POPULAR, INC.

PART I POPULAR, INC.

General:

Popular

is

a diversified,

publicly-owned financial

holding company,

registered under

Holding Company

Act

of

1956, as

amended (the “BHC Act”), and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the

“Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the

largest

financial institution

based in Puerto

Rico, with

consolidated assets of

$75.3 billion, total

deposits of

$66.2 billion

and stockholders’

equity of $6.2 billion at

December 31, 2025. At December 31,

2025, we ranked among the

50 largest U.S. bank holding companies

based on total assets according to information gathered

and disclosed by the Federal Reserve Board.

We operate in two principal markets:

●

Puerto

Rico:

We

provide

retail,

and

banking

as

well

as

auto

and

leasing

and

financing through

our principal

banking subsidiary,

Rico (“Banco

Popular” or

“BPPR”), and

broker-

dealer

and

through

are

insured

under

the

Deposit

Fund (“DIF”)

of the

Federal Deposit

Insurance Corporation

(“FDIC”). The

banking operations

of BPPR

are primarily

based in

Puerto Rico, where BPPR has the largest retail banking

franchise.

●

Mainland

United

States:

We

provide

retail

and

banking

as

well

as

leasing

and

through our New York

-chartered banking subsidiary,

Popular Bank (“PB” or

“Popular U.S.”), which has branches

in New York,

New Jersey,

and Florida. PB’s deposits are insured under the DIF

of the FDIC.

●

BPPR

also

banking

in

the

U.S.

Virgin

the

British

Virgin

Islands

and

New

York.

In

to

BPPR’s commercial

banking operations

in New

York

that include

direct loan

origination and

participating loans

PB,

BPPR

offers

or

holds

on

a

national

scale

in

the

U.S.

market,

loans

previously

originated under

the E-Loan

brand, purchased

personal loans

third parties,

and

gathering insured

institutional

deposits via online deposit gathering platforms. In the U.S. and British

Virgin Islands, BPPR offers a range of banking products,

including loans and deposits to both retail and

commercial customers.

For further information about the Corporation’s results segregated by

its reportable segments, see “Reportable Segment Results” in

the Management’s Discussion

and Analysis of

Financial Condition and Results

of Operations section (“MD&A”)

and Note 36

to the

Consolidated Financial Statements included in this

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial. Commercial loans are comprised of (i) commercial and industrial (“C&I”) loans and leases to commercial

for use in normal

business operations and to finance

working capital needs, equipment purchases or

other projects, (ii) commercial

real

estate

(“CRE”)

loans

(excluding

loans)

for

income-producing real

estate

as

well

as

owner-occupied

properties, and

(iii) multifamily loans

with residential buildings

with five

or more living

units. C&I loans

are underwritten individually

and usually secured with the assets of the company and

the personal guarantee of the business owners. CRE

loans consist of loans

for income-producing

properties and

the financing

of owner-occupied

facilities if

there is

as collateral.

Non-

owner-occupied CRE

generally made

to finance

office and

industrial buildings,

healthcare facilities,

and retail

shopping

centers and are

repaid through cash

flows related to

the operation, sale

or refinancing of

the property.

Multifamily loans, in

certain

cases, result from the conversion of the

Bank’s construction financing to permanent financing and are repaid

through the cash flow,

sale or refinance of the properties.

(2) Mortgage. Mortgage

loans include residential

mortgage loans to

consumers for the

purchase or refinancing

of a

residence and

also include residential construction loans made

to individuals for the construction of refurbishment

of their residence.

(3) Consumer.

Consumer loans

are mainly

comprised of

unsecured personal

loans, credit

cards, and

automobile loans,

and to

a

lesser extent home equity lines of credit (“HELOCs”)

and other loans made by banks to individual

borrowers.

(4)

Construction.

loans

are

CRE

loans

to

or

developers

used

for

the

of

a

or

residential property for which repayment will be generated by the sale

or permanent financing of the property.

Our construction loan

portfolio primarily consists of residential land development,

multifamily housing, and condominium projects.

(5) Lease Financings. Lease financings are offered by

BPPR and are primarily comprised of automobile loans/leases made through

automotive dealerships.

Business Concentration

Since our

business activities

are currently concentrated

primarily in

our results

of operations

condition are dependent upon the general trends of

the Puerto Rico economy and, in particular,

the residential and commercial real

estate markets. The concentration of our

operations in Puerto Rico exposes us

to greater risk than other

banking companies with a

wider

base.

Our

asset

and

revenue

composition

by

geographical

area

is

in

Note

to

the

Financial Statements included in this Form 10-K.

Our loan portfolio is diversified by loan category.

However, 52% of our loan portfolio at

December 31, 2025 consisted of real estate-

related loans,

including residential

mortgage loans,

construction loans

loans secured

by commercial

real estate.

The table below presents the distribution of

our loan portfolio by loan category at December

31, 2025.

Loan category

BPPR

%

PB

%

POPULAR

%

$303

$2,152

$2,455

3,395

2,148

5,543

1,197

1,957

3,154

5,970

2,637

8,607

1,317

1,675

7,348

1,301

8,649

Leasing

2,001

2,001

1,257

1,257

1,836

1,906

Auto

3,820

3,820

Other

Total

$27,659

$11,668

$39,327

Except for the Corporation’s exposure to the Puerto Rico and U.S. Governments, no individual or single group of related accounts is

considered material

in relation

to our

or deposits,

or in

relation to

our overall

For a

discussion of

our loan,

investment,

and

and

our

to

the

of

Puerto

Rico,

see

“Financial

–

Loans”,

“Financial Condition – Deposits” and “Credit Risk – Geographical and Government Risk” in the MD&A and to Note 23 - Commitment

and Contingencies to the Consolidated Financial Statements

included in this Form 10-K.

Credit

Administration

and

Credit

Policies

from our

loan portfolios

is our

of revenue.

Whenever we

make loans,

we expose

ourselves

to

credit

risk.

Credit

risk

is

controlled

and

monitored

through

active

asset

quality

the

use

of

lending

thorough

review

of

and through

active

asset quality

administration.

that

expose

us to

credit

risk are

managed

within

the

Board

of Director’s

Risk Management policy,

and the Credit Risk Tolerance

Limits policy,

which establishes

limits

that

factors

such

as maintainin

g

a prudent

balance

of risk-taking

across

diversified

risk types

units,

with regulator

y

guidance,

and

controlling

the

to lower

credit

quality

assets.

We maintain

credit policies

for all lines of

business in order

to mitigate credit

risk. Our credit

are

approved by

our Board

of Directors.

These policies set

forth,

among

other

things,

the objectives, scope and

responsibilities of the

credit

management cycle.

Our

written

and

for

and

loan

quality

and

require

prompt

identificatio

n

and

quantificatio

n

of

asset

quality

deterioration

or

loss

to provide for the adequacy of the allowance for credit losses. These written procedures establish various approval and lending

limit levels,

ranging

from

bank

branch

or departmen

t

to managerial

and senior

levels.

Approval

levels

are

by the

amount, type

of loan and

risk characteristics

of the credit

facility.

Our

credit

and

documentation

for

each

loan

and

related

type,

when

applicable,

during

the

underwriting,

closing

and

phases.

For

and

loans,

during

the

initial

loan

process,

the

credit

require,

at

a

minimum,

or

tax

returns

of

the

borrower,

an analysis

contained

in

a

credit

package,

a

risk

rating

and

reports

from

credit

and appraisal

s

for

real

estate-related

loans when applicable

.

The credit

also

set

forth

the

closing

documentation

depending

on the

loan

and the

type.

we originate

most

of our

loans

in both

Rico

and mainland

United

States

we

occasionally

or participate

in loans

by other

institutions.

When we

or participate

in loans

others, we ensure

that those loans

meet our underwriting

standards and

are consistent

with our risk

appetite.

Refer

to

the

Credit

Risk

section

of

the

MD&A

in

this

Form

10-K

for

related

to

committees and divisions with responsibilities for establishing

policies and monitoring the Corporation’s credit risk.

Loan

extensions

,

and restructurings

Loans with

satisfactory

credit profiles

can be

extended, renewed

or restructured

.

Some commercia

l

loan facilities

are

structured

as lines

of credit, which

are mainly

one year

in term

and therefore

to be renewed

annually.

Other

may be restructure

d

or extended

from time

to time based

upon changes

in the

borrower’s

needs,

use

of

funds,

timing

of

completion

of

projects

and

other

factors.

If

the

is

not

deemed

to

have

,

extensions,

and restructurings

are done

in the

normal

course

of busines

s

and the

loans

to be recorde

d

as performing.

We

various

factors

to

if

a

is

difficulties.

Indicators

that

the

is

financial difficultie

s

include,

for example:

(i)

the borrower

in default on any

of its debt

or it is

probable tha

t

the borrower

in payment

default on

any of

its debt

in th

e

foreseeable

future

without

the modification

;

(ii)

the

has declare

d

or is in

the

process

of declarin

g

bankruptcy;

(iii)

there

is significan

t

doubt

as to whether

the

will

to

be

a

going

concern;

(iv)

the

has

that

have

been

delisted,

are

in

the

process

of

being

delisted,

or

are

under threa

t

of bein

g

delisted

from

an exchange

;

(v) based

on estimates

and projection

s

that

only

encompass

the

current

,

the

forecasts

that

its

entity-specifi

c

cash

flows

will

be

insufficien

t

to

service

the

debt

(both

and

principal)

in

with

the

terms

of

the

through

maturity;

and

(vi)

absent

the

current

modification,

the

cannot

obtain

funds

from

sources

other

than

the

creditors

at

an

rate

equal to the current market

rate for similar

debt for a non-troubled

debtor.

We

have

workout

who

handle

the majority

of

loans

that

are

past

due

days

and

over,

,

and loans

that

are considered

problem loans

their risk

profile. As

a

general

policy,

we

do

not

advance

money

to

who

have

loans

that

are

days

past

due

or

over.

In

and

loans,

certain

exceptions

may

be approved

under

certain

circumstances,

(i) when

past

due

status

is administrativ

e

in nature,

such

as expiration

of a loan

facility

before

the

new documentatio

n

is executed,

and not as

a result

of paymen

t

or credit

issues;

(ii) to

improve

our collateral

or

maximize

or

future

losses;

and

(iii)

with

respect

to

certain

that,

although

related

through

common

ownership,

are

not

cross

nor

cross-collateralized

and

are

satisfactorily

under

their

loan

Such

are

underwritten

and

our

credit

policy

and

limits,

which

are

on

the

borrower’s

and guarantee,

among

others.

In addition

to the legal

lending limit

established under

state banking

law, discusse

d

in detail

below,

that

expose the

credit

risk

are managed

within

guidelines described

in the

Credit

Risk Tolerance

Limits

policy.

Limits are defined for

loss and credit

performance metrics, portfolio composition and

concentration, and industry and

name-

level,

which

lending

concentration

to

a

single

or

a

group

of

related

borrowers,

lending

limits

based

on industr

y

criteria,

such

of the

banks’

capital.

Refer to Note 2 and Note 8 to the Consolidated Financial Statements included

in this Form 10-K, for additional information

on loan modifications to borrowers with financial difficulties.

Competition

The

in

which

we

operate

is

highly

competitive.

In

Puerto

Rico,

our

primary

market,

the

banking

is

highly

with

respect

to

originatin

g

loans,

and

other

banking

Most

of

our

direct

competitio

n

for

our

and

comes

from

banks and

credit unions.

The

for

BPPR

include

locally

based

banks

and

a

few

large

U.S.

and

foreign

banks

with

operations in Puerto Rico.

We

also

compete

with

players

in th

e

local

that

are

not

subject

to

the

same

as domestic

banks

and bank holdin

g

Those

include

brokerage

firms,

automobile

and

finance

local

and

federal

credit

unions

(locally

known

as

“cooperativas”),

credit car

d

finance

institutional

lenders,

and non-financia

l

and entities.

Credit

unions

provide

basic consume

r

services and collectively

represent a

portion of the

market with

a lower cost structure

and fewer regulatory

constraints.

While our main competition continues to come from other Puerto Rico banks and financial institutions, we face increased

competition from non-Puerto

Rico institutions, as

emerging technologies and

the growth

of e-commerce have

significantly reduced

geographic barriers. These technologies have

also made it easier

for non-depositary institutions to

offer products and

services that

were

traditionally

banking

and

have

allowed

non-traditional

service

and

to

provide

electronic

and

internet-based

solutions

and

In

nonbank

firms

may

have

a

competitive advantage over

traditional banks

and bank

such as

due to factors

such as

differences in

regulation, funding models and tax treatment.

In

the

United

States

we

to

face

substantial

as

our

footprint

resides

in

the

two

large

metropolitan markets of

City /

Northern New Jersey

and the

greater Miami area.

There are a

large number

of banks in

both markets, including community, regional, and national ones, most of which

have more resources than us.

In both

and the

United States,

the primary

factors in

competing

for business

include

pricing,

convenience

of branch

locations

delivery

methods,

range of

products offered,

and the

service delivered.

We must

compete

along

all

these

parameters

to

be

successful.

We

pricing

as

some

of

our

seek

to

market

share

by

reducing

prices

for

or

the

rates

charged

on

loans,

increasing

the

rates

offered

on

or offering

more flexible

terms. Increased

could require

that we

the rates

offered

on deposits

and

lower the rates

charged on loans,

which could adversely

affect our profitability.

Economic

along

with

legislative

and

changes,

have

an

ongoing

impact

on

the

within

the financia

l

industry.

We work

to anticipat

e

and adap

t

to dynamic

whether

through developing

and marketing

innovative

adopting

or developin

g

new technologie

s

that

differentiat

e

our products

and

cross-marketing,

or

personalized

banking

We

strive

to

distinguish

ourselves

from

other

banks

and

in our

marketplace

by providin

g

a high

level

of service

loyalty

and to attrac

t

and retain

we can

provide

no assurance

as

to

the

of

these

efforts

on

our

future

or

results

of

and

as

to

our

ability

to

anticipate

and

adapt

to

changing

and

to

sufficientl

y

improve

our

and/or

banking

products,

in

order

to

successfully

compete

in

our

primary

service

areas.

Transformation Initiatives

continues

its broad-based

,

multi-year,

process transformation,

which was

launched

in

As

part

of

this

transformation,

we

are

making

in

talent

and

new

digital

and

data

our customers

with more

personalized

and accessible

and satisfaction

with more agile

work processes,

and generate sustainable

profitable growth

and value for our

shareholders.

During

2025,

the

to

make

meaningful

progress

in

the

modernization

of

our

channels

and

enhancement

of our customers'

we started

the rollout

of a commercial

cash management

solution

and

deployed

a new

credit

platform

Rico

and the

Virgin

Islands.

We

also

to

invest

in our

physical

retail

network

and

a series

of

exiting

our

U.S.

optimizing

Rico,

and transforming

our Enterprise

Resource

(ERP)

platform

to a

modern

cloud-based solution

in January 2026

.

In

with

the

transformation

the

is

working

to

achieve

a

sustainable

return

on

common

equity

(“ROTCE”)

of

14%

over

the

long

term.

The

made

progress

towards

this

goal

in

2025,

achieving 13%

ROTCE for the full

year.

Refer

to

the

Overview

section

of

Management’s

Discussion

and

Analysis

in this

Form

10-K

for

on

recent

events that have

impacted or

will impact

our current and

future operations.

Human Capital Management

Popular seeks

to embody our

values and

behaviors throughout

our human capital

management practices.

Attracting,

developing,

and retaining

top talent

in an

that promotes

wellness, inclusion,

respect, continuous

learning,

and transparency

are

fundamental

pillars of

long-term strategy.

As of December

31, 2025, Popular

employed 9,427

individuals,

none

of whom were

represented

by a collective

bargaining group.

Nurturing Well

-Being: Employee

Health & Financial

Popular

wellness

of our

is fundamental

to delivering

high-quality

service

to our

and

contributing

positively

to

the

communities

in

which

we

operate.

the

offers

a

wellness program

that includes

medical, pharmacy,

vision, and

dental insurance,

as well as additional

wellness initiatives.

Our programs

are designed

to ensure that

healthcare is

both accessible

and affordable

for our employees,

with Popular covering

up to 78%

of health

insurance premiums,

a figure that

surpasses regional

benchmarks.

In 2025,

we strengthened

our health

and

wellness

offerings

by opening

a state-of-the-art

fitness center

in our San

Juan, Puerto

Rico campus,

to encourage

an active

and

balanced

lifestyle.

As of

2025,

the fitness

center

had

a total

of 2,030

members,

active

eligible

family members

and retirees.

the

promotes

health

and

well-being

by

encouraging

annual

physical

examinations

and

a comprehensive

wellness center

at its Puerto

Rico corporate

offices, staffed

with healthcare

providers and

by

the

of

an

on-site

psychologist

to

provide

mental

health

support.

The

center

over

15,000

visits

from employees

during 2025.

Popular

also seeks

to foster

work-life

balance

by offering

paid time

off

benefits

to our

community

service

leave,

paid

parental

leave,

and

flexible

work

arrangements.

Our

hybrid

work

model,

to

half

of

our

workforce,

is

to

strike

an

balance

between

flexibility

and

needs,

reinforcing

our

commitment

to

a flexible

and

productive

work

In

we regularly

offer

and

workshops

focused

on

physical fitness

and personal financial

Popular

further

offers

a 401(k)

savings

and

plan,

in

which

98%

of

participate.

Under

the

plan,

Popular

matches

$0.50 for

every

dollar

by an

employee,

up to

8% of

the employee’s

salary.

Popular

maintains

a

profit-sharing

plan, contingent

achievement

of pre-established

goals, to

further

align employee

with

the

overall

performance.

Under

the

profit-sharing

plan,

may

receive

up

to

8%

of

their

eligible

(capped

at $70,000),

first

4% paid

in cash

and any

amount

above that

threshold

paid to

the employee’s

savings

and

plan

account.

Popular

regularly

reviews

base

to

remain

with market salaries

for comparable

positions.

Empowering Growth:

Our Commitment

to Talent

Developmen

t

We

are committed

to fostering

the continuous

and upskilling

of our

and

believe

this

is fundamental

to

maintaining

our competitive

advantage.

Towards

that end,

Popular

offers

to strengthen

our

knowledge,

and

skills,

supporting

their

growth

while

and organizational

effectiveness.

Our 40,000

square foot

center in

San Juan,

and our satellite

in New York,

South Florida,

and

the

Virgin

offer

year-round

sessions,

and

workshops.

In

2025,

there

were

6,700

participations

in corporate

academy

voluntary

courses,

new

orientations,

health

coordinator

certifications,

and

manager

onboarding

programs—an

of

2,500

to

the

levels

in

These

courses

offer

instructor-led

experiences

for

to

develop

and

apply

core

and

technical

skills.

Our

commitment

to

continuous

is

further

supported

through

access

to

LinkedIn

Learning,

which

an

extensive

library

of

over

16,000

e-learning

courses,

enabling

to

pursue

self-directed

aligned

with

both

professional

development goals

needs.

Our

focus

on

and

has

growth

for

our

workforce.

As

a

result,

the

mobility

rate in

2025 was

47%, reflecting

who applied

for or

were selected

for open

promotions,

or made

lateral

moves

within

the

organization.

we continued

strengthening

key skills

across

accelerated

focused

on

data

science,

agile

methodologies,

analytics,

process

efficiency,

and

product

During

2025,

in these

programs,

further

the

talent.

During

2025,

Popular

successfully

the Executive

Development

Program,

engaging

over

80 executive

leaders

in a

initiative

focused

on strengthening

key

behaviors,

agility,

accountability,

collaboration,

and leadership

mindset,

aligned

with

our

company

values.

In

we

introduced

the

Middle

Development

Program,

a two-

year

journey

for

over

1,700

leaders

to

reinforce

alignment

with

the

values

and

behaviors

while

fostering

sustainable

transformation.

we provided

our

leaders

with

advanced

tools

to support more

effective and

impactful performance

discussions.

Our

was

crucial

in

advancing

through

assessments,

team

integration

new

manager

integration

facilitations,

and

team

alignment

sessions.

These

efforts

are

to

foster

a

cohesive,

agile,

and

adaptable

workforce

capable

of

supporting

the

business objectives.

Enhancing Leadership

Continuity through

Strategic Succession

integrates

to

ensure

and

orderly

leadership

transitions.

Succession

plans

for senior

are

by the

Chief

Officer

and

to the

Board

of Directors.

also

leverages

our

Talent

Program

to

high-potential

and

high-performing

managers,

them

with

to

enhance

their

skills

and

prepare

them

for

future

senior

management positions.

Employee Experience

Popular

is

committed

to

an

exceptional

that

inspires

our

to

deliver

service

to

our

and

communities.

We

recognize

the

nature

of

our

needs

and

and

have

a

robust

approach

to

and

understanding

their

journey.

Our

engagement

and

survey

program

biannual

pulse surveys,

an annual

enterprise-wide

survey,

and additional

surveys

that assess

the end

-to-end

journey.

We believe

that these

insights

to our

ability

to maintain

a stable

turnover

rate of

8.5%

as

of

the

end

of

our

employee-experience

efforts

are

in

record

rate

of

77%

and

a

sustained

employee-loyalty

score of

81%, positioning

us above

the 50th

percentile

of the Qualtrics

global benchmark

and above

services industry

average benchmark.

Board Oversight

in Human Capital

The

Talent

and

of

the

Board

of

Directors

has

responsibility

for

the

human

capital

practices.

As

part

of

its

responsibilities,

the

Talent

and

reviews

and

advises

on

the

overall

philosophy,

and

and

on

the

talent

and

workforce

engagement,

planning,

and

culture,

among

other human capital

We

you

to

review

our Corporate

Sustainability

Report

published

on www.popular.com

for more

human capital

and initiatives.

The information

on the

the

Sustainability

Report,

is

not,

and

will

not

be

deemed

to

be,

a

part

of

this

Form

10-K

or

incorporated

into any of the

filings with

the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America

(“PNA”)

and

their

Such

laws

and

are

continually

under

review

by

and

state

legislatures

and

federal

and

state

agencies.

Any

change

in

the

laws

and

to

Popular

and

its

subsidiaries could have a material effect on the

business of Popular and its subsidiaries. We will continue to

assess our businesses

and risk management and compliance practices

to conform to developments in the regulatory

General

Popular and PNA are bank holding companies subject to consolidated supervision and

regulation by the Federal Reserve

Board under

Holding Company Act

of 1956

(as amended, the

“BHC Act”). BPPR

and PB

are subject to

supervision and

examination by applicable

federal and state

banking agencies including,

in the

case of BPPR,

the Federal Reserve

Board and the

the Commissioner

of Financial

Institutions of

(the “Office

of the

Commissioner”), and, in

the case

of PB,

the

Federal

Reserve

Board

and

the

New

York

State

of

Services

(the

“NYSDFS”).

broker-dealer

/

investment adviser

Popular Securities,

LLC (“PS”)

and investment

adviser subsidiary

Popular Asset

Management LLC

(“PAM”)

to

regulation by

the SEC,

the Financial

Industry

Regulatory Authority

(“FINRA”), and

the Securities

Investor

Protection Corporation, among others. Other of our non-bank subsidiaries conduct reinsurance and

insurance producer and agency

activities, which are

subject to other

federal, state and

Puerto Rico laws

and regulations as

well as licensing

and regulation by

the

Puerto Rico Office of the Commissioner of Insurance and,

for one insurance agency subsidiary, the NYSDFS.

Enhanced Prudential Standards

Under

the

Dodd-Frank

Wall

Street

Reform

and

Protection

Act

(the

“Dodd-Frank

Act”),

as

by

the

Economic

Growth,

Regulatory

Relief,

and

Protection

Act

and

the

federal

banking

regulators’

“Tailoring

Rules,”

banking

organizations are

categorized based

on status

as

a U.S.

G-SIB,

size

and four

other risk-based

indicators. Among

bank

holding companies with $100

billion or more in

total consolidated assets, the

most stringent standards apply

to U.S. G-SIBs,

which

are subject to Category I standards,

and the least stringent standards apply to Category IV organizations, which have between $100

billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and

which are also

not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk

management requirements. As of December 31, 2025,

Popular had total consolidated assets of $75.3 billion.

Transactions with Affiliates

BPPR

and

PB

are

subject

to

that

limit

the

amount

of

extensions

of

credit

and

certain

other

“covered

transactions” (as defined in Section

23A of the Federal

Reserve Act) between BPPR or

PB, on the

one hand, and Popular,

PNA or

any

of

our

other

on

the

other

hand,

and

that

impose

collateralization

on

such

credit

extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that

affiliate would exceed 10% of

the bank’s capital stock and

surplus or the aggregate amount of

the bank’s covered transactions with

all non-bank affiliates would exceed 20%

of the bank’s capital stock and

surplus. In addition, any transaction between BPPR

or PB,

on the one

hand, and Popular,

PNA or any

of our other

non-banking subsidiaries, on

the other,

is required to

be carried out

on an

arm’s length basis.

Source of Financial Strength

The

Dodd-Frank Act

requires bank

such

as Popular

and

PNA, to

act

as

a source

of

and

managerial strength to their subsidiary banks. Popular

and PNA are expected to commit resources

to support their subsidiary banks,

including at times when Popular

and PNA may not be

in a financial position to

provide such resources. Any capital loans

by a bank

to any

of its

subsidiary depository

institutions are

subordinated in

right of

payment to

depositors and

other indebtedness of such subsidiary depository institution. In the

event of a bank holding company’s bankruptcy,

any commitment

by

the

bank

holding

company

to

a

federal

banking

agency

to

the

capital

of

a

will

be

assumed by

the bankruptcy

trustee and

entitled to

a priority

of payment.

PB are

currently the

only insured

institution subsidiaries of Popular and PNA.

Resolution Planning and Resolution-Related Requirements

A

bank holding

company with

$250 billion

or more

in total

consolidated assets

(or that

is a

Category III

firm based

on

certain risk-based indicators described in the Tailoring

Rules) is required to report periodically to the FDIC

and the Federal Reserve

Board

such

plan

for

its

rapid

and

orderly

in

the

event

of

distress

or

failure.

In

insured depository institutions with total

assets of $50 billion or

more are required to

submit to the FDIC

periodic contingency plans

for

in

the

event

of

the

failure.

In

June

2024,

the

FDIC

finalized

to

the

requirements for insured depository institutions with

$50 billion or more in

total assets. The amendments require insured

institutions with

between $50

billion and $100

assets to submit

informational filings on

a three-year cycle,

with an

interim

supplement updating key information submitted in the off years. These amendments

became effective October 1, 2024, and BPPR’s

first submission under the new rule is due by

April 1, 2026.

On August

29, 2023,

Reserve Board,

FDIC and

the Comptroller

of the

Currency (“OCC”)

issued a

rule

that

would

require

bank

holding

and

insured

with

$100

billion

or

more

in

consolidated assets (as well as their insured depository institution affiliates) to maintain minimum

amounts of eligible long-term debt

(generally, debt

that is unsecured, has

a maturity greater than one

year from issuance and satisfies

additional criteria), subject to a

three-year phase-in

period. The

proposal would

also apply

“clean holding

company” requirements

to Category

II through

IV bank

which would,

things, prohibit

those holding

companies from

entering into

derivatives and

certain

contracts with

third parties.

As of

2025, Popular,

PNA, BPPR

and PB’s

were below

the

thresholds for applicability

of these rules,

except that BPPR

is subject to

the FDIC’s resolution

planning requirements applicable to

insured depository institutions with more than $50

billion but less than $100 billion in assets.

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of

the

FDIC,

and

BPPR

and

PB

are

subject

to

FDIC

deposit

assessments

to

the

DIF.

Deposit

assessments are

the average

consolidated total

the insured

depository institution

minus the

average tangible

equity of the institution during the assessment period. For larger

depository institutions with over $10 billion in assets,

such as BPPR

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among

other measures, that seeks to capture

both the probability that an individual large institution will

fail and the magnitude of the impact on the DIF

if such a failure occurs. The

FDIC has the ability

to make discretionary adjustments to the

total score based upon significant

risk factors that are not

captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30

basis

points

on

an

annualized

basis.

Taking

into

account the

adjustments the

FDIC

may

make

to

the

base

rate,

the

total

base

assessment rate could range from 1.5 to 40 basis points

on an annualized basis.

In

October

2022,

the

FDIC

finalized

a

rule

that

initial

base

deposit

rates

by

basis

points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the Federal Deposit Insurance Act

(“FDIA”), established

a plan

in September

2020 to

restore the

DIF reserve

ratio to

meet or

exceed the

statutory minimum

of 1.35

percent within

eight years. The

increased assessment is

intended to improve

the likelihood that

the DIF

reserve ratio would

reach

the required minimum by the statutory deadline

of September 30, 2028.

As of December 31, 2025, BPPR and

PB had a DIF average total asset

less average tangible equity assessment base of

$69 billion.

On

November 16,

2023,

the

FDIC finalized

a

rule

that

imposes

a special

assessment to

recover the

costs to

the

DIF

from

the

use,

in

March

2023,

of

the systemic

risk

exception to

the

least-cost resolution

test

FDIA

in

connection with the

receiverships of Silicon

Valley Bank

and Signature Bank.

The FDIC estimated

in approving the

rule that those

assessed losses total $16.3 billion. The rule provides

that this loss estimate will be periodically adjusted,

which will affect the amount

of

the special

assessment. Under

the rule,

base is

the

estimated uninsured

deposits that

an insured

institution reported in its Consolidated Reports of Condition and Income (“Call Report”) at December 31, 2022,

excluding the first $5

billion

in estimated

uninsured deposits.

For

a holding

company

that

has

more than

one

institution subsidiary,

such as Popular,

the $5 billion

exclusion is allocated

among the company’s

insured depository institution subsidiaries

in proportion

to each

institution’s estimated

uninsured deposits.

The special

assessments were

to be

collected at

an annual

rate of approximately 13.4 basis points per

year (3.36 basis points per quarter) over

eight quarters,

with the first assessment period

having begun

January 1,

2024. In

June 2024,

due to

the increase

in the

losses, the

FDIC announced that

it projected

that the special

assessment would be collected

for an additional

two quarters beyond the

initial eight quarter collection

period, at a

lower rate.

In December

FDIC reduced

at which

is collected,

with an

invoice payment

date of

March 30, 2026, from 3.36 basis points to

2.97 basis points,

and also reduced the collection period back

to eight quarters.

Brokered Deposits

The FDIA

and regulations

adopted thereunder

restrict the

use of

and the

rate of

interest payable

on

deposits for institutions

that are less

than well capitalized.

Popular does not

believe the brokered

deposits regulations have

had or

will have a material effect on the funding or liquidity

of BPPR and PB.

Capital Adequacy

Popular, PNA,

BPPR and PB are

each required to comply

with applicable capital adequacy standards

established by the

federal

banking

(the

“Capital

Rules”),

which

implement

the

Basel

III

set

forth

by

the

Basel

on

Banking Supervision (the “Basel Committee”) as

well as certain provisions of the Dodd-Frank

Act.

Among other

matters, the

Capital Rules:

(i) impose

a capital

measure called

“Common Equity

Tier

1” (“CET1”)

and the

related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1

capital” instruments meeting

certain revised requirements;

and (iii) mandate

that most deductions/adjustments to

regulatory capital

measures be made

to CET1

and not to

the other components

of capital.

Under the Capital

Rules, for most

banking organizations,

the

most

common

form

of

Tier

capital

is

non-cumulative

perpetual preferred

stock

and

the

most

common form of Tier

2 capital is subordinated notes and

a portion of the

allocation for loan and lease losses,

in each case, subject

to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum

capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted

assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported

on consolidated financial statements (known

as the

“leverage ratio”).

The Capital Rules also impose

a “capital conservation buffer,”

composed entirely of CET1, on top

of these minimum risk-

asset

ratios. The

capital

buffer

is

to

absorb

losses

during

periods

of

economic stress.

Banking

with

a

ratio

of

CET1

to

risk-weighted

assets

above

the

minimum

but

below

the

capital

buffer

will

face

constraints on

dividends, equity repurchases

and compensation based

on the

the shortfall and

eligible retained

income

(that is, four

quarter trailing net income, net

of distributions and tax effects

not reflected in net

income). Popular, BPPR

and PB are

therefore required to maintain such additional capital

conservation buffer of 2.5% of CET1,

effectively resulting in minimum ratios of

(i) CET1

7%, (ii)

Tier

8.5%, and

(iii) Total

capital to

risk-weighted assets of at least 10.5%.

to

the

Capital

Rules,

the

effects

of

certain

accumulated other

comprehensive income

or

loss

(“AOCI”)

items

included in stockholders’ equity

(for example, marks-to-market of securities

held in the available

for sale portfolio) are

not excluded

from

capital

ratios;

banking

that

are

not

subject

to

Categories

I

or

II

under

the

framework for

banking organizations

with $100

billion or

more in

assets, including

PB, may

make a

one-time

permanent election to continue to

exclude these items. Popular,

BPPR and PB have

made this election in order

to avoid significant

variations in

of capital

depending upon

rate fluctuations

on the

of their

available for

sale

securities portfolios.

On July

27, 2023,

banking regulators

proposed revisions

to the

Capital Rules

to implement

the

Basel Committee’s 2017 standards, described

below, and make

other changes to the

Capital Rules, including the ability

of banking

organizations in Categories III and IV to elect not to recognize most elements of AOCI in regulatory capital. The proposal introduces

revised credit risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes.

However, the

revised capital requirements

of the

proposed rule would

not apply

to Popular,

BPPR, or

PB because

they have

less

than $100 billion in total consolidated assets and trading

assets and liabilities below the threshold for market risk requirements. The

federal

banking

regulators have

subsequently indicated

that

they

issue

a

revised

proposal, the

timing

and contents

of

which are uncertain.

The

Capital

Rules

preclude certain

hybrid

securities, such

as

trust

securities, from

inclusion

in

bank

holding

companies’

Tier

capital.

Trust

not

in

Tier

capital

may

nonetheless

be

as

a

component of

Tier 2 capital.

Popular has

not issued

any trust

preferred securities since

May 19,

2010. As

of December

Popular has

$193 million

of trust

preferred securities

outstanding which

no longer

Tier

treatment, but

instead

qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions

from and adjustments to CET1.

Banking organizations that are

not subject to Category

I or II standards

are subject to rules that

provide for simplified capital requirements relating

to the threshold

deductions

for

certain

assets,

tax

assets,

in

the

capital

of

unconsolidated

institutions and inclusion of minority interests

in regulatory capital.

Failure

to

meet

capital

could

subject

Popular

and

its

to

a

variety

of

enforcement remedies, including the termination of deposit insurance by the FDIC

and to certain restrictions on our business. Refer

to “Prompt Corrective Action” below for further

discussion.

In

December 2017,

the Basel

Committee published

standards that

it

described as

the finalization

of the

post-

crisis regulatory

reforms. Among other

things, these

standards revise

the Basel

Committee’s standardized approach

risk

by

recalibrating

risk

weights

and

introducing

new

capital

for

certain

“unconditionally

cancellable

commitments,” such

as

unused credit

card

lines of

credit) and

provide

a new

standardized approach

for operational

risk capital.

Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to Category I and Category II

banking organizations and not to Popular, BPPR and PB.

In 2020, federal bank regulators adopted a rule

that allowed banking organizations to elect to delay

temporarily the

estimated effects of adopting the Current Expected Credit

Loss (“CECL”) model of ASU 2016-13 on regulatory

capital until January

2022 and subsequently to phase in the effects through

January 2025. The Corporation’s capital ratios

at December 31, 2025 reflect

the full phased in impact from the adoption of CECL.

in this

Form 10-K.,

Note 20

and Table

10 of

Management’s Discussion

and Analysis for the

capital ratios of Popular,

BPPR and PB

under Basel III. Refer

in this

Form 10-K Note 2 for more information regarding

CECL.

Prompt Corrective Action

The

FDIA

requires,

among

other

things,

the

federal

banking

to

take

prompt

corrective

action

in

respect

of

insured

that

do

not

meet

minimum

capital

The

FDIA

five

capital

tiers:

“well

capitalized,”

“adequately

capitalized,”

“undercapitalized,”

“significantly

undercapitalized,”

and

“critically

undercapitalized”.

A

depository institution’s capital tier will depend upon how its

capital levels compare with various relevant capital

measures and certain

other factors.

An insured

depository institution will

be deemed

to be

(i) “well

capitalized” if

has a

capital

ratio of 10.0% or greater, a CET1 capital ratio of 6.5%

or greater, a Tier 1

risk-based capital ratio of 8.0% or greater, and a leverage

ratio of 5.0% or

greater, and is

not subject to any order

or written directive by

any such regulatory authority to

meet and maintain a

specific capital level for any capital

measure; (ii) “adequately capitalized” if the institution

has a total risk-based capital ratio

of 8.0%

or greater, a

CET1 capital ratio of 4.5%

or greater, a

Tier 1 risk-based capital

ratio of 6.0% or greater,

and a leverage ratio of

4.0%

or greater

and is

not “well

capitalized”; (iii)

“undercapitalized” if

has a

that is

less than

8.0%, a CET1 capital

ratio less than 4.5%,

a Tier 1

risk-based capital ratio of

less than 6.0% or

a leverage ratio of

less than 4.0%;

(iv) “significantly

undercapitalized” if

has a

of less

than 6.0%,

a CET1

less

than 3%, a Tier

1 risk-based capital ratio of less than 4.0% or

a leverage ratio of less than 3.0%;

and (v) “critically undercapitalized”

if

the

equity

is

equal

to

or

less

than

2.0%

of

average

assets.

An

may

be

downgraded to, or deemed

to be in, a

capital category that is

lower than indicated by

its capital ratios if

it is determined to

be in an

unsafe

or

unsound

or

if

it

an

unsatisfactory

rating

with

respect

to

certain

An

insured

depository institution’s capital category is determined solely for the purpose of applying prompt corrective action

regulations, and the

capital category

may not

constitute an

accurate representation

of the

institution’s overall

or prospects

for other

purposes.

The FDIA generally prohibits an insured depository institution from making any capital

distribution (including payment of a

dividend) or

paying any

management fee to

its holding

company, if

the depository

institution would thereafter

be undercapitalized.

Undercapitalized

are

subject

to

on

from

the

Federal

Reserve

System.

In

are

subject

to

growth

and

are

to

submit

capital

plans.

A

depository institution’s

holding company must

guarantee the capital

restoration plan, up

to an

amount equal to

the lesser

of 5%

of

the

assets

at

the

time

it

becomes

or

the

amount

of

the

capital

deficiency,

when

the

institution fails to comply with the

plan. The federal banking agencies may not

accept a capital restoration plan without determining,

among other things,

that the plan

on realistic assumptions

and is

likely to succeed

in restoring the

depository institution’s

capital. If a depository institution fails to submit an

acceptable plan, it is treated as if it is

significantly undercapitalized.

Significantly

may

be

subject

to

a

number

of

and

restrictions,

including orders to

sell sufficient voting

stock to become

adequately capitalized, requirements to

reduce total assets

and cessation

of receipt

of deposits

from correspondent

banks. Critically

undercapitalized depository

institutions are

appointment of

a

receiver or conservator.

The capital-based prompt

corrective action provisions

of the FDIA

apply to

the FDIC-insured depository

institutions such

as

BPPR

and

PB,

but

they

are

not

to

holding

such

as

Popular

and

PNA,

which

control

such

institutions. As of December 31, 2025,

both BPPR and PB met the quantitative requirements

for ‘well capitalized’ status.

Restrictions on Dividends and Repurchases

The

sources

of

funding

for

Popular

and

PNA

have

from

their

banking

and

non-

banking subsidiaries, asset sales

and proceeds from

the issuance of

debt and equity.

Various statutory

provisions limit the amount

of

dividends an

institution may

pay to

its

without regulatory

approval. A

member bank

must

obtain the approval of the

Federal Reserve Board for any

dividend, if the total of

all dividends declared by the

member bank during

the calendar year would exceed the total of its net income for that year,

combined with its retained net income for the preceding two

years, after

considering those

years’ dividend

activity,

less any

required transfers to

surplus or

to a

fund for

the retirement

of any

preferred stock. During the year

ended December 31, 2025, BPPR declared

cash dividends of $575

million, a portion of

which was

used by Popular for the payments of the cash dividends on its

outstanding common stock. At December 31, 2025, BPPR needed to

obtain prior approval of the Federal Reserve Board before declaring a dividend

in excess of $191 million due to its

retained income,

declared dividend activity and transfers to statutory reserves over the three years ended December 31, 2025. In addition, a member

bank may

not declare

or pay

a dividend

in an

amount greater

than its

undivided profits

as reported

in its

Report of

Condition and

Income, unless the member bank has received the approval of

the Federal Reserve Board. A member bank also may not permit

any

portion of its permanent capital to

be withdrawn unless the withdrawal has

been approved by the Federal Reserve Board.

to

these

requirements, PB

may

not

declare

or

pay

a

dividend without

the

prior

of

the

Federal

Reserve

Board

and

the

NYSDFS.

2025, Popular

received cash

dividends of

$23 million

from Popular

International

Bank, Inc. (“PIBI”) and $22 million from its other

non-banking subsidiaries.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common

stock only out

of net

income available to

common shareholders

over the past

year and

only if

the prospective rate

of earnings retention

appears

consistent with the organization’s current and

expected future capital needs, asset quality

and overall financial condition. Moreover,

under Federal Reserve Board policy, a bank

holding company should not maintain dividend levels that place undue pressure on the

capital of depository

institution subsidiaries or that

may undermine the bank

holding company’s ability to

be a source

of strength to

its

banking subsidiaries.

policy

also

provides that

a

bank

should

inform

the

Federal

Reserve

reasonably in advance of declaring or paying a dividend that

exceeds earnings for the period for which the dividend is

being paid or

that could result in a material adverse change

to the bank holding company’s capital structure.

The

Board

also restricts

the

banking

organizations to

conduct stock

repurchases. In

certain

circumstances, a banking organization’s repurchases

of its common stock may

be subject to a

prior approval or notice requirement

under other regulations or policies of the Federal Reserve. Any redemption or

repurchase of preferred stock or subordinated debt is

subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation

organized under the

laws

of the

to

a withholding

tax

of 10%

instead of

the 30%

applied to

other “foreign”

corporations. Accordingly, dividends from current or accumulated earnings and profits

paid by PNA to Popular, Inc. sourced from the

U.S. operations of PB are subject to a 10% tax withholding.

A corporation organized under the laws of the Commonwealth of Puerto

Rico that is engaged in a U.S. trade or business is generally subject to a branch profits tax of 30% on its earnings and profits

for the

taxable year that are “effectively connected” with

such U.S. trade or business, adjusted as

provided by U.S. federal income tax law.

to

U.S. operations

generate effectively

connected earnings

and profits

that

are not

reinvested in

such U.S. operations

(and that are

not otherwise adjusted

as provided by

U.S. federal income tax

law), such effectively

connected

earnings and profits will generally be subject

to a branch profits tax of 30%.

Part II,

Item 5,

“Market for

Registrant’s Common

Equity,

Related Stockholder

Matters and

Issuer Purchases

of

Equity Securities” for further information on Popular’s

distribution of dividends and repurchases of equity

See

“Puerto

Rico

Regulation”

below

for

a

of

certain

on

ability

to

pay

under

Puerto Rico law.

Interstate Branching

The Dodd-Frank

Act amended

the Riegle-Neal

Interstate Banking

and Branching

Efficiency Act

of 1994

(the “Interstate

Banking

Act”)

to

authorize

national

banks

and

state

banks

to

branch

interstate

through

de

novo

branches. For

purposes

of

the

Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as other state

banks.

Activities and Acquisitions

In general, the BHC Act limits the activities

permissible for bank holding companies to the business of banking, managing

or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to

be

properly

incidental

thereto.

A

company

that

meets

and

capital

and

whose

institutions meet management,

capital and

Community Reinvestment Act

(“CRA”) standards may

elect to

be treated

as a

and engage

in a

substantially broader

range of

nonbanking financial

activities, including

securities underwriting

and dealing, insurance underwriting and making

merchant banking investments in nonfinancial

In order for a bank holding company to elect to be treated as a financial

holding company, (i) all of its depository institution

must

be

well capitalized

(as described

above)

and

well managed

and

(ii)

it

must

file a

declaration with

Reserve Board that it elects to be a “financial holding

company.” As noted above, a bank

holding company electing to be a financial

holding company must itself be and remain

well capitalized and well managed. The Federal Reserve Board’s

regulations applicable

to bank holding companies separately define

“well capitalized” for bank holding companies,

such as Popular,

to require maintaining

a tier 1 capital

ratio of at least

6% and a total capital

ratio of at least 10%.

Popular and PNA have elected

to be treated as

holding

A

is

deemed

to

be

“well

managed”

if,

at

its

most

recent

inspection,

or

subsequent review

by the

appropriate federal banking

agency (or

the appropriate state

banking agency), the

depository institution

at

least

a

“satisfactory”

composite

rating

and

at

least

a

“satisfactory”

rating

for

the

component

of

the

composite

rating.

If,

after

becoming

a

holding

company,

the

company

fails

to

to

meet

any

of

the

capital

or

management requirements

for financial

status, the

company

must

enter into

a confidential

agreement with

the

Federal

Reserve

Board

to

comply

with

all

applicable capital

and

If

the

company

does

not

return

to

within

days,

the

Federal

Reserve

Board

may

extend

the

or

may

order

the

company

to

divest

its

subsidiary banks or the

company may discontinue, or

divest investments in companies

engaged in, activities permissible only

for a

bank holding company that has elected to be treated as a financial

holding company. In addition, if a depository institution subsidiary

controlled by a financial holding company does not

maintain a CRA rating of at least “satisfactory,” the financial holding company

will

be subject to restrictions on certain new activities

and acquisitions.

The Federal Reserve Board

may in certain circumstances limit

our ability to conduct

activities and make acquisitions that

would otherwise be permissible for

a financial holding company.

Furthermore, a financial holding company must obtain

prior written

approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets.

In addition, we

are required to

obtain prior Federal

Reserve Board approval

before engaging in

certain banking and

activities both in the United States and abroad.

The “Volcker

Rule” adopted

as part

of the

Dodd-Frank Act

restricts the

Popular and

its subsidiaries,

BPPR and PB as

well as non-banking subsidiaries, to

sponsor or invest in

“covered funds,” including private funds,

or to engage in

certain types

of proprietary

trading. Popular

and its

subsidiaries generally

do not

engage in

the businesses

the Volcker

Rule; therefore, the Volcker Rule does not have a material effect on our

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in

recent years has been aimed at combating money

laundering and

terrorist financing.

The USA

PATRIOT

Act of

2001 (the

“USA PATRIOT

Act”) strengthened

the ability

of the

U.S.

government to help prevent, detect and prosecute international money

laundering and the financing of terrorism. Title

III of the USA

PATRIOT

Act imposed

significant compliance

and due

diligence obligations,

created new

crimes and

penalties and

expanded the

extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements

could have serious legal and reputational consequences

for the institution.

The

Anti-Money

Laundering

Act

of

(“AMLA”),

which

amended

the

Bank

Secrecy

Act

(the

“BSA”),

is

to

comprehensively

reform

and

modernize

U.S.

laundering

laws.

Among

other

things,

the

AMLA

codifies

a

risk-based

approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to

promulgate

priorities

for

laundering

and

countering

the

financing

of

terrorism

policy;

the

of

for

testing technology and

internal processes for BSA

compliance; expands enforcement-

and investigation-related authority,

a

expansion

in

the

for

certain

BSA

violations;

and

expands

BSA

whistleblower

incentives

and

protections.

Many

of

the

statutory

provisions

in

the

AMLA

require

rulemakings,

reports

and

other

measures,

and

the

impact

of

the

AMLA

will

depend on,

among

other

things,

rulemaking and

implementation guidance.

In

June

2021,

the

Crimes Enforcement Network, a bureau of

the U.S. Department of the

Treasury,

issued the priorities for anti-money laundering

and

countering the

financing of

terrorism policy

required under AMLA.

The priorities

include: corruption, cybercrime,

terrorist financing,

fraud, transnational crime, drug trafficking, human trafficking and

proliferation financing.

Federal regulators

regularly examine BSA/Anti-Money

Laundering and sanctions

compliance to

enhance their

and effectiveness, and the frequency and extent of such examinations

and related remedial actions have been

increasing.

Community Reinvestment Act

The

CRA

banks

to

help

serve

the

credit

needs

of

their

communities,

extending

credit

to

low-

and

moderate-income individuals

and geographies.

Should

Popular

or our

bank

fail

to

serve

the community,

potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries

and affiliates, expand into new financial activities and merge

with or purchase other financial institutions.

Interchange Fees Regulation

The Federal Reserve Board

has established standards for

debit card interchange fees

and prohibited network exclusivity

arrangements and routing restrictions. The

maximum permissible interchange fee that

an issuer may receive

for an electronic debit

transaction is

the sum

of

21 cents

per transaction

and 5

multiplied by

of

the transaction.

the

Board allows

for an

upward adjustment

of

no more

than 1

cent

to

an issuer’s

debit card

interchange fee

if the

issuer develops and implements policies and procedures

reasonably designed to achieve certain fraud-prevention

standards.

In

October

2023,

the

Federal

Reserve

Board

to

its

rules

on

interchange

fees.

If

adopted,

the

proposed changes

would establish

a maximum

permissible interchange

fee of

no more

than 14.4

cents per

transaction plus

four

basis

points

multiplied

by

the

value

of

the

transaction.

The

fraud

prevention

would

be

to

1.3

cents

per

transaction. The proposed changes would also establish an automatic update of

the interchange fee cap every other year based on

a survey of debit card issuers.

Consumer Financial Protection Act of 2010

The Consumer

Financial Protection

Bureau (the

“CFPB”) supervises

“covered persons”

(broadly defined

to include

any

person offering or

providing a consumer financial

product or service and

any affiliated service

provider) for compliance with

federal

consumer financial laws. The CFPB

also has the broad power

to prescribe rules applicable to

a covered person or service

identifying

as

unlawful,

unfair,

deceptive,

or

abusive

acts

or

in

with

any

with

a

for

a

consumer financial product or service, or the offering of

a consumer financial product or service. We are subject to examination and

regulation by the CFPB. During 2025, the CFPB reduced its staff by over 80%. The

reduction in force is the subject of litigation, and

the

staffing

cuts

are

stayed

pending

the

federal

circuit

court’s

en

banc

rehearing

of

the

case.

The

impact

of

these

developments

on

banking

subject

to

CFPB

and

us,

is

uncertain.

The

Financial Protection Act permits states to adopt consumer protection laws and standards that are more stringent than those adopted

at

level and,

circumstances, permits

state attorneys

general to

enforce compliance

with both

the state

and

federal laws and regulations. States and state attorneys general

may increase regulatory, investigative and enforcement activity with

respect to consumer protection, in

response to changes in regulation, supervision

and enforcement of consumer protection laws

by

federal regulators.

On October 22, 2024, the CFPB finalized a new rule to implement Section 1033 of the Consumer Financial Protection Act

that

a

of

payment

or

products,

such

as

a

bank,

to

make

data

to

upon

request

regarding the

products or

services they

obtain from

the provider.

Any such

data provider

also has

to make

such data

third parties, with the consumer’s express authorization and

through an interface that satisfies formatting, performance

and security

for

the

purpose

of

such

third

parties

the

with

or

requested

by

the

consumer. Data required to be made available under the rule includes

transaction information, account balance, account and routing

numbers,

terms

and

upcoming

bill

information,

and

certain

account

verification

data.

The

rule

is

to

give

control

over

their

data,

with

whom

it

is

shared,

and

in

the

of

consumer financial

products or

services. For

banks with

$10 billion

and less

than $250

total assets,

with the rule’s requirements is required beginning on

April 1, 2027. The rule is the subject of litigation,

which is currently stayed while

the CFPB considers revisions to the rule.

Office of Foreign Assets Control Regulation

The

U.S.

Office

of

Foreign

Assets

Control

(“OFAC”)

administers

that

affect

with

foreign

countries,

nationals

and

others.

The

OFAC-administered

targeting

countries

take

many

forms.

Generally,

they

contain

one

or

more

of

the

elements:

(i)

on

trade

with

or

investment in a sanctioned country; and (ii) a blocking

of assets in which the government of the

sanctioned country or other specially

designated nationals have an interest, by prohibiting

transfers of property subject to U.S. jurisdiction (including

property in the United

States or the possession or control of U.S.

persons outside of the United States). Blocked assets (e.g., property

and bank deposits)

cannot

be

paid

out,

withdrawn, set

off

or

in

any

manner without

a

license

from

OFAC.

Failure

to

comply

with these

could

have

serious

legal

and

consequences,

denial

by

federal

of

merger,

acquisition, restructuring, or other expansionary activity.

Protection of Customer Personal Information and

The privacy

provisions of

the Gramm-Leach-Bliley Act

of 1999

generally prohibit financial

institutions, including

us, from

disclosing nonpublic personal financial information of consumer customers to third

parties for certain purposes (primarily marketing)

unless

have

the

opportunity

to

opt

out

of

the

disclosure.

The

Fair

Credit

Act

restricts

sharing

among affiliates for marketing purposes and governs

the use and provision of information to consumer

reporting agencies.

The federal banking regulators have also issued guidance and rules regarding cybersecurity that are intended to enhance

cyber risk management standards among financial institutions. A financial institution is expected to establish lines

of defense and to

maintain risk management processes that are designed to address the risk posed by compromised customer credentials. A financial

is

to

continuity

for

the

rapid

recovery,

resumption and maintenance of

the institution’s operations

after a cyber-attack involving

destructive malware. A financial

is

also

to

develop

to

enable

of

data

and

and

address

rebuilding

network capabilities and restoring data if the institution or its critical service

providers fall victim to this type of cyber-attack. If we

fail

to observe the

regulatory guidance, we could

be subject to various

regulatory sanctions, including financial

penalties. In November

2021, the U.S.

federal bank regulatory agencies

issued a final

rule requiring banking organizations,

including Popular,

PNA, BPPR

and PB, to notify

their primary federal banking regulator

within 36 hours of determining

that a “notification incident” has

occurred. A

notification incident

is a

“computer-security incident” that

has materially

disrupted or degraded,

or is

reasonably likely to

disrupt or

degrade, the

banking organization’s

deliver services

to a

material portion

of its

customer base,

jeopardize the

viability

of

key

of

the

banking

organization,

or

impact

the

stability

of

the

sector.

The

final

rule

also

specific and immediate notifications by bank

service providers that become aware of similar

incidents.

State and foreign regulators

have also been increasingly active

in implementing privacy and cybersecurity

standards and

regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and

providing detailed requirements with respect to these

programs, including data encryption requirements. In New York,

the NYSDFS

regulated

by

the

NYSDFS,

PB,

to,

among

other

things,

(i)

and

a

cybersecurity program designed

to enhance the

confidentiality, integrity

and availability of

their information systems;

(ii) implement

and maintain a written

cyber security policy setting forth

policies and procedures for the

protection of their information systems

and

nonpublic

information;

and

(iii)

designate

a

Chief

Officer.

On

1,

2023,

the

NYSDFS

adopted

amendments to

its

cybersecurity regulations

that

represent

a

update

to

the

regulation of

cybersecurity practices.

The

fall

within

the

five

categories:

(i)

mandatory

with

common

attack

vectors,

(ii)

for

privileged

(iii)

notification

(iv)

expansion

of

cyber

governance practices and (v) additional cybersecurity

requirements for larger companies.

On

July

6,

2023,

the

SEC

adopted

new

rules

that

would

require

registrants,

such

as

to

(i)

report

cybersecurity incidents

on Form

8-K and,

(ii) disclose

in Annual

Report on

cybersecurity policies

and procedures

and

governance practices, including at the board and

management levels.

Many states and foreign

governments have also recently implemented or

modified their data breach notification

and data

privacy

requirements. The

California Consumer

Privacy Act

(“CCPA”)

imposes privacy

compliance obligations

with regard

to

the

collection,

use

and

disclosure of

information of

California residents,

and the

November 2020

amendment to

the

CCPA

creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered

by the law

and certain rights relating

to personal information. The

substantive obligations under the

2020 amendment to the

CCPA

became effective on January 1, 2023. In the European Union, the General Data Protection Regulation heightens privacy compliance

obligations and

imposes strict

standards for

reporting data

breaches. We

monitor these

developments to

comply with

applicable requirements.

See

“Puerto

Rico

Regulation”

below

for

a

of

legislations

and

on

privacy

and

cybersecurity in Puerto Rico.

Climate-Related and ESG Developments

In recent years, certain lawmakers and regulators in and outside the United States have increased their focus on financial

institutions’

and

other

companies’

risk

oversight,

and

in

with

climate

change

and

other

environmental,

social

and

governance (“ESG”)

For

in

2023,

the

NYSDFS

issued

on

climate-related

risk

to

NYSDFS-regulated

banking

and

organizations,

PB.

The

addresses material

risks related

to

climate change

faced by

these

organizations in

the context

of

risk assessment,

risk

and

risk

appetite

setting.

In

2023,

California

enacted

climate-related

laws

certain

doing business in

California to make

certain climate-related disclosures

beginning in 2026,

including but not

limited to greenhouse

gas

emissions data

and climate-related

risks. On

the other

hand, certain

states

have enacted,

or have

proposed to

enact, “anti-

ESG”

statutes,

or

policies, including

statutes

that

prohibit

institutions from

denying or

canceling products

or

services to

a person,

or otherwise discriminating

against a

person in making

available products or

services, on

the basis

of social

credit scores and certain other factors. Additionally, in August 2025, President Trump signed Executive Order 14331, “Guaranteeing

Fair Banking

Access for

All Americans,”

which states

that it

is the

policy of

States that

no American

denied

access

to

because

of

their

constitutionally

or

statutorily

beliefs,

affiliations,

or

views.

The

Order

directs

the

Secretary

and

federal

banking

to

address

politicized

or

unlawful

debanking

Incentive Compensation

The Federal Reserve Board reviews, as

part of its regular,

risk-focused examination process, the incentive compensation

arrangements of

banking organizations, such

as Popular,

not “large,

complex banking

organizations.” Deficiencies will

be

incorporated into

the

organization’s supervisory

ratings, which

can

affect

the

organization’s ability

to

make

acquisitions and

take

other

actions. Enforcement

actions may

be taken

against

a

banking

organization if

its

incentive compensation

arrangements, or

related

risk-management

control

or

governance

processes,

pose

a

risk

to

the

safety

and

soundness

and

the

organization is not taking prompt and effective measures

to correct the deficiencies.

The

Federal

Reserve

Board,

OCC

and

FDIC

have

issued

final

on

incentive

policies intended to discourage excessive risk-taking in

the incentive compensation policies of banking organizations

in order to not

undermine

the

safety

and

soundness

of

such

organizations.

The

guidance,

which

covers

all

that

have

the

ability

to

the risk

profile of an

organization, either individually

or as

part of

a group,

upon the key

principles that

a

banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond

the

ability

to

and

manage

risks,

(ii)

be

compatible

with

and

risk

management, and (iii)

be supported by

strong corporate governance,

including active and

effective oversight

by the

board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking

and

the

SEC,

to

adopt

rules

prohibiting

incentive-based

payment

arrangements that

inappropriate

risks

by

providing excessive

compensation or

lead to

financial loss

at specified

regulated entities

having at

least $1

billion in total

assets (including Popular,

PNA, BPPR and

PB). The U.S.

financial regulators proposed revised

rules in 2016,

which

have not been finalized.

In October

2022, the SEC

adopted a final

rule requiring securities

exchanges to adopt

rules mandating, in

the case of

a

restatement, the

recovery or

“clawback” of

excess incentive-based

compensation paid

to current

or former

executive officers

and

requiring listed

issuers to

disclose any

recovery analysis where

recovery is

triggered by

a restatement.

The excess

would be based

on the amount

the executive officer

would have received

had the incentive-based

compensation been determined

using the restated

financials. The Nasdaq

Stock Market’s listing

standards pursuant to the

SEC’s rule became

effective October 2,

2023. Popular’s clawback policy adopted in accordance

with these listing standards is included as

Exhibit 97.1.

Regulation of Broker-Dealers

Our subsidiary,

PS, is a

registered broker-dealer with the

SEC and subject to

regulation and examination by

the SEC as

well

as

FINRA

and

other

self-regulatory

organizations.

These

cover

a

broad

range

of

issues,

capital

requirements;

sales

and

trading

practices;

use

of

client

funds

and

securities;

the

conduct

of

directors,

and

employees;

record-keeping and recording;

supervisory procedures to

prevent improper trading

on material

non-public information; qualification

and

licensing

of

sales

personnel;

and

on

the

extension

of

credit

in

In

to

federal

registration, state securities

commissions require the

registration of certain

broker-dealers. PS is

registered with 35

U.S. state and

territory securities commissions.

Regulation of Reinsurers, Insurance Producers and

Agents

Popular’s subsidiaries that are engaged in

insurance agency and producer activities are

subject to regulatory supervision

by the Puerto

Rico Office of

the Commissioner of Insurance

and to insurance laws

and regulations requiring licensing

of insurance

producers and

agents. Popular’s

reinsurance subsidiaries

to

licensure and

regulatory supervision

by the

Office of the Commissioner of Insurance and

to insurance laws and regulations requiring, among

other things, minimum capital and

solvency standards, financial reporting, restrictions on

the amount of dividends payable, record

keeping and examinations.

Puerto Rico Regulation

As

a

bank

organized

under

the

laws

of

Puerto

Rico,

BPPR

is

subject

to

and

regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended

(the “Banking Law”).

Section 27 of the Banking Law requires that at least ten percent (10%) of BPPR’s annual retained earnings be transferred

annually to a statutory reserve fund. The

apportionment must be done every year until the

reserve fund is equal to the

total of paid-

in capital on common and preferred stock. Under Regulation 9680 of the Puerto Rico Banking Law, dated July 22, 2025, Banks may

be exempted from

the requirement to transfer

such funds to

the statutory reserve

fund if they

are well capitalized,

have obtained a

rating of

1 or

2 in

the last

examination performed by

the Office

of the

Commissioner or an

applicable regulatory agency

accumulated at least 50% of the paid in

capital for their common and preferred stock in

their reserve fund.

Section

of

the

Banking

Law

also

provides that

when

the

expenditures

of

a

bank

are

greater

than

its

receipts, the

excess of the

former over the latter

must be charged against

the undistributed profits of

the bank, and the

balance, if any,

must be

charged against the statutory reserve fund. If

the statutory reserve fund is not sufficient to cover such balance

in whole or in part, the

outstanding amount must be charged against the capital account and

no dividend may be declared until capital has been restored to

its original amount and the statutory reserve fund to

20% of the original capital.

Section 16 of the

Banking Law requires every

bank to maintain a

legal reserve that, except

as otherwise provided by

the

the Commissioner,

may not be

less than 20%

of its

demand liabilities, excluding

government deposits (federal,

state and

municipal) that

are secured

by collateral.

If a

bank is

authorized to

establish one

or more

bank branches

in a

state of

States or in a foreign country, where such branches are subject to the reserve requirements of that state

or country, the Office of the

Commissioner

may

exempt

said

branch

or

from

the

reserve

of

Section

to

an

order

of

the

Federal

Reserve

Board

dated

24,

1982,

BPPR

has

been

exempted

from

the

reserve

of

the

Federal

Reserve

System

with

respect

to

payable

in

Puerto

Rico.

BPPR

is

subject

to

the

reserve

requirement

prescribed by Section 16 of the Banking Law. During 2025, BPPR was

in compliance with the legal reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to

any one person, firm, partnership or corporation, up to an

aggregate

amount

of

fifteen

percent

(15%)

of

the

paid-in

capital

and

reserve

fund

of

the

bank.

In

the

case

of

loans

which

are

secured by collateral worth at

least 25% more than the

amount of the loan, the

maximum aggregate amount of such secured

loans

is increased to one

third of the paid-in capital

of the bank and

its reserve fund. In no

event may the total of

unsecured and secured

loans to any one person, firm, partnership or corporation exceed an aggregate amount of

33 1/3% of the paid-in capital and reserve

fund of the bank. If the institution is well capitalized and had been rated 1 or

2 in the last examination performed by the Office of the

Commissioner or an applicable

regulatory agency,

its legal lending

limit shall also

include 15% of 100%

of its undivided

profits and

for loans

secured by

collateral worth

25% more

than the

the loan,

the capital

of the

bank shall

also include

1/3% of 100% of

its undivided profits. Institutions rated

3 in their last

regulatory examination may include this

additional component

legal lending

limit only

previous authorization

of the

Office

of the

Commissioner.

There are

no restrictions

under

Section

on

the

amount

of

loans

that

are

wholly

secured

by

bonds,

and

other

evidence

of

indebtedness

of

the

Government of

States or

or by

current debt

bonds, not

in default,

of municipalities

or instrumentalities

of

Puerto Rico. As

of December 31, 2025,

the legal lending

limit for BPPR

under this provision

was $723 million.

During 2025, BPPR

was in compliance with the lending limit requirements

of Section 17 of the Banking Law.

Section

of

the

Banking

Law

authorizes

a

bank

to

conduct

certain

and

related

finance

leasing

of

and

originating

and

loans,

or

through

BPPR

engages

in

finance

leasing

and

the

and

of

loans

through

its

Popular

Auto

and

Popular

divisions, respectively.

With

information privacy,

Puerto

Rico

law

requires businesses

to

implement information

controls to

protect consumers’

personal information from

breaches, as

well as to

provide notice of

any breach to

affected customers. In

Puerto

Rico

enacted the

Cybersecurity Act

of

the

Puerto

Rico,

which

establishes cybersecurity

standards for

government entities

and their

contractors, including

certain reporting

and certification

obligations. As

a depositary

of government

funds, BPPR

considered a

“contractor” under

the statute;

Rico Innovation

and Technology

Service

has

not

yet

adopted

implementing

which

we

expect

to

address

applicability

and

any

exceptions

to

the

statute’s

as noted

above in

“Regulation of

Reinsurers, Insurance

Producers and

Agents,” Popular’s reinsurance

subsidiaries are subject to

licensure and regulatory supervision

by the Puerto Rico

Office of the

Commissioner of Insurance and

to

insurance laws and regulations.

Available Information

We maintain an

Internet website at www.popular.com.

Via the “Investor

Relations” link at our

website, our annual reports

on

Form 10-K,

quarterly reports

on

Form 10-Q,

current

reports on

Form 8-K

and amendments

to

such

reports filed

or furnished

pursuant to Section 13(a) or

15(d) of the Securities Exchange Act

of 1934, as amended (the

“Exchange Act”), are available, free

of

charge, as

soon as

reasonably practicable

after such

forms are

electronically filed

with, or

furnished to,

the SEC.

The SEC

also

maintains an

internet website at

http://www.sec.gov that

contains reports, proxy

and information statements,

and other information

regarding issuers that file electronically with the

SEC. You may obtain copies of our filings on the SEC site.

We have

adopted a

written code

of ethics

that applies

to all

directors, officers

and employees

of Popular,

including our

principal executive officer

and senior financial

officers, in accordance

with Section 406

of the Sarbanes-Oxley

Act of 2002

and the

rules

of

the

SEC

promulgated

thereunder.

Our

Code

of

Ethics

is

on

our

www.popular.com,

in

the

section entitled “Corporate Governance.” In the event that we make changes to, or provide waivers from, the provisions of this Code

of Ethics that

the SEC requires

us to disclose,

we intend to

disclose these events

on our corporate

website in such

section. In

the

Corporate Governance

section

of our

we

posted the

charters

for

our Audit

Committee, Talent

and

Risk

Governance

and

Nominating

and

Committee, as well as our Corporate Governance Guidelines. In addition, information concerning

purchases and sales of our equity

securities by our executive officers and directors is

posted on our website.

All

website

addresses

given

in

this

document

are

for

only

and

are

not

to

be

active

links

or

to

incorporate any website information into this Form

10-K.

We, like

other financial institutions,

face risks

inherent to

and

capital

position.

These

risks

could

cause

our

actual

results

to

differ

from

our

results

or

the

results

contemplated by the forward-looking statements contained

in this report.

The risks described in

this report are not the

only risks we face. Additional

risks and uncertainties not currently

known by

us

or

that

we

deem

to

be

immaterial,

or

that

are

to

all

institutions,

may

also

adversely affect our business, financial condition, liquidity, results of operations or capital

position.

ECONOMIC AND MARKET RISKS

Weakness in

the economy,

particularly in

where a

significant portion

of our

business is

concentrated, has

adversely impacted us in the past and may adversely

impact us in the future.

We have been, and will continue to be, impacted by global and local

economic and market conditions, including weakness

in

the

and

volatility

in

the

inflation,

monetary,

trade

and

fiscal

public

policy,

geopolitical conflicts, business and consumer sentiment

and unemployment. A significant portion of

our business is concentrated in

Puerto Rico, which accounted for 77% of our assets and 79%

of our deposits as of December 31, 2025 and

80% of our revenues for

the

year

ended

31,

As

a

result,

our

and

results

of

are

highly

on

the

general

trends

of

the

Puerto

Rico

economy

and

other

affecting

Puerto

Rico

and

businesses.

The

concentration of

our operations in

exposes us to

greater risks than

other banking companies

with a

wider geographic

base.

has faced significant

economic and fiscal

challenges in the

past, including a

severe recession that

began in

2007 and

persisted for

over a

decade and

an acute

fiscal crisis

that led

to file

for a

form

of federal

bankruptcy protection

in 2017.

fiscal and

economic challenges

have in

the past

adversely affected

our customers,

in

higher

delinquencies,

and

losses

for

us.

While

Puerto

Rico’s

economy

has

been

gradually

recovering

and

the

Puerto

Rico

emerged from

bankruptcy

in

2022,

Puerto

Rico

still

faces

and

economy is

closely tied

to the

U.S. economy,

as well

as

highly reliant

on U.S.

public policy

and funding

decisions. Puerto Rico

has historically received

significant federal support

for a

wide range of

government programs and

including healthcare, education,

infrastructure and social

assistance programs. More

recently, Puerto

Rico has

received significant

federal stimulus,

disaster relief and

reconstruction funding, which

has served as

a major

driver of

economic activity.

Reductions in

federal

funding

to

programs that

have

benefited the

Puerto

Rico

economy

or

delays

in

disbursements could

significantly impact

Puerto

Rico’s

economy

and

hinder

reconstruction

efforts,

the

and

improvement

of

infrastructure.

In

addition, given that Puerto Rico’s Medicaid program is

funded through federal block grants, absent federal legislative action,

annual

Medicaid funding for Puerto

Rico is projected to

drop significantly during the

2027-2028 fiscal year,

which would require the

Puerto

to cover

substantial program costs

and potentially

place significant

strain on

its finances.

Beyond direct

funding,

broader shifts in U.S. policy,

such as changes to tax or trade policies, and

shifts in policies of other governments in response, could

also adversely

impact the

economy.

A weakening

of the

economy or

other adverse

economic conditions

affecting Puerto Rico consumers and businesses could result in decreased demand for our products or services, deterioration in the

credit

quality

of

our

higher

delinquencies,

or

losses,

all

of

which

could

affect

our

business, financial condition, liquidity, results of operations or capital position.

We are

also exposed

to risks

the state

of the

local economies

of the

other markets

in which

we do

such as

and Florida, as

well as to

the state of

the global and

U.S. economy and

financial markets. Evolving

geopolitical

tensions, the introduction

or escalation of tariffs,

inflationary pressures and other

political or economic shifts

may lead to

market volatility

and disruption.

These factors

could, in

turn, adversely

impact our

business, financial condition,

Changes

in

rates

and

credit

spreads

can

impact

our

our

since

a

portion

of

our

business involves

and

lending

money,

and

investing in

Our business

performance are

market interest

rates and

movements in

those rates.

Since a

high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes

in interest rates, in the shape of the yield curve or in spreads between different types of rates, have had and could in the future have

a material impact on our results

of operations and the values of our

assets and liabilities, including our investment portfolio.

rates are

highly sensitive

to many

factors over

have no

control and

may not

be able

to anticipate

adequately,

including general

economic conditions

and the

monetary and

tax policies

of various

governmental bodies,

particularly the

Federal

Reserve Board.

these policies,

including changes

rates, impact

various aspects

of our

business, including

loan originations,

the speed

of prepayments,

loan delinquencies,

of our

investments, the

receive on

our loans

and investment

securities, our

maintain and

generate deposits

and the

pay on

our deposits

funding

sources. The

effects of

these changes

may be

amplified if

we are

effectively manage

the sensitivity

of our

liabilities to market interest rate changes.

The rapid

rise in

in 2022

resulted in

$2.5 billion

in unrealized

mark-to-market losses

on available-for-sale

securities held

in our

investment securities

portfolio. In

October 2022,

we transferred

a fair

$6.5 billion (par value of $7.4 billion), and with accumulated unrealized losses of

$873 million, from our available-for-sale portfolio to

our

While

the

size

of

our

mark-to-market

losses

on

had

been

reduced

to

$0.9

billion

as

of

2025,

if

rates

were

to

again

rise

rapidly

or

for

a

prolonged

period,

we

may

accumulate

mark-to-market

losses

on

in

our

which

may

adversely affect our tangible capital and impact our

ability to return capital to our stockholders.

For a discussion of the Corporation’s

interest rate sensitivity, please refer

to the “Risk Management” section of the MD&A

BUSINESS RISKS

Negative

changes

in

the

of

our

clients

have

us

in

the

past

and

may

impact us in the future.

A significant portion of

our business involves lending money,

which exposes us to

credit risk and

risk of loss if

do

not

repay

their

loans,

leases, credit

cards

or

other

credit

The

performance of

these

credit

affects our

We have

in the

past been

adversely affected

by negative

the

financial condition of our clients due to weakness in

the Puerto Rico and U.S. economy. If the current economic environment were to

deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels

of credit losses

and reserves for credit losses.

We are exposed to

increased credit risks and credit losses

to the extent our clients are

concentrated by industry segment

or type of client.

Our credit risk and credit

losses can increase to the extent

our loans are concentrated in borrowers engaged in

or similar

activities or

in borrowers

who as

a group

may be

uniquely or

disproportionately affected

by certain

economic or

market

conditions. We have significant

exposure to borrowers in certain

economic sectors, such as residential

and commercial real estate,

hospitality and healthcare. Challenging economic or market conditions that affect

the industries or types of clients to

which we have

significant exposure

could result

in higher

credit

losses and

We also

have direct

lending and

investment exposure

to Puerto

entities, which

have faced

our exposure

to the

government consisted

of $391

direct lending

exposure to Puerto

Rico municipalities and

$209 million in

loans insured or

securities issued by

Puerto Rico governmental

but for

is non-governmental.

We also

have indirect

lending exposure

to the

government in the

form of loans

to private borrowers

who are service

providers, lessors, suppliers

or have other

relationships with

the Puerto Rico government. While the overall fiscal situation

of the Puerto Rico government has improved in recent years,

as

a

result

of

the

and

certain

of

its

having

restructured

their

debt

some

Puerto

Rico

government entities, including certain municipalities, still face significant

fiscal challenges. A deterioration in the fiscal situation of the

Puerto Rico government and

its instrumentalities, and in

particular the fiscal situation

of the Puerto

Rico municipalities to

have direct lending exposure,

could result in higher

credit losses and reserves

for credit losses. For

a discussion of risks

the Corporation’s credit

exposure to the

Puerto Rico and

USVI governments, see

the Geographic and

Government Risk section

in

the MD&A section of this Form 10-K.

Deterioration in the

values of real

properties securing our commercial, mortgage

loan and construction portfolios

have in

the past resulted, and may in the future result,

in increased credit losses and harm our results

As of

2025, 55%

of

our loan

portfolio consisted

of loans

secured by

collateral (comprised

of

29% in

commercial loans,

22% in

loans and

4%

in construction

loans). The

such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy of some

of the markets we serve has in

the past resulted in significant declines in the value

of the real properties securing our loan portfolio,

leading to

increased credit losses.

If the

the real

estate properties securing

our loan portfolio

declines again in

the future,

we

may be

increase our

provisions for

loan losses

and allowance

losses. Any

such

increase could

have an

on our

For more

the credit

quality of

our construction,

commercial and mortgage portfolio, see the Credit

Risk section of the MD&A included in this

Defective and repurchased loans may harm our business

and financial condition.

In

with

the

sale

and

of

loans,

we

are

to

make

a

variety

of

customary

and

warranties regarding

Popular

and

the

loans

being

sold

or

securitized.

Our

obligations with

these

representations and warranties are generally outstanding for the

life of the loan, and they

relate to, among other things, compliance

with

laws

and

the

accuracy

of

in

the

loan

documents

and

loan

file

and

the

and

enforceability of

the

loan.

A

loan

that

does

not

comply

with

the

secondary

market’s

may

take

longer to

sell, impact

to securitize

the loans

or pledge

the loans

as collateral

for borrowings,

or be

unsalable or

salable

only

at

a

discount.

if

any

such

loan

is

sold

before

we

detect

non-compliance,

we

may

be

obligated

to

repurchase the loan and bear any associated loss directly,

or we may be obligated to indemnify the purchaser against any loss.

We

seek to

minimize repurchases and

losses from defective

loans by correcting

flaws, if possible,

and selling or

re-selling such loans.

if

we

were

to

suffer

losses

from

defective

and

loans,

our

results

of

and

condition could be materially impacted.

If we are

unable to maintain

or grow our

deposits, we may

be subject to

paying higher funding costs

and our net

income may decrease.

We rely primarily on bank deposits as a low cost and

stable source of funding for our lending and

investment activities and

the operation of

our business. Therefore, our

funding costs are largely

dependent on our ability

to maintain and

grow our deposits.

As

our

have

raised

the

rates

they

pay

on

our

funding

costs

have

increased,

as

we

have

had

to

pay to

our depositors

to avoid

losing deposits and

to procure

new ones.

Rising interest

rates have

also led

customers to move their funds to other

financial institutions or to alternative investments that pay higher interest

rates.

periods of market stress

or lack of market or

customer confidence in financial institutions may

result in a loss of

customer deposits,

especially to the

extent those deposits are

in excess of

the FDIC-insured limit

of $250,000. As of

December 31, 2025, we

had $14

billion of total deposits (other than collateralized public funds, which represent public deposit balances from

governmental entities in

the

U.S.

and

its

territories,

Puerto

Rico

and

the

United

States

Virgin

that

are

based

on

such

jurisdictions’ applicable

collateral requirements)

in excess

of the

FDIC-insured limit.

If deposits

decrease, we

may need

to rely

on

more expensive sources of

funding, which would

negatively impact our interest

rate margin and net

interest income.

In addition, a

reduction in our deposits would decrease our earning

assets, which would also negatively affect our net interest

income.

We have a significant amount of deposits from the Puerto

Rico government, its instrumentalities and municipalities ($19.4

billion, or

29% of our

total deposits, as

2025), and the

amount of these

deposits may fluctuate

depending on the

financial condition and liquidity of

these entities, as well

as on our ability

to maintain these customer

relationships. Under the terms

of BPPR’s deposit

pricing agreement with the

Puerto Rico government, most

public fund deposit rates

are market linked

with a lag

minus a

specified spread.

Therefore, as

market rates

rise, we

to sequentially

pay our

public

deposits. If the mix of our deposits shifts towards a higher proportion of higher-cost deposits for any reason, our funding costs would

increase and our net interest income would be expected

to decrease.

OPERATIONAL RISKS

We and

our third-party

providers have

been, and

expect in

to be,

cyber-attacks. Future

cyber-attacks could cause substantial harm and

have an adverse effect on our business

risks

for

large

such

as

Popular

have

in

recent

years

in

part

because

of

the

proliferation

of

new

technologies,

such

as

mobile

banking,

cloud

hosting,

and

the

ability

to

conduct instant financial transactions anywhere globally, as well as due to geopolitical conflicts and the increased sophistication and

of

organized crime,

hackers, terrorists,

nation-states, hacktivists

and

other parties.

Cybersecurity threats

are constantly

evolving,

especially

given

the

in,

and

the

rise

of

the

use

of,

and

quantum

computing,

thereby

increasing the difficulty of preventing, detecting and

successfully defending against them.

In

the

ordinary

course

of

we

rely

on

electronic

communications

and

systems

to

conduct

our

and

to

transmit

and

store

sensitive

data.

Notwithstanding

our

and

the

resources

we

devote to protecting the security of our systems, there

is no assurance that all of our security measures

will be effective at all times,

especially

as

the

threats

from

cyber-attacks

are

continuous

and

severe.

The

risk

of

a

breach

due

to

a

is

increase as

we continue to

expand our

digital capabilities, mobile

banking and other

internet-based product offerings,

the use of the cloud for system development and

hosting and internal use of internet-based

products and applications.

We

detect and

identify attacks

becoming more

sophisticated and

increasing in

volume, as

well as

attackers

that

respond

rapidly

to

changes

in

countermeasures. The

most

risks

that

we

or

our

critical service providers may face include, but are not limited to, e-fraud,

denial-of-service (DDoS), ransomware, computer intrusion

and

the

exploitation

of

that

might

result

in

of

in

the

or

loss

of

customer or proprietary data, and significant financial loss. These types of cyber-attacks have in the past resulted and may continue

to result

in the

compromise of

sensitive customer

data, such

as account

numbers, credit

cards and

social security

numbers, and

could present significant reputational, legal and regulatory

costs to Popular if successful.

Our

customer-facing

platforms

are

also

routinely

by

threat

actors

aiming

to

gain

unauthorized

access

to

our

clients’

accounts.

we

have

to

protect

against

such

attacks,

there

is

no

assurance that these

defensive measures will

keep pace with

threats that are

continuous and growing

in severity.

For example, in

2022, certain customers were affected by brute force attacks on one of our platforms, which resulted in certain of our customers log-

in credentials

and information

being exposed,

resulting in

fraudulent transfers

or withdrawals.

Popular customers

been

card skimming

events in

our ATM

terminals. As

we have

notified, and

conducted additional

remediation for,

customers identified as

affected by

these incidents. Cyber-security

risks have also

been exacerbated by

the discovery of

vulnerabilities in

widely distributed

third party

software, which

have in

the past

affected and

in the

future could

affect Popular’s

or

any of its service provider’s systems, as

further detailed below.

The

use

of

remote

access

and

video

conferencing

solutions

to

enable

work-from-home

arrangements for employees has

also increased our exposure

to cyber-attacks, including through

the use of

deep fakes and brand

impersonation.

We

expect

the

rise

and

use

of

to

exacerbate

this

risk.

In

a

third

party

could

misappropriate confidential information

obtained by intercepting

signals or communications

from mobile

devices used by

customers or employees. Recent geopolitical conflicts have also exacerbated the risks related to supply-chain

compromises and de-

stabilizing activities of nation-state sponsored actors.

A material compromise or circumvention of the security of our systems could

have serious negative consequences for us,

of

our

and

those

of

our

and

counterparties,

misappropriation

of

confidential

of

Popular

or

that

of

our

counterparties

or

or

damage

to

computers

or

systems used

by us

or by

our clients,

customers and

counterparties, and

could result

in violations of

applicable privacy

laws,

loss

to

us

or

to

our

scrutiny

and

actions,

dissatisfaction,

significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us. Banking regulators

increasingly scrutinize third-party relationships supporting critical activities. If our regulators determine that our oversight,

protections, or

and controls

of our

third-party providers

(including critical

providers) are

inadequate, we

to

implement

controls,

conduct

reviews,

restrict

or

terminate

relationships,

or

undertake

costly

remediation or

conversion activities,

any of

disrupt operations,

increase expenses,

or adversely

reputation

The

extent

of

a

particular

and

the

steps

that

we

may

need

to

take

to

the

attack

may

not

be

immediately

clear,

and

it

may

take

a

amount

of

time

before

such

an

investigation

can

be

completed.

While

such

an

investigation is ongoing, Popular may not necessarily know the full extent

of the harm caused by the cyber-attack, and that

damage

may continue to spread.

These factors may inhibit

our ability to provide

rapid, full and reliable

information about the cyber-attack to

our clients, customers, counterparties and regulators, as well as the public. Moreover, we may be required under SEC rules

or bank

regulations to disclose information about a cybersecurity event before it has been resolved

or fully investigated. Furthermore, it may

not be clear how best to contain and remediate the potential harm

caused by the cyber-attack, and certain errors or actions could be

repeated or compounded before they are discovered

and remediated. Cyber-attacks could also cause interruptions

in our operations

and result in the incurrence of significant costs,

including those related to forensic analysis

and legal counsel.

We also

rely on

for the

performance of

a significant

portion of

our information

technology functions and

the

provision of information security,

technology and business process services. As a result, a

successful compromise or circumvention

of

the security

of

the systems

providers could

have serious

negative consequences

for us,

compromise

of

our

systems,

misappropriation of

our

confidential

or

that

of

our

counterparties

or

employees, or

other negative

implications identified

above with

a cyber-attack

on our

systems. The

most important

of

these

providers for

us

is

Evertec. As

we

depend on

Evertec to

identify and

remediate certain

of

our

cybersecurity vulnerabilities. Cyber-attacks at third-party service

providers are also becoming increasingly common, and,

as a result,

cybersecurity risks relating to our vendors, including Evertec have increased.

Certain risks particular to Evertec and our dependence

on

third

parties

are

discussed

under

“We

rely

on

other

to

provide

key

of

our

including certain of our core financial transaction processing and

information technology and security services, which exposes us to

a number

of operational

risks that

on us”

in the

Operational Risks

in this

Form 10-K. During 2023, personal information of Popular customers’ data was compromised in a data breach incident that impacted

MOVEit, the third-party file transfer platform used by one of our service

providers. Popular notified, as required or otherwise deemed

appropriate,

identified

as

by

the

incident.

during

2024,

threat

actors

exploited

a

vulnerability in

the Fortinet

enterprise management

server software

used by

Evertec, which

migrated to

one of

Popular's domain

controllers

due

to

a shared

network

environment. While

Evertec

eventually determined

that

no

BPPR

information was

exfiltrated as a result of

this incident, the event underscores

the risks inherent in Popular’s dependency

on Evertec. Although these

incidents did not

have a material

Popular, including

its business strategy,

or financial condition,

and

our

service

agreed

to

cover

external

remediation

costs

therewith,

a

compromise

of

Popular

or

the

of

our

maintained

by

third

party

vendors

could

result

in

consequences, reputational damage and financial

loss to us. The

success of our business

depends in part on

the continuing ability

(and other)

to perform

these functions

and services

in a

timely and

satisfactory manner,

which performance

could be disrupted or otherwise adversely affected

due to failures or other information security events originating

at the third parties

or

at

the

third

parties’

suppliers

or

vendors

(so-called

“fourth

party

risk”).

We

may

not

be

able

to

monitor

or

fourth-party

risk,

in

particular

as

it

relates

to

the

use

of

common

suppliers

or

vendors

by

the

third

parties

that

perform

functions and services for us.

As cyber

threats continue

to evolve,

we also

expend significant

additional resources

to modify

or

enhance

our

layers

of

defense

or

to

and

remediate

or

incidents.

The

obsolescence

in

our

hardware

or

limits

our

ability

to

vulnerabilities.

System

enhancements and

updates

also

create

risks

with

implementing new

systems

and

integrating

them

with

ones,

risks

with

supply chain compromises and the software development lifecycle of the systems used by us and our service providers. In

addressing certain

information security

vulnerabilities, such

as hardware-based

vulnerabilities, may

affect

of our

systems.

The

ability

of

our

hardware

and

to

deliver

patches

and

updates

to

vulnerabilities in a timely manner can introduce

additional risks, particularly when a vulnerability is being actively

exploited by threat

actors.

our

efforts

to

timely

and

manage

such

risks,

given

the

rise

in

number

and

urgency

of

required patches and third-party software, as well as

the obsolescence in some of our hardware and

software, may impact our day-

to-day operations, the availability of our systems and

delay the deployment of technology enhancements

and innovation.

If Popular’s operational systems,

or those of

external parties on which

Popular’s businesses depend, are

unable to meet

the requirements of our businesses and operations or the standards of our regulators

or other applicable data protection and privacy

laws, or if they fail, have other significant shortcomings or are impacted by cyber-attacks,

Popular could be materially and adversely

affected.

We

rely

on

other

to

provide

key

of

our

certain

of

our

core

processing

and

and

which

exposes

us

to

a

number

of

operational risks that could have a material

adverse effect on us.

Third parties provide key components of our business operations, such

as data processing, information security, recording

and monitoring transactions,

online banking interfaces and

services, Internet connections and

network access. The most

important

of

these

providers for

us

is

Evertec

due

in

large

part

to

its

role

as

a service

provider to

BPPR,

our

banking subsidiary.

We are dependent on Evertec for the provision of

essential services to our business, including certain

of BPPR’s

core financial

transaction processing and

information technology and

security services. As

we are particularly

exposed to

the operational risks of Evertec,

including those related to its

security architecture and potential breakdowns or

failures of Evertec’s

systems or internal controls environment.

Over the

course of our

relationship with Evertec,

we have experienced

interruptions and delays

in key

services provided

by Evertec, as well as cyber events, as a result of system breakdowns, their exposure to zero-day vulnerabilities, misconfigurations,

human

error,

application

obsolescence

and

dependency

on

shared

infrastructure

and

shared

environments,

which

have in certain cases also

led to exposure of Popular information

and BPPR customer information. In particular,

the current level of

obsolescence in the hardware and

software used by Evertec

to service us exposes

us to heightened operational and

risks, including system outages.

Our ability to cure

legacy obsolescence in the

hardware and software we

procure from Evertec, to

expand

our

over

being

by

Evertec,

as

well

as

to

effect

the

segregation

of

our

shared

is

to

be

lengthy

and

complex,

which

exacerbates

our

to

operational,

risks. See

“The transition

to new

technology providers,

and the

replacement of

services currently

provided to us by Evertec, will be lengthy and

complex” in the Operational Risks section of Item 1A

in this Form 10-K below.

While

we

select

third-party vendors

carefully

and

have

increased our

of

these

relationships, our

oversight is

constrained by

of our

ongoing visibility into

our vendor’s systems

and operations, and

we do not

have direct control

over

their actions, assets

or services. Any

problems caused by

these vendors, including

those resulting from

disruptions in the

provided, vulnerabilities

in or

breaches of

the vendor’s

systems or

environments, failure

of the

vendor to

handle current

or higher

volumes, failure of the vendor to provide services for any reason or

poor performance of services, failure of the vendor to notify us

of

a

event

in

a

timely

manner,

or

our

vendors’

misuse

of

and

other

automatic

decision

making

technologies,

could

affect

our

ability

to

deliver

and

to

our

and

conduct

our

disrupt

our

result

in

to

and

counterparties,

result

in

the

imposition

of

fines,

penalties or judgments by our regulators, lead to exposure of our information or that of our customers or harm to our reputation, any

could materially

and adversely

affect us.

The inability

of our

providers to

timely address

threats may further exacerbate these

risks. Financial or operational difficulties of

a third-party vendor could also

hurt our operations

if

those

interfere

vendor’s ability

to

serve

us.

Replacing these

third-party vendors,

when possible,

could

also

create

delay

and

expense.

the

use

of

third

parties

creates

an

unavoidable inherent

risk

to

our

The transition to new financial services technology providers, and the replacement of services currently provided to

us by

Evertec, will be lengthy and complex.

Switching from one vendor of core financial transaction processing and related technology and security services to one or

more new

vendors is

a complex

process that

carries business

risks. The

implementation cycle

for such

a transition

lengthy and require

significant financial and

management resources from

Popular. Such

a transition can

also

increase costs (including conversion costs), impede or disrupt business or technological initiatives, and expose us and our clients to

business disruption, as well as operational and cybersecurity risks. As

we transition all or a portion of

the existing services provided

by Evertec

to new

technology providers,

either (i)

at the

end of

the term

of the

Second Amended

and Restated

Master Services Agreement

(the “MSA”) and

related agreements or

(ii) earlier upon

the termination of

any service for

convenience

under the MSA, these transition risks could result in an adverse effect on our

business, financial condition and results of operations.

Although Evertec

has agreed

certain transition

assistance to

us in

the termination

of the

MSA, we

are

ultimately dependent on their ability to provide those

services in a responsive and competent manner, as well as their ability to retain

experienced personnel to

provide the services. A

successful transition will

also depend on

our ability to

retain personnel who

have

relevant experience

and expertise.

Furthermore, we

may require

transition assistance

from Evertec

beyond the

term of

the MSA,

potentially delaying and lengthening any transition

process away from Evertec while increasing

related costs and risks

of disruption

to us and our clients.

Under the

MSA, we

are able

to terminate

services for

convenience with

180 days’

prior notice.

We expect

to exercise

term of

the MSA

to terminate

certain services

for convenience

and to

transition such

services to

other service

providers prior to the expiration

of the MSA, subject to

complying with the revenue minimums contemplated in

the MSA and certain

other conditions. In

practice, in order

to switch

to a

new provider for

a particular service,

we will have

to commence procuring

and

working on

a transition

process for

such service

significantly in

advance of

its termination

and, in

any case,

much earlier

than the

expiration date of the MSA, and such process may extend beyond the current term of the MSA. Furthermore, if we are unsuccessful

or

decide

not

to

complete

the

after

expending significant

funds

and

management resources,

it

could

also

result

in

an

adverse effect on our business, financial condition and

Unforeseen or

catastrophic events,

extreme weather

events and

other natural

disasters, man-made

disasters,

acts of violence or

war, or the

emergence of pandemics or epidemics, could

cause a disruption in our

operations or other

consequences that could have a material adverse

effect on our financial condition and results

A

portion

of

our

are

located

in

the

Caribbean

and

Florida,

a

region

susceptible

to

hurricanes,

earthquakes and other

similar events. In

2017, Puerto Rico,

USVI and BVI

were severely impacted

by Hurricanes Irma

and María,

which resulted in significant disruption to our operations and adversely affected

our clients in these markets, and in 2022, Hurricane

Fiona impacted the

southwest area of

adversely affecting our

customers in

that region. Other

types of

unforeseen or

catastrophic events, including

pandemics, epidemics, man-made

disasters, or acts

of violence or

war, or

the fear that

such events

could occur

in the

future, could

also adversely

impact our

operations and

financial results.

in 2020,

the COVID-19

pandemic

severely

global

health,

spending

and

global

and

caused

significant disruption to businesses

worldwide, including our business

and those of

our customers, service providers

and suppliers.

Future unforeseen or catastrophic events, and actions taken by governmental authorities and other third parties in response to such

events, could

our operations,

cause economic

and market

disruption, adversely

impact the

borrowers to

timely repay

their loans,

or affect

of any

collateral held

by us,

any of

have a

material adverse

our

business, financial condition or results of operations. The frequency, severity and impact of future unforeseen or catastrophic events

is

to

predict. While

we maintain

insurance against

natural disasters

and

other unforeseen

events, including

coverage

for

business interruption, the insurance may not be sufficient to cover all of the damage from any such event, and there is

no insurance

against the

disruption that

a catastrophic

event could

produce to

the markets

that we

serve and

the potential

negative impact

to

economic activity.

Climate change could have a material adverse

impact on our business operations and that

of our clients and customers.

Our business and

the activities and

operations of our

clients and customers

may be disrupted

by global climate

change.

Potential physical risks

from climate change

include the increase

in the

frequency and severity

of weather

events, such as

storms

and

hurricanes,

and

long-term

shifts

in

climate

patterns, such

as

sustained

higher

and

lower

temperatures,

sea

level

rise,

heat

waves

and

droughts,

among

others.

Our

concentration

in

localities,

Puerto

Rico,

the

U.S.V.I.,

B.V.I.

and

Florida, particularly

susceptible to

risks arising

from climate

change, including

severe hurricanes

and sea

level rise,

heighten the

threat we

face from

climate change. Additionally,

of climate

the markets

that we

operate and

in other

global

markets may

have the

effect of

increasing the

costs or

reducing the

availability of

insurance needed

for our

business operations.

Climate change may also create transitional risks resulting from a shift to a low-carbon economy.

These transition risks may include

changes in the legal and regulatory landscape, technology, consumer sentiment and preferences, and market demands that seek to

mitigate the

effects

of climate

change. Changes

in the

legal

landscape may

additionally increase

our compliance

costs.

These

climate-driven

changes