BPOP 10-K & 10-Q changes, risk factors and insider trading

We, like other financial institutions, face risks inherent to our business, financial condition, liquidity, position.

We have been, and will continue to be, impacted by global and local economic and market conditions, including weakness economy, disruptions volatility inflation, monetary, policy, geopolitical conflicts, business and consumer sentiment and unemployment. A significant portion of our business is concentrated in Puerto Rico, which accounted for approximately 77% of our assets and 80%79% of our deposits as of December 31, 20242025 and 79%80% of our revenues for result, trends affecting consumers businesses. The concentration of our operations Rico exposes greater risks than other banking companies wider geographic base.

has faced significant economic and fiscal challenges in the past, including a severe recession that began in 2007 and persisted for over a decade and an acute fiscal crisis that led Rico government to file of federal bankruptcy protection in 2017.

Rico’s gradually recovering emerged from bankruptcy still faces fiscal challenges.

Beyond direct funding, broader shifts in U.S. policy, such as changes to tax or trade policies, and shifts in policies of other governments in response, could also adversely impact Ricothe economy.

A weakening economy or other adverse economic conditions affecting Puerto Rico consumers and businesses could result in decreased demand for our products or services, deterioration in the delinquencies, charge-offs or increased losses, all of which could adversely affect our business, financial condition, liquidity, results of operations or capital position.

spreads portfolio, business involves money, investing in instruments.

these policies, including changes in interest rates, impact various aspects business, including loan originations, the speed of prepayments, loan delinquencies, investments, the receive on our loans and investment securities, our maintain and generate deposits pay on our deposits sources. The effects of these changes amplified if we are effectively manage the sensitivity liabilities to market interest rate changes.

The rapid rise in in 2022 resulted in

$2.5 billion in unrealized mark-to-market losses on available-for-sale securities held in our investment securities portfolio. In October 2022, we transferred U.S. Treasury securities with a fair value of approximately $6.5 billion (par value of $7.4 billion), and with accumulated unrealized losses of $873 million, from our available-for-sale portfolio to size mark-to-market $0.9 again rapidly prolonged accumulate mark-to-market adversely affect our held-to-maturitytangible portfolio.capital and impact our ability to return capital to our stockholders.

A significant portion of our business involves lending money, which exposes us to credit risk and risk of loss if repay leases, credit cards performance of affects our and results We have past been adversely affected by negative financial condition of our clients due to weakness in the Puerto Rico and U.S. economy. If the current economic environment were to deteriorate, more customers may have difficulty in repaying their credit obligations, which may result in higher levels of credit losses and reserves for credit losses.

Our credit risk and credit losses can increase to the extent our loans are concentrated in borrowers engaged in or similar activities or in borrowers who as a group uniquely or disproportionately affected by certain economic or conditions. We have significant exposure to borrowers in certain economic sectors, such as residential and commercial real estate, hospitality and healthcare. Challenging economic or market conditions that affect the industries or types of clients to which we have significant exposure could result in higher losses and adversely affect our business, financial condition, operations or capital position.

We also have direct lending and investment exposure to Puerto Rico government entities, which have faced fiscal challenges.

our exposure government consisted of $336$391 direct lending exposure to Puerto Rico municipalities and $220$209 million in loans insured or securities issued by Puerto Rico governmental but for which the principal source of repayment is non-governmental.

We also have indirect lending exposure government in the form of loans to private borrowers who are service providers, lessors, suppliers or have other relationships with the Puerto Rico government. While the overall fiscal situation of the Puerto Rico government has improved in recent years, having restructured government entities, including certain municipalities, still face significant fiscal challenges. A deterioration in the fiscal situation of the Puerto Rico government and its instrumentalities, and in particular the fiscal situation of the Puerto Rico municipalities to which we have direct lending exposure, could result in higher credit losses and reserves for credit losses. For a discussion of risks the Corporation’s credit exposure to the Puerto Rico and USVI governments, see the Geographic and Government Risk section inthe MD&A section of this Form 10-K.

2025, 55% of our loan portfolio consisted of loans secured by collateral (comprised of 29% in commercial loans, 22% in residential mortgage loans and 3%4% in construction loans). The value of the collateral securing such loans is dependent upon economic conditions in the area in which the collateral is located. Weakness in the economy of some of the markets we serve has in the past resulted in significant declines in the value of the real properties securing our loan portfolio, leading to increased credit losses. If the value of the real estate properties securing our loan portfolio declines again in future, we may be required to increase our provisions for loan losses and allowance for loan losses. Any such increase could an adverse effect on our financial condition and results of operations. For more information on the credit quality of our construction, commercial and mortgage portfolio, see the Credit Risk section of the MD&A included in this

variety customary representations warranties regarding securitized.

obligations with representations and warranties are generally outstanding for the life of the loan, and they relate to, among other things, compliance accuracy documents file characteristics enforceability of loan.

However, suffer defective repurchased condition could be materially impacted.

raised increased, increase the pay to our depositors to avoid losing deposits and to procure new ones.

Additionally,Rising interest rates have also led customers to move their funds to other financial institutions or to alternative investments that pay higher interest periods of market stress or lack of market or customer confidence in financial institutions may result in a loss of customer deposits, especially to the extent those deposits are in excess of the FDIC-insured limit of $250,000. As of December 31, 2025, we had $13$14 billion of total deposits (other than collateralized public funds, which represent public deposit balances from governmental entities itsin territories, including Puerto Rico United States Virgin Islands, that are collateralized based on such jurisdictions’ applicable collateral requirements) in excess of the FDIC-insured limit. If deposits decrease, we may need to rely on more expensive sources of funding, decrease our earning assets, which would also negatively affect our net interest income.

In addition, a reduction in our deposits would decrease our earning assets, which would also negatively affect our net interest We have a significant amount of deposits from the Puerto Rico government, its instrumentalities and municipalities ($19.5$19.4 billion, approximatelyor 30%29% of our total deposits, as 2024of December 31, 2025), and the amount of these deposits may fluctuate depending on the financial condition and liquidity of these entities, as well as on our ability to maintain these customer relationships. Under the terms of BPPR’s deposit pricing agreement with the Puerto Rico government, most public fund deposit rates are market linked with a lag minus a specified spread.

Therefore, as market rates rise, we are required to sequentially increase thepay our public deposits. If the mix of our deposits shifts towards a higher proportion of higher-cost deposits for any reason, our funding costs would increase and our net interest income would be expected to decrease.

OPERATIONAL RISKSWe and our third-party providers have been, and expect in the future to be, subjectcyber-attacks. toFuture cyber-attacks,cyber-attacks could cause substantial harm and have an adverse effect on our business and results of operations.

Cybersecurity because proliferation technologies, mobile banking, cloud hosting, artificial intelligence conduct instant financial transactions anywhere globally, as well as due to geopolitical conflicts and the increased sophistication and organized crime, hackers, terrorists, nation-states, hacktivists cyber-attacksother expected to increase with the evolution and emergence of new technologies such as artificial intelligence and quantum computing.parties.

breach cyber-attack expected to increase as we continue to expand our digital capabilities, mobile banking and other internet-based product offerings, the use of the cloud for system development and hosting and internal use of internet-based products and applications.

detect and identify attacks becoming more sophisticated and increasing in volume, as attackers respond rapidly defensive countermeasures. The cyber-attack critical service providers may face include, but are not limited to, e-fraud, denial-of-service (DDoS), ransomware, computer intrusion exploitation zero-day vulnerabilities might customer or proprietary data, and significant financial loss. LossThese fromtypes e-fraudof occurscyber-attacks whenhave cybercriminals compromise our systems orin the systems of our customers and extract funds from customer’s credit cards or bank accounts, including through brute force, password spraying and credential stuffing attacks directed at gaining unauthorized access to individual accounts. Denial-of-service attacks intentionally disrupt the legitimate users, including customers and employees, to access networks, websites online resources. Computer intrusion attempts, either direct or through social engineering (pretext calls), supply chain compromise, email, text voice messages, brand impersonation (regularly phishing, vishing, smishing quishing), havepast resulted in and may thecontinue to result compromise of sensitive customer data, such as account numbers, credit cards and social security numbers, and could present significant reputational, legal and regulatory costs to Popular if successful.

customer-facing platforms routinely attacked threat actors aiming gain unauthorized clients’ accounts.

implemented defensive designed protect attacks, assurance that these defensive measures will keep pace with threats that are continuous and growing in certain customers have been affected by brute force attacks on one of our platforms, which resulted in certain of our customers log-credentials taken over, fraudulent transfers withdrawals.severity.

Popular customers card skimming events in our ATM terminals. As we have notified, and conducted additional remediation for, customers identified as affected by these incidents. Cyber-security recentlyrisks have also been exacerbated by the discovery of zero-day vulnerabilities in widely distributed third party software, which have in the past affected and in the future could affect Popular’s or any of its service provider’s systems, as further detailed below.

remote video conferencing solutions enable work-from-home arrangements for employees and facilitate the use of digital channels by our customers, has also increased our exposure to cyber-attacks, including through the use of deep fakes and brand impersonation.

expect exacerbate misappropriate confidential information obtained by intercepting signals or communications from mobile devices used by customers or employees. Recent geopolitical conflicts have also exacerbated the risks related to supply-chain compromises and de-stabilizing activities of nation-state sponsored actors.

A material compromise or circumvention of the security of our systems could have serious negative consequences for us, clients, counterparties, misappropriation confidential clients, counterparties damage computers systems used by us or by our clients, customers and counterparties, and could result in violations of applicable privacy laws, scrutiny actions, dissatisfaction, significant litigation exposure and harm to our reputation, all of which could have a material adverse effect on us. Banking regulators increasingly scrutinize third-party relationships supporting critical activities. If our regulators determine that our oversight, protections, or and controls third-party providers (including critical providers) are inadequate, we could be implement controls, independent reviews, restrict terminate relationships, undertake costly remediation or conversion activities, disrupt operations, increase expenses, or adversely affect our reputation and results of operations.

particular cyber-attack steps need investigate attack immediately clear, investigation completed.

These factors may inhibit our ability to provide rapid, full and reliable information about the cyber-attack to our clients, customers, counterparties and regulators, as well as the public. Moreover, new regulationswe may requirebe usrequired under SEC rules or bank regulations to disclose information about a cybersecurity event before it has been resolved or fully investigated. Furthermore, it may not be clear how best to contain and remediate the potential harm caused by the cyber-attack, and certain errors or actions could be repeated or compounded before they are discovered and remediated. Cyber-attacks could also cause interruptions in our operations and result in the incurrence of significant costs, including those related to forensic analysis and legal counsel.

In addition to the other information set forth in this report, you should carefully consider the risk factors discussed under “Part I - Item 1A - Risk Factors”" in our 2025 Form 10-K. These factors could materially adversely affect our business, financial condition, liquidity, results of operations and capital position, and could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in this report. Also refer to the discussion in “Part I - Item 2 - Management’s Discussion and Analysis of Financial Condition and Results of Operations" in this report for additional information that may supplement or update the discussion of risk factors below and in our 2025 Form 10-K.

The risks described in our 2025 Form 10-K and in this report are not the only risks facing us. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect our business, financial condition, liquidity, results of operations and capital position.

This report includes management’s discussion and analysis (“MD&A”) of the consolidated financial position and financial performance of Popular, Inc. (the “Corporation”" or “Popular”"). All accompanying tables, financial statements and notes included elsewhere in this report should be considered an integral part of this analysis.

The Corporation is a diversified, publicly owned financial holding company subject to the supervision and regulation of the Board of Governors of the Federal Reserve System. The Corporation has operations in Puerto Rico, the United States (“U.S.”") mainland and the U.S. and British Virgin Islands. In Puerto Rico, the Corporation provides retail, mortgage, commercial banking services and auto and equipment leasing and financing through its principal banking subsidiary, Banco Popular de (“BPPR”), as well as broker-dealer and insurance services through specialized subsidiaries. In U.S. mainland, Corporation provides retail and equipment leasing financing, York-chartered subsidiary, Bank (“PB” “Popular U.S.”), branches located York, Jersey Florida.

As a financial services company, the Corporation’s earnings are significantly affected by general business and economic conditions in the markets which we serve. Lending and deposit activities and fee income generation are influenced by the level of business spending and investment, consumer income, spending and savings, capital market activities, competition, customer preferences, interest rate conditions and prevailing market rates on competing products.

The Corporation operates in a highly regulated environment and may be adversely affected by changes in federal and local laws and regulations. Also, competition with other financial institutions, as well as with non-traditional financial service providers and technology companies that provide electronic and internet-based financial solutions and services, could adversely affect its profitability.

The Corporation continuously monitors general business and economic conditions, industry-related indicators and trends, competition, interest rate volatility, credit quality indicators, loan,loan and deposit demand, operational and systems efficiencies, revenue enhancements and changes in the regulation of financial services companies.

The description of the Corporation’s business contained in Item 1 of the 2025 Form 10-K, while not all inclusive, discusses additional information about the business of the Corporation. Readers should also refer to “Part I - Item 1A”" of the 2025 Form 10-K and “Part II - Item 1A”" of this Form 10-Q for a discussion of certain risks and uncertainties to which the Corporation is subject, many beyond the Corporation’s control that, in addition to the other information in this Form 10-Q, readers should consider.

The Corporation’s common stock is traded on the NASDAQ Global Select Market under the symbol BPOP.

Financial highlights for the quarter ended MarchJune 31,30, 2026

Non-interestThe Corporation’s net income for the quarter ended June 30, 2026 amounted to $165.6$278.2 million, an increase of $13.6$67.8 million when compared to net income of $210.4 million for the quarter ended MarchJune 31,30, 2025,2025. Higher net income was mainly driven by higher creditnet and debit card feeinterest income, higher assetnon-interest management fees,income, and higherlower insuranceoperating fees.expenses partially offset by an increase in the provision for credit losses.

ReferFinancial to Table 1 for selected financial datahighlights for the quartersquarter ended MarchJune 31,30, 2026 and Marchinclude: