable to BPPR and PB.

The resolution of pending litigation and regulatory proceedings, if unfavorable to us, could have material adverse financial

effects or cause us significant reputational harm, which, in turn, could seriously harm our business prospects.

We face legal risks in our businesses, and the volume of claims and amount of damages and penalties claimed in

litigation and regulatory proceedings against financial institutions remains high. We are involved in a number of litigation, arbitration

and regulatory proceedings in the ordinary course of our business. Substantial legal liability or significant regulatory action against

us could have material adverse financial effects or cause significant reputational harm to us or other adverse consequences, which

in turn could seriously harm our business prospects. For further information relating to our legal risk, see Note 23 - “Commitments &

Contingencies”, to the Consolidated Financial Statements in this Form 10-K.

LIQUIDITY RISKS

We are subject to liquidity risks arising from market events or disruptions and instances of low investor and depositor

confidence. Furthermore, actions by the rating agencies or decreases in our capital levels may have adverse effects on our

liquidity and business, including by raising the cost of our obligations or affecting our ability to borrow.

We must maintain adequate liquidity and funding sources to support our operations, fund customer deposit withdrawals,

repay borrowings and debt, comply with our financial obligations, fund planned capital distributions and meet regulatory

requirements. The Corporation’s most significant source of funds are bank deposits, including customer deposits and brokered

deposits. In addition to deposits, sources of liquidity include secured borrowing arrangements, such as those with the Federal

Reserve Bank of New York and the Federal Home Loan Bank of New York (“FHLBNY”), unpledged securities from our investment

portfolio, the capital markets and proceeds from loan sales or securitizations.

Popular’s liquidity and ability to fund and operate its business could be materially adversely affected by a variety of

conditions and factors, some of which are out of Popular’s control. For example, market events or disruptions, such as periods of

market stress and low investor confidence in financial institutions could result in deposit withdrawals, especially to the extent those

deposits are in excess of the FDIC-insured limit of $250,000. As of December 31, 2025, we had $14 billion of total deposits (other

than collateralized public funds, which represent public deposit balances from governmental entities in the U.S. and its territories,

including Puerto Rico and the United States Virgin Islands, that are collateralized based on such jurisdictions’ applicable collateral

requirements) in excess of the FDIC-insured limit. We may also suffer outflows of customer deposits due to competition from other

banks or alternative investments. In addition, in periods of stress, we may not be able to access existing funding sources, access

the capital markets or to sell or securitize loans or other assets, or to access such sources or to sell or securitize assets on favorable

terms.

In addition, actions by the rating agencies could raise the cost of our borrowings, since lower rated securities are usually

required by the market to pay higher rates than obligations of higher credit quality. Our credit ratings were reduced substantially in

2009 and, although one of the three major rating agencies upgraded our senior unsecured rating back to “investment grade” during

2021, the remaining two rating agencies have not upgraded their current “non-investment grade” rating. The market for non-

investment grade securities is much smaller and less liquid than for investment grade securities. If we were to attempt to issue

preferred stock or debt securities into the capital markets, it is possible that there would not be sufficient demand to complete a

transaction or that the cost could be substantially higher than for more highly rated securities. If Popular is unable to access the

capital markets on favorable terms, our liquidity may be adversely affected.

Changes in our ratings and capital levels could affect our relationships with some creditors and limit our access to funding.

For example, having negative tangible capital may impact our ability to access some sources of wholesale funding. The Federal

Housing Finance Agency restricts the FHLBNY from lending to members of the FHLBNY with negative tangible capital unless the

member’s primary banking regulator makes a written request to the FHLBNY to maintain access to borrowings. Both BPPR and PB

have secured borrowing facilities with the FHLBNY and could borrow up to $3.3 billion and $1.5 billion respectively as of December

31, 2025, of which $42.7 million and $0.8 billion respectively were used. Losing access to the FHLBNY borrowing facilities could

adversely impact liquidity at the banking subsidiaries. Additionally, if BPPR or PB cease to be well-capitalized, the FDIA and

regulations adopted thereunder would restrict their ability to accept brokered deposits and limit the rate of interest payable on

deposits.

Our banking subsidiaries also have recourse obligations under certain agreements with third parties, including servicing

and custodial agreements, that include ratings covenants. Upon failure to maintain the required credit ratings, the third parties could

have the right to require us to engage a substitute fund custodian and increase collateral levels securing recourse obligations.

Collateral pledged by us to secure recourse obligations approximated $23.8 million on December 31, 2025. While management

expects that we would be able to meet any additional collateral requirements if and when needed, the requirements to post collateral

under certain agreements or the loss of custodian funds could reduce our liquidity resources and impact our results of operations.

As a bank holding company, we depend on dividends and distributions from our subsidiaries for liquidity.

As a bank holding company, we depend primarily on dividends from our banking and other operating subsidiaries to fund

our cash needs, including to capitalize our subsidiaries. Our banking subsidiaries, BPPR and PB, are limited by law in their ability to

make dividend payments and other distributions to us based on their earnings, dividend history, and capital position. Based on its

current financial condition, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the

NYSDFS. A failure by our banking subsidiaries to generate sufficient income and free cash flow to make dividend payments to us

may affect our ability to fund our cash needs, which could have a negative impact on our financial condition, liquidity, results of

operation or capital position. Such failure could also affect our ability to pay dividends to our stockholders and to repurchase shares

of our common stock. We have in the past suspended dividend payments on our common stock and preferred stock during times of

economic uncertainty, and there can be no assurance that we will be able to continue to declare dividends to our stockholders in

any future periods.

An impact on the tangible capital levels of our operating subsidiaries, could also limit the amount of capital we may

upstream to the holding company. Tangible capital levels have in the past been, and may in the future be, adversely affected by the

impact of rapidly rising interest rates on investment securities in our available-for-sale portfolio. For a discussion of risks related to

changes in interest rates, see “Changes in interest rates and credit spreads can adversely impact our financial condition, including

our investment portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments” in Item 1A of this Form 10-K.

We also depend on dividends from our banking and other operating subsidiaries to pay debt service on outstanding debt

and to repay maturing debt. Our ability to declare such dividends would be subject to regulatory requirements and could require the

prior approval of the Federal Reserve Board.

STRATEGIC RISKS

Potential acquisitions of businesses or loan portfolios could increase some of the risks that we face, and may be delayed

or prohibited due to regulatory constraints.

To the extent permitted by our applicable regulators, we may pursue strategic acquisition opportunities. Acquiring other

businesses, however, involves various risks, including potential exposure to unknown or contingent liabilities of the target company,

exposure to potential asset quality issues of the target company, potential disruption to our business, the possible loss of key

employees and customers of the target company, and difficulty in estimating the value of the target company. If we pay a premium

over book or market value in connection with an acquisition, some dilution of our tangible book value and net income per common

share may occur. Furthermore, failure to realize the expected revenue increases, cost savings, increases in geographic or product

presence, or other projected benefits from an acquisition could have a material adverse effect on our business, financial condition

and results of operations.

Similarly, acquiring loan portfolios involves various risks. When acquiring loan portfolios, management makes

assumptions and judgments about the collectability of the loans, including the creditworthiness of borrowers and the value of the

real estate and other assets serving as collateral for the repayment of secured loans. In estimating the extent of the losses, we

analyze the loan portfolio based on historical loss experience, volume and classification of loans, volume and trends in

delinquencies and nonaccruals, local economic conditions, and other pertinent information. If our assumptions are incorrect,

however, our actual losses could be higher than estimated and increased loss reserves may be required, which would negatively

affect our results of operations.

Finally, certain acquisitions by financial institutions, including us, are subject to approval by a variety of federal and state

regulatory agencies. Regulatory approvals could be delayed, impeded, restrictively conditioned or denied. We may fail to pursue,

evaluate or complete strategic and competitively significant acquisition opportunities as a result of our inability, or perceived or

anticipated inability, to obtain regulatory approvals in a timely manner, under reasonable conditions or at all. Difficulties associated

with potential acquisitions that may result from these factors could have a material adverse effect on our business, financial

condition and results of operations.

We continue our broad-based multi-year, technological and business process transformation. The failure to achieve the

goals of the transformation project, the inability to maintain expenses related to our transformation program within current

estimates or delays in executing our plans may materially and adversely affect our business, competitive position,

financial condition, results of operations, or cause reputational harm.

The Corporation continues its broad-based multi-year, technological and business process transformation, which was

launched in 2022. As part of this transformation, we are making significant investments in technology, talent and new digital and

data capabilities in order to provide our customers with more personalized and accessible services, increase employee performance

and satisfaction with more agile work processes, and generate sustainable profitable growth and value for our shareholders.

We may not succeed in executing all projects or aspects of the transformation program, may abandon projects or aspects,

or fail to successfully launch new applications or achieve the intended functionality and operational benefits from these technological

initiatives, which could result in failed or partially successful implementations. In addition, we may fail to properly estimate costs of

the transformation program or may experience delays in executing our plans. Such failures or delays may in turn cause the

Corporation to incur costs exceeding our current estimates or disrupt our operations, including our technological services to our

customers, or fall short of our projected earnings or expense reduction targets driven by these efforts. To the extent that these

disruptions persist over time and/or recur, this could negatively impact our competitive position, require additional expenditures, and/or harm our relationships with our customers and thus may materially adversely affect our business, financial condition, results of operations, or cause reputational harm.

We face significant and increasing competition in the rapidly evolving financial services industry, and face challenges in

the adoption of new technologies such as artificial intelligence which may put us at a competitive disadvantage.

We operate in a highly competitive environment, in which we compete on the basis of a number of factors, including

customer service, quality and variety of products and services, price, interest rates on loans and deposits, innovation, technology,

ease of use, reputation, and transaction execution. While our main competition continues to come from other Puerto Rico banks and

financial institutions, we face increased competition from non-Puerto Rico institutions, as emerging technologies and the growth of

e-commerce have significantly reduced geographic barriers. These technologies have also made it easier for non-depositary

institutions to offer products and services that were traditionally considered banking products and allowed non-traditional financial

service providers and technology companies to provide electronic and internet-based financial solutions and services. In addition,

nonbank firms may have a competitive advantage over traditional banks and bank holding companies such as Popular due to

factors such as differences in regulation, funding models and tax treatment. We may also be unable to adopt or integrate new

technologies that could reduce expenses and simplify our operations, including artificial intelligence, automation and algorithmic

tools, at the pace of such competitors due to operational and compliance challenges and risks relating to data quality, internal

controls, privacy and consumer protection, among others. Our failure to successfully adopt and integrate these new technologies in

a timely and effective manner may impair our ability to compete effectively or to attract or retain business. Moreover, increased

competition could create pressure to lower prices, fees, commissions or credit standards on our products and services, which could

adversely affect our financial condition and results of operations. Increased competition could also create pressure to raise interest

rates on deposits or increase deposit attrition, which could negatively impact our business, financial condition, liquidity results of

operations or capital position.

If we are unable to meet constant technological changes and react quickly to meet new industry standards, including as a

result of our continued dependence on Evertec, we may be unable to enhance our current services and introduce new

products and services in a timely and cost-effective manner, placing us at a competitive disadvantage and significantly

affecting our business, financial condition, liquidity, results of operations or capital position.

To compete effectively, we need to constantly enhance and modify our products and services and introduce new products

and services to attract and retain clients or to match products and services offered by our competitors, including technology

companies and other nonbank firms that are engaged in providing similar products and services,

some of which are or may be

provided by Evertec itself. Our ability to compete effectively will depend in part on our ability to react quickly to meet new industry

standards and use new technology, such as artificial intelligence, to satisfy customer demands, as well as to create additional

efficiencies in our operations. Popular expects that it will continue to depend on Evertec’s technology services to operate and control

current products and services and to implement future products and services, making our success dependent on Evertec’s ability to

timely complete and introduce these enhancements and new products and services in a cost-effective manner.

Some of our competitors rely on financial services technology and outsourcing companies that are much larger than

Evertec, serve a greater number of clients than Evertec, and may have better technological capabilities and product offerings than

Evertec. Furthermore, financial services technology companies typically make capital investments to develop and modify their

product and service offerings to facilitate their customers’ compliance with the extensive and evolving regulatory and industry

requirements, and, in most cases, such costs are borne by the technology provider. Because of our contractual relationship with

Evertec, and because Popular is the sole customer of certain of Evertec’s services and products,

including core bank processing of

BPPR, we have in the past borne the full cost of such developments and modifications and may be required to do so in the future,

subject to the terms of the MSA.

Moreover, the terms, speed, scalability, and functionality of certain of Evertec’s technology services are not competitive

when compared to offerings from its competitors. Evertec’s failure to sufficiently invest in and upscale its technology and services

infrastructure to meet the rapidly changing technology demands of our industry may result in our being unable to meet customer

expectations and attract or retain customers. Furthermore, Evertec’s strategy and investments may also be refocused away from

Popular towards other strategic initiatives,

potentially including initiatives that could have the effect of disintermediating us from our

customers or otherwise present a competitive risk. Any such impact could, in turn, reduce Popular’s revenues, place us at a

competitive disadvantage and significantly affect our business, financial condition, liquidity, results of operations or capital position.

While we have over time narrowed the scope of services which we are dependent on Evertec to obtain, in exchange for obtaining

releases in 2022 from exclusivity restrictions that limited our ability to engage other third-party providers of financial technology

services, we agreed to extensions of certain existing commercial agreements with Evertec and, as a result, have prolonged the duration of our exposure to the risks presented by Evertec’s technological capabilities and its failures to enhance its products and services and otherwise meet evolving demands. We may also be exposed to heightened business risks in connection with our dependency on Evertec with respect to BPPR’s merchant acquiring business, which exclusivity runs until 2035, and with respect to the ATH Network, which commitment runs until 2030, in light of the pace of technology changes and competition in the payments industry.

The ability to attract and retain qualified employees is critical to our success.

Our success depends, in large part, on our ability to attract and retain qualified employees. Competition for qualified

candidates, especially in the area of information technology, is intense and has increased recently as a result of a tighter labor

market. Increased competition may lead to difficulties in attracting or retaining qualified employees, which may, in turn, lead to

significant challenges in the execution of our business strategies and have an adverse effect on the quality of the service we provide

to the customers and communities we serve. Such challenges could adversely affect our business, operations and financial

condition. In addition, increased competition may lead to higher compensation packages and more flexible work arrangements. We

may also be required to hire employees outside of our market areas for certain positions that require specific expertise, which could

result in employment and tax compliance-related expenses, challenges and risks. In addition, flexible work arrangements, such as

remote or hybrid work models, have led to other workplace challenges, including fewer opportunities for face-to-face interactions or

to promote a cohesive corporate culture and heightened cybersecurity, information security and other operational risks.

Our ability to attract and retain qualified employees is also impacted by regulatory limitations on our compensation

practices, such as clawback requirements of incentive compensation, which may not affect other institutions with which we compete

for talent. The scope and content of regulators’ policies on executive compensation continue to develop and are likely to continue

evolving. Such policies and limitations on our compensation practices could adversely affect our ability to attract, retain and motivate

talented senior leaders in support of our long-term strategy.

OTHER RISKS

An impairment of our goodwill, deferred tax assets or amortizable intangible assets could adversely affect our financial

condition and results of operations.

As of December 31, 2025, we had $790 million, $814 million and $188 million, respectively, of goodwill, net deferred tax

assets and amortizable intangible assets, including capitalized software costs, recorded on our balance sheet.

Under GAAP, goodwill is tested for impairment at least annually and amortizable intangible assets are tested for

impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Factors that may be

considered a change in circumstances, indicating that the carrying value of the goodwill or amortizable intangible assets may not be

recoverable, include a decline in Popular’s stock price related to a deterioration in global or local economic conditions, declines in

our market capitalization, reduced future earnings estimates, and interest rate changes. The goodwill impairment evaluation process

requires us to make estimates and assumptions with regards to the fair value of our reporting units. Actual values may differ

significantly from these estimates. Such differences could result in future impairment of goodwill that would, in turn, negatively

impact our results of operations and the reporting unit where the goodwill is recorded.

The determination of whether a deferred tax asset is realizable is based on weighting all available evidence. The

realization of deferred tax assets, including carryforwards and deductible temporary differences, depends upon the existence of

sufficient taxable income of the same character during the carryback or carryforward period. The analysis considers all sources of

taxable income available to realize the deferred tax asset, including the future reversal of existing taxable temporary differences,

future taxable income exclusive of reversing temporary differences and carryforwards, taxable income in prior carryback years and

tax-planning strategies. Changes in these factors may affect the realizability of our deferred tax assets in our Puerto Rico and U.S.

operations.

If our goodwill, deferred tax assets or amortizable intangible assets become impaired, we may be required to record a

significant charge to earnings, which could adversely affect our financial condition and results of operations.

We could experience unexpected losses if the estimates or assumptions we use in preparing our financial statements are

incorrect or differ materially from actual results.

In preparing our financial statements pursuant to U.S. GAAP, we are required to make estimates and assumptions that

are often based on subjective and complex judgments about matters that are inherently uncertain. For example, we use estimates

and assumptions to determine our allowance for credit losses, our liability for contingent litigation losses, and the fair value of certain of our assets and liabilities, such as debt securities, loans held for sale, MSRs, intangible assets and deferred tax assets. If such estimates or assumptions are incorrect or differ materially from actual results, we could experience unexpected losses or other adverse impacts, some of which could be significant.

For further information on other risks faced by Popular please refer to the MD&A section of this Form 10-K.

Cybersecurity

As filed, 15,794 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

The Corporation assesses, identifies and manages cybersecurity risk as part of the Corporation’s overall risk management

framework, alongside associated information security, anti-money laundering and counterterrorism, operational, fraud, regulatory,

legal and reputational risks, among others.

The Corporation has established three management committees that oversee and monitor different aspects of cybersecurity risk.

The Enterprise Risk Management Committee (the “ERM Committee”), chaired by the Chief Risk Officer, oversees and

monitors the risks included in the Risk Appetite Statement (the “RAS”) of the Corporation’s Risk Management Policy,

including cybersecurity risks.

The Information Technology and Cyber Risk Committee (“ITCRC”), chaired by the Chief Security Officer and the Chief

Information and Digital Strategy Officer, oversees and monitors information technology (“IT”), privacy and cybersecurity

risks, mitigating actions and controls, applicable regulatory developments, key risks metrics, and IT and cyber incidents

that may result in operational, compliance and reputational risks.

The Operational Risk Committee (“ORCO”), chaired by the Chief Risk Officer, oversees and monitors operational risk

management activities to ensure the development and consistent application of operational risk policies, processes and

procedures that measure, limit and manage the Corporation's operational risks while maintaining the effectiveness and

efficiency of the operating and business processes. As part of its responsibilities, ORCO oversees business continuity

matters, as well as operational losses stemming from any cybersecurity or fraud events.

The ITCRC and ORCO meet at least quarterly and report on cybersecurity and other matters to the ERM Committee.

The Board has established a Board-level Risk Management Committee (“RMC”), which is responsible for the oversight of the

Corporation’s overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit

and manage the Corporation’s risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides

an overview of Popular’s cybersecurity threat risk management and strategy processes, which includes summaries of escalated

incidents and incident remediation status. Our Chief Security Officer, Chief Information and Digital Strategy Officer, Chief

Information Security Officer (“CISO”), Chief Risk Officer and the Financial and Operational Risk Management Division (the “FORM

Division”) Manager generally participate in such meetings. The RMC is also responsible for (i) overseeing the development,

implementation and maintenance of the Corporation’s information security program (the “Information Security Program”); (ii)

approving the Corporation’s risk management program and any related policies and controls; (iii) overseeing the implementation by

the Corporation’s management of the Corporation’s risk management program and any related policies, procedures and controls;

(iv) overseeing the Corporation’s risk management with respect to emerging technologies, including artificial intelligence; and (v)

reviewing reports regarding selected topics such as cyber.

In addition, the Board also has a standing Technology Committee (the “TC”) that oversees the Corporation’s technology functions,

strategy, operations, investments and needs. The TC meets at least quarterly and our Chief Information and Digital Strategy Officer

and our Chief Security Officer generally participate in such meetings. The TC (i) oversees the development and implementation of

the Corporation’s technology strategy and initiatives, (ii) monitors the risks associated with critical technology vendor relationships,

including cyber risks, and (iii) reviews and receives reports from management and third parties regarding the Corporation’s

technology functions, operations, strategy and initiatives, as well as current and emerging technology trends and risks arising

therefrom.

The Board in turn also receives briefings on cybersecurity matters and risks, including an annual presentation from the Chief

Security Officer and the CISO on the Information Security Program.

In addition, as part of the Board’s director education plan,

members of the Board take, on an annual basis, a cybersecurity training that provides the Board with an overview of cybersecurity

principles and regulations that are relevant to our institution and the Board’s oversight function.

To identify, assess and manage risks from cybersecurity threats, the Corporation has established a three lines of defense

framework. The first line of defense is composed of business line management that identifies and manages the risks associated with

business activities, including cybersecurity risk. The second line of defense is made up of members of the Corporation’s Corporate

Risk Management Group and the Corporate Security and Operations Group (the “CSOG”) who, among other things, measure and

report on the Corporation’s risk activities. In such line of defense, the FORM Division, within the Corporate Risk Management

Group, is responsible for (i) establishing baseline metrics that measure, monitor, limit and manage the framework that identifies and

manages multiple and cross-enterprise risks, including cybersecurity risks; and (ii) articulating the RAS and supporting metrics,

including those related to operational risk, business continuity, disaster recovery and third-party management oversight processes.

Meanwhile, Popular’s Corporate Information Security and Privacy Division (the “CISP”), which is headed by the CISO and reports to

the CSOG, is responsible for the development of strategies, policies and programs to assess and mitigate cybersecurity and privacy

risks. Members of the CISP (including the CISO) and FORM Division report on and escalate cybersecurity, IT and privacy risks to

management committees, such as the ITCRC, ORCO and ERM Committees, and, if appropriate, to the RMC, TC, and the Board of

Directors, as required under relevant policies and procedures. Lastly, the third line of defense consists of the Corporate Auditing

Division, which independently provides assurance regarding the effectiveness of the risk framework and reports directly to the Audit

Committee of the Board.

Popular monitors various vectors of threats and utilizes open-source intelligence forums and communities such as the Financial

Services Information Sharing and Analysis Center and the Cybersecurity and Infrastructure Security Agency, among others, to

receive threat intelligence feeds which are reviewed by the CISP. As cybersecurity threats are identified, they are evaluated to

assess the level of exposure and the potential risk to Popular. The ITCRC and the ERM Committee discuss and track the threats

identified in internal assessments and scans or in third-party reports. Depending on the evolution and materiality of the threat, these

are escalated to the RMC as appropriate.

The CISP develops the Information Security Program, which considers and evaluates risks posed by cybersecurity threats, events

and activities impacting the industry and the Corporation. The Information Security Program outlines the Corporation’s overall

strategy and governance to protect the confidentiality, integrity and availability of information and prevent access by unauthorized

personnel, and is based on standards and controls set by the National Institute of Standards and Technology (“NIST”), including the

NIST’s Framework for Improving Critical Infrastructure Cybersecurity. Popular currently leverages the Cyber Assessment Tool (the

“CAT”), a tool based on NIST standards and controls developed by the Federal Financial Institutions Examination Council (“FFIEC”),

in order to measure the Corporation’s cybersecurity preparedness and maturity levels. The CAT assessment results are integrated

into the overall Information Security Program evaluation. In 2025, we began the transition to the Cyber Risk Institute (“CRI”) Profile

2.0 assessment framework, following the announcement by the FFIEC of the sunset of the CAT. The transition to the CRI

framework is expected to be completed in 2026. The CRI Profile was produced through public-private collaboration and is a list of

assessment questions curated based on the intersection of global regulations and cyber standards, such as the International

Standards Organization (ISO) and the NIST.

The CISP also manages the Incident Response Program (“IRP”) of the Corporation and is in charge of overseeing, assessing and

managing cyber incidents. The IRP outlines the measures Popular must take to prepare for, detect, respond to and recover from

cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate

incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

The Corporation also undertakes the below listed additional activities in its effort to maintain regulatory compliance, identify, assess

and manage its material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents:

Conduct tabletop exercises that simulate cybersecurity incidents to raise awareness and enhance Popular’s responsive

measures;

Assess how business and corporate strategies, new products, technology deployments, external events and the evolution of

threats impact the Corporation’s information security controls in order to determine if they require any additional resources,

technology or processes;

Discuss cybersecurity risks with law enforcement, peer groups, industry forums and trade associations;

Provide training to all Popular employees upon hiring and annually thereafter on cybersecurity and customer data handling

and use requirements;

Offer training and awareness campaigns to customers and employees based on their role;

Conduct phishing simulations for employees, with escalation protocols for employees that fail such tests to enhance

awareness and responsiveness to such possible threats;

Offer learning and development opportunities to employees who handle and manage cybersecurity matters;

Carry cyber insurance to provide protection against potential losses arising from cybersecurity incidents; and

Monitor emerging legal and regulatory requirements and implement changes to our processes, policies and statements, as

necessary.

Popular engages third parties to assist in certain cybersecurity matters.

In particular, Popular uses the expertise of third parties to

perform specialized assessments to test its systems, such as periodic penetration testing, that provide insights into the effectiveness

of its controls. Popular also engages third parties to provide computer forensics and investigations services as needed to assess

and address actual or potential cybersecurity incidents. In addition, Popular hires third parties to provide the first level security

monitoring of Popular’s external and internal networks.

Popular’s Third Party Risk Management Policy outlines the management of risks associated with the Corporation’s use of third-party

service providers, and the CSOG assesses the impact and level of cybersecurity and privacy risk of such providers. Popular

performs due diligence on third parties and monitors third parties that have access to its systems, data or facilities that house such

systems or data on a periodic basis, and based on due diligence results, determines how often vendor assessments are performed

on such third party. Popular also conducts periodic application and vendor assessments for third-party providers and their products.

Furthermore, Popular requires third parties that have access to its systems, data or facilities that house such systems or data to take

a training on cybersecurity at least annually.

For a description of how identified cybersecurity threats may affect Popular’s business strategy or results, see under the headings

“We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks. Future cyber-

attacks could cause substantial harm and have an adverse effect on our business and results of operations.” and “We rely on other

companies to provide key components of our business infrastructure, including certain of our core financial transaction processing

and information technology and security services, which exposes us to a number of operational risks that could have a material

adverse effect on us.”, included as part of our risk factor disclosures in Item 1A in this Form 10-K, which disclosures are

incorporated by reference herein.

To date, previous cybersecurity incidents have not materially affected our results of operations or

financial condition.

The CSOG operates under the direction of the Chief Security Officer. The Chief Security Officer has over 37 years of experience,

including over 13 years of professional experience in information technology and cybersecurity matters such as the oversight of the

Information Security Program and the design and execution of the information security audit plan of the Corporation.

She is a

Certified Public Accountant and also holds a Juris Doctor degree and FINRA administered Series 7 and Series 27 certifications. She

holds the title of Executive Vice President and Chief Security Officer and has been in her role since 2018. Prior to that, she served

as Senior Vice President and General Auditor of the Corporation from November 2012 to April 2018. Before 2012, she served in

various risk related functions of the Corporation and as the Chief Operating Officer and Chief Financial Officer of Popular’s broker

dealer business.

The CISO has over 30 years of work experience. She holds the title of Senior Vice President and Corporate Chief Information

Security Officer and assumed this role in January 2026. Prior to this role, since 2022, she served as Senior Vice President and

Financial and Operational Risk Management Division Manager, with oversight of the enterprise and operational risks of the

Corporation. Before 2022, she held positions for 18 years as Operational and IT Risk Director, Head of ERM and Operational Risk,

and Chief Information Security Officer for other financial institutions. She holds a BBA with majors in Accounting and Information

Systems, and a Master of Science in Information Technology Management.

The Corporate Risk Management Group operates under the direction of the Chief Risk Officer. The Chief Risk Officer has over 32

years of work experience.

He holds the title of Executive Vice President and Chief Risk Officer and has been in his role since 2011.

Prior to joining the Corporation, he served for 17 years as Chief Financial Officer, Head of Retail Bank and Mortgage Operations,

Head of Commercial and Construction Mortgage and Head of Interest Rate Risk, among other positions, for other banks. He holds

a BS with a major in Computer Engineering and an MBA with majors in Finance and Accounting.

The FORM Division Manager has over 30 years of work experience. She holds the title of Senior Vice President and FORM Division

Manager and has been in her role since January 2026. Prior to this role, since 2018, she held the position of Senior Vice President

and Division Manager of the Corporate Risk Reviews Division reporting directly to the RMC. She has leadership experience in

treasury management, investment strategy and enterprise risk oversight. She holds a BSBA with majors in Finance and

International Business and an MBA with concentrations in Finance and Management.

Properties

As filed, 1,839 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

As of December 31, 2025, BPPR operated 162 branches, of which 67 were owned and 95 were leased premises, and PB

operated 39 branches of which 3 were owned and 36 were on leased premises. Also, the Corporation had 582 ATMs operating in

Puerto Rico, 27 in the Virgin Islands and 97 in the U.S. Mainland. The principal properties owned by Popular for banking operations

and other services are described below. Our management believes that each of our facilities is well maintained and suitable for its

purpose.

Puerto Rico

Popular Center, the twenty-story Popular and BPPR headquarters building, located at 209 Muñoz Rivera Avenue, Hato Rey, Puerto

Rico.

Popular Center North Building, a three-story building, on the same block as Popular Center.

Popular Street Building, a parking and office building located at Ponce de León Avenue and Popular Street, Hato Rey, Puerto Rico.

Cupey Center Complex, one building, three-stories high, two buildings, two-stories high each, and two buildings three-stories high

each located in Cupey, Río Piedras, Puerto Rico.

Old San Juan Building, a twelve-story structure located in Old San Juan, Puerto Rico.

Guaynabo Corporate Office Park Building, a two-story building located in Guaynabo, Puerto Rico.

Altamira Building, a nine-story office building located in Guaynabo, Puerto Rico.

El Señorial Center, a four-story office building and a two-story branch building located in Río Piedras, Puerto Rico.

Ponce de León 167 Building, a five-story office building located in Hato Rey, Puerto Rico.

Muñoz Rivera 200, a ten-story building located in Hato Rey, Puerto Rico.

U.S. & British Virgin Islands

BPPR Virgin Islands Center, a three-story building located in St. Thomas, U.S. Virgin Islands.

Popular Center -Tortola, a four-story building located in Tortola, British Virgin Islands.

Legal proceedings

As filed, 145 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

For a discussion of Legal proceedings, see Note 23, “Commitments and Contingencies”, to the Consolidated Financial Statements

in this Form 10-K.

Market risk

As filed, 229 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

The information regarding the market risk of our investments appears under the caption “Risk Management”, on page 79

within Management’s Discussion and Analysis of Financial Condition and Results of Operations in this Form 10-K.

Controls and procedures

As filed, 1,615 characters, with its headings, lists and tables. Extracted from the main document; charts and exhibits are in the original on sec.gov.

Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the

effectiveness of our disclosure controls and procedures (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the

Exchange Act) as of the end of the period covered by this report. Based on such evaluation, our Chief Executive Officer and Chief

Financial Officer have concluded that, as of the end of such period, our disclosure controls and procedures are effective in

recording, processing, summarizing and reporting, on a timely basis, information required to be disclosed by Popular in the reports

that we file or submit under the Exchange Act and such information is accumulated and communicated to management, as

appropriate, to allow timely decisions regarding required disclosures.

Assessment on Internal Control over Financial Reporting

Information relating to our assessment on internal control over financial reporting is presented under the captions “Report

of Management on Internal Control Over Financial Reporting” and “Report of Independent Registered Public Accounting Firm”

located on pages 107 and 108 of this Form 10-K.

Changes in Internal Control over Financial Reporting

There have been no changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f)

and 15d-15(f) under the Exchange Act) that occurred during the quarter ended December 31, 2025, that have materially affected, or

are reasonably likely to materially affect, our internal control over financial reporting.

Figures reported in this filing

Standardized line items from the XBRL in this filing, for the period ended 2025-12-31. Comparative periods it repeats are left out.

Figures reported in this filing
Line item	Period	Value	XBRL concept
Interest expense	12 months2025-01-01 to 2025-12-31	$1.24bn	us-gaap:InterestExpense
Income tax	12 months2025-01-01 to 2025-12-31	$173.6m	us-gaap:IncomeTaxExpenseBenefit
Net income	12 months2025-01-01 to 2025-12-31	$833.2m	us-gaap:NetIncomeLoss
Diluted EPS	12 months2025-01-01 to 2025-12-31	$12.30	us-gaap:EarningsPerShareDiluted
Basic EPS	12 months2025-01-01 to 2025-12-31	$12.31	us-gaap:EarningsPerShareBasic
Diluted shares (weighted)	12 months2025-01-01 to 2025-12-31	67,612,847 shares	us-gaap:WeightedAverageNumberOfDilutedSharesOutstanding
Operating cash flow	12 months2025-01-01 to 2025-12-31	$878.4m	us-gaap:NetCashProvidedByUsedInOperatingActivities
Capital expenditure	12 months2025-01-01 to 2025-12-31	$197.5m	us-gaap:PaymentsToAcquirePropertyPlantAndEquipment
Dividends paid	12 months2025-01-01 to 2025-12-31	$197.6m	us-gaap:PaymentsOfDividends
Total assets	At period end2025-12-31	$75.35bn	us-gaap:Assets
Total liabilities	At period end2025-12-31	$69.10bn	us-gaap:Liabilities
Shareholders' equity	At period end2025-12-31	$6.25bn	us-gaap:StockholdersEquity

Source: SEC EDGAR, the filing index for accession 0001193125-26-085756. Last ingested by Listed: Nov 9, 2026, 17:41 ET. Listed shows no prices and gives no investment advice.

Business

General:

Lending Activities

Business Concentration

Loan category

(Dollars in millions)

BPPR

PB

POPULAR

Credit Administration and Credit Policies

Loan extensions , renewals and restructurings

Competition

Transformation Initiatives

Human Capital Management

Nurturing Well -Being: Employee Health & Financial Security

Empowering Growth: Our Commitment to Talent Developmen

t

Enhancing Leadership Continuity through Strategic Succession Planning

Employee Experience

Board Oversight in Human Capital

Regulation and Supervision

General

Enhanced Prudential Standards

Transactions with Affiliates

Source of Financial Strength

Resolution Planning and Resolution-Related Requirements

FDIC Insurance

Brokered Deposits

Capital Adequacy

Prompt Corrective Action

Restrictions on Dividends and Repurchases

Interstate Branching

de novo

Activities and Acquisitions

Anti-Money Laundering Initiative and the USA PATRIOT Act

Community Reinvestment Act

Interchange Fees Regulation

Consumer Financial Protection Act of 2010

Office of Foreign Assets Control Regulation

Protection of Customer Personal Information and Cybersecurity

Climate-Related and ESG Developments

Incentive Compensation

Regulation of Broker-Dealers

Regulation of Reinsurers, Insurance Producers and Agents

Puerto Rico Regulation

Available Information

Risk factors

ECONOMIC AND MARKET RISKS

Weakness in the economy, particularly in Puerto Rico, where a significant portion of our business is concentrated, has

adversely impacted us in the past and may adversely impact us in the future.

Changes in interest rates and credit spreads can adversely impact our financial condition, including our investment

portfolio, since a significant portion of our business involves borrowing and lending money, and investing in financial

instruments.

BUSINESS RISKS

Negative changes in the financial condition of our clients have adversely impacted us in the past and may adversely

impact us in the future.

We are exposed to increased credit risks and credit losses to the extent our clients are concentrated by industry segment

or type of client.

Deterioration in the values of real properties securing our commercial, mortgage loan and construction portfolios have in

Defective and repurchased loans may harm our business and financial condition.

If we are unable to maintain or grow our deposits, we may be subject to paying higher funding costs and our net interest

income may decrease.

OPERATIONAL RISKS

We and our third-party providers have been, and expect in the future to continue to be, subject to cyber-attacks. Future

We rely on other companies to provide key components of our business infrastructure, including certain of our core

financial transaction processing and information technology and security services, which exposes us to a number of

operational risks that could have a material adverse effect on us.

The transition to new financial services technology providers, and the replacement of services currently provided to us by

Evertec, will be lengthy and complex.

Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters,

acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other

LEGAL AND REGULATORY RISKS

Our businesses are highly regulated, and the laws and regulations that apply to us have a significant impact on our

business and operations.

We are from time to time subject to information requests, investigations and other regulatory enforcement proceedings

from departments and agencies of the U.S., Puerto Rico, New York and other state governments, including those that

investigate compliance with U.S. sanctions and consumer protection laws and regulations, which may expose us to

significant penalties and collateral consequences, and could result in higher compliance costs or restrictions on our

operations.

Complying with economic and trade sanctions programs and anti-money laundering laws and regulations can increase our