POPULAR INC

PART I POPULAR, INC.

General

Popular

is

a diversified,

publicly-owned financial

holding company,

registered under

Act

of

1956, as

amended (the “BHC Act”), and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the

“Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the

largest

financial institution

based in Puerto

Rico, with

consolidated assets of

$70.8 billion, total

deposits of

$63.6 billion

and stockholders’

equity of $5.1 billion at

December 31, 2023. At December 31,

2023, we ranked among the

50 largest U.S. bank holding companies

based on total assets according to information gathered

and disclosed by the Federal Reserve Board.

We operate in two principal markets:

●

Puerto Rico:

We

provide retail,

mortgage and

commercial banking

services through

our principal

Banco

Popular

de

Puerto

Rico

(“Banco

Popular”

or

“BPPR”),

as

well

as

auto

and

leasing

and

banking,

broker-dealer

and

through

are

insured

under

the

Deposit Insurance

Fund (“DIF”)

of the

Federal Deposit

Insurance Corporation (“FDIC”).

operations of

BPPR are

primarily based in Puerto Rico, where BPPR has the

largest retail banking franchise.

●

Mainland

United

States:

We

provide

retail,

and

banking

through

our

New

York-chartered

Popular Bank (“PB” or

“Popular U.S.”), which has

branches in New York,

New Jersey and Florida;

as well

as investment and

insurance services, and commercial

direct financing leases through

specialized subsidiaries. PB’s deposits

are insured under the DIF of the FDIC.

●

BPPR

also

conducts

banking

in

the

U.S.

Virgin

Islands,

the

British

Virgin

Islands

and

New

York.

In

to

BPPR’s commercial

banking operations

in New

York

that include

direct loan

origination and

participating loans

originated by

PB,

BPPR

offers

or

holds

on

a

National

scale

in

the

U.S.

market,

loans

originated under

the E-Loan

brand, purchased

personal loans

originated by

third parties,

and

gathering insured

institutional

deposits via online deposit gathering platforms. In the U.S. and British

Virgin Islands, BPPR offers a range of banking products,

including loans and deposits to both retail and

commercial customers.

For further information about the Corporation’s results segregated by

its reportable segments, see “Reportable Segment Results” in

the Management’s Discussion

and Analysis of

Financial Condition and Results

of Operations section

(“MD&A”) and Note

37 to the

Consolidated Financial Statements included in this Form

10-K.

Transformation Initiative:

The

launched

a

significant,

and

process

during

the

second half of 2022. The

needs and expectations of our

clients, as well as the

competitive landscape, have evolved, compelling us

to make important investments in our technological infrastructure and adopt more agile practices. We

believe these investments will

result in an enhanced digital experience for our clients, as

well as better technology and more efficient processes for our employees,

and make us a more efficient and

profitable company, allowing us to

achieve a 14% return on tangible common equity target by

the

end of 2025.

Our technology and business transformation

will be a significant

priority for the Corporation over

the next three years

and beyond. Refer to the Overview section

of Management’s Discussion and Analysis included in

this Form 10-K for information on

recent significant events that have impacted or will

impact our current and future operations.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial.

Commercial loans are comprised of (i) commercial and industrial (“C&I”) loans and leases to commercial customers

for

use

in

normal

and

to

finance

working

capital

needs,

or

other

projects,

and

(ii)

commercial real

estate (“CRE”) loans

(excluding construction loans)

for income-producing real

estate properties as

well as

owner-

occupied properties. C&I

loans are underwritten

individually and usually

secured with the

assets of the

company and the

of

the

owners. CRE

loans consist

of

loans

for

income-producing real

estate

properties and

the financing

of

owner-occupied facilities

if there

is real

estate as

collateral. Non-owner-occupied

CRE loans

are generally

made to

finance office

and

industrial buildings,

healthcare facilities,

multifamily buildings

and

retail shopping

centers

and are

repaid through

cash

flows

related to the operation, sale or refinancing of the

property.

(2) Mortgage. Mortgage

loans include residential

mortgage loans to

consumers for the

purchase or refinancing

of a

residence and

also include residential construction loans made

to individuals for the construction of refurbishment

of their residence.

(3) Consumer.

Consumer loans

are mainly

comprised of

unsecured personal

loans, credit

cards, and

automobile loans,

and to

a

lesser extent home equity lines of credit (“HELOCs”)

and other loans made by banks to individual

borrowers.

(4) Construction.

Construction loans are CRE loans to companies,

community or homeowners’ associations, or developers used for

the construction of a commercial or residential property for which repayment will be generated by the sale or permanent financing of

the property.

Our construction loan

portfolio primarily consists

of retail, residential

(land and condominiums),

office and warehouse

product types.

(5) Lease Financings. Lease financings are offered by

BPPR and are primarily comprised of automobile loans/leases made through

automotive dealerships.

Business Concentration

Since our

business activities

are currently concentrated

primarily in

our results

of operations

condition are dependent upon the general trends of

the Puerto Rico economy and, in particular,

the residential and commercial real

estate markets. The concentration of our

operations in Puerto Rico exposes us

to greater risk than other

banking companies with a

wider

base.

Our

asset

and

revenue

by

geographical

area

is

in

“Financial

about

Geographic Areas” below and in Note 37 to the

Consolidated Financial Statements included in this

Our loan portfolio is diversified by loan category.

However, approximately 55% of our loan portfolio at December 31, 2023 consisted

of real estate-related

loans, including residential

mortgage loans, construction

loans and commercial

loans secured by

real estate. The table below presents the distribution

of our loan portfolio by loan category at

December 31, 2023.

Loan category

(Dollars in millions)

BPPR

%

PB

%

POPULAR

%

C&I

$4,796

$2,330

$7,126

CRE

4,695

5,888

10,583

Leasing

1,732

1,732

6,726

6,969

6,392

1,304

7,696

Total

$24,511

$10,554

$35,065

Except for

Rico Government

sector,

no individual

or single

group of

related accounts

is

considered material

in relation

to our

or deposits,

or in

relation to

our overall

For a

discussion of

our loan

portfolio, our

deposits portfolio

and our

the Government

Rico, see

“Financial Condition

– Loans”,

“Financial

–

Deposits”

and

“Credit

Risk

–

Geographical and

Risk” in

the

MD&A

and

to

Note

Commitment and

Contingencies to the Consolidated Financial Statements

included in this Form 10-K.

Credit

Administration

and

Credit

Policies

from our

loan portfolios

is our

of revenue.

Whenever we

make loans,

we expose

ourselves

to

credit

risk.

Credit

risk

is

controlled

and

monitored

through

active

asset

quality

the

use

of

lending

thorough

review

of

and through

active

asset quality

administration.

that

expose

us to

credit

risk are

managed

within

the

Board

of Director’s

Risk Management policy,

and the Credit Risk Tolerance

Limits policy,

which establishes

limits

that

factors

such

as maintainin

g

a prudent

balance

of risk-taking

across

diversified

risk types

and business

units,

with regulator

y

guidance,

and

controlling

the

to lower

credit

quality

assets.

We maintain

credit policies

for all lines of

business in order

to mitigate credit

risk. Our credit

are

approved by

our Board

of Directors.

These policies set

forth,

among

other

things,

the objectives, scope and

responsibilities of the

credit

management cycle.

Our

written

and

for

and

loan

quality

and

require

prompt

identificatio

n

and

quantificatio

n

of

asset

quality

or

loss

to

ensure

the

of

the

for

credit

losses.

These

written

various

and

lending

limit

levels,

ranging

from

bank

branch

or

department

to

managerial

and

senior

levels.

Approval

levels are

by the

amount,

type

of loan

and risk

of the credit

facility.

Our

credit

and

documentation

for

each

loan

and

related

type,

when

applicable,

during

the

underwriting,

closing

and

phases.

For

and

construction

loans,

during

the

initial

loan

process,

the

credit

require,

at

a

minimum,

or

tax

returns

of

the

borrower,

an analysis

contained

in

a

credit

package,

a

risk

rating

and

reports

from

credit

and appraisal

s

for

real

estate-related

loans when applicable

.

also

set

forth

the

closing

documentation

depending

on the

loan

and the

type.

Although

we originat

e

most

of our

loans

in both

the

Puerto

Rico

and mainlan

d

United

States

we

occasionally

or

in

loans

by

other

institutions.

When

we

or

in

loans

by

others,

we

conduct

the

same

of

s

and apply

the

same

as we do

for

loans

by us. This also

a review

of the

legal

documentation.

Refer

to

the

Credit

Risk

section

of

the

MD&A

in

this

Form

10-K

for

related

to

committees and divisions with responsibilities for establishing

policies and monitoring the Corporation’s credit risk.

Loan

extensions

,

renewals

and restructurings

Loans with

satisfactory

credit profiles

can be

extended, renewed

or restructured

.

Some commercia

l

are

structured

as lines

of credit, which

are mainly

one year

in term

and therefore

to be renewed

annually.

Other

may be restructure

d

or extended

from time

to time based

upon changes

in the

borrower’s

needs,

use

of

funds,

timing

of

completion

of

projects

and

other

If

the

is

not

deemed

to

have

,

extensions,

renewals

and restructurings

are done

in the

normal

course

of busines

s

and the

loans

to be recorde

d

as performing.

We

various

factors

to

if

a

is

difficulties.

Indicators

that

the

is

financial difficultie

s

for example:

(i)

in default on

any of its debt

or it is

probable tha

t

in payment

default on

any of

its debt

in th

e

foreseeable

future

without

the modification

;

(ii)

the

has declare

d

or is in

the

process

of declarin

g

bankruptcy;

(iii)

there

is significan

t

doubt

as to

whether

the

will

to

be

a

going

concern;

(iv)

the

has

that

have

been

delisted,

are

in

the

process

of

being

delisted,

or

are

under threa

t

of bein

g

delisted

from

an exchange

;

(v) based

on estimates

and projection

s

that

only

encompass

the

current

capabilities

,

the

forecasts

that

its

entity-specifi

c

cash

flows

will

be

insufficien

t

to

service

the

debt

(both

and

principal)

in

with

the

terms

of

the

through

maturity;

and

(vi)

absent

the

current

modification,

the

cannot

obtain

funds

from

sources

other

than

the

creditors

at

an

rate

equal to the current market

rate for similar

debt for a non-troubled

debtor.

We

have

workout

who

handle

the majority

of

loans

that

are

past

due

days

and

over,

,

and loans

that

are considere

d

problem

loans

based

on their

risk profile

.

As a

general

policy,

we

do

not

advance

money

to

who

have

loans

that

are

days

past

due

or

over.

In

and

construction

loans,

certain

exceptions

may

be approve

d

under

certain

circumstances,

(i) when

past

due

status

is administrativ

e

in nature,

such

as expiration

of a loan

facility

before

the

new documentatio

n

is executed,

and not as

of paymen

t

or credit

issues;

(ii) to

improve

our collateral

or

maximize

or

mitigate

future

losses;

and

(iii)

with

respect

to

certain

that,

although

related

through

common

ownership,

are

not

cross

defaulted

nor

cross-collateralized

and

are

satisfactorily

under

their

loan

facilities.

Such

advances

are

underwritten

and

our

credit

policy

and

limits,

which

are

on

the

borrower’s

and guarantee,

among

others.

In addition

to the legal

established under

state banking

law, discusse

d

in detail

below,

that

expose the

Corporation to

credit

risk

are managed

within

guidelines described

in the

Credit

Risk Tolerance

Limits

policy.

Limits are defined for

loss and credit

performance metrics, portfolio composition and

concentration, and industry and

name-

level,

which

lending

concentration

to

a

single

or

a

group

of

related

borrowers,

lending

limits

based

on industr

y

criteria,

such

of the

banks’

capital.

Refer to Note 2 and Note 9 to the Consolidated Financial Statements included

in this Form 10-K, for additional information

on loan modifications to borrowers with financial difficulties.

Competition

The

in

which

we

operate

is

highly

competitive.

In

Puerto

Rico,

our

primary

market,

the

banking

is

highly

with

respect

to

originatin

g

loans,

and

other

banking

Most

of

our

direct

competitio

n

for

our

and

comes

from

banks and

credit unions.

The

for

BPPR

include

locally

based

banks

and

a

few

large

U.S.

and

foreign

banks

with

operations in

While

the

banking competitors

Rico

reduced

in

recent years

as

a

result

of

consolidations,

these

have

allowed

some

of

our

to

gain

greater

resources,

such

as

a

broader range of products

We

also

compete

with

players

in th

e

local

that

are

not subjec

t

to

the

same

as domestic

banks

and bank holdin

g

Those

include

brokerage

firms,

automobile

and

finance

local

and

federal

credit

unions

(locally

known

as

“cooperativas”),

credit car

d

finance

institutional

lenders

and non-financia

l

and

entities.

Credit

unions

provide

basic

These

collectively

represent a significant

portion of the

market and have

a lower cost structure

and fewer regulatory

constraints.

In

the

United

States

we

to

face

pressure

as

our

footprint

resides

in

the

two

large,

metropolitan markets of

City / Northern

New Jersey and

the greater Miami

area.

There is a

large number of

community

and

regional

banks

along

with

national

banking

present

in

both

many

of

which

have

a

larger

amount

of

resources than us.

In both

and the

United States,

the primary

factors in

for business

include

pricing,

convenience

of branch

locations

range of

products offered,

and the

service delivered.

We must

compete

along

all

these

parameters

to

be

successful.

We

pricing

pressure

as

some

of

our

seek

to

market

share

by

reducing

prices

for

or

the

rates

charged

on

loans,

increasing

the

rates

offered

on

or offering

more flexible

terms. Increased

competition

could require

that we

the rates

offered

on deposits

and

lower the rates

charged on loans,

which could adversely

affect our profitability.

along

with

legislative

and

have

an

ongoing

impact

on

the

within

the financia

l

industry.

We work

to anticipat

e

and adap

t

to dynamic

whether

through developing

and marketing

innovative

and services,

adopting

or developin

g

new technologie

s

that

differentiat

e

our products

and

cross-marketing,

or

personalized

banking

We

strive

to

distinguish

ourselves

from

other

banks

and

in our

marketplace

by providin

g

a high

level

of service

to enhance

loyalty

and to attrac

t

and retain

we can

provide

no assurance

as

to

the

of

these

efforts

on

our

future

or

results

of

and

as

to

our

ability

to

and

adapt

to

changing

and

to

sufficientl

y

improve

our

and/or

banking

products,

in

order

to

successfully

compete

in

our

primary

service

areas.

Human Capital Management

Popular

seeks

to

embody

our

purpose

of “putting

people

at the

center

of progress”

its human

capital

Attracting,

developing

and

top

talent

in

an

that

promotes

wellness,

inclusion,

and

transparency

are

fundamental

pillars

of

our

As

of

31,

2023,

Popular

has

9,237

none of whom

are represented

by a collective

bargaining group.

Nurturing Well-Being: Employee Health & Financial

Popular believes

health and

wellness of

Popular’s employees

is essential

to enable

Popular to

serve

its customers

and contribute

positively

to the

communities

where it

operates.

Our health

and wellness

program includes

health,

pharmacy,

vision and

dental insurance,

as well

as other

initiatives.

Our programs

seek to

ensure that

healthcare

being

both accessible

and affordable

for our

with Popular

covering

up to

90% of

health

premiums,

a figure

that

surpasses

regional

benchmarks.

In

2023,

we

launched

a

guide

on

mental

health

to

support

leaders

in

promoting

emotional

within

their

teams

and

engaging

with

team

members

who

may

be

facing

mental

health

promotes employee

health and

wellbeing by

encouraging

annual physical

exams and

a

health

and

center

at

its

Puerto

Rico-based

offices

staffed

with

healthcare

providers,

where

can

their

physical

exam,

receive

acute

care

or visit

a nutritionist

or

psychologist

free

of charge.

Our

health

and

center received

over 15,680 visits

from employees

during 2023.

Popular

also seeks

to foster

work-life

balance by

paid time

off benefits

to our

including community

service

leave,

paid

parental

leave

and

flexible

work

Our

hybrid

work

model,

accessible

to

half

of

our

workforce,

underscores our

commitment to

flexible work

environments.

we continuously

offer activities

and workshops

centered on

physical fitness

and personal financial

Popular

further

a 401(k)

savings

and investment

plan, in

which

98% of

participate.

Popular

matches

$0.50

for every

dollar

the employee

contributes

to the

401(k)

plan,

up to

8% of

their

salary.

Popular

offers

a profit

-sharing

plan,

contingent

upon

the

achievement

of

pre-set

goals,

to

further

align

with

its

collective

success.

The

profit-sharing

plan

allows

to

receive

up to

8%

of

their

eligible

(capped

at

$70,000),

of

which

the

first

4%

is

paid

in

cash

and

anything

beyond

such

percent

is

paid

to

the

employee’s

Savings

and

Investment

Plan

account. Popular

regularly

evaluates employees’

base compensation

compete with

the salaries

paid in similar

in

other

Our

ongoing

to

our

employees’

market-aligned

salary

merit increases

and raising

our hourly

pay rates to

$15 per hour

in Puerto Rico

and $16 per

hour in the Virgin

Islands as

of 2023,

and $17

per hour

in Florida

and $20 per

hour in

and New Jersey

as of 2022.

we invested

$22.5M

in enhancing

our employees’

compensation.

Empowering Growth: Our Commitment to Talent Development

We

are

to

the

continuous

and

upskilling

of

our

and

believe

it

is

fundamental

to

our

edge.

Towards

that

end,

Popular

aimed

at

strengthening

our

employees’

knowledge,

abilities

and skills

their

growth which,

seeks

to enhance

strategies

and

competencies.

Our

40,000

square

foot

Center

in

San

Juan,

Puerto

Rico

and

our

satellite

in New

York,

South Florida,

and the Virgin

Islands offer

year-round

training sessions,

and workshops.

we transitioned

back to

in-person

sessions,

but also

offering

virtual

Our seven

academies

had

more

than

8,000

registrations

from

our

during

2023,

1,600

more

than

in

Our

commitment

to continuous

is further

supported

by offering

our employees

access to

LinkedIn

Learning,

which provides

an extensive

library

of over

16,000

e-learning

courses.

users

totaled

61% of

our employees,

of 24%

from

2022, for a

total of 17,006

hours logged

during the year.

Our

focus

on

and

has

growth

to

our

workforce.

As

a

result,

the

internal mobility

rate in 2023

was 36%. This

included employees

who applied

or were selected

for vacancies,

were

promoted,

or

had

lateral

movements.

we

invested

in

the

education

of

over

practitioners

through

Accelerated

Programs

focused

on

data

science,

analytics,

process

excellence,

and

program

The

also

offered

its

in

engineering,

but

not

limited

to,

coding

and

development.

Leadership

remains

a

priority

at

as

we

believe

it

is

vital

for

driving

engagement

and achieving

our strategic

objectives.

With this

in mind,

we launched

a new

program

in 2023

focused

on

exploring

the

role

leaders

play

in

creating

the

right

for

our

culture

to

thrive.

Our

strategy

aims

to

enhance

both

and

by

preparing

us

to

meet

future

In

2023,

we

facilitated

interventions

that

focused

on

change

team

alignment, and

leader effectiveness.

Enhancing Leadership Continuity through Strategic

Succession Planning

Popular’s business

strategy further

takes into

account succession

planning to

ensure effective

leadership transitions.

Succession

plans for

senior management

are developed

by the CEO

and presented

to the Board

of Directors.

Popular’s succession

planning

also

leverages

our

Talent

Program

(the

“Program”)

that

seeks

to

high-potential

and

high-

managers,

which

are

with

to

enhance

their

skills

and

prepare

them

for

senior

management positions.

Diversity, Equity and Inclusion

Popular

is

to

a

diverse,

equitable

and

inclusive

workplace.

As

of

31,

2023,

64.5%

of

the

employees were

female, and

35.5% were male.

Women accounted

for 63% of first

and mid-level

management and

36.6%

of

executive-level

as

of

such

date.

We

have

recently

enriched

our

talent

pool

with

the

inclusion

of

professionals

from Latin America,

thereby enhancing

multicultural

diversity

within our organization.

Central to

our diversity

efforts

is our

multidisciplinary

Diversity,

Equity and

Inclusion

(“DEI”)

Council,

which is

overseen

by our

Diversity

Officer.

Our

DEI Policy

is committed

to attracting,

and developing

a diverse

population;

a work

where

are

treated

equitably

and

with

respect;

and

seeking,

creating,

and

relationships

with

diverse suppliers.

We

are

to

fair

pay

and

conduct

related

pay

analyses

on

an

annual

basis.

The

results

for

revealed

a

1.8

point

improvement

in

Puerto

Rico

and

the

Virgin

Islands

and

a

6.4

point

improvement

in

the

United

States

in

our

gender-related

pay

to

the

end

of

Our

commitment

to

gender

equality

has

been

in the Bloomberg

Gender Equality

Index for two

consecutive

years (2021-2022

and 2022-2023).

Our

Employee

Resource

Groups

(“ERGs”)

are

key

that

support

our

DEI

In

2023,

our

ERGs

witnessed

growth

in

membership.

Popular

Pride,

our

ERG

focused

on

the

LGBTQ+

community,

seeks

to

enhance

awareness

and engagement

of LGBTQ

issues.

Network

of Women

in Popular,

focused

on empowering

women,

and

Popular

Embrace,

focused

on

functional

also

achieved

notable

milestones,

partnering

with

our

human

division

to

educate

and

promote

and

during

we

a

Black/African

American ERG in

the US.

Popular also

supports victims

of gender-based

violence and

provides a

special leave

of 15 days

eligible to

located in

in order to

handle situations

related to gender

violence, domestic

violence or

stalking.

Employee Experience

Popular

aims

to

provide

an

exceptional

that

inspires

its

to

deliver

service

to

and communities.

We

the

dynamic

nature

of employee

needs

and

and

have implemented

a

more

robust

to measure

and

understand

the

employee’s

journey.

In

2023,

we revised

our

Employee

Engagement

&

Experience

Survey

program

to

(i)

our

assessments

from

biennial

to

and

annually

and

(ii)

include

surveys

that

measure

the

end-to-end

journey

from

recruiting

and

onboarding

to

offboarding.

We

believe that

the insights

received from

these surveys

have allowed

us to

introduce

people initiatives

helped us

reduce

our turnover

rate to 7.9%

as of the

end of 2023,

a 2.9 percentage

point improvement

from 2022.

Our voluntary

turnover rate

also

saw a notable

decrease to

6.4%, down

2.4 percentage

points from

the previous

year.

the survey

has enabled

us to

monitor

our employee

loyalty

score

and identify

or enhance

our current

score

of 84%,

which positions

us

within the 75th

percentile of

the Qualtrics

global benchmark

and above the

average benchmark

of the financial

industry.

Board Oversight in Human Capital

The

Talent

and

of

the

Board

of

has

responsibility

for

the

human capital

As part

of its

responsibilities,

the Talent

and Compensation

reviews and

advises

on the

general

philosophy,

and policies,

and

on the

talent

and development,

workforce

engagement,

succession

planning,

culture,

equity

pay equity)

and inclusion,

among other human

capital topics.

We

you

to

review

our Corporate

Sustainability

Report

published

on www.popular.com

for more

human capital

and initiatives.

The information

on the

the

Sustainability

Report,

is

not,

and

will

not

be

deemed

to

be,

a

part

of

this

Form

10-K

or

incorporated

into any of the

filings with

the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America

(“PNA”)

and

their

Such

laws

and

are

continually

under

review

by

Congress

and

state

legislatures

and

federal

and

state

agencies.

Any

change

in

the

laws

and

to

Popular

and

its

subsidiaries could have a material effect on the

business of Popular and its subsidiaries. We will continue to

assess our businesses

and risk management and compliance practices

to conform to developments in the regulatory

General

Popular and PNA are bank holding companies subject to consolidated supervision

and regulation by the Federal Reserve

Board under

Holding Company Act

of 1956

(as amended, the

“BHC Act”). BPPR

and PB

are subject to

supervision and

examination by applicable

federal and state

banking agencies including,

in the

case of BPPR,

the Federal Reserve

Board and the

the Commissioner

Institutions of

(the “Office

of the

Commissioner”), and, in

of PB,

the

Federal

Reserve

Board

and

the

New

York

State

of

Services

(the

“NYSDFS”).

broker-dealer

/

investment adviser

Popular Securities,

LLC (“PS”)

and investment

advisor subsidiary

Popular Asset

Management LLC

(“PAM”)

to

regulation by

the SEC,

the Financial

Industry

Regulatory Authority

(“FINRA”), and

the Securities

Investor

Protection Corporation, among others. Other of our non-bank subsidiaries conduct reinsurance and

insurance producer and agency

activities, which are

subject to other

federal, state and

Puerto Rico laws

and regulations as

well as licensing

and regulation by

the

Puerto Rico Office of the Commissioner of Insurance and,

for one insurance agency subsidiary, the NYSDFS.

Enhanced Prudential Standards

Under

the

Dodd-Frank

Wall

Street

Reform

and

Act

(the

“Dodd-Frank

Act”),

as

by

the

Growth,

Regulatory

Relief,

and

Act

and

the

federal

banking

regulators’

“Tailoring

Rules,”

banking

organizations are

categorized based

on status

as

a U.S.

G-SIB,

size

and four

other risk-based

indicators. Among

bank

holding companies with $100

billion or more in

total consolidated assets, the

most stringent standards apply

to U.S. G-SIBs,

which

are subject to Category I standards and the

least stringent standards apply to Category IV organizations, which have between $100

billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and

which are also

not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk

management requirements. As of December 31, 2023,

Popular had total consolidated assets of $70.8 billion.

Transactions with Affiliates

BPPR

and

PB

are

subject

to

that

limit

the

amount

of

extensions

of

credit

and

certain

other

“covered

transactions” (as defined in Section

23A of the Federal

Reserve Act) between BPPR or

PB, on the

one hand, and Popular,

PNA or

any

of

our

other

on

the

other

hand,

and

that

impose

collateralization

on

such

credit

extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that

affiliate would exceed 10% of

the bank’s capital stock and

surplus or the aggregate amount of

the bank’s covered transactions with

all affiliates would exceed 20% of the bank’s capital stock and surplus. In addition,

any transaction between BPPR or PB, on the one

hand, and Popular, PNA

or any of our other non-banking

subsidiaries, on the other,

is required to be carried out

on an arm’s length

basis.

Source of Financial Strength

The

Dodd-Frank Act

requires bank

holding companies,

such

as Popular

and

PNA, to

act

as

a source

of

and

managerial strength to their subsidiary banks. Popular

and PNA are expected to commit resources

to support their subsidiary banks,

including at times when Popular

and PNA may not be

in a financial position to

provide such resources. Any capital loans

by a bank

to any

of its

subsidiary depository

institutions are

subordinated in

right of

payment to

depositors and

to certain

other indebtedness of such subsidiary depository institution. In the

event of a bank holding company’s bankruptcy,

any commitment

by

the

bank

holding

company

to

a

federal

banking

agency

to

the

capital

of

a

will

be

assumed by

the bankruptcy

trustee and

entitled to

a priority

of payment.

PB are

currently the

only insured

institution subsidiaries of Popular and PNA.

Resolution Planning and Resolution-Related Requirements

A

bank holding

company with

$250 billion

or more

in total

consolidated assets

(or that

is a

Category III

firm based

on

certain risk-based indicators described in the Tailoring

Rules) is required to report periodically to the FDIC

and the Federal Reserve

Board

such

plan

for

its

rapid

and

orderly

in

the

event

of

distress

or

failure.

In

insured depository institutions with total

assets of $50 billion or

more are required to

submit to the FDIC

periodic contingency plans

for

in

the

event

of

the

failure.

In

2018,

the

FDIC

issued

a

moratorium

on

plans

for

insured

depository institutions

with more

than $50

assets. The

moratorium is

still in

effect for

institutions with

$50 billion

but less

than $100

assets. On

August 29,

FDIC proposed

amendments to

the resolution

planning requirements

for insured

depository institutions

with $50

more in

total assets.

The amendments

would require

insured depository institutions with between $50 billion and

$100 billion in assets to submit informational filings on

a two-year cycle,

with an interim supplement updating key information

submitted in the off years.

On August

29, 2023,

Reserve Board,

FDIC and

the Comptroller

of the

Currency (“OCC”)

issued a

rule

that

would

require

bank

holding

and

insured

with

$100

billion

or

more

in

consolidated assets (as well as their insured depository institution affiliates) to maintain minimum

amounts of eligible long-term debt

(generally, debt

that is unsecured, has

a maturity greater than one

year from issuance and satisfies

additional criteria), subject to a

three-year phase-in

period. The

proposal would

also apply

“clean holding

company” requirements

to Category

II through

IV bank

holding companies, which would, among other things, prohibit

entering into derivatives and certain other

financial contracts with third

parties.

As of December 31, 2023, Popular,

PNA, BPPR and PB’s total assets were below

the thresholds for applicability of these

rules, except that BPPR would be subject to the

FDIC’s proposed amendments to its resolution planning requirements applicable to

insured depository institutions

with more than

$50 billion but

less than $100

billion in assets

(if those amendments

are adopted as

proposed).

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of

the

FDIC,

and

BPPR

and

PB

are

subject

to

FDIC

deposit

assessments

to

the

DIF.

Deposit

assessments are

the average

consolidated total

the insured

depository institution

minus the

average tangible

equity of the institution during the assessment period. For larger

depository institutions with over $10 billion in assets,

such as BPPR

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among

other measures, that seeks to capture

both the probability that an individual large institution will

fail and the magnitude of the impact on the DIF

if such a failure occurs. The

FDIC has the ability

to make discretionary adjustments to the

total score based upon significant

risk factors that are not

captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30

basis points on an annualized basis.

After the effect of

potential base-rate adjustments, the total base assessment rate could

range

from 1.5 to 40 basis points on an annualized

basis.

In

October

2022,

the

FDIC

finalized

a

rule

that

initial

base

deposit

rates

by

basis

points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the Federal Deposit Insurance Act

(“FDIA”), established

a plan

in September

2020 to

restore the

DIF reserve

ratio to

meet or

exceed the

statutory minimum

of 1.35

percent within

eight years. The

increased assessment is

intended to improve

the likelihood that

the DIF

reserve ratio would

reach

the required minimum by the statutory deadline

of September 30, 2028.

As

of

31,

2023,

we

had

a

DIF

average

total

asset

less

average

equity

base

of

approximately $66 billion.

On

November 16,

2023,

the

FDIC finalized

a

rule

that

imposes

a special

assessment to

recover the

costs to

the

DIF

from

the

use,

in

March

2023,

of

the

risk

exception to

the

test

FDIA

in

connection with the

receiverships of Silicon

Valley Bank

and Signature Bank.

The FDIC estimated

in approving the

rule that those

assessed losses

total approximately $16.3

billion. The

rule provides

that this

loss estimate

will be

periodically adjusted, which

will

affect

the

amount

of

the

special assessment.

rule, the

base

is

the

deposits that

an

institution reported

in its

Consolidated Reports of

Condition and Income

(“Call Report”)

excluding the

first

uninsured deposits.

For a

that

has more

than one

such

as

the

$5

billion

exclusion

is

allocated

among

the

insured

subsidiaries in

proportion to

each insured

special

assessments will

be

collected at

an annual

rate of

approximately 13.4 basis

points per year

(3.36 basis

points per

quarter) over eight

quarters in

and 2025,

first assessment

period beginning

2024. Because

loss pursuant

to the

systemic risk

will

be

periodically adjusted,

the

FDIC

retains the

cease

collection

early,

extend the

special

collection period and

impose a final

shortfall special assessment

on a one-time

basis. Popular expects the

special assessments to

be

tax

deductible. The

total

of

the assessments

for Popular

is

estimated at

$71.4 million

and such

amount

was recorded

as

an

expense in

the quarter

of adoption

(the quarter

31, 2023).

As of

FDIC’s loss

described in the final rule

had increased by approximately $4.1 billion to $20.4

billion, or approximately 25%. If such increase

in the

loss

remains

unchanged and

is

in

the

same

manner,

the

Corporation estimates

that

the

incremental

expense for the special assessments could be approximately

$18 million.

Brokered Deposits

The FDIA

and regulations

adopted thereunder

restrict the

use of

brokered deposits

and the

rate of

interest payable

on

deposits for institutions

that are less

than well capitalized.

Popular does not

believe the brokered

deposits regulations have

had or

will have a material effect on the funding or liquidity

of BPPR and PB.

Capital Adequacy

Popular, PNA,

BPPR and PB are

each required to comply

with applicable capital adequacy standards

established by the

federal

banking

(the

“Capital

Rules”),

which

the

Basel

III

set

forth

by

the

Basel

on

Banking Supervision (the “Basel Committee”) as

well as certain provisions of the Dodd-Frank

Act.

Among other

matters, the

Capital Rules:

(i) impose

a capital

measure called

“Common Equity

Tier

1” (“CET1”)

and the

related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1

capital” instruments meeting

certain revised requirements;

and (iii) mandate

that most deductions/adjustments to

measures be made

to CET1

and not to

the other components

of capital.

Under the Capital

Rules, for most

banking organizations,

the

most

common

form

of

Additional

Tier

capital

is

non-cumulative

perpetual preferred

stock

and

the

most

common form of Tier

2 capital is subordinated notes and

a portion of the

allocation for loan and lease losses,

in each case, subject

to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum

capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted

assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported

on consolidated financial statements (known as the

“leverage ratio”).

The Capital Rules also impose

a “capital conservation buffer,”

composed entirely of CET1, on top

of these minimum risk-

asset

ratios. The

capital

conservation

buffer

is

to

absorb

losses

during

periods

of

economic stress.

Banking

with

a

ratio

of

CET1

to

risk-weighted

assets

above

the

minimum

but

below

the

capital

conservation

buffer

will

face

constraints on

dividends, equity repurchases

and compensation based

on the

the shortfall and

eligible retained

income

(that is,

four quarter trailing

net income, net

of distributions

and tax

effects not

reflected in net

income). Thus, Popular,

PB are required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of

(i)

CET1 to risk-weighted assets

of at least 7%,

(ii) Tier 1

capital to risk-weighted assets of

at least 8.5%, and

(iii) Total

capital to risk-

weighted assets of at least 10.5%.

In addition, under

prior risk-based capital rules,

the effects of

accumulated other comprehensive income

or loss (“AOCI”)

items included in stockholders’

equity (for example, marks-to-market of securities

held in the available

for sale portfolio) under

U.S.

GAAP were reversed

for the

purposes of determining

regulatory capital ratios.

Capital Rules, the

effects of certain

AOCI

items

are

not

excluded;

banking

that

are

not

subject

to

Categories

I

or

II

under

the

framework for

with $100

more in

assets, including

PB, may

make a

one-time

permanent election to continue to

exclude these items. Popular,

BPPR and PB have

made this election in order

to avoid significant

variations in

of capital

depending upon

rate fluctuations

on the

of their

available for

sale

securities portfolios.

The

Capital

Rules

preclude certain

hybrid

securities, such

as

trust

securities, from

inclusion

in

bank

holding

companies’ Tier 1 capital. Trust preferred securities no

longer included in Popular’s Tier 1 capital may nonetheless be included as a

component of

Tier 2 capital.

not issued

any trust

preferred securities since

May 19,

2010. As

$193 million

of trust

preferred securities

outstanding which

qualify for

Tier

treatment, but

instead

qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions

from and adjustments to CET1.

Banking organizations that are

not subject to Category

I or II standards

are subject to rules that

provide for simplified capital requirements relating

to the threshold

deductions

for

certain

assets,

tax

assets,

in

the

capital

of

unconsolidated

institutions and inclusion of minority interests

in regulatory capital.

Failure

to

meet

capital

could

subject

Popular

and

its

to

a

variety

of

enforcement remedies, including the termination of deposit insurance by the FDIC

and to certain restrictions on our business. Refer

to “Prompt Corrective Action” below for further

discussion.

In

December 2017,

the Basel

Committee published

standards that

it

described as

the finalization

of the

post-

crisis regulatory

reforms. Among other

things, these

standards revise

the Basel

Committee’s standardized approach

risk

by

recalibrating

risk

weights

and

introducing

new

capital

for

certain

“unconditionally

cancellable

commitments,” such

as

unused credit

card

lines of

credit) and

provide

a new

standardized approach

for operational

risk capital.

current U.S.

capital rules,

operational risk

capital requirements

and a

capital floor

apply only

to advanced

approaches

institutions, and not to Popular, BPPR and PB.

On

July

27,

2023,

the

federal

banking

revisions

to

the

Capital

Rules

to

the

Basel

Committee’s

and

make

other

changes

to

the

Capital

Rules,

the

ability

of

banking

in

Categories III and

IV to

elect not to

recognize most elements

of AOCI in

regulatory capital. The

proposal introduces revised

credit

risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However,

the

revised capital requirements of the proposed rule would not apply to Popular, BPPR, or PB because

they have less than $100 billion

in total consolidated assets and trading assets and

liabilities below the threshold for market risk

In

2018,

the

federal

banking

a

final

rule

modifying

their

capital

rules

and

providing an

option to

phase in

over a

three years

the day-one

effects of

the Current

Expected Credit

Loss (“CECL”) model

of ASU 2016-13.

The final

rule also revised

the agencies’

other rules to

reflect the update

to the

standards. Popular has availed itself

of the option to

phase in over a period

of three years the

day one effects on

adoption of

CECL. In

2020, federal

bank regulators

adopted a

rule that

allowed banking

organizations to

elect to

delay

temporarily

the

effects

of

adopting

CECL

on

capital

until

January

and

to

phase

in

the

effects through January 2025.

Refer to the Consolidated Financial Statements in this Form 10-K., Note 21 and Table 9 of

Management’s Discussion and

Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer

to the Consolidated Financial Statements in this Form

10-K Note 2 for more information regarding CECL.

Prompt Corrective Action

The

FDIA

requires,

among

other

things,

the

federal

banking

to

take

prompt

corrective

action

in

respect

of

insured

that

do

not

meet

minimum

capital

The

FDIA

five

capital

tiers:

“well

capitalized,”

“adequately

capitalized,”

“undercapitalized,”

“significantly

undercapitalized,”

and

“critically

undercapitalized”.

A

depository institution’s capital tier will depend upon how its

capital levels compare with various relevant capital

measures and certain

other factors.

An insured

depository institution will

be deemed

to be

(i) “well

capitalized” if

has a

capital

ratio of 10.0% or greater, a CET1 capital ratio of 6.5%

or greater, a Tier 1

risk-based capital ratio of 8.0% or greater, and a leverage

ratio of 5.0% or

greater, and is

not subject to any order

or written directive by

any such regulatory authority to

meet and maintain a

specific capital level for any capital

measure; (ii) “adequately capitalized” if the institution

has a total risk-based capital ratio

of 8.0%

or greater, a

CET1 capital ratio of 4.5%

or greater, a

Tier 1 risk-based capital

ratio of 6.0% or greater,

and a leverage ratio of

4.0%

or greater

and is

not “well

capitalized”; (iii)

“undercapitalized” if

has a

that is

less than

8.0%, a CET1 capital

ratio less than 4.5%,

a Tier 1

risk-based capital ratio of

less than 6.0% or

a leverage ratio of

less than 4.0%;

(iv) “significantly

undercapitalized” if

has a

of less

than 6.0%,

a CET1

less

than 3%, a Tier

1 risk-based capital ratio of less than 4.0% or

a leverage ratio of less than 3.0%;

and (v) “critically undercapitalized”

if

the

equity

is

equal

to

or

less

than

2.0%

of

average

assets.

An

may

be

downgraded to, or deemed

to be in, a

capital category that is

lower than indicated by

its capital ratios if

it is determined to

be in an

unsafe

or

unsound

or

if

it

receives

an

unsatisfactory

rating

with

respect

to

certain

matters.

An

insured

depository institution’s capital category is determined solely for the purpose of applying prompt corrective action

regulations, and the

capital category

may not

constitute an

accurate representation

of the

institution’s overall

or prospects

for other

purposes.

The FDIA generally prohibits an insured depository institution from making any capital

distribution (including payment of a

dividend) or

paying any

management fee to

its holding

company, if

the depository

institution would thereafter

be undercapitalized.

Undercapitalized

are

subject

to

on

from

the

Federal

Reserve

System.

In

are

subject

to

growth

and

are

to

submit

capital

restoration

plans.

A

holding company must

guarantee the capital

restoration plan, up

to an

amount equal to

the lesser

of 5%

of

the

assets

at

the

time

it

becomes

or

the

amount

of

the

capital

deficiency,

when

the

institution fails to comply with the

plan. The federal banking agencies may not

accept a capital restoration plan without determining,

among other things,

that the plan

on realistic assumptions

and is

likely to succeed

in restoring the

capital. If a depository institution fails to submit an

acceptable plan, it is treated as if it is

significantly undercapitalized.

Significantly

may

be

subject

to

a

number

of

and

restrictions,

including orders to

sell sufficient voting

stock to become

adequately capitalized, requirements to

reduce total assets

and cessation

of receipt

of deposits

from correspondent

banks. Critically

undercapitalized depository

institutions are

appointment of

a

receiver or conservator.

The capital-based prompt

corrective action provisions

of the FDIA

apply to

the FDIC-insured depository

institutions such

as

BPPR

and

PB,

but

they

are

not

to

holding

such

as

Popular

and

PNA,

which

control

such

institutions. As of December 31, 2023,

both BPPR and PB met the quantitative requirements

for ‘well capitalized’ status.

Restrictions on Dividends and Repurchases

The

sources

of

funding

for

Popular

and

PNA

have

from

their

banking

and

non-

banking subsidiaries, asset sales

and proceeds from

the issuance of

debt and equity.

Various statutory

provisions limit the amount

of

dividends an

institution may

pay to

its

without regulatory

approval. A

member bank

must

obtain the approval of the

Federal Reserve Board for any

dividend, if the total of

all dividends declared by the

member bank during

the calendar year would exceed the total of its net income for that year,

combined with its retained net income for the preceding two

years, after

considering those

years’ dividend

less any

required transfers to

surplus or

to a

fund for

the retirement

of any

preferred stock. During the year

ended December 31, 2023, BPPR declared

cash dividends of $200

million, a portion of

which was

used by Popular for the payments of the cash dividends on its

outstanding common stock. At December 31, 2023, BPPR needed to

obtain prior approval of the Federal Reserve Board before declaring a dividend

in excess of $387 million due to its

retained income,

declared dividend activity and transfers to statutory reserves over the

three year’s ended December 31, 2023. In addition, a member

bank may

not declare

or pay

a dividend

in an

amount greater

than its

undivided profits

in its

Report of

Condition and

Income, unless the member bank has received the approval of

the Federal Reserve Board. A member bank also may not permit

any

portion of its permanent capital to

be withdrawn unless the withdrawal has

been approved by the Federal Reserve Board.

to

these

requirements, PB

may

not

declare

or

pay

a

dividend without

the

prior

of

the

Federal

Reserve

Board

and

the

NYSDFS.

During the year

2023, PB

declared cash dividends

of $50

million, a portion

was used

by

Popular for the payments of the cash dividends on

its outstanding common stock.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common

stock only out

of net

income available to

common shareholders

over the past

year and

only if

the prospective rate

of earnings retention

appears

consistent with the organization’s current and

expected future capital needs, asset quality

and overall financial condition. Moreover,

under Federal Reserve Board policy, a bank

holding company should not maintain dividend levels that place undue pressure on the

capital of depository

institution subsidiaries or that

may undermine the bank

holding company’s ability to

be a source

of strength to

its

banking subsidiaries.

policy

also

provides that

a

bank

should

inform

the

Federal

Reserve

reasonably in advance of declaring or paying a dividend that

exceeds earnings for the period for which the dividend is

being paid or

that could result in a material adverse change

to the bank holding company’s capital structure.

The

Board

also restricts

the

banking

organizations to

conduct stock

repurchases. In

certain

circumstances, a banking organization’s repurchases

of its common stock may

be subject to a

prior approval or notice requirement

under other regulations or policies of the Federal Reserve. Any redemption or

repurchase of preferred stock or subordinated debt is

subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation

organized under the

laws

of the

to

a withholding

tax

of 10%

instead of

the 30%

applied to

other “foreign”

corporations. Accordingly, dividends from current or accumulated earnings and profits

paid by PNA to Popular, Inc. sourced from the

U.S. operations of PB are subject to a 10%

tax withholding.

Part II,

Item 5,

“Market for

Registrant’s Common

Equity,

Related Stockholder

Matters and

Issuer Purchases

of

Equity Securities” for further information on Popular’s

distribution of dividends and repurchases of equity

See

“Puerto

Rico

Regulation”

below

for

a

of

certain

on

ability

to

pay

under

Puerto Rico law.

Interstate Branching

The Dodd-Frank

Act amended

the Riegle-Neal

Interstate Banking

and Branching

Efficiency Act

of 1994

(the “Interstate

Banking

Act”)

to

authorize

national

banks

and

state

banks

to

branch

interstate

through

de

novo

branches. For

purposes

of

the

Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as other state

banks.

Activities and Acquisitions

In general, the BHC Act limits the activities

permissible for bank holding companies to the business of banking, managing

or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to

be

properly

incidental

thereto.

A

company

who

meets

and

capital

and

whose

institutions meet management,

capital and

Community Reinvestment Act

(“CRA”) standards may

elect to

be treated

as a

and engage

in a

substantially broader

range of

nonbanking financial

activities, including

securities underwriting

and dealing, insurance underwriting and making

merchant banking investments in nonfinancial

In order for a bank holding company to elect to be treated as a financial

holding company, (i) all of its depository institution

must

be

well capitalized

(as described

above)

and

well managed

and

(ii)

it

must

file a

declaration with

Reserve Board that it elects to be a “financial holding

company.” As noted above, a bank

holding company electing to be a financial

holding company must itself be and remain

well capitalized and well managed. The Federal Reserve Board’s

regulations applicable

to bank holding companies separately define

“well capitalized” for bank holding companies,

such as Popular,

to require maintaining

a tier 1 capital

ratio of at least

6% and a total capital

ratio of at least 10%.

Popular and PNA have elected

to be treated as

holding

A

is

deemed

to

be

“well

managed”

if,

at

its

most

recent

inspection,

or

subsequent review

by the

appropriate federal banking

agency (or

the appropriate state

banking agency), the

depository institution

at

least

a

“satisfactory”

composite

rating

and

at

least

a

“satisfactory”

rating

for

the

of

the

composite

rating.

If,

after

becoming

a

holding

company,

the

company

fails

to

to

meet

any

of

the

capital

or

management requirements

for financial

status, the

company

must

enter into

a confidential

agreement with

the

Federal

Reserve

Board

to

comply

with

all

applicable capital

and

If

the

company

does

not

return

to

within

days,

the

Federal

Reserve

Board

may

extend

the

or

may

order

the

company

to

divest

its

subsidiary banks or the

company may discontinue, or

divest investments in companies

engaged in, activities permissible only

for a

bank holding company that has elected to be treated as a financial

holding company. In addition, if a depository institution subsidiary

controlled by a financial holding company does not

maintain a CRA rating of at least “satisfactory,” the financial holding company

will

be subject to restrictions on certain new activities

and acquisitions.

The Federal Reserve Board

may in certain circumstances limit

our ability to conduct

activities and make acquisitions that

would otherwise be permissible for

a financial holding company.

Furthermore, a financial holding company must obtain

prior written

approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets.

In addition, we

are required to

obtain prior Federal

Reserve Board approval

before engaging in

certain banking and

other financial

activities both in the United States and abroad.

The “Volcker

Rule” adopted

as part

of the

Dodd-Frank Act

restricts the

Popular and

its subsidiaries,

BPPR and PB as

well as non-banking subsidiaries, to

sponsor or invest in

“covered funds,” including private funds,

or to engage in

certain types

of proprietary

trading. Popular

and its

subsidiaries generally

do not

engage in

the businesses

the Volcker

Rule; therefore, the Volcker Rule does not have a material effect on our

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in

recent years has been aimed at combating money

laundering and

terrorist financing.

The USA

PATRIOT

Act of

2001 (the

“USA PATRIOT

Act”) strengthened

of the

U.S.

government to help prevent, detect and prosecute international money

laundering and the financing of terrorism. Title

III of the USA

PATRIOT

Act imposed

significant compliance

and due

diligence obligations,

created new

crimes and

penalties and

expanded the

extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements

could have serious legal and reputational consequences

for the institution.

The

Anti-Money

Laundering

Act

of

(“AMLA”),

which

amended

the

Bank

Secrecy

Act

(the

“BSA”),

is

to

comprehensively

reform

and

modernize

U.S.

laundering

laws.

Among

other

things,

the

AMLA

codifies

a

approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to

promulgate

priorities

for

laundering

and

countering

the

of

terrorism

policy;

the

of

for

testing technology and

internal processes for BSA

compliance; expands enforcement-

and investigation-related authority,

a

expansion

in

the

for

certain

BSA

violations;

and

expands

BSA

whistleblower

incentives

and

protections. Many of

the statutory provisions

in the AMLA

will require additional

rulemakings, reports and

other measures, and

the

impact

of

the

AMLA

will

depend on,

among

other

things,

rulemaking and

implementation guidance.

In

June

2021,

the

Crimes Enforcement Network, a bureau of

the U.S. Department of the

Treasury,

issued the priorities for anti-money laundering

and

countering the

financing of

terrorism policy

required under AMLA.

The priorities

include: corruption, cybercrime,

terrorist financing,

fraud, transnational crime, drug trafficking, human trafficking and

proliferation financing.

Federal regulators

regularly examine BSA/Anti-Money

Laundering and sanctions

compliance to

enhance their

and effectiveness, and the frequency and extent of such examinations

and related remedial actions have been

increasing.

Community Reinvestment Act

The

CRA

banks

to

help

serve

the

credit

needs

of

their

communities,

extending

credit

to

low-

and

moderate-income individuals

and geographies.

Should

Popular

or our

bank

fail

to

serve

the community,

potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries

and affiliates, expand

into new financial activities

and merge with or

purchase other financial institutions.

On October 24, 2023,

the

OCC,

the

Federal

Reserve

Board,

and

the

FDIC

jointly

issued

a

final

rule

to

modernize

the

federal

banking

agencies’

CRA

regulations and respond to changes in the

banking industry. Among other

items, the final rule introduces new tests

under which the

performance of banks will

be assessed and includes

data collection and reporting requirements,

many of which are

applicable only

to banks with over

$10 billion in assets, such

as BPPR and PB.

The effective date of

the final rule is

April 1, 2024; however,

banks

will not be required to begin complying with certain provisions

of the final rule until January 1, 2026, with data reporting requirements

becoming applicable on January 1, 2027.

Interchange Fees Regulation

The Federal Reserve Board

has established standards for

debit card interchange fees

and prohibited network exclusivity

arrangements and routing restrictions. The

maximum permissible interchange fee that

an issuer may receive

for an electronic debit

transaction is

the sum

of

21 cents

per transaction

and 5

multiplied by

of

the transaction.

the

Board allows

for an

upward adjustment

of

no more

than 1

cent

to

an issuer’s

debit card

interchange fee

if the

issuer develops and implements policies and procedures

reasonably designed to achieve certain fraud-prevention

standards.

In

October

2023,

the

Federal

Reserve

Board

to

its

rules

on

interchange

fees.

The

changes would establish a

maximum permissible interchange fee of

no more than

14.4 cents per transaction

plus four basis points

multiplied by

of the

transaction. The

fraud prevention

adjustment would

be increased

to 1.3

cents per

transaction. The

proposed rule would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card

issuers.

Consumer Financial Protection Act of 2010

The Consumer

Financial Protection

Bureau (the

“CFPB”) supervises

“covered persons”

(broadly defined

to include

any

person offering or

providing a consumer financial

product or service and

any affiliated service

provider) for compliance with

federal

consumer financial laws. The CFPB

also has the broad power

to prescribe rules applicable to

a covered person or service

provider

identifying

as

unlawful,

unfair,

deceptive,

or

abusive

acts

or

in

with

any

with

a

for

a

consumer financial product or service, or the offering of

a consumer financial product or service. We are subject to examination and

regulation by the CFPB.

On October

19, 2023,

the CFPB

proposed a

new rule

to implement

Section 1033

of the

Consumer Financial

Act

that

would require

a provider

of

payment accounts

or

products, such

as a

bank, to

make data

consumers upon

request regarding the products or services they obtain from the provider. Any such data

provider would also have to make such data

available to third

parties, with the consumer’s

express authorization and through

an interface that satisfies

formatting, performance

and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by

the

consumer.

Data

that

would

be

to

be

made

available under

the

rule

would

include

information,

account

balance, account

and routing

numbers, terms and

conditions, upcoming bill

information, and certain

account verification data.

The

rule

is

to

give

consumers

control

over

their

data,

with

whom

it

is

shared,

and

competition in the provision of consumer financial products or services. For banks with at least $850 million and less than $50 billion

in

total

assets,

with

the

rule’s

would

be

two

and

a

half

years

after

adoption of the final rule. For

banks with at least $50 billion and

less than $500 billion in total

assets, compliance with the proposed

rule’s requirements would be required approximately

one year after adoption of the final rule.

On

January

17,

2024,

the

CFPB

a

rule

that

would

reform

the

governing

overdraft practices applicable

to banks such

as BPPR and

PB that have

more than $10

billion in assets.

The proposed rule

would

modify

or

eliminate

several

long-standing

exclusions

from

to

credit

that

exempted certain overdraft practices.

The proposal would also generally require banks to restructure many overdraft fees, overdraft

lines

of credit,

overdraft practices

as separate

consumer credit

accounts that

those requirements.

These changes

to the

regulatory framework could

PB, among

other things,

facing higher

compliance costs

in

charging

fees,

a

ability

to

recover

amounts

extended

as

protection,

reducing

the

availability of overdraft protection, and/or charging lower

overdraft fees.

Office of Foreign Assets Control Regulation

The

U.S.

Office

of

Foreign

Assets

Control

(“OFAC”)

administers

that

affect

with

foreign

countries,

nationals

and

others.

The

OFAC-administered

targeting

countries

take

many

forms.

Generally,

they

contain

one

or

more

of

the

elements:

(i)

on

trade

with

or

investment in a sanctioned country; and (ii) a blocking

of assets in which the government of the

sanctioned country or other specially

designated nationals have an interest, by prohibiting

transfers of property subject to U.S. jurisdiction (including

property in the United

States or the possession or control of U.S.

persons outside of the United States). Blocked assets (e.g., property

and bank deposits)

cannot

be

paid

out,

withdrawn, set

off

or

in

any

manner without

a

license

from

OFAC.

Failure

to

comply

with these

sanctions could have serious legal and reputational

consequences.

Protection of Customer Personal Information and

The privacy

provisions of

the Gramm-Leach-Bliley Act

of 1999

generally prohibit financial

institutions, including

us, from

disclosing nonpublic personal financial information of consumer customers to third

parties for certain purposes (primarily marketing)

unless

have

the

opportunity

to

opt

out

of

the

disclosure.

The

Fair

Credit

Act

restricts

sharing

among affiliates for marketing purposes and governs

the use and provision of information to consumer

reporting agencies.

The federal

banking regulators have

also issued guidance

and proposed rules

regarding cybersecurity that

are intended

to

enhance cyber

standards among

financial institutions.

A

financial institution

is expected

to

establish lines

of

defense

and

to

risk

that

are

to

address

the

risk

posed

by

compromised

credentials. A

financial institution’s

management is

maintain sufficient

business continuity

planning processes

for the

rapid

recovery,

resumption

and

maintenance

of

the

after

a

destructive

malware.

A

is

also

to

develop

to

enable

of

data

and

and

address rebuilding

network capabilities

and restoring

data if

or its

critical service

providers fall

victim to

this type

of

cyber-attack. If

we fail

to observe

guidance, we

could be

various regulatory

sanctions, including financial

penalties. In November 2021, the U.S. federal bank regulatory

agencies issued a final rule requiring banking

organizations, including

PNA,

PB,

to

notify their

primary federal

banking regulator

within

36 hours

of

determining that

a “notification

incident”

has

occurred.

A

notification

incident

is

a

“computer-security

incident”

that

has

disrupted

or

degraded,

or

is

reasonably likely

to materially

disrupt or

degrade, the

banking organization’s

deliver services

to

its

customer base,

jeopardize the viability

of key

operations of the

banking organization, or

impact the stability

of the

financial sector.

The final rule also requires specific and immediate

notifications by bank service providers that

become aware of similar incidents.

State and foreign regulators

have also been increasingly active

in implementing privacy and cybersecurity

standards and

regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and

providing detailed requirements with respect to these

programs, including data encryption requirements. In New York,

the NYSDFS

by

the

NYSDFS,

PB,

to,

among

other

things,

(i)

and

a

cybersecurity program designed

to enhance the

confidentiality, integrity

and availability of

their information systems;

(ii) implement

and maintain a written

cyber security policy setting forth

policies and procedures for the

protection of their information systems

and

nonpublic

information;

and

(iii)

designate

a

Chief

Officer.

On

1,

2023,

the

NYSDFS

adopted

amendments to

its

cybersecurity regulations

that

represent

a

update

to

the

regulation of

cybersecurity practices.

The

fall

within

the

five

categories:

(i)

mandatory

with

common

attack

vectors,

(ii)

for

privileged

accounts,

(iii)

notification

(iv)

expansion

of

cyber

and

(v)

additional cybersecurity

requirements for

larger companies.

Most

of

the

will

become

effective 180 days after adoption.

On

July

6,

2023,

the

SEC

adopted

new

rules

that

would

require

registrants,

such

as

to

(i)

report

cybersecurity incidents

on Form

8-K and,

(ii) disclose

in Annual

Report on

cybersecurity policies

and procedures

and

governance practices, including at the board and

management levels.

Many states and foreign

governments have also recently implemented or

modified their data breach notification

and data

privacy

requirements. The

California Consumer

Privacy Act

(“CCPA”)

imposes privacy

compliance obligations

with regard

to

the

collection,

use

and

disclosure of

information of

California residents,

and the

November 2020

amendment to

the

CCPA

creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered

by the law

and certain rights relating

to personal information. The

substantive obligations under the

2020 amendment to the

CCPA

became effective

on January

1, 2023.

In European

Union, the

General Data

Protection Regulation heightens

privacy compliance

and

imposes

strict

for

data

breaches.

We

expect

this

trend

to

and

are

continually

monitoring developments in the jurisdictions in which

we operate.

See

“Puerto

Rico

Regulation”

below

for

a

of

legislations

and

on

privacy

and

cybersecurity in Puerto Rico.

Climate-Related and ESG Developments

In

recent

years,

federal,

state

and

international

lawmakers

and

have

their

focus

on

institutions’

and

other

companies’

risk

oversight,

and

in

with

climate

change

and

other

environmental, social and

governance (“ESG”) matters.

on October

24, 2023, the

Federal Reserve, FDIC,

and OCC

finalized

interagency

on

for

climate-related

risk

to

institutions with more

than $100 billion

in total consolidated

assets. The principles

are intended to

support efforts by

large financial

institutions to

focus on key

aspects of climate-related

financial risk management

and cover six

areas: (1)

governance; (2) policies,

procedures,

and

limits; (3)

strategic planning;

(4)

risk

management; (5)

data,

risk measurement,

and reporting;

and

(6)

analysis.

On

21,

2022,

the

NYSDFS

on

climate-related

risk

to

NYSDFS-regulated banking

and mortgage

organizations, including

PB.

The

proposed guidance

would address

material financial

risks related to

climate change faced

by these organizations in

the context of

risk assessment, risk management,

and risk appetite

setting. On March 21, 2022, the SEC issued a proposed rule on the enhancement and

standardization of climate-related disclosures

for investors. The

proposed rule would

require public issuers,

including the Company,

to significantly expand

the scope of

climate-

related disclosures in

their SEC filings.

The SEC

also announced plans

to propose rules

to require enhanced

disclosure regarding

human capital management and board diversity for

public issuers.

Incentive Compensation

The Federal Reserve Board reviews, as

part of its regular,

risk-focused examination process, the incentive compensation

arrangements of

banking organizations, such

as Popular,

not “large,

complex banking

organizations.” Deficiencies will

be

incorporated into

the

organization’s supervisory

ratings, which

can

affect

the

organization’s ability

to

make

acquisitions and

take

other

actions. Enforcement

actions may

be taken

against

a

banking

organization if

its

incentive compensation

arrangements, or

related

risk-management

control

or

pose

a

risk

to

the

safety

and

soundness

and

the

organization is not taking prompt and effective measures

to correct the deficiencies.

The

Federal

Reserve

Board,

OCC

and

FDIC

have

issued

final

on

incentive

policies intended to discourage excessive risk-taking in

the incentive compensation policies of banking organizations

in order to not

undermine

the

safety

and

soundness

of

such

organizations.

The

guidance,

which

covers

all

that

have

the

ability

to

the risk

profile of an

organization, either individually

or as

part of

a group,

upon the key

principles that

a

banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond

the

ability

to

and

manage

risks,

(ii)

be

compatible

with

and

risk

management, and (iii)

be supported by

strong corporate governance,

including active and

effective oversight

by the

board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking

and

the

SEC,

to

adopt

rules

prohibiting

incentive-based

payment

arrangements that

inappropriate

risks

by

providing excessive

compensation or

lead to

financial loss

at specified

regulated entities

having at

least $1

billion in total

assets (including Popular,

PNA, BPPR and

PB). The U.S.

financial regulators proposed revised

rules in 2016,

which

have not been finalized.

In October

2022, the SEC

adopted a final

rule requiring securities

exchanges to adopt

rules mandating, in

a

restatement, the

recovery or

“clawback” of

excess incentive-based

compensation paid

to current

or former

executive officers

and

requiring listed

issuers to

disclose any

recovery analysis where

recovery is

triggered by

a restatement.

The excess

would be based

on the amount

the executive officer

would have received

had the incentive-based

compensation been determined

using the restated

financials. The Nasdaq

Stock Market’s listing

standards pursuant to the

SEC’s rule became

effective October 2,

2023. Popular’s clawback policy adopted in accordance

with these listing standards is included as

Exhibit 97.1.

Regulation of Broker-Dealers

Our subsidiary,

PS, is a

registered broker-dealer with the

SEC and subject to

regulation and examination by

the SEC as

well

as

FINRA

and

other

self-regulatory

organizations.

These

cover

a

broad

range

of

issues,

capital

requirements;

sales

and

trading

practices;

use

of

client

funds

and

securities;

the

conduct

of

directors,

and

employees;

record-keeping and recording;

supervisory procedures to

prevent improper trading

on material

non-public information; qualification

and

licensing

of

sales

personnel;

and

on

the

extension

of

credit

in

In

to

federal

registration, state securities

commissions require the

registration of certain

broker-dealers. PS is

registered with 35

U.S. state and

territory securities commissions.

Regulation of Reinsurers, Insurance Producers and Agents

Popular’s subsidiaries that are engaged in

insurance agency and producer activities are

subject to regulatory supervision

by the Puerto

Rico Office of

the Commissioner of Insurance

and to insurance laws

and regulations requiring licensing

of insurance

producers and

agents. Popular’s

reinsurance subsidiaries

to

licensure and

regulatory supervision

by the

Office of the Commissioner of Insurance and

to insurance laws and regulations requiring, among

other things, minimum capital and

solvency standards, financial reporting, restrictions on

the amount of dividends payable, record

keeping and examinations.

Puerto Rico Regulation

As

a

bank

organized

under

the

laws

of

Puerto

Rico,

BPPR

is

subject

to

supervision,

and

regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended

(the “Banking Law”).

Section 27

of the

Banking Law

requires that

at

least ten

percent (10%)

of the

yearly net

income of

BPPR be

credited

annually to a reserve

fund. The apportionment must be

done every year until the

reserve fund is equal to

the total of paid-in

capital

on common and preferred stock. During 2023, $44.5

million was transferred to the statutory reserve

account.

Section

of

the

Banking

Law

also

provides that

when

the

expenditures

of

a

bank

are

greater

than

its

receipts, the

excess of the

former over the latter

must be charged against

the undistributed profits of

the bank, and the

balance, if any,

must be

the reserve

fund.

If the

reserve fund

is

not sufficient

to

cover such

balance in

whole or

in part,

amount must be charged against

the capital account and no

dividend may be declared until capital

has been restored to its

original

amount and the reserve fund to 20% of the original

capital.

Section 16 of the

Banking Law requires every

bank to maintain a

legal reserve that, except

as otherwise provided by

the

the Commissioner,

may not be

less than 20%

of its

demand liabilities, excluding

government deposits (federal,

state and

municipal) that

are secured

by collateral.

If a

bank is

authorized to

establish one

or more

bank branches

in a

state of

States or in a foreign country, where such branches are subject to the reserve requirements of that state

or country, the Office of the

Commissioner

may

exempt

said

branch

or

branches

from

the

reserve

of

Section

to

an

order

of

the

Federal

Reserve

Board

dated

24,

1982,

BPPR

has

been

exempted

from

the

reserve

of

the

Federal

Reserve

System

with

respect

to

payable

in

Puerto

Rico.

BPPR

is

subject

to

the

reserve

prescribed by the Banking Law. During 2023, BPPR was in compliance

with the statutory reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to

any one person, firm, partnership or corporation, up to an

aggregate amount of

fifteen percent (15%)

of the paid-in

capital and reserve fund

of the bank.

31, 2023, the

legal

for BPPR

under this

provision was

approximately $341

million. In

of loans

worth at

least 25% more

than the amount

of the

maximum aggregate amount

of such secured

loans is

increased to

one

third of

the paid-in capital

of the bank,

plus its reserve

fund. In no

event may the

total of unsecured

and secured loans

to any one

person, firm, partnership or corporation exceed an aggregate amount of 33 1/3% of the paid-in capital and reserve fund of the bank.

If the institution is well capitalized and had been rated

1 in the last examination performed by the Office

of the Commissioner or any

regulatory agency,

its legal

shall also

include 15%

of 50%

of its

undivided profits

and for

loans secured

by collateral

worth at

least 25%

of the

capital of

the bank

shall also

include 33

1/3% of

50% of

its undivided

profits. Institutions rated 2

in their last

regulatory examination may include this

additional component in their

legal lending limit

only

with the previous authorization of the Office of the Commissioner. There are no restrictions under Section 17 on the amount of loans

that are wholly secured

by bonds, securities and

other evidence of indebtedness

of the Government of

the United States or

Puerto

Rico,

or

by

current

debt

bonds,

not

in

default,

of

or

of

Puerto

Rico.

During

2023,

BPPR

was

in

compliance with the lending limit requirements of Section

17 of the Banking Law.

Section

of

the

Banking Law

authorizes a

bank to

conduct certain

and

related

activities directly

or

through

subsidiaries, including finance leasing of personal property and originating and servicing

mortgage loans. BPPR engages in finance

leasing through

its wholly-owned

Popular Auto,

LLC, which

is organized

and operates

Rico. The

and servicing of mortgage loans is conducted by

Popular Mortgage, a division of BPPR.

With

information privacy,

Puerto

Rico

law

requires businesses

to

implement information

controls to

protect

consumers’

from

breaches,

as

well

as

to

provide

notice

of

any

breach

to

In

addition, as

noted above

in “Regulation

of

Reinsurers, Insurance

Producers and

Agents”, Popular’s

reinsurance subsidiaries

are

licensure and regulatory

supervision by the

Puerto Rico Office

of the

Commissioner of Insurance

and to insurance

laws

and regulations.

Available Information

We maintain an

Internet website at www.popular.com.

Via the “Investor

Relations” link at our

website, our annual reports

on

Form 10-K,

quarterly reports

on

Form 10-Q,

current

reports on

Form 8-K

and amendments

to

such

reports filed

or furnished

pursuant to Section 13(a) or

15(d) of the Securities Exchange Act

of 1934, as amended (the

“Exchange Act”), are available, free

of

charge, as

soon as

reasonably practicable

after such

forms are

electronically filed

with, or

furnished to,

the SEC.

The SEC

also

maintains an

internet website at

http://www.sec.gov that

contains reports, proxy

and information statements,

and other information

regarding issuers that file electronically with the

SEC. You may obtain copies of our filings on the SEC site.

We have

adopted a

written code

of ethics

that applies

to all

directors, officers

and employees

of Popular,

including our

principal executive officer

and senior financial

officers, in accordance

with Section 406

of the Sarbanes-Oxley

Act of 2002

and the

rules

of

the

SEC

promulgated

thereunder.

Our

Code

of

Ethics

is

on

our

www.popular.com,

in

the

section entitled “Corporate Governance.” In the event that we make changes to, or provide waivers from, the provisions of this Code

of Ethics that

the SEC requires

us to disclose,

we intend to

disclose these events

on our corporate

website in such

section. In

the

Corporate Governance

section

of our

we

posted the

charters

for

our Audit

Committee, Talent

and

Risk

Governance

and

Nominating

and

Committee, as well as our Corporate Governance Guidelines. In addition, information concerning

purchases and sales of our equity

securities by our executive officers and directors is

posted on our website.

All

website

addresses

given

in

this

document

are

for

only

and

are

not

to

be

active

links

or

to

incorporate any website information into this Form

10-K.

We, like

other financial institutions,

face risks

inherent to

financial condition, liquidity,

and

capital

These

risks

could

cause

our

actual

results

to

differ

from

our

results

or

the

results

contemplated by the forward-looking statements contained

in this report.

The risks described in

this report are not the

only risks we face. Additional

risks and uncertainties not currently

known by

us

or

that

we

deem

to

be

immaterial,

or

that

are

to

all

institutions,

may

also

adversely affect our business, financial condition, liquidity, results of operations or capital

ECONOMIC AND MARKET RISKS

Weakness in

the economy,

particularly in

where a

of our

business is

concentrated, has

adversely impacted us in the past and may adversely

impact us in the future.

We have been, and will continue to be, impacted by global and local

economic and market conditions, including weakness

in the

economy,

disruptions and

volatility in

markets, inflation,

monetary and

fiscal policies,

public policy,

geopolitical

conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated

in Puerto Rico,

which accounted for approximately 77% of

our assets and 81% of

our deposits as of December 31,

2023 and 78% of our

for the

2023. As

a result,

operations are

highly dependent

on the

general

trends

of

the

Puerto

Rico

economy

and

other

affecting

Puerto

Rico

consumers

and

businesses.

The

concentration of

our operations in

exposes us to

greater risks than

other banking companies

with a

wider geographic

base.

has faced significant

economic and fiscal

challenges in the

past, including a

severe recession that

began in

2007 and

persisted for

over a

decade and

an acute

fiscal crisis

that led

to file

for a

form

of federal

bankruptcy protection

in 2017.

Puerto Rico’s

have in

the past

adversely affected

our customers,

in

higher

delinquencies,

and

losses

for

us.

While

Puerto

economy

has

been

recovering

and

the

Puerto

Rico

emerged

from

bankruptcy

in

2022,

Puerto

Rico

still

faces

and

fiscal

Puerto

Rico

has

historically

a

amount

of

federal

funds

through

non-recurring

appropriations, particularly to cover costs associated with its health insurance program, and Puerto Rico’s recent economic recovery

has

been partially

significant federal

disaster relief

and stimulus

funding. Therefore,

Rico economy

is highly

susceptible

to

changes

in

federal

public

policy

towards

Puerto

Rico.

Public

policy

changes

that

result

in

a

of

federal

funding for Puerto

Rico, or in

delays in the

receipt of such funding,

could significantly impact Puerto

Rico’s economy.

A weakening

of the Puerto

Rico economy or other

adverse economic conditions affecting

Puerto Rico consumers and

businesses could result in

decreased demand

for our

products or services,

deterioration in the

credit quality

of our

customers, higher

delinquencies, charge-

offs or increased losses, all of which could adversely affect

our financial condition and results of operations.

We are

also exposed

to risks

the state

of the

local economies

of the

other markets

in which

we do

such as New York and Florida, and to the state of the global and U.S. economy and financial

markets. Global financial markets have

recently

experienced periods

of

extraordinary disruption

and volatility,

exacerbated by

geopolitical conflicts,

the

U.S.

debt-ceiling

situation,

high

levels

of

inflation

and

rapid

in

rates.

Inflationary

certain

of

our

(including our

personnel expenses)

and adversely

affected consumer

sentiment. Central

bank responses

to inflationary

led to higher

market interest rates

and, in turn,

lower activity levels across

U.S. and global financial

markets. These circumstances

resulted in,

and could

result in,

reductions in

of

our investments.

If these

conditions persist

or worsen,

our

results of operations, financial position and liquidity

could be materially and adversely affected.

Changes

in

rates

and

credit

spreads

can

impact

our

our

portfolio,

since

a

portion

of

our

business involves

and

lending

money,

and

investing in

Our business

performance are

market interest

movements in

those rates.

Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

a material impact on our results

of operations and the values of our

assets and liabilities, including our investment portfolio.

highly sensitive

to many

factors over

have no

control and

may not

be able

to anticipate

adequately,

including general

economic conditions

and the

monetary and

tax policies

of various

governmental bodies,

particularly the

Federal

Reserve Board.

Increasing levels of inflation, driven

by pent-up demand and supply-chain disruptions caused

by the COVID-19 pandemic

and the war in Ukraine, led

the Federal Market Committee of the Federal Reserve Board

(the “FOMC”) to execute a series of sharp

benchmark interest

rate increases

beginning in

quarter of

2022. While

the

FOMC has

indicated that

it

may conclude

its

interest rate hike cycle, the amount and pace of any reduction in interest rates remains uncertain. Higher interest rates could lead to

fewer originations of

commercial and residential

real estate loans,

loss of deposits,

a misalignment in

the pricing of

short-term and

borrowings,

less

in

the

markets

and

higher

funding

costs.

higher

rates

could

negatively affect

the payment

performance on

loans linked

to variable

to the

extent borrowers

are unable

to afford

higher interest

payments, which

could result

in higher

delinquencies. Inflationary

pressure arising

from increases

rates

may also affect

borrowers’ financial condition and

their ability to

pay their debts

when due. Additionally,

if the interest

rates we pay

on

our

and

other

were

to

at

a

faster

rate

than

the

rates

we

receive

on

loans

and

other

investments,

our

net

income,

and,

therefore,

our

earnings,

could

be

affected.

All

of

these

outcomes

could

adversely affect our earnings, liquidity and capital levels.

The

rapid

rise

in

rates

in

in

$2.5

billion

in

mark-to-market

losses

on

available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with

a fair value of approximately $6.5 billion (par value of

$7.4 billion), and with accumulated unrealized losses of $873 million, from our

available-for-sale portfolio to

our held-to-maturity portfolio.

While the size

of our unrealized

mark-to-market losses on

available-for-

sale

had

been

reduced

to

$1.4

billion

as

of

31,

2023,

if

rates

were

to

again

rise

rapidly

or

for

a

prolonged period, we may accumulate significant additional mark-to-market

losses on investment securities in our available-for-sale

portfolio, which may adversely affect our tangible capital

and impact our ability to return capital to our

stockholders.

For a discussion of the Corporation’s

interest rate sensitivity, please refer

to the “Risk Management” section of the MD&A

BUSINESS RISKS

Negative

changes

in

the

of

our

clients

have

us

in

the

past

and

may

impact us in the future.

A significant portion of

our business involves lending money,

which exposes us to

credit risk and

risk of loss if

do

not

repay

their

loans,

leases, credit

cards

or

other

credit

The

these

credit

affects our

and results

We have

in the

past been

adversely affected

by negative

the

financial condition of our clients due to weakness in

the Puerto Rico and U.S. economy. If the current economic environment were to

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels

of credit losses

and reserves for credit losses.

We are exposed to

increased credit risks and credit losses

to the extent our clients are

concentrated by industry segment

or type of client.

Our credit risk and credit

losses can increase to the extent

our loans are concentrated in borrowers engaged in

or similar

activities or

in borrowers

who as

a group

may be

uniquely or

disproportionately affected

by certain

economic or

market

conditions. We have significant

exposure to borrowers in certain

economic sectors, such as residential

and commercial real estate,

hospitality and healthcare. Challenging economic or market conditions that affect

the industries or types of clients to

which we have

significant exposure could result in higher credit

losses and adversely affect our financial condition

and results of operations.

We also

have direct

lending and

investment exposure

to Puerto

entities, which

have faced

fiscal challenges.

our exposure

to the

government consisted

of $362

direct lending

exposure to Puerto

Rico municipalities and

$238 million in

loans insured or

securities issued by

Puerto Rico governmental

but for

is non-governmental.

We also

have indirect

lending exposure

to the

government in the

form of loans

to private borrowers

who are service

providers, lessors, suppliers

or have other

relationships with

the Puerto Rico government. While the overall fiscal situation

of the Puerto Rico government has improved in recent years,

as

result

of

the

and

certain

of

its

having

restructured

their

debt

some

Puerto

Rico

government entities, including certain municipalities, still face significant

fiscal challenges. A deterioration in the fiscal situation of the

government and its

instrumentalities, and in

particular in the

fiscal situation

of the

municipalities to

which

we have direct lending exposure, could result in

higher credit losses and reserves for credit losses. For

a discussion of risks related

to the Corporation’s credit exposure to the Puerto Rico

and USVI governments, see the Geographic and

Government Risk section in

the MD&A section of this Form 10-K.

Deterioration in the

values of real

properties securing our commercial, mortgage

loan and construction portfolios

have in

the past resulted, and may in the future result,

in increased credit losses and harm our results

As of

2023, approximately

55% of

our loan

portfolio consisted

of loans

(comprised of 30% in commercial loans, 22% in residential

mortgage loans and 3% in construction loans). The

value of the collateral

securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy

of some of the

markets we serve has in

the past resulted in significant

declines in the value of

the real properties securing our

loan

portfolio, leading to increased credit losses. If the value of

the real estate properties securing our loan portfolio declines again in

the

future, we may be

required to increase our

provisions for loan losses

and allowance for loan

losses. Any such increase could

have

an adverse effect on

our financial condition and results of

operations. For more information on the credit

quality of our construction,

commercial and mortgage portfolio, see the Credit

Risk section of the MD&A included in this

We

are

exposed

to

credit

risk

from

loans

that

have

been

sold

or

are

being

subject

to

Popular

is

at

risk

for

loan

defaults

from

the

time

it

funds

a

loan

until

the

time

the

loan

is

sold

or

securitized into a

mortgage-backed security.

However, we

have retained part

of the credit

risk on sales

of mortgage loans

through

arrangements,

and

we

also

service

certain

loan

with

recourse.

At

31,

2023,

we

were

exposed to credit risk with respect to $0.6 billion in residential mortgage loans sold

or serviced subject to credit recourse provisions,

consisting principally of loans associated with the Fannie Mae and

Freddie Mac programs. Pursuant to such recourse provisions,

we

are required to repurchase the loan or reimburse the third-party investor for the incurred loss in the event of a customer default. The

maximum potential amount of future payments that

we would be required to make

under the recourse arrangements in the event

of

by

the

is

to

the

total

outstanding balance

of

the

loans

with

and

interest, if

applicable. In

the

event

of

nonperformance by

the borrower,

we

have

rights

to

the

underlying collateral

securing the

mortgage loan.

we repurchased

approximately $2

provisions. As

our liability

established to

cover the

loss exposure

loans sold

or

serviced with credit recourse amounted to $4 million. We may suffer losses on these loans if the proceeds from a foreclosure sale of

the property underlying

a defaulted mortgage

loan are less

than the outstanding

principal balance of

the loan plus

any uncollected

interest advanced and the costs of holding and disposing

of the related property.

Defective and repurchased loans may harm our business

and financial condition.

In

with

the

sale

and

of

loans,

we

are

to

make

a

variety

of

customary

representations

and

warranties regarding

Popular

and

the

loans

being

sold

or

securitized.

Our

obligations with

these

representations and warranties are generally outstanding for the

life of the loan, and they

relate to, among other things, compliance

with

laws

and

the

accuracy

of

in

the

loan

documents

and

loan

file

and

the

and

enforceability of

the

loan.

A

loan

that

does

not

comply

with

the

secondary

market’s

may

take

longer to

sell, impact

to securitize

or pledge

as collateral

for borrowings,

or be

unsalable or

salable

only

at

a

discount.

if

any

such

loan

is

sold

before

we

detect

non-compliance,

we

may

be

obligated

to

repurchase the loan and bear any associated loss directly,

or we may be obligated to indemnify the purchaser against any loss.

We

seek to

minimize repurchases and

losses from defective

loans by correcting

flaws, if possible,

and selling or

re-selling such loans.

if

we

were

to

suffer

losses

from

defective

and

repurchased

loans,

our

results

of

and

condition could be materially impacted.

If we are

unable to maintain

or grow our

deposits, we may

paying higher funding costs

and our net

income may decrease.

We rely primarily

on bank deposits as

a low cost and

stable source of funding

for our lending activities

and the operation

of

our

Therefore,

our

funding

costs

are

largely

on

our

ability

to

and

grow

our

As

our

competitors have raised the

interest rates they pay

on deposits, our

funding costs have increased,

as we have

needed to increase

the rates we

pay to our depositors

to avoid losing deposits

and to procure new

ones. Rising interest rates

have also led customers

to move their funds to alternative investments that

pay higher interest rates.

Additionally, periods of market stress

or lack of market

or customer confidence in financial institutions may result in

a loss of customer deposits, especially to the

extent those deposits are

in excess of the FDIC-insured limit of $250,000. As of

December 31, 2023, we had $14.6 billion of deposits (other

than collateralized

public funds, which represent public deposit balances from governmental entities in the U.S. and its territories, including Puerto Rico

and the United States Virgin Islands, that are collateralized based on such jurisdictions’

applicable collateral requirements) in excess

of the FDIC-insured limit. As deposits decrease, we

may need to rely on more

expensive sources of funding. Furthermore, we have

a

amount

of

from

the

Puerto

Rico

its

and

($18.1

or

approximately 28% of our

total deposits, as of

December 31, 2023), and

the amount of these

deposits may fluctuate depending on

liquidity of

these entities,

as well

as on

these customer

relationships. Under

the

terms of

BPPR’s deposit

pricing agreement

with Puerto

Rico public

sector,

public fund

deposit rates

are market

linked with

a lag

minus a

specified spread.

Therefore, as

market rates

rise, we

to sequentially

rates we

pay our

public

deposits. If

we are unable

to maintain or

grow our deposits

for any

reason, we may

paying higher funding

our net interest income may decrease.

OPERATIONAL RISKS

We

and our

third-party providers

have been,

and expect

in the

future to

be, subject

to cyber-attacks,

which

could cause substantial harm and have an adverse

effect on our business and results of operations.

risks

for

large

such

as

Popular

have

in

recent

years

in

part

because of

the proliferation

of new

technologies, such

as mobile

banking, artificial

intelligence and

to conduct

instant

financial transactions anywhere

globally, growing

geo-political threats, such

as the ongoing

wars in Ukraine

and in the

Gaza Strip,

and the increased sophistication and activities of

organized crime, hackers, terrorists, nation-states, hacktivists and other parties. In

the ordinary

course of

business, we

rely on

electronic communications

and information

systems to

conduct our

to

transmit

and

store

sensitive

data.

We

employ

a

layered

defensive approach

that

employs

people, processes

and

to

manage and

maintain cybersecurity

controls through

a variety

of preventative

and detective

tools that

monitor, block,

and provide

alerts

regarding suspicious

and

identify suspected

advanced persistent

threats.

Notwithstanding our

defensive measures

and

the

we

devote

to

protect

the

of

our

there

is

no

that

all

of

our

measures will be effective at all times, especially as the threats from cyber-attacks are continuous and severe. The risk of a security

breach due

to a

cyber-attack could

the future

as we

expand our

mobile banking

internet-based

product

offerings,

the

use

of

the

cloud

for

system

and

hosting

and

use

of

internet-based

and

We

detect and

identify attacks

becoming more

sophisticated and

increasing in

volume, as

well as

attackers

that

respond

rapidly

to

changes

in

defensive

countermeasures. The

most

risks

that

we

or

our

critical service providers may face include, but are not limited to,

e-fraud, denial-of-service (DDoS), ransomware, computer intrusion

and

the

exploitation of

software zero-day

vulnerabilities that

might result

in

disruption of

and in

the

exposure or

loss of

or

proprietary

data.

Loss

from

e-fraud

occurs

when

cybercriminals

our

systems

or

the

systems

of

our

customers and extract

funds from customer’s

credit cards or

bank accounts, including

through brute force,

password spraying and

credential

stuffing

attacks

directed

at

gaining

unauthorized

access

to

accounts.

Denial-of-service

attacks

intentionally

disrupt

the

ability

of

legitimate

users,

and

to

access

networks,

websites

and

online

resources.

Computer intrusion attempts either direct or through social engineering (pretext calls), supply chain compromise, email, text or voice

messages, including using brand impersonation (regularly referred

to as phishing, vishing, smishing

and quishing), have resulted in

and may continue to result in the compromise of sensitive customer data, such as account numbers, credit cards and social security

numbers,

and

could

present

reputational, legal

and

regulatory costs

to

Popular

if

successful.

The

emergence of

new

technologies such as artificial intelligence and quantum

computing are further expected to exacerbate

the risk of cyber-attacks.

Our

customer-facing

platforms

are

also

routinely

attacked

by

threat

actors

aiming

to

gain

unauthorized

access

to

our

clients’ accounts.

recently implemented

certain defensive

measures in

response to

brute force

attacks on

one of

our

platforms which resulted in certain

of our customers log-in credentials

and information being exposed. As

a result, Popular notified,

as required

or otherwise

deemed appropriate,

customers identified

as affected

by the

incident. We

have to

date not

experienced

material losses in connection with these attacks. Cyber-security risks have also been recently exacerbated by the discovery of zero-

day vulnerabilities in widely distributed third party software,

such as the vulnerability identified in the Apache

log4j in December 2021

and in the MOVEit file transfer application in

May 2023, which could affect Popular’s or any

of its service provider’s systems.

The

use

of

remote

access

and

video

conferencing

solutions

to

enable

work-from-home

arrangements for employees and facilitate

the use of digital

channels by our customers,

has also increased our

exposure to cyber-

attacks. In

addition, a

third party

could misappropriate

confidential information

obtained by

intercepting signals

or communications

from mobile devices

used by Popular’s customers

or employees. Recent events,

including the wars

in Ukraine and

the Gaza Strip,

illustrated increased

geo-political factors

and the

risks related

to supply-chain

compromises and

de-stabilizing activities

linked to

nation-state sponsored

activity as

an increasing

trend to

monitor actively.

Risks and

exposures related

to cyber

attacks are expected to remain high for the foreseeable future due to

the rapidly evolving nature and sophistication of these threats,

including the

rise in

the use

of cyber-attacks

as geopolitical

weapons. Although

we are

regularly targeted

by unauthorized

threat-

actor activity, including denial-of-service attacks, we have not, to date, experienced

any material losses as a result of cyber-attacks.

A material compromise or circumvention of the security of our systems could

have serious negative consequences for us,

of

our

and

those

of

our

and

counterparties,

misappropriation

of

confidential information

of us

or that

of our

clients, customers,

counterparties or

employees, or

damage to

computers or

systems

used

by

us

or

by

our

and

counterparties,

and

could

result

in

violations

of

privacy

and

other

laws,

financial loss

to us

or to

our customers,

loss of

confidence in

our security

measures, customer

dissatisfaction, significant litigation

exposure and harm to

our reputation, all of

which could have a

material adverse effect

on us. For example,

if personal, non-public,

confidential

or

proprietary

in

our

possession

were

to

be

mishandled,

misused

or

stolen,

we

could

suffer

regulatory consequences, reputational damage

and financial loss.

Such mishandling, misuse

or misappropriation could include,

for

example, if such information

were provided to parties

who are not permitted

to have the

information, either by fault

of our systems,

by our employees

or counterparties, or

where such information

is intercepted or

otherwise inappropriately taken by

our employees

or third parties.

The

extent

of

a

particular

and

the

steps

that

we

may

need

to

take

to

investigate

the

attack

may

not

be

immediately

clear,

and

it

may

take

a

amount

of

time

before

such

an

investigation

can

be

completed.

While

such

an

investigation is ongoing, Popular may not necessarily know the full extent

of the harm caused by the cyber-attack, and that

damage

may continue to spread.

These factors may inhibit

our ability to provide

rapid, full and reliable

information about the cyber-attack to

our clients,

customers, counterparties

and regulators,

as well

as the

public. Moreover,

new regulations may

require us

to disclose

information about a cybersecurity event before

it has been resolved or

fully investigated. Furthermore, it may not

be clear how best

to

contain

and

remediate

the

harm

caused

by

the

cyber-attack,

and

certain

errors

or

actions

could

be

repeated

or

compounded before they are discovered and remediated. Cyber-attacks could cause interruptions

in our operations and result in the

incurrence

of

costs,

including those

related

to

forensic analysis

and

legal counsel,

each of

which may

be

ascertain the extent

of any potential

harm to our

customers, or employees, or

damage to our information

systems and any

legal or

regulatory obligations that

may result therefrom.

Any cyber incidents

could also result

in, among other

things, increased regulatory

scrutiny

and adverse

regulatory or

civil

litigation consequences.

For a

discussion of

the guidance

and rules

that federal

banking

have

released

or

and

cyber

risk

see

“Regulation

and

Supervision” in

Part

I,

Item

1 —

the

for the

year

31,

2023. Any

or

all

of

the

foregoing factors could further increase the impact

of the incident and thereby the costs and consequences

of a cyber-attack.

We also

rely on

for the

our information

technology functions and

the

provision of information security,

technology and business process services. As a result, a

successful compromise or circumvention

of

the security

of

the systems

providers could

have serious

negative consequences

for us,

of

our

misappropriation of

our

confidential

or

that

of

our

customers,

or

or

other

implications

identified

above

with

respect

to

a

on

our

which

could

have

a

on

us.

Cyber-attacks at

are

also

becoming increasingly

common,

and,

as

a

result, cybersecurity risks relating to our vendors have

increased. The most important of these third-party service providers

for us is

Evertec. Certain risks particular to Evertec and

our dependence on third parties are discussed

under “We rely on other companies to

provide key components of our business infrastructure, including certain of our core financial transaction processing and information

security services, which

exposes us

to a

number of operational

risks that

on

us”

in

the

Risks

section

of

Item

1A

in

this

Form

10-K.

During

2021,

we

that,

as

a

result

of

the

widely

reported breach of

Accellion, Inc.’s File

Transfer Appliance tool,

which was being

used at the time

of such breach

by a U.S.-based

third-party advisory services vendor of

Popular, personal information of

certain Popular customers was compromised. During

2023,

personal information of Popular customer data was compromised in a data breach incident that impacted MOVEit, the third-party file

transfer

platform

used

by

one

of

our

providers.

In

both

instances,

Popular

notified,

as

or

deemed

appropriate, customers identified

as affected

by the incident.

Although these incidents

did not have

a material effect

on Popular or

its financial condition,

our networks and

systems were not

impacted, and our third-party

service providers agreed to

cover external

remediation

costs

therewith,

a

of

the

of

our

by

third

party

vendors

could

result

in

consequences,

damage

and

loss

to

us.The

success

of

our

business depends

in part

on the

continuing ability

(and other)

to perform

these functions

and services

in a

timely

and

satisfactory

manner,

which

could

be

disrupted

or

due

to

failures

or

other

information security

events originating at

the third

parties or at

the third parties’

suppliers or vendors

(so-called “fourth party

risk”).

We

may

not

be

able

to

monitor

or

mitigate

fourth-party

risk,

in

particular

as

it

relates

to

the

use

of

common

suppliers or vendors by the third parties that perform

functions and services for us.

As

cyber

threats

to

evolve,

we

expect

to

expend

to

to

modify

or

enhance our

layers of

defense or

to investigate

and remediate

security vulnerabilities

or incidents.

System

enhancements and

updates also

create risks

implementing new

systems and

integrating them

with existing

ones,

including risks associated with supply chain compromises

and the software development lifecycle of the

systems used by us and our

service providers. Due

to the complexity

and interconnectedness of information

technology systems, the

process of enhancing

our

layers

of

defense can

itself

create

a

risk

of

systems

and

issues.

In

addressing

certain

security vulnerabilities, such as

hardware-based vulnerabilities, may affect

the performance of our

information technology systems.

The ability of our

hardware and software providers to deliver

patches and updates to mitigate vulnerabilities

in a timely manner

can

introduce additional risks, particularly when a vulnerability is being actively exploited by threat actors. Moreover,

our efforts to timely

mitigate vulnerabilities and

manage such risks,

given the rise

in number and

urgency of

required patches and

third-party software,

including “zero-day vulnerabilities”, as

well as the obsolescence

in some of our

hardware and software, may

impact our day-to-day

the

availability

of

our

systems

and

delay

the

deployment

of

and

innovation.

The

obsolescence in any of our hardware or

software may limit our ability to mitigate vulnerabilities.

If Popular’s operational systems,

or those of

external parties on which

Popular’s businesses depend, are

unable to meet

the requirements of our

businesses and operations or bank

regulatory standards, or if they

fail, have other significant

shortcomings

or are impacted by cyber-attacks, Popular could

be materially and adversely affected.

Unforeseen or

catastrophic events,

extreme weather

events and

other natural

disasters, man-made

acts of violence or

war, or the

emergence of pandemics or epidemics, could

cause a disruption in our

operations or other

consequences that could have a material adverse

effect on our financial condition and results

A

portion

of

our

are

located

in

the

Caribbean

and

Florida,

a

region

susceptible

to

earthquakes and other

similar events. In

2017, Puerto Rico,

USVI and BVI

were severely impacted

by Hurricanes Irma

and María,

which resulted in significant disruption to our operations and adversely affected

our clients in these markets, and in 2022, Hurricane

Fiona impacted the

southwest area of

adversely affecting our

customers in

that region. Other

types of

unforeseen or

catastrophic events, including

pandemics, epidemics, man-made

disasters, or acts

of violence or

war, or

the fear that

such events

could

occur,

could

also

impact

our

and

results.

For

in

2020,

the

pandemic

severely

global

health,

spending

and

global

and

caused

to

businesses worldwide,

our

and

those

of

our

customers, service

and

suppliers.

Future

unforeseen or

catastrophic events,

including new

pandemic events, and

actions taken

by governmental authorities

and other third

parties in

response to such

events, could again

our operations, cause

economic and market

disruption, adversely

impact the ability of borrowers to

timely repay their loans, or affect

the value of any collateral

held by us, any of which

could have a

effect on

or results

The frequency,

severity and

future

unforeseen or catastrophic events is difficult to