POPULAR, INC. - Annual Report: 2020 (Form 10-K)

1

2

Forward-Looking Statements

This Form 10-K contains “forward-looking statements” within the meaning of the U.S. Private Securities Litigation Reform Act of 1995, including, without limitation, statements about Popular Inc.’s (the “Corporation,” “Popular,” “we,” “us,” “our”) business, financial condition, results of operations, plans, objectives, future performance and the effects of the COVID-19 pandemic on our business. Forward-looking statements in this Annual Report on Form 10-K also include the expected benefits of the Popular Bank New York branches optimization strategy, as well as related estimates of pre-tax charges and anticipated annual operating expense savings. These statements are not guarantees of future performance, are based on management’s current expectations and, by their nature, involve risks, uncertainties, estimates and assumptions. Potential factors, some of which are beyond the Corporation’s control, could cause actual results to differ materially from those expressed in, or implied by, such forward-looking statements. Risks and uncertainties include without limitation the effect of competitive and economic factors, and our reaction to those factors, the adequacy of the allowance for loan losses, delinquency trends, market risk and the impact of interest rate changes, capital markets conditions, capital adequacy and liquidity, and the effect of legal and regulatory proceedings and new accounting standards on the Corporation’s financial condition and results of operations. All statements contained herein that are not clearly historical in nature are forward-looking, and the words “anticipate,” “believe,” “continues,” “expect,” “estimate,” “intend,” “project” and similar expressions and future or conditional verbs such as “will,” “would,” “should,” “could,” “might,” “can,” “may” or similar expressions are generally intended to identify forward-looking statements.

Various factors, some of which are beyond Popular’s control, could cause actual results to differ materially from those expressed in, or implied by, such forward-looking statements. Factors that might cause such a difference include, but are not limited to:

 the rate of growth or decline in the economy and employment levels, as well as general business and economic conditions in the geographic areas we serve and, in particular, in the Commonwealth of Puerto Rico (the “Commonwealth” or “Puerto Rico”), where a significant portion of our business is concentrated;

 the impact of the current fiscal and economic challenges of Puerto Rico and the measures taken and to be taken by the Puerto Rico Government and the Federally-appointed oversight board on the economy, our customers and our business;

 the impact of the pending debt restructuring proceedings under Title III of the Puerto Rico Oversight, Management and Economic Stability Act (“PROMESA”) and of other actions taken or to be taken to address Puerto Rico’s fiscal challenges on the value of our portfolio of Puerto Rico government securities and loans to governmental entities and of our commercial, mortgage and consumer loan portfolios where private borrowers could be directly affected by governmental action;

 the amount of Puerto Rico public sector deposits held at the Corporation, whose future balances are uncertain and difficult to predict and may be impacted by factors such as the amount of Federal funds received by the P.R. Government in connection with the COVID-19 pandemic and the rate of expenditure of such funds, as well as the timeline and outcome of current Puerto Rico debt restructuring proceedings under Title III of PROMESA;

 the scope and duration of the COVID-19 pandemic, actions taken by governmental authorities in response to the pandemic, and the direct and indirect impact of the pandemic on us, our customers, service providers and third parties;

 changes in interest rates and market liquidity, which may reduce interest margins, impact funding sources and affect our ability to originate and distribute financial products in the primary and secondary markets;

 the fiscal and monetary policies of the federal government and its agencies;

 changes in federal bank regulatory and supervisory policies, including required levels of capital and the impact of proposed capital standards on our capital ratios;

 additional Federal Deposit Insurance Corporation (“FDIC”) assessments;

 regulatory approvals that may be necessary to undertake certain actions or consummate strategic transactions, such as acquisitions and dispositions;

3

 unforeseen or catastrophic events, including extreme weather events, other natural disasters, man-made disasters or the emergence of pandemics, epidemics and other health-related crises, which could cause a disruption in our operations or other adverse consequences for our business;

 the relative strength or weakness of the consumer and commercial credit sectors and of the real estate markets in Puerto Rico and the other markets in which borrowers are located;

 the performance of the stock and bond markets;

 competition in the financial services industry;

 possible legislative, tax or regulatory changes; and

 a failure in or breach of our operational or security systems or infrastructure or those of EVERTEC, Inc., our provider of core financial transaction processing and information technology services, or of other third parties providing services to us, including as a result of cyberattacks, e-fraud, denial-of-services and computer intrusion, that might result in loss or breach of customer data, disruption of services, reputational damage or additional costs to Popular.

Other possible events or factors that could cause our results or performance to differ materially from those expressed in these forward-looking statements include the following:

 negative economic conditions that adversely affect housing prices, the job market, consumer confidence and spending habits which may affect, among other things, the level of non-performing assets, charge-offs and provision expense;

 changes in market rates and prices which may adversely impact the value of financial assets and liabilities;

 potential judgments, claims, damages, penalties, fines, enforcement actions and reputational damage resulting from pending or future litigation and regulatory or government investigations or actions, including as a result of our participation in and execution of government programs related to the COVID-19 pandemic;

 changes in accounting standards, rules and interpretations;

 our ability to grow our core businesses;

 decisions to downsize, sell or close units or otherwise change our business mix; and

 management’s ability to identify and manage these and other risks.

Further, statements about the potential effects of the COVID-19 pandemic on our business, financial condition, liquidity and results of operation may constitute forward-looking statements and are subject to the risk that actual effects may differ, possibly materially, from what is reflected in those forward-looking statements due to factors and future developments that are uncertain, unpredictable and in many cases beyond our control, including actions taken by governmental authorities in response to the pandemic and the direct and indirect impact of the pandemic on us, our customers, service providers and third parties.

Moreover, the outcome of legal and regulatory proceedings, as discussed in “Part I, Item 3. Legal Proceedings,” is inherently uncertain and depends on judicial interpretations of law and the findings of regulators, judges and/or juries. Investors should refer to “Part I, Item 1A” of this Form 10-K for a discussion of certain risks and uncertainties to which the Corporation is subject.

All forward-looking statements included in this Form 10-K are based upon information available to Popular as of the date of this Form 10- K, and other than as required by law, including the requirements of applicable securities laws, we assume no obligation to update or revise any such forward-looking statements to reflect occurrences or unanticipated events or circumstances after the date of such statements.

4

TABLE OF CONTENTS

5

PART I POPULAR, INC.

ITEM 1. BUSINESS

General

Popular is a diversified, publicly-owned financial holding company, registered under the Bank Holding Company Act of 1956, as amended (the “BHC Act”) and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the largest financial institution based in Puerto Rico, with consolidated assets of $65.9 billion, total deposits of $56.9 billion and stockholders’ equity of $6.0 billion at December 31, 2020. At December 31, 2020, we ranked among the 50 largest U.S. bank holding companies based on total assets according to information gathered and disclosed by the Federal Reserve Board.

We operate in two principal markets:

 Puerto Rico: We provide retail, mortgage and commercial banking services through our principal banking subsidiary, Banco Popular de Puerto Rico (“Banco Popular” or “BPPR”), as well as auto and equipment leasing and financing, investment banking, broker-dealer and insurance services through specialized subsidiaries. BPPR’s deposits are insured under the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”). The banking operations of BPPR are primarily based in Puerto Rico, where BPPR has the largest retail banking franchise.

 Mainland United States: We provide retail, mortgage and commercial banking services through our New York-chartered banking subsidiary, Popular Bank (“PB” or “Popular U.S.”), which has branches in New York, New Jersey and Florida. PB’s deposits are insured under the DIF of the FDIC.

 BPPR also conducts banking operations in the U.S. Virgin Islands, the British Virgin Islands and New York. In addition to BPPR’s commercial banking operations in New York, BPPR offers financial products on a National scale in the U.S. market, including by operating an online platform used to originate personal loans under the E-Loan brand, issuing several co-branded credit cards offerings and gathering insured institutional deposits via online deposit gathering platforms. In the U.S. and British Virgin Islands, BPPR offers a range of banking products, including loans and deposits to both retail and commercial customers.

For further information about the Corporation’s results segregated by its reportable segments, see “Reportable Segment Results” in the Management’s Discussion and Analysis section of the Annual Report and Note 36 included in the Annual Report in this Form 10-K.

Unless otherwise stated, all references in this Form 10-K to total loan portfolio, total credit exposure or loan portfolios, exclude covered loans, which represent loans acquired in the Westernbank FDIC-assisted transaction that were covered under loss sharing agreements with the FDIC and non-covered loans held-for-sale. The loss sharing agreements with the FDIC were terminated on May 22, 2018.

Refer to the Overview section of Management’s Discussion and Analysis, in the Annual Report in this Form 10-K., for information on recent significant events that have impacted or will impact our current and future operations.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial. Commercial loans are comprised of (i) commercial and industrial (C&I) loans to commercial customers for use in normal business operations and to finance working capital needs, equipment purchases or other projects, and (ii) commercial real estate (CRE) loans (excluding construction loans) for income-producing real estate properties as well as

6

owner-occupied properties. C&I loans are underwritten individually and usually secured with the assets of the company and the personal guarantee of the business owners. CRE loans consist of loans for income-producing real estate properties and the financing of owner-occupied facilities if there is real estate as collateral. Non-owner-occupied CRE loans are generally made to finance office and industrial buildings, healthcare facilities, multifamily buildings and retail shopping centers and are repaid through cash flows related to the operation, sale or refinancing of the property.

(2) Mortgage. Mortgage loans include residential mortgage loans to consumers for the purchase or refinancing of a residence and also include residential construction loans made to individuals for the construction of refurbishment of their residence.

(3) Consumer. Consumer loans are mainly comprised of personal loans, credit cards, and automobile loans, and to a lesser extent home equity lines of credit (“HELOCs”) and other loans made by banks to individual borrowers.

(4) Construction. Construction loans are CRE loans to companies or developers used for the construction of a commercial or residential property for which repayment will be generated by the sale or permanent financing of the property. Our construction loan portfolio primarily consists of retail, residential (land and condominiums), office and warehouse product types.

(5) Lease Financings. Lease financings are offered by BPPR and are primarily comprised of automobile loans/leases made through automotive dealerships and equipment lease financings.

(6) Legacy. At PB, we carry a legacy portfolio comprised of commercial loans, construction loans and lease financings related to certain lending products exited by the Corporation as part of restructuring efforts carried out in prior years at PB.

Covered Loans.

On April 30, 2010, BPPR acquired most of the loan portfolio of the former Westernbank Puerto Rico from the FDIC, as receiver (the “Westernbank FDIC-assisted transaction”). Loans acquired in the Westernbank FDIC-assisted transaction that were subject to a loss sharing agreement with the FDIC are referred to as “covered loans.” “Covered” foreclosed other real estate properties were also subject to loss sharing agreements.

The Corporation previously presented the loans covered by the loss-sharing agreements with the FDIC separately as “covered loans” since the risk of loss was significantly different than those not covered under the loss-sharing agreements, due to the loss protection provided by the FDIC. On May 22, 2018, the Corporation entered into a Termination Agreement with the FDIC to terminate all loss-share arrangements in connection with the Westernbank FDIC-assisted transaction. As a result of the Termination Agreement, assets that were covered by the loss share agreement, including covered loans in the amount of approximately $514.6 million as of March 31, 2018, were reclassified as non-covered. The Corporation now recognizes entirely all future credit losses, expenses, gains, and recoveries related to the formerly covered assets with no offset due to or from the FDIC.

Business Concentration

Since our business activities are currently concentrated primarily in Puerto Rico, our results of operations and financial condition are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real estate markets. The concentration of our operations in Puerto Rico exposes us to greater risk than other banking companies with a wider geographic base. Our asset and revenue composition by geographical area is presented in “Financial Information about Geographic Areas” below and in Note 36 in the Annual Report in this Form 10-K.

Our loan portfolio is diversified by loan category. However, approximately 57% of our loan portfolio at December 31, 2020

7

consisted of real estate-related loans, including residential mortgage loans, construction loans and commercial loans secured by commercial real estate. The table below presents the distribution of our loan portfolio by loan category at December 31, 2020. As described above, “Legacy” refers to loans remaining from lines of businesses we exited as a result of the restructuring of our U.S. operations in 2008 and 2009.

Except for the Corporation’s exposure to the Puerto Rico Government sector, no individual or single group of related accounts is considered material in relation to our total assets or deposits, or in relation to our overall business. For a discussion of our loan portfolio and our exposure to the Government of Puerto Rico, see “Financial Condition – Loans” and “Credit Risk – Geographical and Government Risk” in the “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in the Annual Report in this Form 10-K.

Credit Administration and Credit Policies

Interest from our loan portfolios is our principal source of revenue. Whenever we make loans, we expose ourselves to credit risk. Credit risk is controlled and monitored through active asset quality management, including the use of lending standards, thorough review of potential borrowers and active asset quality administration.

Business activities that expose us to credit risk are managed within the Board of Director’s Risk Management policy, and the Credit Risk Tolerance Limits policy, which establishes limits that consider factors such as maintaining a prudent balance of risk-taking across diversified risk types and business units, compliance with regulatory guidance, controlling the exposure to lower credit quality assets, and limiting growth in, and overall exposure to, any product or risk segment where we do not have sufficient experience and a proven ability to predict credit losses.

We maintain comprehensive credit policies for all lines of business in order to mitigate credit risk. Our credit policies are ratified by our Board of Directors and set forth, among other things, underwriting standards and procedures for monitoring and evaluating loan portfolio quality. Our credit policies also require prompt identification and quantification of asset quality deterioration or potential loss to ensure the adequacy of the allowance for credit losses. Included in these policies, primarily determined by the amount, type of loan and risk characteristics of the credit facility, are various approval levels and lending limit constraints, ranging from the branch or department level to those that are more centralized.

Our credit policies and procedures establish documentation requirements for each loan and related collateral type, when applicable, during the underwriting, closing and monitoring phases. For commercial and construction loans, during the initial loan underwriting process, the credit policies require, at a minimum, historical financial statements or tax returns of the borrower and any guarantor, an analysis of financial information contained in a credit approval package, a risk rating determination and reports from credit agencies and appraisals for real estate-related loans. The credit policies also set forth the required closing documentation depending on the loan and the collateral type.

Although we originate most of our loans internally in both the Puerto Rico and mainland United States markets, we occasionally purchase or participate in loans originated by other financial institutions. When we purchase or participate in loans originated by others, we conduct the same underwriting analysis of the borrowers and apply the same criteria as we do for loans originated by us. This also includes a review of the applicable legal documentation.

8

Refer to the Credit Risk section of Management’s Discussion and Analysis, in the Annual Report in this Form 10-K for information related to management committees and divisions with responsibilities for establishing policies and monitoring the Corporation’s credit risk.

Loan extensions, renewals and restructurings

Loans with satisfactory credit profiles can be extended, renewed or restructured. Many commercial loan facilities are structured as lines of credit, which are mainly one year in term and therefore are required to be renewed annually. Other facilities may be restructured or extended from time to time based upon changes in the borrower’s business needs, use of funds, timing of completion of projects and other factors. If the borrower is not deemed to have financial difficulties, extensions, renewals and restructurings are done in the normal course of business and are not considered concessions, and the loans continue to be recorded as performing.

We evaluate various factors to determine if a borrower is experiencing financial difficulties. Indicators that the borrower is experiencing financial difficulties include, for example: (i) the borrower is currently in default on any of its debt or it is probable that the borrower would be in payment default on any of its debt in the foreseeable future without the modification; (ii) the borrower has declared or is in the process of declaring bankruptcy; (iii) there is significant doubt as to whether the borrower will continue to be a going concern; (iv) currently, the borrower has securities that have been delisted, are in the process of being delisted, or are under threat of being delisted from an exchange; and (v) based on estimates and projections that only encompass the current business capabilities, the borrower forecasts that its entity-specific cash flows will be insufficient to service the debt (both interest and principal) in accordance with the contractual terms of the existing agreement through maturity; and absent the current modification, the borrower cannot obtain funds from sources other than the existing creditors at an effective interest rate equal to the current market interest rate for similar debt for a non-troubled debtor.

We have specialized workout officers who handle the majority of commercial loans that are past due 90 days and over, borrowers experiencing financial difficulties, and those that are considered problem loans based on their risk profile. As a general policy, we do not advance additional money to borrowers that are 90 days past due or over. In commercial and construction loans, certain exceptions may be approved under certain circumstances, including (i) when past due status is administrative in nature, such as expiration of a loan facility before the new documentation is executed, and not as a result of payment or credit issues; (ii) to improve our collateral position or otherwise maximize recovery or mitigate potential future losses; and (iii) with respect to certain entities that, although related through common ownership, are not cross defaulted nor cross-collateralized and are performing satisfactorily under their respective loan facilities. Such advances are underwritten and approved following our credit policy guidelines and limits, which are dependent on the borrower’s financial condition, collateral and guarantee, among others.

In addition to the legal lending limit established under applicable state banking law, discussed in detail below, business activities that expose the Corporation to credit risk should be managed within guidelines described in the Credit Risk Tolerance Limits policy. Limits are defined for loss and credit performance metrics, portfolio composition and concentration, and industry and name-level, which monitors lending concentration to a single borrower or a group of related borrowers, including specific lending limits based on industry or other criteria, such as a percentage of the banks’ capital.

Refer to Note 2 and Note 8 to the Consolidated Financial Statements, in the Annual Report in this Form 10-K, for additional information on troubled debt restructuring (“TDRs”).

Competition

The financial services industry in which we operate is highly competitive. In Puerto Rico, our primary market, the banking business is highly competitive with respect to originating loans, acquiring deposits and providing other banking services. Most of our direct competition for our products and services comes from commercial banks and credit unions. The principal competitors for BPPR include locally based commercial banks and a few large U.S. and foreign banks with operations in Puerto Rico. While the number of banking competitors in Puerto Rico has been reduced in recent years as a result of consolidations, these transactions have allowed some of our competitors to gain greater resources, such as a

9

broader range of products and services.

We also compete with specialized players in the local financial industry that are not subject to the same regulatory restrictions as domestic banks and bank holding companies. Those competitors include brokerage firms, mortgage companies, insurance companies, automobile and equipment finance companies, local and federal credit unions (locally known as “cooperativas”), credit card companies, consumer finance companies, institutional lenders and other financial and non-financial institutions and entities. Credit unions generally provide basic consumer financial services. These competitors collectively represent a significant portion of the market and have lower cost structure and fewer regulatory constraints.

In the United States we continue to face substantial competitive pressure as our footprint resides in the two large, metropolitan markets of New York City / Northern New Jersey and the greater Miami area. There is a large number of community and regional banks along with national banking institutions present in both markets, many of which have a larger amount of resources than us.

In both Puerto Rico and the United States, the primary factors in competing for business include pricing, convenience of branch locations and other delivery methods, range of products offered, and the level of service delivered. We must compete effectively along all these parameters to be successful. We may experience pricing pressure as some of our competitors seek to increase market share by reducing prices or offering more flexible terms. Competition is particularly acute in the market for deposits, where pricing is very aggressive. Increased competition could require that we increase the rates offered on deposits or lower the rates charged on loans, which could adversely affect our profitability.

Economic factors, along with legislative and technological changes, will have an ongoing impact on the competitive environment within the financial services industry. We work to anticipate and adapt to dynamic competitive conditions whether it may be developing and marketing innovative products and services, adopting or developing new technologies that differentiate our products and services, cross-marketing, or providing personalized banking services. We strive to distinguish ourselves from other community banks and financial services providers in our marketplace by providing a high level of service to enhance customer loyalty and to attract and retain business. However, we can provide no assurance as to the effectiveness of these efforts on our future business or results of operations, and as to our continued ability to anticipate and adapt to changing conditions, and to sufficiently improve our services and/or banking products, in order to successfully compete in our primary service areas.

Human Capital Management

Attracting, developing, and retaining top talent in an environment that promotes employee well-being, safety, development, diversity and inclusion is a fundamental pillar of our long-term strategy. As of December 31, 2020, Popular employed approximately 8,700 employees of which none are represented by a collective bargaining group.

Employee Well-Being

The physical, emotional, and financial well-being of the Corporation’s employees is a prominent goal of our human capital strategy. Our full and part-time employees have access to affordable healthcare with Popular covering 88% of the premium in Puerto Rico and the Virgin Islands, and 80% of the premium in the mainland United States. Additionally, the Corporation promotes employee health by encouraging annual physical exams and maintaining a Health and Wellness Center staffed with doctors, nurses, and other healthcare professionals at its Puerto Rico-based corporate offices, where employees can complete their physical exam, come in for acute care or visit a nutritionist or psychologist free of charge.

We provide targeted benefits aimed at promoting work-life balance. For example, the Corporation’s time off program includes community service leave, paid parental leave (including childbirth, adoption and bonding time) and flexible work arrangements. To support our employees’ emotional well-being during the COVID-19 pandemic, we enhanced our Well-Being Academy with redesigned virtual sessions addressing stress and emotional intelligence, and we adapted our Employee Assistance Program to offer virtual mental health conversations geared at managing work and life challenges. The Corporation also offers physical fitness events and breaks, now virtually, as well as employee workshops on personal financial management. In addition, special bonuses were given to front-line workers in recognition of their extra efforts during the COVID-19 pandemic. Popular seeks to continuously improve its programs to meet employees’ health and wellness needs, which the Corporation believes is essential to attract and

10

retain employees of the highest caliber.

Employee Safety

The safety of our customers and employees is paramount to us. We have workforce safety measures and programs in place geared at reducing occupational-related illnesses. For example, our organization offers ergonomic equipment and workspaces, prepares front-line employees on safe work procedures in case of potentially violent incidents, and trains employees as health coordinators to assist their colleagues in case of a medical emergency. In response to the COVID-19 pandemic, the Corporation enhanced its safety measures in all its facilities reinforcing sanitization practices, work configuration spacing and air filtering, among others, and established protocols based on the recommendations of the Centers for Disease Control and Prevention, the World Health Organization and local Health Departments. As part of the safety measures implemented, remote working was quickly enabled for about 50% of our workforce to prevent further spread of the virus. In addition, the Corporation created a team of case managers for the monitoring and contact tracing of confirmed and suspected COVID-19 cases, providing employees with support from diagnosis to recovery.

Talent Development

Popular seeks to develop the skills of its employees and leaders to sustain the Corporation’s competitive advantage. Our 40,000 square foot Development Center in San Juan, Puerto Rico offers training sessions, activities, and workshops throughout the year. In response to the COVID-19 pandemic, the Corporation launched virtual training offerings including hundreds of redesigned sessions and over 20 new courses.

Employees are also subject to mandatory trainings regarding regulatory compliance and other key topics during the year.

Recognizing that leadership development is crucial to driving results and achieving the Corporation’s strategic goals, Popular has implemented programs aimed at strengthening and developing leadership skills and effective talent management. Such programs offer special sessions focused on leading through the current environment, building skills for complex problem solving and organizational change, and strategies to motivate and support teams. Popular’s strong training and development framework has contributed to internal growth opportunities for its employees, with 41% of positions filled with internal candidates.

Diversity and Inclusion

We foster a diverse and inclusive environment in the belief that diversity reflects who we are and spurs innovation. As of December 31, 2020, 66% of the Corporation’s employees were female, while 34% were male. Women accounted for 63% of first and mid-level management and 27% of executive-level management at such date. The Corporation maintains a multidisciplinary council, headed by our Corporate Diversity Officer, to develop and implement initiatives that support its Diversity and Inclusion Policy and strategy. This strategy seeks to broaden the inclusion, employment advancement and development of minorities and women in the workplace, as well as the utilization of suppliers owned, controlled, or operated by minorities and/or women. In addition, this strategy seeks to prepare the Corporation’s employees to recognize and value the differences of those we serve.

Popular is an organization committed to pay equity and conducts analyses on an annual basis with related pay adjustment strategies to address gaps. As part of this commitment, Popular invested nearly $400,000 in closing the gender pay gap in 2020, for a total of $2.5 million over the past nine years. As a result, our gender pay gap continues to narrow and is now lower than the nationwide median, according to data from the US Census Bureau. The Corporation has also expressed public support of movements advocating for equality such as Black Lives Matter and Pride Month. During 2020, as part of its commitment to supplier and customer diversity, Popular invited suppliers and commercial customers to a virtual forum with the Corporation’s procurement unit and minority business enterprise leaders to continue educating this community on diversity and inclusion best practices.

Employee Experience

Popular aims to provide an excellent employee experience that inspires its employees to provide customers and communities with the best service. To understand its employees’ experience, the Corporation conducts anonymous pulse and engagement surveys (including the Great Place to Work survey) as well as exit interviews to identify areas of opportunity and set and monitor action plans. In 2020, our efforts were focused on understanding employees’ end-to-end journey in Popular through design thinking

11

methodologies. The findings of this exercise, which was conducted with senior leaders, employee experience key stakeholders and randomly selected employees, were used to strengthen our talent strategy. We seek to continuously measure and improve the employee experience to increase productivity while contributing to improve the customer experience and business results. As of year-end 2020, our voluntary turnover rate was 5.9%, below the finance and insurance industry average of approximately 13% based on U.S. Bureau of Labor & Statistics data.

Board Oversight

The Talent and Compensation Committee of the Corporation’s Board of Directors has oversight responsibility for the Corporation’s human capital management. As part of its responsibilities, the Talent and Compensation Committee reviews and advises management on the Corporation’s general compensation philosophy, programs, and policies, and on the Corporation’s talent development, succession planning, culture, diversity and inclusion, among other human capital topics.

We encourage you to review our 2020 Corporate Sustainability Report to be published on www.popular.com during the second quarter of 2021 for more detailed information regarding the Corporation’s human capital management programs and initiatives. The information on the Corporation’s website, including the 2020 Corporate Sustainability Report, is not, and will not be deemed to be, a part of this annual report on Form 10-K or incorporated into any of the Corporation’s filings with the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America (“PNA”) and their respective subsidiaries. Such laws and regulations are continually under review by Congress and state legislatures and federal and state regulatory agencies. Any change in the laws and regulations applicable to Popular and its subsidiaries could have a material effect on the business of Popular and its subsidiaries. We will continue to assess our businesses and risk management and compliance practices to conform to developments in the regulatory environment.

General

Popular and PNA are bank holding companies subject to consolidated supervision and regulation by the Federal Reserve Board under the BHC Act. BPPR and PB are subject to supervision and examination by applicable federal and state banking agencies including, in the case of BPPR, the Federal Reserve Board and the Office of the Commissioner of Financial Institutions of Puerto Rico (the “Office of the Commissioner”), and, in the case of PB, the Federal Reserve Board and the New York State Department of Financial Services (the “NYSDFS”).

Enhanced Prudential Standards

In October 2019, the federal banking agencies finalized rules that tailor the application of enhanced prudential standards to large bank holding companies and the capital and liquidity rules to large bank holding companies and depository institutions (the “Tailoring Rules”) to implement amendments to the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) per the Economic Growth, Regulatory Relief, and Consumer Protection Act. Under the Tailoring Rules, banking organizations are categorized based on status as a U.S. G-SIB, size and four other risk-based indicators. Among bank holding companies with $100 billion or more in total consolidated assets, the most stringent standards apply to U.S. G-SIBs, which are subject to Category I standards and the least stringent standards apply to Category IV organizations, which have between $100 billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and which are also not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk management requirements. As of December 31, 2020, Popular had total consolidated assets of $65.9 billion.

Transactions with Affiliates

BPPR and PB are subject to restrictions that limit the amount of extensions of credit and certain other “covered transactions” (as defined in Section 23A of the Federal Reserve Act) between BPPR or PB, on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, and that impose collateralization requirements on such credit extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that affiliate would exceed 10% of the bank’s capital stock and surplus or the aggregate amount of the bank’s covered transactions with all affiliates would exceed 20% of the bank’s capital stock and surplus. In addition, any transaction between BPPR or PB, on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, is required to be carried out on an arm’s length basis.

12

Source of Financial Strength

The Dodd-Frank Act requires bank holding companies, such as Popular and PNA, to act as a source of financial and managerial strength to their subsidiary banks. Popular and PNA are expected to commit resources to support their subsidiary banks, including at times when Popular and PNA may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary depository institutions are subordinated in right of payment to depositors and to certain other indebtedness of such subsidiary depository institution. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal banking agency to maintain the capital of a subsidiary depository institution will be assumed by the bankruptcy trustee and entitled to a priority of payment. BPPR and PB are currently the only insured depository institution subsidiaries of Popular and PNA.

Resolution Planning

A bank holding company with $250 billion or more in total consolidated assets (or that is a Category III firm based on certain risk-based indicators described in the Tailoring Rules) is required to report periodically to the FDIC and the Federal Reserve Board such company’s plan for its rapid and orderly resolution in the event of material financial distress or failure. In addition, insured depository institutions with total assets of $50 billion or more are required to submit to the FDIC periodic contingency plans for resolution in the event of the institution’s failure. In April 2019, the FDIC released an advance notice of proposed rulemaking about potential changes to its insured depository institution resolution planning requirements, and announced that the next round of insured depository institution resolution plan submissions would not be required until the rulemaking process is complete. The FDIC has not yet completed its rulemaking process. However, in January 2021, the FDIC announced that, given the passage of time from the last resolution plan submissions and the uncertain economic outlook, the FDIC will resume requiring resolution plan submissions for insured depository institutions with $100 billion or more in assets.

As of December 31, 2020, Popular, PNA, BPPR and PB’s total assets were below the thresholds for applicability of these rules.

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC, and BPPR and PB are subject to FDIC deposit insurance assessments to maintain the DIF. Deposit insurance assessments are based on the average consolidated total assets of the insured depository institution minus the average tangible equity of the institution during the assessment period. For smaller depository institutions with less than $10 billion in assets, the FDIC assigns an individual rate based on a formula using financial data and CAMELS ratings. A depository institution reporting over $10 billion in assets for four consecutive quarters will be reclassified as a large depository institution. PB has consecutively reported assets of more than $10 billion since the third quarter of 2019 and has now been categorized as a larger depository institution. For larger depository institutions with over $10 billion in assets, such as BPPR, and PB, the FDIC uses a “scorecard” methodology, which also considers CAMELS ratings, among other measures, that seeks to capture both the probability that an individual large institution will fail and the magnitude of the impact on the DIF if such a failure occurs. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30 basis points on an annualized basis. After the effect of potential base-rate adjustments, the total base assessment rate could range from 1.5 to 40 basis points on an annualized basis.

As of December 31, 2020, we had a DIF average total asset less average tangible equity assessment base of approximately $59 billion.

Brokered Deposits

The FDIA and regulations adopted thereunder restrict the use of brokered deposits and the rate of interest payable on deposits for institutions that are less than well capitalized. There are no such restrictions on a bank that is well capitalized. In December 2020, the FDIC issued a final rule that is designed to bring the brokered deposits regulations in line with modern deposit taking methods and that is expected to reduce the amount of deposits that would be classified as brokered. Popular does not believe the brokered deposits regulations, and the proposed amendments, have had or will have a material effect on the funding or liquidity of BPPR and PB.

Capital Adequacy

Popular, BPPR and PB are each required to comply with the Basel III Capital Rules. These rules implement the Basel III

13

framework set forth by Basel Committee on Banking Supervision (the “Basel Committee”) as well as certain provisions of the Dodd-Frank Act.

Among other matters, the Basel III Capital Rules: (i) impose a capital measure called “Common Equity Tier 1” (“CET1”) and the related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; and (iii) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital. Under the Basel III Capital Rules, for most banking organizations, including Popular, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the Basel III Capital Rules’ specific requirements.

Pursuant to the Basel III Capital Rules, the minimum capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”).

The Basel III Capital Rules also impose a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and eligible retained income (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income). Thus, Popular, BPPR and PB are required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%.

In addition, under prior risk-based capital rules, the effects of accumulated other comprehensive income or loss (“AOCI”) items included in stockholders’ equity (for example, marks-to-market of securities held in the available for sale portfolio) under U.S. GAAP were reversed for the purposes of determining regulatory capital ratios. Pursuant to the Basel III Capital Rules, the effects of certain AOCI items are not excluded; however, non-advanced approaches banking organizations, including Popular, BPPR and PB, may make a one-time permanent election to continue to exclude these items. Popular, BPPR and PB have made this election in order to avoid significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their securities portfolios.

The Basel III Capital Rules preclude certain hybrid securities, such as trust preferred securities, from inclusion in bank holding companies’ Tier 1 capital. Trust preferred securities no longer included in Popular’s Tier 1 capital may nonetheless be included as a component of Tier 2 capital. Popular has not issued any trust preferred securities since May 19, 2010. At December 31, 2020, Popular has $374 million of trust preferred securities outstanding which no longer qualify for Tier 1 capital treatment, but instead qualify for Tier 2 capital treatment.

Failure to meet capital guidelines could subject Popular and its depository institution subsidiaries to a variety of enforcement remedies, including the termination of deposit insurance by the FDIC and to certain restrictions on our business. Refer to “Prompt Corrective Action” below for further discussion.

In November 2017, the federal bank regulators adopted a final rule to extend the transitional regulatory capital treatment applicable during 2017 for certain items, including certain deferred tax assets, mortgage servicing assets, investments in non-consolidated financial entities and minority interests, for non-advanced approaches banking organizations, such as Popular, BPPR and PB , until April 1, 2020 when final rules to simplify the regulatory treatment of those items (the “Capital Simplification Rules”) took effect.

In December 2017, the Basel Committee on Banking Supervision published standards that it described as the finalization of the Basel III post-crisis regulatory reforms (the standards are commonly referred to as “Basel IV”). Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing

14

new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. These standards will generally be effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2027. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to Popular, BPPR and PB. The impact of Basel IV on us will depend on the manner in which it is implemented by the federal bank regulators.

In December 2018, the federal banking agencies approved a final rule modifying their regulatory capital rules and providing an option to phase in over a period of three years the day-one regulatory capital effects of the Current Expected Credit Loss (“CECL”) model of ASU 2016-13. The final rule also revises the agencies’ other rules to reflect the update to the accounting standards. The Corporation has availed itself of the option to phase in over a period of three years the day one effects on regulatory capital from the adoption of CECL. During 2020, federal bank regulators adopted a rule that allows banking organizations to elect to delay temporarily the estimated effects of adopting the current expected credit losses accounting standard (“CECL”) on regulatory capital until January 2022 and subsequently to phase in the effects through January 2025. Under the rule, during 2020 and 2021, the adjustment to CET1 capital reflects the change in retained earnings upon adoption of CECL at January 1, 2020, plus 25% of the increase in the allowance for credit losses since January 1, 2020.

Refer to the Consolidated Financial Statements in the Annual Report in this Form 10-K., Note 20 and Table 9 of Management’s Discussion and Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer to the Consolidated Financial Statements in the Annual Report in this Form 10-K Note 3 for more information regarding CECL.

Prompt Corrective Action

The Federal Deposit Insurance Act (the “FDIA”) requires, among other things, the federal banking agencies to take prompt corrective action in respect of insured depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized”. A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors.

An insured depository institution will be deemed to be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized” (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. An insured depository institution’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the institution’s overall financial condition or prospects for other purposes.

The FDIC generally prohibits an insured depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company, if the depository institution would thereafter be undercapitalized. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition, undercapitalized depository institutions are subject to growth limitations and are required to submit capital restoration plans. A depository institution’s holding company must guarantee the capital restoration plan, up to an amount equal to the lesser of 5% of the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency, when the institution fails to comply with the plan. The federal banking agencies may not accept a capital restoration plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions,

15

including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a receiver or conservator.

The capital-based prompt corrective action provisions of the FDIA apply to the FDIC-insured depository institutions such as BPPR and PB, but they are not directly applicable to holding companies such as Popular and PNA, which control such institutions. As of December 31, 2020, both BPPR and PB were well capitalized.

Restrictions on Dividends and Repurchases

The principal sources of funding for Popular and PNA have included dividends received from their banking and non-banking subsidiaries, asset sales and proceeds from the issuance of debt and equity. Various statutory provisions limit the amount of dividends an insured depository institution may pay to its holding company without regulatory approval. A member bank must obtain the approval of the Federal Reserve Board for any dividend, if the total of all dividends declared by the member bank during the calendar year would exceed the total of its net income for that year, combined with its retained net income for the preceding two years, less any required transfers to surplus or to a fund for the retirement of any preferred stock. In addition, a member bank may not declare or pay a dividend in an amount greater than its undivided profits as reported in its Report of Condition and Income, unless the member bank has received the approval of the Federal Reserve Board. A member bank also may not permit any portion of its permanent capital to be withdrawn unless the withdrawal has been approved by the Federal Reserve Board. Pursuant to these requirements, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the NYSDFS. During the year ended December 31, 2020, BPPR declared cash dividends of $578 million, a portion of which was used by Popular for the payments of the cash dividends on its outstanding common stock and a $500 million in accelerated stock repurchases. Subject to the Federal Reserve’s ability to establish more stringent specific requirements under its supervisory or enforcement authority, at December 31, 2020, BPPR could have declared a dividend of approximately $86.9 million.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common stock only out of net income available to common shareholders over the past year and only if the prospective rate of earnings retention appears consistent with the organization’s current and expected future capital needs, asset quality and overall financial condition. Moreover, under Federal Reserve Board policy, a bank holding company should not maintain dividend levels that place undue pressure on the capital of depository institution subsidiaries or that may undermine the bank holding company’s ability to be a source of strength to its banking subsidiaries. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company's capital structure.

The Federal Reserve Board also restricts the ability of banking organizations to conduct stock repurchases. In certain circumstances, a banking organization’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations or policies of the Federal Reserve. Any redemption or repurchase of preferred stock or subordinated debt is subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation organized under the laws of the Commonwealth of Puerto Rico are subject to a withholding tax of 10% instead of the 30% applied to other “foreign” corporations.

Refer to Part II, Item 5, “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities” for further information on Popular’s distribution of dividends and repurchases of equity securities.

See “Puerto Rico Regulation” below for a description of certain restrictions on BPPR’s ability to pay dividends under Puerto Rico law.

Interstate Branching

The Dodd-Frank Act amended the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Interstate Banking Act”) to authorize national banks and state banks to branch interstate through de novo branches. For purposes of the Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as are other state banks.

16

Activities and Acquisitions

In general, the BHC Act limits the activities permissible for bank holding companies to the business of banking, managing or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to be properly incidental thereto. A bank holding companies whose subsidiary depository institutions meet management, capital and Community Reinvestment Act (“CRA”) standards may elect to be treated as a financial holding company and engage in a substantially broader range of nonbanking financial activities, including securities underwriting and dealing, insurance underwriting and making merchant banking investments in nonfinancial companies.

In order for a bank holding company to elect to be treated as a financial holding company, (i) all of its depository institution subsidiaries must be well capitalized (as described above) and well managed and (ii) it must file a declaration with the Federal Reserve Board that it elects to be a “financial holding company.” A bank holding company electing to be a financial holding company must also be and remain well capitalized and well managed. Popular and PNA have elected to be treated as financial holding companies. A depository institution is deemed to be “well managed” if, at its most recent inspection, examination or subsequent review by the appropriate federal banking agency (or the appropriate state banking agency), the depository institution received at least a “satisfactory” composite rating and at least a “satisfactory” rating for the management component of the composite rating. If, after becoming a financial holding company, the company fails to continue to meet any of the capital or management requirements for financial holding company status, the company must enter into a confidential agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. If the company does not return to compliance within 180 days, the Federal Reserve Board may extend the agreement or may order the company to divest its subsidiary banks or the company may discontinue, or divest investments in companies engaged in, activities permissible only for a bank holding company that has elected to be treated as a financial holding company. In addition, if a depository institution subsidiary controlled by a financial holding company does not maintain a CRA rating of at least satisfactory, the financial holding company will be subject to restrictions on certain new activities and acquisitions.

The Federal Reserve Board may in certain circumstances limit our ability to conduct activities and make acquisitions that would otherwise be permissible for a financial holding company. Furthermore, a financial holding company must obtain prior written approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets. In addition, we are required to obtain prior Federal Reserve Board approval before engaging in certain banking and other financial activities both in the United States and abroad.

The so-called “Volcker Rule” issued under the Dodd-Frank Act restricts the ability of Popular and its subsidiaries, including BPPR and PB, to sponsor or invest in "covered funds," including private funds, or to engage in certain types of proprietary trading. In October 2019, the Volcker Rule regulators finalized amendments, effective on January 1, 2020, but with a required compliance date of January 1, 2021, to their regulations implementing the Volcker Rule, tailoring compliance requirements based on the size and scope of a banking entity’s trading activities and clarifying and amending certain definitions, requirements and exemptions. In addition, in June 2020, the Volcker Rule regulators finalized their previously proposed amendments to the Volcker Rule’s regulations relating to covered funds. These amendments established new exclusions from covered fund status for certain types of investment vehicles, modified the eligibility criteria for certain existing exclusions, and clarified and modified other provisions governing banking entities’ investments in and other transactions and relationships involving covered funds. These amendments became effective on October 1, 2020. Popular and its subsidiaries generally do not engage in the businesses subject to the Volcker Rule; therefore, the Volcker Rule does not have a material effect on our operations.

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in recent years has been aimed at combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA PATRIOT Act”) strengthened the ability of the U.S. government to help prevent, detect and prosecute international money laundering and the financing of terrorism. Title III of the USA PATRIOT Act imposed significant compliance and due diligence obligations, created new crimes and penalties and expanded the extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements could have serious legal and reputational consequences for the institution.

In January 2021, the Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act (the “BSA”), was enacted. The AMLA is intended to comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the development of

17

standards by the U.S. Department of the Treasury for evaluating technology and internal processes for BSA compliance; and expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance.

Community Reinvestment Act

The CRA requires banks to help serve the credit needs of their communities, including extending credit to low- and moderate-income individuals and geographies. Should Popular or our bank subsidiaries fail to serve adequately the community, potential penalties may include regulatory denials of applications to expand branches, relocate, add subsidiaries and affiliates, expand into new financial activities and merge with or purchase other financial institutions. In December 2019, the OCC and FDIC issued a notice of proposed rulemaking intended to amend the respective CRA rules of each regulator. The OCC issued its final CRA rule in May 2020, while the FDIC has not finalized its revisions. In September 2020, the Federal Reserve issued an advance notice of proposed rulemaking that seeks public comment on ways to modernize the Federal Reserve’s CRA regulations. The effects on Popular of any potential change to the CRA rules will depend on the final form of any Federal Reserve rulemaking and cannot be predicted at this time.

Interchange Fees Regulation

The Federal Reserve Board has established standards for debit card interchange fees and prohibited network exclusivity arrangements and routing restrictions. The maximum permissible interchange fee that an issuer may receive for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. Additionally, the Federal Reserve Board allows for an upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee if the issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards.

Consumer Financial Protection Act of 2010

The Consumer Financial Protection Bureau (the “CFPB”) supervises “covered persons” (broadly defined to include any person offering or providing a consumer financial product or service and any affiliated service provider) for compliance with federal consumer financial laws. The CFPB also has the broad power to prescribe rules applicable to a covered person or service provider identifying as unlawful, unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. We are subject to examination and regulation by the CFPB.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department Office of Foreign Assets Control (“OFAC”) administers economic sanctions that affect transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country; and (ii) a blocking of assets in which the government of the sanctioned country or other specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the United States or the possession or control of U.S. persons outside of the United States). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of the Gramm-Leach-Bliley Act of 1999 generally prohibit financial institutions, including us, from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing) unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing among affiliates for marketing purposes and governs the use and provision of information to consumer reporting agencies.

The federal banking regulators have also issued guidance and proposed rules regarding cybersecurity that are intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish lines of defense and to ensure that its risk management processes address the risk posed by compromised customer credentials. A financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of

18

cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. In December 2020, the U.S. federal bank regulatory agencies released a proposed rule regarding notification requirements for banking organizations related to significant computer security incidents. Under the proposal, a bank holding company, such as Popular and PNA, and state member bank, such as BPPR and PB, would be required to notify the Federal Reserve within 36 hours of incidents that could result in the banking organization’s inability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The effects on Popular, PNA, BPPR and PB will depend on the final form of the rule and how it is implemented.

State and foreign regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. In New York, the NYDFS requires financial institutions regulated by the NYDFS, including PB, to, among other things, (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems; (ii) implement and maintain a written cyber security policy setting forth policies and procedures for the protection of their information systems and nonpublic information; and (iii) designate a Chief Information Security Officer.

Many states and foreign governments have also recently implemented or modified their data breach notification and data privacy requirements. The California Consumer Privacy Act (“CCPA”) became effective on January 1, 2020 and imposes privacy compliance obligations with regard to the personal information of California residents, and the November 2020 amendment to the CCPA creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered by the law and certain rights relating to personal information. In European Union, the General Data Protection Regulation heightens privacy compliance obligations and imposes strict standards for reporting data breaches. We expect this trend to continue and are continually monitoring developments in the jurisdictions in which we operate.

See “Puerto Rico Regulation” below for a description of legislations and regulations on information privacy and cybersecurity in Puerto Rico.

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Popular, that are not “large, complex banking organizations.” Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Federal Reserve Board, OCC and FDIC have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking agencies and the SEC, to adopt rules prohibiting incentive-based payment arrangements that encourage inappropriate risks by providing excessive compensation or that could lead to a material financial loss at specified regulated entities having at least $1 billion in total assets (including Popular, PNA, BPPR and PB). The U.S. financial regulators proposed revised rules in 2016, which have not been finalized.

Puerto Rico Regulation

As a commercial bank organized under the laws of Puerto Rico, BPPR is subject to supervision, examination and regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended (the “Banking Law”).

19

Section 27 of the Banking Law requires that at least ten percent (10%) of the yearly net income of BPPR be credited annually to a reserve fund. The apportionment must be done every year until the reserve fund is equal to the total of paid-in capital on common and preferred stock. During 2020, $49.4 million was transferred to the statutory reserve account.

Section 27 of the Banking Law also provides that when the expenditures of a bank are greater than its receipts, the excess of the former over the latter must be charged against the undistributed profits of the bank, and the balance, if any, must be charged against the reserve fund. If the reserve fund is not sufficient to cover such balance in whole or in part, the outstanding amount must be charged against the capital account and no dividend may be declared until capital has been restored to its original amount and the reserve fund to 20% of the original capital.

Section 16 of the Banking Law requires every bank to maintain a legal reserve that, except as otherwise provided by the Office of the Commissioner, may not be less than 20% of its demand liabilities, excluding government deposits (federal, state and municipal) that are secured by collateral. If a bank is authorized to establish one or more bank branches in a state of the United States or in a foreign country, where such branches are subject to the reserve requirements of that state or country, the Office of the Commissioner may exempt said branch or branches from the reserve requirements of Section 16. Pursuant to an order of the Federal Reserve Board dated November 24, 1982, BPPR has been exempted from the reserve requirements of the Federal Reserve System with respect to deposits payable in Puerto Rico. Accordingly, BPPR is subject to the reserve requirement prescribed by the Banking Law. During 2020, BPPR was in compliance with the statutory reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to any one person, firm, partnership or corporation, up to an aggregate amount of fifteen percent (15%) of the paid-in capital and reserve fund of the bank. As of December 31, 2020, the legal lending limit for BPPR under this provision was approximately $303 million. In the case of loans which are secured by collateral worth at least 25% more than the amount of the loan, the maximum aggregate amount is increased to one third of the paid-in capital of the bank, plus its reserve fund. If the institution is well capitalized and had been rated 1 in the last examination performed by the Office of the Commissioner or any regulatory agency, its legal lending limit shall also include 15% of 50% of its undivided profits and for loans secured by collateral worth at least 25% more than the amount of the loan, the capital of the bank shall also include 33 1/3% of 50% of its undivided profits. Institutions rated 2 in their last regulatory examination may include this additional component in their legal lending limit only with the previous authorization of the Office of the Commissioner. There are no restrictions under Section 17 on the amount of loans that are wholly secured by bonds, securities and other evidence of indebtedness of the Government of the United States or Puerto Rico, or by current debt bonds, not in default, of municipalities or instrumentalities of Puerto Rico. During 2020, BPPR was in compliance with the lending limit requirements of Section 17 of the Banking law.

Section 14 of the Banking Law authorizes a bank to conduct certain financial and related activities directly or through subsidiaries, including finance leasing of personal property and originating and servicing mortgage loans. BPPR engages in finance leasing through its wholly-owned subsidiary, Popular Auto, LLC, which is organized and operates in Puerto Rico. The origination and servicing of mortgage loans is conducted by Popular Mortgage, a division of BPPR.

On information privacy, Puerto Rico law requires businesses to implement information security controls to protect consumers’ personal information from breaches, as well as to provide notice of any breach to affected customers.

Available Information

We maintain an Internet website at www.popular.com. Via the “Investor Relations” link at our website, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to such reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available, free of charge, as soon as reasonably practicable after such forms are electronically filed with, or furnished to, the SEC. The SEC also maintains an internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. You may obtain copies of our filings on the SEC site.

We have adopted a written code of ethics that applies to all directors, officers and employees of Popular, including our principal executive officer and senior financial officers, in accordance with Section 406 of the Sarbanes-Oxley Act of 2002 and the rules of the SEC promulgated thereunder. Our Code of Ethics is available on our corporate website, www.popular.com, in the section entitled “Corporate Governance.” In the event that we make changes in, or provide waivers from, the provisions of this Code of Ethics that the SEC requires us to disclose, we intend to disclose these events on our corporate website in such section. In the Corporate Governance section of our corporate website, we have also posted the charters for our Audit Committee, Talent and Compensation Committee, Risk Management Committee and Corporate Governance and Nominating Committee, as well as our

20

Corporate Governance Guidelines. In addition, information concerning purchases and sales of our equity securities by our executive officers and directors is posted on our website.

All website addresses given in this document are for information only and are not intended to be active links or to incorporate any website information into this document.

ITEM 1A. RISK FACTORS

We, like other financial institutions, face risks inherent to our business, financial condition, liquidity, results of operations and capital position. These risks could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in this report.

The risks described in this report are not the only risks we face. Additional risks and uncertainties not currently known by us or that we currently deem to be immaterial, or that are generally applicable to all financial institutions, also may materially adversely affect our business, financial condition, liquidity, results of operations or capital position.

RISKS RELATING TO THE BUSINESS and economic ENVIRONMENT AND OUR INDUSTRY

The coronavirus (COVID-19) pandemic has significantly disrupted the global economy and the markets in which we operate, which has adversely impacted, and may continue to adversely impact, our business, financial condition and results of operation. Its continued impact will depend on future developments, which are highly uncertain and difficult to predict, including the scope and duration of the pandemic, the direct and indirect impact of the pandemic on our employees, customers, clients, counterparties and service providers, as well as other market participants, and actions taken by governmental authorities and other third parties in response to the pandemic.

The COVID-19 pandemic has significantly disrupted and negatively impacted the global economy, disrupted global supply chains, created significant volatility in the financial markets, significantly increased unemployment levels worldwide and decreased consumer confidence and commercial activity generally, including in the markets in which we do business, leading to an increased risk of delinquencies, defaults and foreclosures. The COVID-19 pandemic has also contributed to higher and more volatile credit loss expense and potential for increased charge-offs; loan and credit ratings downgrades; credit deterioration and defaults in many industries; a significant increase in the volatility of equity, fixed income and commodity markets; and a decrease in the rates and yields on U.S. Treasury securities and other investment securities, which has led to decreased net interest income.

In response to the pandemic, governments across the world, including the governments of Puerto Rico (our primary market), the United States Virgin Islands (“USVI”) and the British Virgin Islands (“BVI”), as well as state governments in the United States mainland, including New York, New Jersey and Florida, where Popular Bank (“PB”) has branches, ordered the temporary closure of many businesses, implemented mandatory curfews and the institution of social distancing, shelter in place and other health and safety requirements. Although many of these restrictive measures have been eased or lifted, allowing for the gradual reopening of the economy, certain restrictive measures remain in place and additional restrictive measures may be implemented in the future as a result of a resurgence in the spread of the virus or new strains of the virus. The restrictions imposed by governments in response to the outbreak caused significant disruption to economic activity and an increase in unemployment in the markets in which we operate, including Puerto Rico, which has been facing significant fiscal and economic challenges for over a decade. For more information, refer to the Geographic and Government Risk section of the Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) section in the Annual Report on Form 10-K. Further deterioration of the Puerto Rico, USVI, BVI and the broader U.S. economy would be expected to adversely affect the ability of our borrowers to comply with their financial obligations and adversely impact demand for our products and services. The disruption in economic activity could also adversely affect the financial condition of government entities in Puerto Rico, the USVI and BVI to which we have exposure.

The COVID-19 pandemic also has significantly disrupted our operations and negatively impacted our business and financial condition. Many of BPPR’s and PB’s branches were temporarily closed in response to the pandemic. Currently, nearly all BPPR’s and PB’s branches are operating, in all instances subject to measures to preserve the health and safety of our employees and customers. To protect the health and safety of our workforce, we have facilitated a significant portion of our workforce to work remotely, which further exposes the Corporation to heightened risks with respect to cybersecurity, information security and other operational incidents, as well as our ability to maintain an effective system of internal controls. Furthermore, although we have

21

implemented a remote work protocol for many of our workers and instituted health and safety measures to protect employees that cannot work remotely, a disruption to our ability to deliver financial products or services to, or interact with, our customers could also result in losses or increased operational costs, regulatory fines, penalties and other sanctions, or harm our reputation.

Furthermore, in response to the pandemic, beginning in March 2020, the Corporation implemented measures to provide financial relief to customers through programs such as payment moratoriums, suspensions of foreclosures and other collection activity, as well as waivers of certain fees and service charges. By the end of the third quarter of 2020 the Corporation had reinstated the imposition of these fees and service charges and resumed its delinquent loan collection efforts. The Federal Government also approved several economic stimulus measures, including the Coronavirus Aid, Relief and Economic Security Act, or CARES Act, that seek to cushion the economic fallout of the pandemic, including guaranteeing loans to small and medium-sized businesses through the Small Business Administration’s (“SBA”) Paycheck Protection Program (the “PPP”). However, there can be no assurance that measures taken by governmental authorities will be sufficient to offset the pandemic’s economic impact. In addition, moratoriums imposed by Federal or state law or provided voluntarily by the Corporation may limit our ability to determine the impact of the COVID-19 pandemic on the financial condition of certain of our customers and the credit quality of our loan portfolio until borrowers that have benefited from such moratoriums are required to resume loan repayments. As of December 31, 2020, only 4,359 loans with an aggregate book value of $0.5 billion remained subject to payment moratoriums. For a discussion on the loan payment moratorium programs implemented by the Corporation to provide financial relief to customers during the pandemic, refer to the Allowance for Credit Losses section of the MD&A in the Annual Report on Form 10-K. Such moratorium and stimulus programs have also imposed significant operational burdens on the Corporation, which also heighten the risk of operational incidents, including fraud and undetected errors. Our participation (or lack of participation) in certain governmental programs enacted in response to the pandemic, including the PPP, could further result in reputational harm, litigation and regulatory and other government action against the Corporation. For example, the Corporation may be exposed to the risk of litigation, from both customers and non-customers that approached the Corporation regarding PPP loans, regarding its process and procedures used in processing applications under the PPP and may be exposed to adverse action for the improper conduct of its employees in connection with such loans. Furthermore, the Corporation may also have credit risk with respect to PPP loans if the SBA determines that there have been deficiencies in the way a PPP loan was originated, funded, or serviced by the Corporation, and denies its liability under the guaranty, reduces the amount of the guaranty or, if it has already paid under the guaranty, seeks recovery of any loss related to the deficiency from the Corporation.

The Corporation’s financial results for the year 2020 reflect the impact of the business disruption and relief measures described above. For example, the Corporation’s revenue streams were impacted during the first and second quarters of the year as a result of reduced consumer transaction activity, lower interchange income, the waiver of certain late fees and service charges, as well as the suspension in mortgage origination and related securitization and loan sale activities. During 2020, the Corporation also incurred additional expenses related to front-line employee bonuses, the enabling of remote access for employees to work from home, the expansion of employee benefits, as well as the impact of specific measures to prevent the spread of the disease and efforts related to customer relief programs, among other related expenses. The Corporation’s financial results for the second half of 2020 reflect the impact of increased economic activity because of the gradual reopening of the economy and the related improvement in the macroeconomic environment, as well as the impact of the various government stimulus programs launched in response to the pandemic. The extent to which the COVID-19 pandemic continues to impact our business, results of operations and financial condition (including our provision for credit losses, net charge offs, regulatory capital, liquidity ratios and the liquidity of the bank holding company and its operating subsidiaries), as well as the operations of our clients, customers, service providers and suppliers, will depend on future developments, which are highly uncertain and difficult to predict at this time, including the scope and duration of the pandemic, the appearance of new strains of the virus and actions taken by governmental authorities and other third parties in response to the pandemic, such as the speed and effectiveness of vaccination programs and the nature and length of economic stimulus initiatives. To the extent the pandemic continues to adversely affect our business, financial condition, liquidity or results of operations, it may also have the effect of heightening many of the other risks described in this section.

A significant portion of our business is concentrated in Puerto Rico, where economic and fiscal challenges have adversely impacted and may continue to adversely impact us.

Our credit exposure is concentrated in Puerto Rico, which accounted as of December 31, 2020 for approximately 82% of our total assets, 84% of our deposits and 81% of our revenues for the year ended December 31, 2020. As such, our financial condition and results of operations are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real estate markets and asset values in Puerto Rico. Puerto Rico entered recession in the fourth quarter of fiscal year 2006 and its gross national product (GNP) thereafter contracted in real terms every year between fiscal years 2007

22

and 2018 (inclusive), except fiscal year 2012. Pursuant to the latest Puerto Rico Planning Board (the “Planning Board”) estimates, published in June 2020, the Commonwealth’s real GNP for fiscal years 2017 and 2018 decreased by 3.2% and 4.2%, respectively. The Planning Board estimates that real GNP increased approximately 1.5% in fiscal year 2019 due to the influx of federal funds and private insurance payments to repair damage caused by Hurricanes Irma and María, and that it decreased by approximately -5.4% in fiscal year 2020 due primarily to the adverse impact of the COVID-19 pandemic and the measures taken by the government in response to the same. The Planning Board projected that the negative effects of COVID-19 would continue through fiscal year 2021, resulting in a contraction in real GNP of approximately -2% in the current fiscal year.

The Commonwealth’s government has also been facing significant fiscal challenges that may have been exacerbated by the COVID-19 pandemic. The historical structural imbalance between revenues and expenditures, on the one hand, and unfunded legacy pension obligations, on the other hand, coupled with the Commonwealth’s inability to access financing in the capital markets or from private lenders, resulted in the Commonwealth and various public corporations defaulting on and eventually seeking to restructure their debts and for the U.S. Congress to enact the Puerto Rico Oversight, Management and Economic Stability Act (“PROMESA”) in June 2016. PROMESA, among other things, established a seven-member federally-appointed oversight board (the “Oversight Board”) with broad powers over the finances of the Commonwealth and its instrumentalities and provided to the Commonwealth, its public corporations and municipalities, broad-based restructuring authority, including through a bankruptcy-type process similar to that of Chapter 9 of the U.S. Bankruptcy Code. For a discussion of risks related to the Corporation’s credit exposure to the Commonwealth and its instrumentalities, see the Geographic and Government Risk section in the MD&A section of the Annual Report on Form 10-K.

The credit quality of BPPR’s loan portfolio necessarily reflects, among other things, the general economic conditions in Puerto Rico and other adverse conditions affecting Puerto Rico consumers and businesses. The Commonwealth’s prolonged recession resulted in limited loan demand and in an increase in the rate of foreclosures and delinquencies on loans granted in Puerto Rico. The measures taken to address the fiscal crisis and those that may have to be taken in the future could affect many of our individual customers and customers’ businesses, which could cause credit losses that adversely affect us. Fiscal adjustments have resulted and may continue to result in significant resistance from local politicians and other stakeholders, which may lead to social and political instability. Any reduction in consumer spending because of these issues may also adversely impact our interest and non-interest revenues.

If global or local economic conditions worsen, including as a result of the COVID-19 pandemic, or the Government of Puerto Rico is unable to manage its fiscal crisis, including completing an orderly restructuring of its debt obligations while continuing to provide essential services, those adverse effects could continue or worsen in ways that we are not able to predict and that are outside of our control. Under such circumstances, we could experience an increase in the level of provision for loan losses, nonperforming assets, net charge-offs and reserve for credit losses. These factors could have a material adverse impact on our earnings and financial condition.

Further deterioration in collateral values of properties securing our commercial, mortgage loan and construction portfolios would result in increased credit losses and continue to harm our results of operations.

The value of properties in some of the markets we serve, in particular in Puerto Rico, declined during the past decade as a result of adverse economic conditions. Further deterioration of the value of real estate collateral securing our commercial, mortgage loan and construction loan portfolios would result in increased credit losses. As of December 31, 2020, approximately 27%, 27% and 3%, of our loan portfolio consisted of commercial loans secured by real estate, mortgage loans and construction loans, respectively.

Substantially our entire loan portfolio is located within the boundaries of the U.S. economy. Whether the collateral is in Puerto Rico, the USVI, the BVI or the U.S. mainland, the performance of our loan portfolio and the collateral value backing the transactions are dependent upon the performance of and conditions within each specific real estate market. General economic conditions in Puerto Rico (as impacted by the COVID-19 pandemic) and fiscal reforms aimed at addressing the current fiscal crisis could cause a further deterioration of the value of the real estate collateral securing our loan portfolios.

A further deterioration of the fair value of real estate properties for collateral dependent impaired loans would require increases in our provision for loan losses and allowance for loan losses. Any such increase would have an adverse effect on our future financial condition and results of operations. For more information on the credit quality of our construction, commercial and mortgage portfolio, see the Credit Risk section of the MD&A included in the Annual Report on Form 10-K.

23

Legislative and regulatory reforms may have a significant impact on our business and results of operations.

Popular is subject to extensive regulation, supervision and examination by federal, New York and Puerto Rico banking authorities. Any change in applicable federal, New York or Puerto Rico laws or regulations (or laws and regulations in other jurisdictions in which we may do business, such as California), including any changes implemented by the new administration, could have a substantial impact on our operations. Additional laws and regulations may be enacted or adopted in the future that could significantly affect our powers, authority and operations, which could have a material adverse effect on our financial condition and results of operations. Further, regulators in the performance of their supervisory and enforcement duties, have significant discretion and power to prevent or remedy unsafe and unsound practices or violations of laws by banks and bank holding companies. The exercise of this regulatory discretion and power could have a negative impact on Popular. Furthermore, the Commonwealth has enacted various reforms in response to its fiscal and economic problems and is likely to implement additional reforms as part of its obligations under PROMESA.

RISKS RELATING TO OUR BUSINESS

The fiscal and economic challenges of some of the jurisdictions in which we operate could materially adversely affect the value and performance of our portfolio of government securities and our loans to government entities in such jurisdictions, as well as the value and performance of commercial, mortgage and consumer loans to private borrowers who have significant relationships with the government or could be directly affected by government action in such jurisdictions. A reduction in Puerto Rico government deposits could also adversely affect our net interest income.

We have direct and indirect lending and investment exposure to the Puerto Rico government, its public corporations and municipalities. A deterioration of the Commonwealth’s fiscal and economic condition, including as a result of the COVID-19 pandemic and/or actions taken by the Commonwealth government or the Oversight Board to address the ongoing fiscal and economic crisis in Puerto Rico, could materially adversely affect the value and performance of our Puerto Rico government obligations, as well as the value and performance of commercial, mortgage and consumer loans to private borrowers who have significant relationships with the government or could be directly affected by government action, resulting in losses to us.

At December 31, 2020, our direct exposure to Puerto Rico government obligations was limited to obligations from various municipalities and amounted to $377 million. Of the amount outstanding at December 31, 2020, $342 million consisted of loans and $35 million consisted of securities. These municipal obligations are mostly general obligations backed by property tax revenues and to which the applicable municipality has pledged its good faith, credit and unlimited taxing power, or “special obligations”, to which the applicable municipality has pledged other revenues. In addition, at December 31, 2020, the Corporation had $317 million in loans insured or securities issued by Puerto Rico governmental entities but for which the principal source of repayment is non-governmental. For additional discussion of the Corporation’s exposure to the Puerto Rico government and its instrumentalities and municipalities, refer to the Geographic and Government Risk section in the MD&A section of the Annual Report on Form 10-K.

BPPR’s commercial loan portfolio also includes loans to private borrowers who are service providers, lessors, suppliers or have other relationships with the Puerto Rico government. These borrowers could be negatively affected by the fiscal measures to be implemented to address the Commonwealth’s fiscal crisis and the ongoing debt restructuring proceedings under PROMESA. Similarly, BPPR’s mortgage and consumer loan portfolios include loans to government employees which could also be negatively affected by fiscal measures such as employee layoffs or furloughs.

Furthermore, BPPR has a significant amount of deposits from the Commonwealth, its instrumentalities, and municipalities. The amount of such deposits may fluctuate depending on the financial condition and liquidity of such entities, as well as on the ability of BPPR to maintain these customer relationships. A portion of such deposits could also be used by the Commonwealth as part of its debts restructuring agreements under Title III of PROMESA. While a significant decrease in these deposits should not materially affect our liquidity since such deposits are collateralized, a significant decrease in the amount of such deposits could adversely affect our net interest income.

BPPR also has operations in the USVI and has credit exposure to USVI government entities. At December 31, 2020, BPPR’s direct exposure to USVI instrumentalities and public corporations amounted to approximately $105 million, of which $70 million is outstanding. The USVI has been experiencing several fiscal and economic challenges that could adversely affect the ability of its public corporations and instrumentalities to service their outstanding debt obligations. For additional information on the

24

Corporation’s exposure to the USVI government, refer to the Geographic and Government Risk section in the MD&A section of the Annual Report on Form 10-K.

Our businesses are subject to extensive regulation and we from time to time receive requests for information from departments of the U.S. and Puerto Rico governments, including those that investigate mortgage-related conduct.

Our businesses are subject to extensive regulation and we from time to time self-report compliance matters to, or receive requests for information from, departments of the U.S. and Puerto Rico governments. BPPR has received subpoenas and other requests for information from the departments of the U.S. government that investigate mortgage-related conduct, mainly concerning real estate appraisals and residential and construction loans in Puerto Rico. BPPR has also self-identified and reported to applicable regulators matters with respect to mortgage related practices.

For example, in July 2017, management learned that certain letters related to approximately 23,000 residential mortgage loans generated by Popular to comply with Bureau of Consumer Financial Protection (“CFPB”) rules requiring written notification to borrowers who have submitted a loss mitigation application were not mailed to borrowers over a period of up to approximately three-years due to a systems interface error. Loss mitigation is a process whereby creditors work with mortgage loan borrowers who are having difficulties making their loan payments on their debt. Popular corrected the systems interface error that caused the letters not to be sent, notified applicable regulators (including the CFPB), completed a review of its mortgage files to assess the scope of potential customer impact and conducted outreach and remediation efforts with respect to borrowers potentially affected by the systems interface error.

Incidents of this nature and investigations or examinations by governmental authorities (whether arising from these incidents or otherwise) may result in judgments, settlements, fines, enforcement actions, penalties or other sanctions adverse to the Corporation which could materially and adversely affect the Corporation’s business, financial condition or results of operations, or cause serious reputational harm.

We are exposed to credit risk from mortgage loans that have been sold or are being serviced subject to recourse arrangements.

Popular is generally at risk for mortgage loan defaults from the time it funds a loan until the time the loan is sold or securitized into a mortgage-backed security. We have furthermore retained, through recourse arrangements, part of the credit risk on sales of mortgage loans, and we also service certain mortgage loan portfolios with recourse. At December 31, 2020, we serviced $0.9 billion in residential mortgage loans subject to credit recourse provisions, principally loans associated with Fannie Mae and Freddie Mac programs. In the event of any customer default, pursuant to the credit recourse provided, we are required to repurchase the loan or reimburse the third-party investor for the incurred loss. The maximum potential amount of future payments that we would be required to make under the recourse arrangements in the event of nonperformance by the borrowers is equivalent to the total outstanding balance of the residential mortgage loans serviced with recourse and interest, if applicable. During 2020, we repurchased approximately $161 million in mortgage loans subject to credit recourse provisions. In the event of nonperformance by the borrower, we have rights to the underlying collateral securing the mortgage loan. As of December 31, 2020, our liability established to cover the estimated credit loss exposure related to loans sold or serviced with credit recourse amounted to $22 million. We may suffer losses on these loans when the proceeds from a foreclosure sale of the property underlying a defaulted mortgage loan are less than the outstanding principal balance of the loan plus any uncollected interest advanced and the costs of holding and disposing of the related property.

Defective and repurchased loans may harm our business and financial condition.

In connection with the sale and securitization of loans, we are required to make a variety of customary representations and warranties regarding Popular and the loans being sold or securitized. Our obligations with respect to these representations and warranties are generally outstanding for the life of the loan, and they relate to, among other things, compliance with laws and regulations, underwriting standards, the accuracy of information in the loan documents and loan file and the characteristics and enforceability of the loan.