POPULAR, INC. - Annual Report: 2021 (Form 10-K)

1

2

Forward-Looking Statements

This Form 10-K contains “forward-looking statements” within the meaning of the U.S. Private Securities Litigation Reform Act of 1995, including, without limitation, statements about Popular Inc.’s (the “Corporation,” “Popular,” “we,” “us,” “our”) business, financial condition, results of operations, plans, objectives and future performance. These statements are not guarantees of future performance, are based on management’s current expectations and, by their nature, involve risks, uncertainties, estimates and assumptions. Potential factors, some of which are beyond the Corporation’s control, could cause actual results to differ materially from those expressed in, or implied by, such forward-looking statements. Risks and uncertainties include without limitation the effect of competitive and economic factors, and our reaction to those factors, the adequacy of the allowance for loan losses, delinquency trends, market risk and the impact of interest rate changes, capital markets conditions, capital adequacy and liquidity, and the effect of legal and regulatory proceedings and new accounting standards on the Corporation’s financial condition and results of operations. All statements contained herein that are not clearly historical in nature are forward-looking, and the words “anticipate,” “believe,” “continues,” “expect,” “estimate,” “intend,” “project” and similar expressions and future or conditional verbs such as “will,” “would,” “should,” “could,” “might,” “can,” “may” or similar expressions are generally intended to identify forward-looking statements.

Various factors, some of which are beyond Popular’s control, could cause actual results to differ materially from those expressed in, or implied by, such forward-looking statements. Factors that might cause such a difference include, but are not limited to:

the rate of growth or decline in the economy and employment levels, as well as general business and economic conditions in the geographic areas we serve and, in particular, in the Commonwealth of Puerto Rico (the “Commonwealth” or “Puerto Rico”), where a significant portion of our business is concentrated;

 the impact of the current fiscal and economic challenges of Puerto Rico and the measures taken and to be taken by the Puerto Rico Government and the Federally-appointed oversight board on the economy, our customers and our business;

 the impact of the pending debt restructuring proceedings under Title III of the Puerto Rico Oversight, Management and Economic Stability Act (“PROMESA”) and of other actions taken or to be taken to address Puerto Rico’s fiscal challenges on the value of our portfolio of Puerto Rico government securities and loans to governmental entities and of our commercial, mortgage and consumer loan portfolios where private borrowers could be directly affected by governmental action;

 the amount of Puerto Rico public sector deposits held at the Corporation, whose future balances are uncertain and difficult to predict and may be impacted by factors such as the amount of Federal funds received by the P.R. Government in connection with the COVID-19 pandemic and the rate of expenditure of such funds, as well as the timeline and implementation of the Plan of Adjustment for the Puerto Rico debt restructuring under Title III of PROMESA;

 risks related to Popular’s planned acquisition of certain information technology and related assets currently used by EVERTEC, Inc. to service certain of Banco Popular de Puerto Rico’s key channels, as well as the planned entry into amended and restated commercial agreements and the sale or conversion into non-voting of Popular’s ownership stake in Evertec (the “Transaction”), including: the length of time necessary to consummate the Transaction; the ability to satisfy the conditions to the closing thereof; the receipt of any regulatory approvals necessary to effect the Transaction and the contemplated return to shareholders of net gains resulting from a sale of EVERTEC, Inc. shares; the ability to successfully transition and integrate the assets acquired as part of the Transaction, as well as related operations, employees and third party contractors; unexpected costs, including, without limitation, costs due to exposure to any unrecorded liabilities or issues not identified during due diligence investigation of the Transaction or that are not subject to indemnification or reimbursement by EVERTEC, Inc.; risks that Popular may be affected by operational and other risks arising from the acquisition of the acquired assets, including the transition and integration thereof, or by adverse effects on relationships with customers, employees and service providers; and business and other risks arising from the extension of Popular’s current commercial agreements with EVERTEC, Inc., as well as the sale or conversion of EVERTEC, Inc. shares owned by Popular;

3

 the scope and duration of the COVID-19 pandemic (including the appearance of new strains of the virus), actions taken by governmental authorities in response to the pandemic, and the direct and indirect impact of the pandemic on us, our customers, service providers and third parties;

 changes in interest rates and market liquidity, which may reduce interest margins, impact funding sources and affect our ability to originate and distribute financial products in the primary and secondary markets;

 the fiscal and monetary policies of the federal government and its agencies;

 changes in federal bank regulatory and supervisory policies, including required levels of capital and the impact of proposed capital standards on our capital ratios;

 additional Federal Deposit Insurance Corporation (“FDIC”) assessments;

 regulatory approvals that may be necessary to undertake certain actions or consummate strategic transactions, such as acquisitions and dispositions;

 unforeseen or catastrophic events, including extreme weather events, other natural disasters, man-made disasters, acts of violence or war or the emergence of pandemics, epidemics and other health-related crises, which could cause a disruption in our operations or other adverse consequences for our business;

 the relative strength or weakness of the consumer and commercial credit sectors and of the real estate markets in Puerto Rico and the other markets in which borrowers are located;

 the performance of the stock and bond markets;

 competition in the financial services industry;

 possible legislative, tax or regulatory changes; and

 a failure in or breach of our operational or security systems or infrastructure or those of EVERTEC, Inc., our provider of core financial transaction processing and information technology services, or of other third parties providing services to us, including as a result of cyberattacks, e-fraud, denial-of-services and computer intrusion, that might result in loss or breach of customer data, disruption of services, reputational damage or additional costs to Popular.

Other possible events or factors that could cause our results or performance to differ materially from those expressed in these forward-looking statements include the following:

 negative economic conditions that adversely affect housing prices, the job market, consumer confidence and spending habits which may affect, among other things, the level of non-performing assets, charge-offs and provision expense;

 changes in market rates and prices which may adversely impact the value of financial assets and liabilities;

 potential judgments, claims, damages, penalties, fines, enforcement actions and reputational damage resulting from pending or future litigation and regulatory or government investigations or actions, including as a result of our participation in and execution of government programs related to the COVID-19 pandemic;

 changes in accounting standards, rules and interpretations;

 our ability to grow our core businesses;

 decisions to downsize, sell or close units or otherwise change our business mix; and

 management’s ability to identify and manage these and other risks.

4

Moreover, the outcome of legal and regulatory proceedings, as discussed in “Part I, Item 3. Legal Proceedings,” is inherently uncertain and depends on judicial interpretations of law and the findings of regulators, judges and/or juries. Investors should refer to “Part I, Item 1A” of this Form 10-K for a discussion of certain risks and uncertainties to which the Corporation is subject.

All forward-looking statements included in this Form 10-K are based upon information available to Popular as of the date of this Form 10- K, and other than as required by law, including the requirements of applicable securities laws, we assume no obligation to update or revise any such forward-looking statements to reflect occurrences or unanticipated events or circumstances after the date of such statements.

5

TABLE OF CONTENTS

6

PART I POPULAR, INC.

ITEM 1. BUSINESS

General

Popular is a diversified, publicly-owned financial holding company, registered under the Bank Holding Company Act of 1956, as amended (the “BHC Act”) and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the “Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the largest financial institution based in Puerto Rico, with consolidated assets of $75.1 billion, total deposits of $67.0 billion and stockholders’ equity of $6.0 billion at December 31, 2021. At December 31, 2021, we ranked among the 50 largest U.S. bank holding companies based on total assets according to information gathered and disclosed by the Federal Reserve Board.

We operate in two principal markets:

 Puerto Rico: We provide retail, mortgage and commercial banking services through our principal banking subsidiary, Banco Popular de Puerto Rico (“Banco Popular” or “BPPR”), as well as auto and equipment leasing and financing, investment banking, broker-dealer and insurance services through specialized subsidiaries. BPPR’s deposits are insured under the Deposit Insurance Fund (“DIF”) of the Federal Deposit Insurance Corporation (“FDIC”). The banking operations of BPPR are primarily based in Puerto Rico, where BPPR has the largest retail banking franchise.

 Mainland United States: We provide retail, mortgage and commercial banking services through our New York-chartered banking subsidiary, Popular Bank (“PB” or “Popular U.S.”), which has branches in New York, New Jersey and Florida; as well as commercial direct financing leases through a specialized subsidiary, Popular Equipment Finance LLC in Minnesota. PB’s deposits are insured under the DIF of the FDIC.

 BPPR also conducts banking operations in the U.S. Virgin Islands, the British Virgin Islands and New York. In addition to BPPR’s commercial banking operations in New York, BPPR offers financial products on a National scale in the U.S. market, including by operating an online platform used to originate personal loans under the E-Loan brand, issuing several co-branded credit cards offerings and gathering insured institutional deposits via online deposit gathering platforms. In the U.S. and British Virgin Islands, BPPR offers a range of banking products, including loans and deposits to both retail and commercial customers.

For further information about the Corporation’s results segregated by its reportable segments, see “Reportable Segment Results” in the Management’s Discussion and Analysis section of the Annual Report and Note 37 included in the Annual Report in this Form 10-K.

Refer to the Overview section of Management’s Discussion and Analysis, in the Annual Report in this Form 10-K., for information on recent significant events that have impacted or will impact our current and future operations.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial. Commercial loans are comprised of (i) commercial and industrial (C&I) loans and leases to commercial customers for use in normal business operations and to finance working capital needs, equipment purchases or other projects, and (ii) commercial real estate (CRE) loans (excluding construction loans) for income-producing real estate properties as well as owner-occupied properties. C&I loans are underwritten individually and usually secured with the assets of the company and the personal guarantee of the business owners. CRE loans consist of loans for income-producing real estate properties and the financing of owner-occupied facilities if there is real estate as collateral. Non-owner-occupied CRE loans are generally made to finance office and industrial buildings, healthcare facilities, multifamily buildings and retail shopping centers and are repaid through cash flows related to the operation, sale or refinancing of the property.

7

(2) Mortgage. Mortgage loans include residential mortgage loans to consumers for the purchase or refinancing of a residence and also include residential construction loans made to individuals for the construction of refurbishment of their residence.

(3) Consumer. Consumer loans are mainly comprised of personal loans, credit cards, and automobile loans, and to a lesser extent home equity lines of credit (“HELOCs”) and other loans made by banks to individual borrowers.

(4) Construction. Construction loans are CRE loans to companies or developers used for the construction of a commercial or residential property for which repayment will be generated by the sale or permanent financing of the property. Our construction loan portfolio primarily consists of retail, residential (land and condominiums), office and warehouse product types.

(5) Lease Financings. Lease financings are offered by BPPR and are primarily comprised of automobile loans/leases made through automotive dealerships and equipment lease financings.

Business Concentration

Since our business activities are currently concentrated primarily in Puerto Rico, our results of operations and financial condition are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real estate markets. The concentration of our operations in Puerto Rico exposes us to greater risk than other banking companies with a wider geographic base. Our asset and revenue composition by geographical area is presented in “Financial Information about Geographic Areas” below and in Note 37 in the Annual Report in this Form 10-K.

Our loan portfolio is diversified by loan category. However, approximately 57% of our loan portfolio at December 31, 2021 consisted of real estate-related loans, including residential mortgage loans, construction loans and commercial loans secured by commercial real estate. The table below presents the distribution of our loan portfolio by loan category at December 31, 2021.

Except for the Corporation’s exposure to the Puerto Rico Government sector, no individual or single group of related accounts is considered material in relation to our total assets or deposits, or in relation to our overall business. For a discussion of our loan portfolio and our exposure to the Government of Puerto Rico, see “Financial Condition – Loans” and “Credit Risk – Geographical and Government Risk” in the “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in the Annual Report in this Form 10-K.

Credit Administration and Credit Policies

Interest from our loan portfolios is our principal source of revenue. Whenever we make loans, we expose ourselves to credit risk. Credit risk is controlled and monitored through active asset quality management, including the use of lending standards, thorough review of potential borrowers and active asset quality administration.

Business activities that expose us to credit risk are managed within the Board of Director’s Risk Management policy, and the Credit Risk Tolerance Limits policy, which establishes limits that consider factors such as maintaining a prudent balance of risk-taking across diversified risk types and business units, compliance with regulatory guidance, controlling the exposure to lower credit quality assets, and limiting growth in, and overall exposure to, any product or risk segment where we do not have sufficient experience and a proven ability to predict credit losses.

8

We maintain comprehensive credit policies for all lines of business in order to mitigate credit risk. Our credit policies are approved by our Board of Directors. These policies set forth, among other things, the objectives, scope and responsibilities of the credit management cycle. Our internal written procedures establish underwriting standards and procedures for monitoring and evaluating loan portfolio quality and require prompt identification and quantification of asset quality deterioration or potential loss to ensure the adequacy of the allowance for credit losses. These written procedures establish various approval and lending limit levels, ranging from bank branch or department officers to managerial and senior management levels. Approval levels are primarily determined by the amount, type of loan and risk characteristics of the credit facility.

Our credit policies and procedures establish documentation requirements for each loan and related collateral type, when applicable, during the underwriting, closing and monitoring phases. For commercial and construction loans, during the initial loan underwriting process, the credit policies require, at a minimum, historical financial statements or tax returns of the borrower and any guarantor, an analysis of financial information contained in a credit approval package, a risk rating determination and reports from credit agencies and appraisals for real estate-related loans. The credit policies also set forth the required closing documentation depending on the loan and the collateral type.

Although we originate most of our loans internally in both the Puerto Rico and mainland United States markets, we occasionally purchase or participate in loans originated by other financial institutions. When we purchase or participate in loans originated by others, we conduct the same underwriting analysis of the borrowers and apply the same criteria as we do for loans originated by us. This also includes a review of the applicable legal documentation.

Refer to the Credit Risk section of Management’s Discussion and Analysis, in the Annual Report in this Form 10-K for information related to management committees and divisions with responsibilities for establishing policies and monitoring the Corporation’s credit risk.

Loan extensions, renewals and restructurings

Loans with satisfactory credit profiles can be extended, renewed or restructured. Many commercial loan facilities are structured as lines of credit, which are mainly one year in term and therefore are required to be renewed annually. Other facilities may be restructured or extended from time to time based upon changes in the borrower’s business needs, use of funds, timing of completion of projects and other factors. If the borrower is not deemed to have financial difficulties, extensions, renewals and restructurings are done in the normal course of business and are not considered concessions, and the loans continue to be recorded as performing.

We evaluate various factors to determine if a borrower is experiencing financial difficulties. Indicators that the borrower is experiencing financial difficulties include, for example: (i) the borrower is currently in default on any of its debt or it is probable that the borrower would be in payment default on any of its debt in the foreseeable future without the modification; (ii) the borrower has declared or is in the process of declaring bankruptcy; (iii) there is significant doubt as to whether the borrower will continue to be a going concern; (iv) currently, the borrower has securities that have been delisted, are in the process of being delisted, or are under threat of being delisted from an exchange; and (v) based on estimates and projections that only encompass the current business capabilities, the borrower forecasts that its entity-specific cash flows will be insufficient to service the debt (both interest and principal) in accordance with the contractual terms of the existing agreement through maturity; and absent the current modification, the borrower cannot obtain funds from sources other than the existing creditors at an effective interest rate equal to the current market interest rate for similar debt for a non-troubled debtor.

We have specialized workout officers who handle the majority of commercial loans that are past due 90 days and over, borrowers experiencing financial difficulties, and those that are considered problem loans based on their risk profile. As a general policy, we do not advance additional money to borrowers that are 90 days past due or over. In commercial and construction loans, certain exceptions may be approved under certain circumstances, including (i) when past due status is administrative in nature, such as expiration of a loan facility before the new documentation is executed, and not as a result of payment or credit issues; (ii) to improve our collateral position or otherwise maximize recovery or mitigate potential future losses; and (iii) with respect to certain entities that, although related through common ownership, are not cross defaulted nor cross-collateralized and are performing satisfactorily under their respective loan facilities.

9

Such advances are underwritten and approved following our credit policy guidelines and limits, which are dependent on the borrower’s financial condition, collateral and guarantee, among others.

In addition to the legal lending limit established under applicable state banking law, discussed in detail below, business activities that expose the Corporation to credit risk should be managed within guidelines described in the Credit Risk Tolerance Limits policy. Limits are defined for loss and credit performance metrics, portfolio composition and concentration, and industry and name-level, which monitors lending concentration to a single borrower or a group of related borrowers, including specific lending limits based on industry or other criteria, such as a percentage of the banks’ capital.

Refer to Note 2 and Note 9 to the Consolidated Financial Statements, in the Annual Report in this Form 10-K, for additional information on troubled debt restructuring (“TDRs”).

Competition

The financial services industry in which we operate is highly competitive. In Puerto Rico, our primary market, the banking business is highly competitive with respect to originating loans, acquiring deposits and providing other banking services. Most of our direct competition for our products and services comes from commercial banks and credit unions. The principal competitors for BPPR include locally based commercial banks and a few large U.S. and foreign banks with operations in Puerto Rico. While the number of banking competitors in Puerto Rico has been reduced in recent years as a result of consolidations, these transactions have allowed some of our competitors to gain greater resources, such as a broader range of products and services.

We also compete with specialized players in the local financial industry that are not subject to the same regulatory restrictions as domestic banks and bank holding companies. Those competitors include brokerage firms, mortgage companies, insurance companies, automobile and equipment finance companies, local and federal credit unions (locally known as “cooperativas”), credit card companies, consumer finance companies, institutional lenders and other financial and non-financial institutions and entities. Credit unions generally provide basic consumer financial services. These competitors collectively represent a significant portion of the market and have lower cost structure and fewer regulatory constraints.

In the United States we continue to face substantial competitive pressure as our footprint resides in the two large, metropolitan markets of New York City / Northern New Jersey and the greater Miami area. There is a large number of community and regional banks along with national banking institutions present in both markets, many of which have a larger amount of resources than us.

In both Puerto Rico and the United States, the primary factors in competing for business include pricing, convenience of branch locations and other delivery methods, range of products offered, and the level of service delivered. We must compete effectively along all these parameters to be successful. We may experience pricing pressure as some of our competitors seek to increase market share by reducing prices or offering more flexible terms. Competition is particularly acute in the market for deposits, where pricing is very aggressive. Increased competition could require that we increase the rates offered on deposits or lower the rates charged on loans, which could adversely affect our profitability.

Economic factors, along with legislative and technological changes, will have an ongoing impact on the competitive environment within the financial services industry. We work to anticipate and adapt to dynamic competitive conditions whether it may be developing and marketing innovative products and services, adopting or developing new technologies that differentiate our products and services, cross-marketing, or providing personalized banking services. We strive to distinguish ourselves from other community banks and financial services providers in our marketplace by providing a high level of service to enhance customer loyalty and to attract and retain business. However, we can provide no assurance as to the effectiveness of these efforts on our future business or results of operations, and as to our continued ability to anticipate and adapt to changing conditions, and to sufficiently improve our services and/or banking products, in order to successfully compete in our primary service areas.

Human Capital Management

Attracting, developing, and retaining top talent in an environment that promotes wellness, inclusion, learning, and transparency is a

10

fundamental pillar of our long-term strategy. As of December 31, 2021, Popular employed approximately 8,500 employees, none of which are represented by a collective bargaining group.

Employee Well-Being & Safety

We are cognizant that our journey to become a better organization is dependent on our employees’ wellbeing. It is the foundation of our ability to fulfill our commitment to support our customers and the communities we serve. The Corporation offers its employees a comprehensive benefits package, including, but not limited to, health insurance, leaves and wellness initiatives. Our full and part-time employees have access to affordable healthcare with Popular covering 88% of the premium in Puerto Rico and the Virgin Islands, and 80% of the premium in the mainland United States. In both regions, the amount Popular covers is better than the benchmark. Additionally, the Corporation promotes employee health by encouraging annual physical exams and maintaining a Health and Wellness Center staffed with doctors, nurses, and other healthcare professionals at its Puerto Rico-based corporate offices, where employees can complete their physical exam, come in for acute care or visit a nutritionist or psychologist free of charge. The Health and Wellness Center received more than 13,164 in-person and virtual visits from employees during 2021, a key component to effectively manage the challenges provoked by the pandemic.

We also provide targeted benefits aimed at promoting work-life balance. For example, the Corporation’s time off program includes community service leave, paid parental leave (including for childbirth, adoption, and bonding time) and flexible work arrangements. In addition, in response to the COVID-19 pandemic, a Hybrid Work Model pilot was launched in 2021 for which 45% of the Corporation’s positions are eligible. To support our employees’ emotional well-being during the pandemic, we continued enhancing our Well-Being Academy by adapting our Employee Assistance Program to offer virtual mental health conversations geared at managing work and life challenges. In addition, the Corporation offers physical fitness events and breaks, as well as employee workshops on personal financial management.

To provide for the safety of our colleagues, we have continuously monitored COVID-19 infections among our employee population throughout the pandemic. Popular’s effective implementation of its established COVID-19 protocols has contributed to the health and safety of our customers, employees, and their families. Vaccination clinics were also hosted during 2021 to help our employees and their families receive the first and second dose of the COVID-19 vaccine. Approximately 2,900 employees and 1,220 dependents benefited from these efforts. Supported by our vaccination mandate, Popular reached a vaccination rate among its employees of 96.7% as of December 31, 2021.

Talent Development

Popular seeks to develop the skills of its employees and leaders to sustain the Corporation’s competitive advantage. Employees are subject to mandatory trainings in connection with regulatory compliance matters and other key topics throughout the year. Our 40,000 square foot Development Center in San Juan, Puerto Rico offers training sessions, activities, and workshops year-round. In 2021, the Corporation remained offering virtual training sessions after effectively transitioning most offerings provided in the Development Center to a virtual setting to continue impacting employee growth despite the pandemic. More than 215 sessions were delivered, with 5,204 participating employees. Popular also launched LinkedIn Learning, which features over 16,000 on-demand e-learning programs to strengthen and advance the Corporation’s development strategies for all its employees. The Corporation is proud to have received the Brandon Hall Group’s 2021 Excellence Award in Technology for its Targeted English Program. This program helps employees whose first language is Spanish to strengthen their English language skills and feel confident speaking, reading, and writing in business or personal settings. Popular’s strong training and development framework has contributed to increased internal growth opportunities for our employees. As a result, 44% of employees had mobility opportunities in 2021.

Recognizing that leadership development is crucial to driving results, keeping employees engaged, and achieving the Corporation’s strategic goals, Popular has implemented programs aimed at strengthening and developing leadership skills and effective talent management. For example, during 2021 our leaders received virtual readiness trainings to help them support their teams to adapt to new working environments and ways of working resulting from the effects of the COVID-19 pandemic. As part of the Corporation’s Executive Leadership Development strategy, readiness courses were offered to employees in topics such as change management, conscious inclusion, leading hybrid teams, and better conversations focused on the return to office scenarios.

Diversity, Equity, and Inclusion

11

At Popular, we value our differences and strive to improve the workplace experience for all. As of December 31, 2021, 66% of the Corporation’s employees were female, while 34% were male. Women accounted for 63% of first and mid-level management and 30% of executive-level management as of such date. The Corporation also maintains a multidisciplinary council, headed by our Corporate Diversity Officer, which helps develop and implement initiatives to support the Corporation’s Diversity, Equity, and Inclusion (DE&I) Policy and strategy. The Corporation’s DE&I strategy seeks to broaden the inclusion, employment advancement and development of minorities and women in the workplace, as well as the utilization of suppliers owned, controlled, or operated by minorities and/or women. In addition, this strategy seeks to prepare the Corporation’s employees to recognize and value the differences of those we serve.

During 2021, Popular was honored to be included in the 2022 Bloomberg Gender Equality Index (GEI). Popular was also listed as one of the 15 best workplaces for women in the Caribbean and Central America by Great Place to Work® in 2021.

Popular is an organization committed to fair pay and conducts analyses on an annual basis with related pay adjustment strategies to address gender gaps. As a result, our gender pay gap continues to narrow and is now lower than the nationwide median, according to data from the US Census Bureau.

The Corporation has also expressed public support of movements advocating for equality such as Pride Month. In 2021, Popular established its first Employee Resource Group for our LGBT+ employees to better serve the interests of the community and create awareness and engagement among employees. Popular also introduced the Gender and Domestic Violence Policy which grants a paid 15-day leave for victims of gender violence, domestic violence, stalking and/or sexual harassment.

Employee Experience

Popular aims to provide an excellent employee experience that inspires its employees to provide customers and communities with the best service. To understand its employees’ experience, the Corporation conducts anonymous pulse and engagement surveys (including the Great Place to Work survey) as well as exit interviews to identify areas of opportunity and set and monitor action plans. In 2021, Popular was listed as one of the top 15 best workplaces in the Caribbean by Great Place to Work®. We seek to continuously measure and improve the employee experience with aims to increase employee productivity while contributing to enhance customer satisfaction and improve business results.

The Corporation launched an interactive dashboard that encompasses data surrounding different people-related topics to support the people strategy, data-driven decision-making and environmental, social and governance (“ESG”) monitoring. The dashboard provides senior management with visibility of people metrics. As of year-end 2021, our voluntary turnover rate was 11%.

Board Oversight

The Talent and Compensation Committee of the Corporation’s Board of Directors has oversight responsibility for the Corporation’s human capital management. As part of its responsibilities, the Talent and Compensation Committee reviews and advises management on the Corporation’s general compensation philosophy, programs, and policies, and on the Corporation’s talent development, succession planning, culture, diversity, equity (including pay equity) and inclusion, among other human capital topics.

We encourage you to review our Corporate Sustainability information published on www.popular.com for more detailed information regarding the Corporation’s human capital management programs and initiatives. The information on the Corporation’s website, including the Corporation’s Corporate Sustainability Reports, is not, and will not be deemed to be, a part of this annual report on Form 10-K or incorporated into any of the Corporation’s filings with the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America (“PNA”) and their respective subsidiaries. Such laws and regulations are continually under review by Congress and state legislatures and federal and state regulatory agencies. Any change in the laws and regulations applicable to Popular and its subsidiaries could have a material effect on the business of Popular and its subsidiaries. We will continue to assess our businesses

12

and risk management and compliance practices to conform to developments in the regulatory environment.

General

Popular and PNA are bank holding companies subject to consolidated supervision and regulation by the Federal Reserve Board under the BHC Act. BPPR and PB are subject to supervision and examination by applicable federal and state banking agencies including, in the case of BPPR, the Federal Reserve Board and the Office of the Commissioner of Financial Institutions of Puerto Rico (the “Office of the Commissioner”), and, in the case of PB, the Federal Reserve Board and the New York State Department of Financial Services (the “NYSDFS”).

Enhanced Prudential Standards

Under the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), as modified by the Economic Growth, Regulatory Relief, and Consumer Protection Act and the federal banking regulators’ 2019 “Tailoring Rules,” banking organizations are categorized based on status as a U.S. G-SIB, size and four other risk-based indicators. Among bank holding companies with $100 billion or more in total consolidated assets, the most stringent standards apply to U.S. G-SIBs, which are subject to Category I standards and the least stringent standards apply to Category IV organizations, which have between $100 billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and which are also not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk management requirements. As of December 31, 2021, Popular had total consolidated assets of $75.1 billion.

Transactions with Affiliates

BPPR and PB are subject to restrictions that limit the amount of extensions of credit and certain other “covered transactions” (as defined in Section 23A of the Federal Reserve Act) between BPPR or PB, on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, and that impose collateralization requirements on such credit extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that affiliate would exceed 10% of the bank’s capital stock and surplus or the aggregate amount of the bank’s covered transactions with all affiliates would exceed 20% of the bank’s capital stock and surplus. In addition, any transaction between BPPR or PB, on the one hand, and Popular, PNA or any of our other non-banking subsidiaries, on the other, is required to be carried out on an arm’s length basis.

Source of Financial Strength

The Dodd-Frank Act requires bank holding companies, such as Popular and PNA, to act as a source of financial and managerial strength to their subsidiary banks. Popular and PNA are expected to commit resources to support their subsidiary banks, including at times when Popular and PNA may not be in a financial position to provide such resources. Any capital loans by a bank holding company to any of its subsidiary depository institutions are subordinated in right of payment to depositors and to certain other indebtedness of such subsidiary depository institution. In the event of a bank holding company’s bankruptcy, any commitment by the bank holding company to a federal banking agency to maintain the capital of a subsidiary depository institution will be assumed by the bankruptcy trustee and entitled to a priority of payment. BPPR and PB are currently the only insured depository institution subsidiaries of Popular and PNA.

Resolution Planning

A bank holding company with $250 billion or more in total consolidated assets (or that is a Category III firm based on certain risk-based indicators described in the Tailoring Rules) is required to report periodically to the FDIC and the Federal Reserve Board such company’s plan for its rapid and orderly resolution in the event of material financial distress or failure. In addition, insured depository institutions with total assets of $50 billion or more are required to submit to the FDIC periodic contingency plans for resolution in the event of the institution’s failure. In June 2021, the FDIC issued a Statement on Resolution Plans for Insured Depository Institutions, which, among other things, establishes a three-year filing cycle for banks with $100 billion or more in total assets and provides details regarding the content that filers will be expected to prepare.

As of December 31, 2021, Popular, PNA, BPPR and PB’s total assets were below the thresholds for applicability of these rules.

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of the FDIC, and BPPR and PB are subject to FDIC deposit insurance assessments to maintain the DIF. Deposit insurance assessments are based on the average consolidated total assets of the insured depository institution minus the average tangible equity of the institution during the assessment period. For larger depository institutions with over $10 billion in assets, such as BPPR

13

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among other measures, that seeks to capture both the probability that an individual large institution will fail and the magnitude of the impact on the DIF if such a failure occurs. The FDIC has the ability to make discretionary adjustments to the total score based upon significant risk factors that are not adequately captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30 basis points on an annualized basis. After the effect of potential base-rate adjustments, the total base assessment rate could range from 1.5 to 40 basis points on an annualized basis.

As of December 31, 2021, we had a DIF average total asset less average tangible equity assessment base of approximately $69 billion.

Brokered Deposits

The FDIA and regulations adopted thereunder restrict the use of brokered deposits and the rate of interest payable on deposits for institutions that are less than well capitalized. There are no such restrictions on a bank that is well capitalized (see “Prompt Corrective Action” below for a description of the standard of “well capitalized”). Popular does not believe the brokered deposits regulations, and the proposed amendments, have had or will have a material effect on the funding or liquidity of BPPR and PB.

Capital Adequacy

Popular, Popular, BPPR and PB are each required to comply with applicable capital adequacy standards established by the federal banking agencies (the “Capital Rules”), which implement the Basel III framework set forth by Basel Committee on Banking Supervision (the “Basel Committee”) as well as certain provisions of the Dodd-Frank Act.

Among other matters, the Capital Rules: (i) impose a capital measure called “Common Equity Tier 1” (“CET1”) and the related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1 capital” instruments meeting certain revised requirements; and (iii) mandate that most deductions/adjustments to regulatory capital measures be made to CET1 and not to the other components of capital. Under the Capital Rules, for most banking organizations, including Popular, the most common form of Additional Tier 1 capital is non-cumulative perpetual preferred stock and the most common form of Tier 2 capital is subordinated notes and a portion of the allocation for loan and lease losses, in each case, subject to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported on consolidated financial statements (known as the “leverage ratio”).

The Capital Rules also impose a “capital conservation buffer,” composed entirely of CET1, on top of these minimum risk-weighted asset ratios. The capital conservation buffer is designed to absorb losses during periods of economic stress. Banking institutions with a ratio of CET1 to risk-weighted assets above the minimum but below the capital conservation buffer will face constraints on dividends, equity repurchases and compensation based on the amount of the shortfall and eligible retained income (that is, four quarter trailing net income, net of distributions and tax effects not reflected in net income). Thus, Popular, BPPR and PB are required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of (i) CET1 to risk-weighted assets of at least 7%, (ii) Tier 1 capital to risk-weighted assets of at least 8.5%, and (iii) Total capital to risk-weighted assets of at least 10.5%.

In addition, under prior risk-based capital rules, the effects of accumulated other comprehensive income or loss (“AOCI”) items included in stockholders’ equity (for example, marks-to-market of securities held in the available for sale portfolio) under U.S. GAAP were reversed for the purposes of determining regulatory capital ratios. Pursuant to the Basel III Capital Rules, the effects of certain AOCI items are not excluded; however, non-advanced approaches banking organizations, including Popular, BPPR and PB, may make a one-time permanent election to continue to exclude these items. Popular, BPPR and PB have made this election in order to avoid significant variations in the level of capital depending upon the impact of interest rate fluctuations on the fair value of their securities portfolios.

14

The Capital Rules preclude certain hybrid securities, such as trust preferred securities, from inclusion in bank holding companies’ Tier 1 capital. Trust preferred securities no longer included in Popular’s Tier 1 capital may nonetheless be included as a component of Tier 2 capital. Popular has not issued any trust preferred securities since May 19, 2010. At December 31, 2021, Popular has $193 million of trust preferred securities outstanding which no longer qualify for Tier 1 capital treatment, but instead qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions from and adjustments to CET1. Non-advanced approaches banking organizations are subject to rules that provide for simplified capital requirements relating to the threshold deductions for certain mortgage servicing assets, deferred tax assets, investments in the capital of unconsolidated financial institutions and inclusion of minority interests in regulatory capital.

Failure to meet capital guidelines could subject Popular and its depository institution subsidiaries to a variety of enforcement remedies, including the termination of deposit insurance by the FDIC and to certain restrictions on our business. Refer to “Prompt Corrective Action” below for further discussion.

In December 2017, the Basel Committee published standards that it described as the finalization of the Basel III post-crisis regulatory reforms. Among other things, these standards revise the Basel Committee’s standardized approach for credit risk (including by recalibrating risk weights and introducing new capital requirements for certain “unconditionally cancellable commitments,” such as unused credit card lines of credit) and provide a new standardized approach for operational risk capital. These standards will generally be effective on January 1, 2023, with an aggregate output floor phasing in through January 1, 2028. Under the current U.S. capital rules, operational risk capital requirements and a capital floor apply only to advanced approaches institutions, and not to Popular, BPPR and PB. The impact of these standards on us will depend on the manner in which they are implemented by the federal bank regulators.

In December 2018, the federal banking agencies approved a final rule modifying their regulatory capital rules and providing an option to phase in over a period of three years the day-one regulatory capital effects of the Current Expected Credit Loss (“CECL”) model of ASU 2016-13. The final rule also revised the agencies’ other rules to reflect the update to the accounting standards. Popular has availed itself of the option to phase in over a period of three years the day one effects on regulatory capital from the adoption of CECL. In 2020, federal bank regulators adopted a rule that allowed banking organizations to elect to delay temporarily the estimated effects of adopting the current expected credit losses accounting standard (“CECL”) on regulatory capital until January 2022 and subsequently to phase in the effects through January 2025. Under the rule, during 2020 and 2021, the adjustment to CET1 capital reflects the change in retained earnings upon adoption of CECL at January 1, 2020, plus 25% of the increase in the allowance for credit losses since January 1, 2020.

Refer to the Consolidated Financial Statements in the Annual Report in this Form 10-K., Note 21 and Table 8 of Management’s Discussion and Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer to the Consolidated Financial Statements in the Annual Report in this Form 10-K Note 3 for more information regarding CECL.

Prompt Corrective Action

The Federal Deposit Insurance Act (the “FDIA”) requires, among other things, the federal banking agencies to take prompt corrective action in respect of insured depository institutions that do not meet minimum capital requirements. The FDIA establishes five capital tiers: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized”. A depository institution’s capital tier will depend upon how its capital levels compare with various relevant capital measures and certain other factors.

An insured depository institution will be deemed to be (i) “well capitalized” if the institution has a total risk-based capital ratio of 10.0% or greater, a CET1 capital ratio of 6.5% or greater, a Tier 1 risk-based capital ratio of 8.0% or greater, and a leverage ratio of 5.0% or greater, and is not subject to any order or written directive by any such regulatory authority to meet and maintain a specific capital level for any capital measure; (ii) “adequately capitalized” if the institution has a total risk-based capital ratio of 8.0% or greater, a CET1 capital ratio of 4.5% or greater, a Tier 1 risk-based capital ratio of 6.0% or greater, and a leverage ratio of 4.0% or greater and is not “well capitalized” (iii) “undercapitalized” if the institution has a total risk-based capital ratio that is less than 8.0%, a CET1 capital ratio less than 4.5%, a Tier 1 risk-based capital ratio of less than 6.0% or a leverage ratio of less than 4.0%; (iv) “significantly undercapitalized” if the institution has a total risk-based capital ratio of less than 6.0%, a CET1 capital ratio less than 3%, a Tier 1 risk-based capital ratio of less than 4.0% or a leverage ratio of less than 3.0%; and (v) “critically undercapitalized” if the institution’s tangible equity is equal to or less than 2.0% of average quarterly tangible assets. An institution may be

15

downgraded to, or deemed to be in, a capital category that is lower than indicated by its capital ratios if it is determined to be in an unsafe or unsound condition or if it receives an unsatisfactory examination rating with respect to certain matters. An insured depository institution’s capital category is determined solely for the purpose of applying prompt corrective action regulations, and the capital category may not constitute an accurate representation of the institution’s overall financial condition or prospects for other purposes.

The FDIC generally prohibits an insured depository institution from making any capital distribution (including payment of a dividend) or paying any management fee to its holding company, if the depository institution would thereafter be undercapitalized. Undercapitalized depository institutions are subject to restrictions on borrowing from the Federal Reserve System. In addition, undercapitalized depository institutions are subject to growth limitations and are required to submit capital restoration plans. A depository institution’s holding company must guarantee the capital restoration plan, up to an amount equal to the lesser of 5% of the depository institution’s assets at the time it becomes undercapitalized or the amount of the capital deficiency, when the institution fails to comply with the plan. The federal banking agencies may not accept a capital restoration plan without determining, among other things, that the plan is based on realistic assumptions and is likely to succeed in restoring the depository institution’s capital. If a depository institution fails to submit an acceptable plan, it is treated as if it is significantly undercapitalized.

Significantly undercapitalized depository institutions may be subject to a number of requirements and restrictions, including orders to sell sufficient voting stock to become adequately capitalized, requirements to reduce total assets and cessation of receipt of deposits from correspondent banks. Critically undercapitalized depository institutions are subject to appointment of a receiver or conservator.

The capital-based prompt corrective action provisions of the FDIA apply to the FDIC-insured depository institutions such as BPPR and PB, but they are not directly applicable to holding companies such as Popular and PNA, which control such institutions. As of December 31, 2021, both BPPR and PB were well capitalized.

Restrictions on Dividends and Repurchases

The principal sources of funding for Popular and PNA have included dividends received from their banking and non-banking subsidiaries, asset sales and proceeds from the issuance of debt and equity. Various statutory provisions limit the amount of dividends an insured depository institution may pay to its holding company without regulatory approval. A member bank must obtain the approval of the Federal Reserve Board for any dividend, if the total of all dividends declared by the member bank during the calendar year would exceed the total of its net income for that year, combined with its retained net income for the preceding two years, after considering those years’ dividend activity, less any required transfers to surplus or to a fund for the retirement of any preferred stock. During the year ended December 31, 2021, BPPR declared cash dividends of $761 million, a portion of which was used by Popular for the payments of the cash dividends on its outstanding common stock, $350 million in accelerated stock repurchases and $181 million in the redemption of trust preferred securities. At December 31, 2021, BPPR have needed to obtain prior approval of the Federal Reserve Board before declaring a dividend due to its declared dividend activity and transfers to statutory reserves over the three year’s ended December 31, 2021. In addition, a member bank may not declare or pay a dividend in an amount greater than its undivided profits as reported in its Report of Condition and Income, unless the member bank has received the approval of the Federal Reserve Board. A member bank also may not permit any portion of its permanent capital to be withdrawn unless the withdrawal has been approved by the Federal Reserve Board. Pursuant to these requirements, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the NYSDFS.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common stock only out of net income available to common shareholders over the past year and only if the prospective rate of earnings retention appears consistent with the organization’s current and expected future capital needs, asset quality and overall financial condition. Moreover, under Federal Reserve Board policy, a bank holding company should not maintain dividend levels that place undue pressure on the capital of depository institution subsidiaries or that may undermine the bank holding company’s ability to be a source of strength to its banking subsidiaries. Federal Reserve policy also provides that a bank holding company should inform the Federal Reserve reasonably in advance of declaring or paying a dividend that exceeds earnings for the period for which the dividend is being paid or that could result in a material adverse change to the bank holding company's capital structure.

The Federal Reserve Board also restricts the ability of banking organizations to conduct stock repurchases. In certain circumstances, a banking organization’s repurchases of its common stock may be subject to a prior approval or notice requirement under other regulations or policies of the Federal Reserve. Any redemption or repurchase of preferred stock or subordinated debt is subject to the prior approval of the Federal Reserve.

16

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation organized under the laws of the Commonwealth of Puerto Rico are subject to a withholding tax of 10% instead of the 30% applied to other “foreign” corporations.

Refer to Part II, Item 5, “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities” for further information on Popular’s distribution of dividends and repurchases of equity securities.

See “Puerto Rico Regulation” below for a description of certain restrictions on BPPR’s ability to pay dividends under Puerto Rico law.

Interstate Branching

The Dodd-Frank Act amended the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 (the “Interstate Banking Act”) to authorize national banks and state banks to branch interstate through de novo branches. For purposes of the Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as are other state banks.

Activities and Acquisitions

In general, the BHC Act limits the activities permissible for bank holding companies to the business of banking, managing or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to be properly incidental thereto. A company who meets management and capital standards and whose subsidiary depository institutions meet management, capital and Community Reinvestment Act (“CRA”) standards may elect to be treated as a financial holding company and engage in a substantially broader range of nonbanking financial activities, including securities underwriting and dealing, insurance underwriting and making merchant banking investments in nonfinancial companies.

In order for a bank holding company to elect to be treated as a financial holding company, (i) all of its depository institution subsidiaries must be well capitalized (as described above) and well managed and (ii) it must file a declaration with the Federal Reserve Board that it elects to be a “financial holding company.” As noted above, a bank holding company electing to be a financial holding company must be and remain well capitalized and well managed. Popular and PNA have elected to be treated as financial holding companies. A depository institution is deemed to be “well managed” if, at its most recent inspection, examination or subsequent review by the appropriate federal banking agency (or the appropriate state banking agency), the depository institution received at least a “satisfactory” composite rating and at least a “satisfactory” rating for the management component of the composite rating. If, after becoming a financial holding company, the company fails to continue to meet any of the capital or management requirements for financial holding company status, the company must enter into a confidential agreement with the Federal Reserve Board to comply with all applicable capital and management requirements. If the company does not return to compliance within 180 days, the Federal Reserve Board may extend the agreement or may order the company to divest its subsidiary banks or the company may discontinue, or divest investments in companies engaged in, activities permissible only for a bank holding company that has elected to be treated as a financial holding company. In addition, if a depository institution subsidiary controlled by a financial holding company does not maintain a CRA rating of at least “satisfactory,” the financial holding company will be subject to restrictions on certain new activities and acquisitions.

The Federal Reserve Board may in certain circumstances limit our ability to conduct activities and make acquisitions that would otherwise be permissible for a financial holding company. Furthermore, a financial holding company must obtain prior written approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets. In addition, we are required to obtain prior Federal Reserve Board approval before engaging in certain banking and other financial activities both in the United States and abroad.

The “Volcker Rule” adopted as part of the Dodd-Frank Act restricts the ability of Popular and its subsidiaries, including BPPR and PB as well as non-banking subsidiaries, to sponsor or invest in "covered funds," including private funds, or to engage in certain types of proprietary trading. Popular and its subsidiaries generally do not engage in the businesses subject to the Volcker Rule; therefore, the Volcker Rule does not have a material effect on our operations.

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in recent years has been aimed at combating money laundering and terrorist financing. The USA PATRIOT Act of 2001 (the “USA PATRIOT Act”) strengthened the ability of the U.S. government to help prevent, detect and prosecute international money laundering and the financing of terrorism. Title III of the USA

17

PATRIOT Act imposed significant compliance and due diligence obligations, created new crimes and penalties and expanded the extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements could have serious legal and reputational consequences for the institution.

In January 2021, the Anti-Money Laundering Act of 2020 (“AMLA”), which amends the Bank Secrecy Act (the “BSA”), was enacted. The AMLA is intended to comprehensively reform and modernize U.S. anti-money laundering laws. Among other things, the AMLA codifies a risk-based approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to promulgate priorities for anti-money laundering and countering the financing of terrorism policy; requires the development of standards for testing technology and internal processes for BSA compliance; expands enforcement- and investigation-related authority, including a significant expansion in the available sanctions for certain BSA violations; and expands BSA whistleblower incentives and protections. Many of the statutory provisions in the AMLA will require additional rulemakings, reports and other measures, and the impact of the AMLA will depend on, among other things, rulemaking and implementation guidance. In June 2021, the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury, issued the priorities for anti-money laundering and countering the financing of terrorism policy required under AMLA. The priorities include: corruption, cybercrime, terrorist financing, fraud, transnational crime, drug trafficking, human trafficking and proliferation financing.

Community Reinvestment Act

The CRA requires banks to help serve the credit needs of their communities, including extending credit to low- and moderate-income individuals and geographies. Should Popular or our bank subsidiaries fail to serve adequately the community, potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries and affiliates, expand into new financial activities and merge with or purchase other financial institutions. In September 2020, the Federal Reserve issued an advance notice of proposed rulemaking that seeks public comment on ways to modernize the Federal Reserve’s CRA regulations. The effects on Popular of any potential change to the CRA rules will depend on the final form of any Federal Reserve rulemaking and cannot be predicted at this time.

Interchange Fees Regulation

The Federal Reserve Board has established standards for debit card interchange fees and prohibited network exclusivity arrangements and routing restrictions. The maximum permissible interchange fee that an issuer may receive for an electronic debit transaction is the sum of 21 cents per transaction and 5 basis points multiplied by the value of the transaction. Additionally, the Federal Reserve Board allows for an upward adjustment of no more than 1 cent to an issuer’s debit card interchange fee if the issuer develops and implements policies and procedures reasonably designed to achieve certain fraud-prevention standards.

Consumer Financial Protection Act of 2010

The Consumer Financial Protection Bureau (the “CFPB”) supervises “covered persons” (broadly defined to include any person offering or providing a consumer financial product or service and any affiliated service provider) for compliance with federal consumer financial laws. The CFPB also has the broad power to prescribe rules applicable to a covered person or service provider identifying as unlawful, unfair, deceptive, or abusive acts or practices in connection with any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service. We are subject to examination and regulation by the CFPB.

Office of Foreign Assets Control Regulation

The U.S. Treasury Department Office of Foreign Assets Control (“OFAC”) administers economic sanctions that affect transactions with designated foreign countries, nationals and others. The OFAC-administered sanctions targeting countries take many different forms. Generally, however, they contain one or more of the following elements: (i) restrictions on trade with or investment in a sanctioned country; and (ii) a blocking of assets in which the government of the sanctioned country or other specially designated nationals have an interest, by prohibiting transfers of property subject to U.S. jurisdiction (including property in the United States or the possession or control of U.S. persons outside of the United States). Blocked assets (e.g., property and bank deposits) cannot be paid out, withdrawn, set off or transferred in any manner without a license from OFAC. Failure to comply with these sanctions could have serious legal and reputational consequences.

Protection of Customer Personal Information and Cybersecurity

The privacy provisions of the Gramm-Leach-Bliley Act of 1999 generally prohibit financial institutions, including us, from disclosing nonpublic personal financial information of consumer customers to third parties for certain purposes (primarily marketing)

18

unless customers have the opportunity to opt out of the disclosure. The Fair Credit Reporting Act restricts information sharing among affiliates for marketing purposes and governs the use and provision of information to consumer reporting agencies.

The federal banking regulators have also issued guidance and proposed rules regarding cybersecurity that are intended to enhance cyber risk management standards among financial institutions. A financial institution is expected to establish lines of defense and to ensure that its risk management processes address the risk posed by compromised customer credentials. A financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations after a cyber-attack involving destructive malware. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties. In November 2021, the U.S. federal bank regulatory agencies issued a final rule requiring banking organizations, including Popular, PNA, BPPR and PB, to notify their primary federal banking regulator within 36 hours of determining that a “notification incident” has occurred. A notification incident is a “computer-security incident” that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or impact the stability of the financial sector. The final rule also requires specific and immediate notifications by bank service providers that become aware of similar incidents.

State and foreign regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. In New York, the NYDFS requires financial institutions regulated by the NYDFS, including PB, to, among other things, (i) establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems; (ii) implement and maintain a written cyber security policy setting forth policies and procedures for the protection of their information systems and nonpublic information; and (iii) designate a Chief Information Security Officer.

Many states and foreign governments have also recently implemented or modified their data breach notification and data privacy requirements. The California Consumer Privacy Act (“CCPA”) became effective on January 1, 2020 and imposes privacy compliance obligations with regard to the personal information of California residents, and the November 2020 amendment to the CCPA creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered by the law and certain rights relating to personal information. The substantive obligations under the 2020 amendment to the CCPA will become effective on January 1, 2023. In European Union, the General Data Protection Regulation heightens privacy compliance obligations and imposes strict standards for reporting data breaches. We expect this trend to continue and are continually monitoring developments in the jurisdictions in which we operate.

See “Puerto Rico Regulation” below for a description of legislations and regulations on information privacy and cybersecurity in Puerto Rico.

Incentive Compensation

The Federal Reserve Board reviews, as part of its regular, risk-focused examination process, the incentive compensation arrangements of banking organizations, such as Popular, that are not “large, complex banking organizations.” Deficiencies will be incorporated into the organization’s supervisory ratings, which can affect the organization’s ability to make acquisitions and take other actions. Enforcement actions may be taken against a banking organization if its incentive compensation arrangements, or related risk-management control or governance processes, pose a risk to the organization’s safety and soundness and the organization is not taking prompt and effective measures to correct the deficiencies.

The Federal Reserve Board, OCC and FDIC have issued comprehensive final guidance on incentive compensation policies intended to ensure that the incentive compensation policies of banking organizations do not undermine the safety and soundness of such organizations by encouraging excessive risk-taking. The guidance, which covers all employees that have the ability to materially affect the risk profile of an organization, either individually or as part of a group, is based upon the key principles that a banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond the organization’s ability to effectively identify and manage risks, (ii) be compatible with effective internal controls and risk management, and (iii) be supported by strong corporate governance, including active and effective oversight by the organization’s board of directors.

19

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking agencies and the SEC, to adopt rules prohibiting incentive-based payment arrangements that encourage inappropriate risks by providing excessive compensation or that could lead to a material financial loss at specified regulated entities having at least $1 billion in total assets (including Popular, PNA, BPPR and PB). The U.S. financial regulators proposed revised rules in 2016, which have not been finalized. In addition, the SEC proposed in 2015, but has not adopted in final form, rules directing national securities exchanges and associations to establish listing standards requiring companies to adopt policies that require executive officers to pay back incentive-based compensation that they were awarded erroneously. In October 2021, the SEC reopened comment period on this proposal.

Puerto Rico Regulation

As a commercial bank organized under the laws of Puerto Rico, BPPR is subject to supervision, examination and regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended (the “Banking Law”).

Section 27 of the Banking Law requires that at least ten percent (10%) of the yearly net income of BPPR be credited annually to a reserve fund. The apportionment must be done every year until the reserve fund is equal to the total of paid-in capital on common and preferred stock. During 2021, $ 78.4 million was transferred to the statutory reserve account.

Section 27 of the Banking Law also provides that when the expenditures of a bank are greater than its receipts, the excess of the former over the latter must be charged against the undistributed profits of the bank, and the balance, if any, must be charged against the reserve fund. If the reserve fund is not sufficient to cover such balance in whole or in part, the outstanding amount must be charged against the capital account and no dividend may be declared until capital has been restored to its original amount and the reserve fund to 20% of the original capital.

Section 16 of the Banking Law requires every bank to maintain a legal reserve that, except as otherwise provided by the Office of the Commissioner, may not be less than 20% of its demand liabilities, excluding government deposits (federal, state and municipal) that are secured by collateral. If a bank is authorized to establish one or more bank branches in a state of the United States or in a foreign country, where such branches are subject to the reserve requirements of that state or country, the Office of the Commissioner may exempt said branch or branches from the reserve requirements of Section 16. Pursuant to an order of the Federal Reserve Board dated November 24, 1982, BPPR has been exempted from the reserve requirements of the Federal Reserve System with respect to deposits payable in Puerto Rico. Accordingly, BPPR is subject to the reserve requirement prescribed by the Banking Law. During 2020, BPPR was in compliance with the statutory reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to any one person, firm, partnership or corporation, up to an aggregate amount of fifteen percent (15%) of the paid-in capital and reserve fund of the bank. As of December 31, 2021, the legal lending limit for BPPR under this provision was approximately $315 million. In the case of loans which are secured by collateral worth at least 25% more than the amount of the loan, the maximum aggregate amount is increased to one third of the paid-in capital of the bank, plus its reserve fund. If the institution is well capitalized and had been rated 1 in the last examination performed by the Office of the Commissioner or any regulatory agency, its legal lending limit shall also include 15% of 50% of its undivided profits and for loans secured by collateral worth at least 25% more than the amount of the loan, the capital of the bank shall also include 33 1/3% of 50% of its undivided profits. Institutions rated 2 in their last regulatory examination may include this additional component in their legal lending limit only with the previous authorization of the Office of the Commissioner. There are no restrictions under Section 17 on the amount of loans that are wholly secured by bonds, securities and other evidence of indebtedness of the Government of the United States or Puerto Rico, or by current debt bonds, not in default, of municipalities or instrumentalities of Puerto Rico. During 2020, BPPR was in compliance with the lending limit requirements of Section 17 of the Banking law.

Section 14 of the Banking Law authorizes a bank to conduct certain financial and related activities directly or through subsidiaries, including finance leasing of personal property and originating and servicing mortgage loans. BPPR engages in finance leasing through its wholly-owned subsidiary, Popular Auto, LLC, which is organized and operates in Puerto Rico. The origination and servicing of mortgage loans is conducted by Popular Mortgage, a division of BPPR.

On information privacy, Puerto Rico law requires businesses to implement information security controls to protect consumers’ personal information from breaches, as well as to provide notice of any breach to affected customers.

20

Available Information

We maintain an Internet website at www.popular.com. Via the “Investor Relations” link at our website, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K and amendments to such reports filed or furnished pursuant to Section 13(a) or 15(d) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), are available, free of charge, as soon as reasonably practicable after such forms are electronically filed with, or furnished to, the SEC. The SEC also maintains an internet website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC. You may obtain copies of our filings on the SEC site.

We have adopted a written code of ethics that applies to all directors, officers and employees of Popular, including our principal executive officer and senior financial officers, in accordance with Section 406 of the Sarbanes-Oxley Act of 2002 and the rules of the SEC promulgated thereunder. Our Code of Ethics is available on our corporate website, www.popular.com, in the section entitled “Corporate Governance.” In the event that we make changes in, or provide waivers from, the provisions of this Code of Ethics that the SEC requires us to disclose, we intend to disclose these events on our corporate website in such section. In the Corporate Governance section of our corporate website, we have also posted the charters for our Audit Committee, Talent and Compensation Committee, Risk Management Committee, Corporate Governance and Nominating Committee and Technology Committee, as well as our Corporate Governance Guidelines. In addition, information concerning purchases and sales of our equity securities by our executive officers and directors is posted on our website.

All website addresses given in this document are for information only and are not intended to be active links or to incorporate any website information into this document.

ITEM 1A. RISK FACTORS

We, like other financial institutions, face risks inherent to our business, financial condition, liquidity, results of operations and capital position. These risks could cause our actual results to differ materially from our historical results or the results contemplated by the forward-looking statements contained in this report.

The risks described in this report are not the only risks we face. Additional risks and uncertainties not currently known by us or that we currently deem to be immaterial, or that are generally applicable to all financial institutions, also may materially adversely affect our business, financial condition, liquidity, results of operations or capital position.

Summary

The risk factors that could adversely affect our business, financial condition, liquidity, results of operations and capital position include:

RISKS RELATING TO THE BUSINESS AND ECONOMIC ENVIRONMENT AND OUR INDUSTRY

 The coronavirus (COVID-19) pandemic has significantly disrupted the global economy and the markets in which we operate, which adversely impacted, and may continue to adversely impact, our business, financial condition and results of operation.

 A significant portion of our business is concentrated in Puerto Rico, where economic and fiscal challenges have adversely impacted and may continue to adversely impact us.

 Further deterioration in collateral values of properties securing our commercial, mortgage loan and construction portfolios would result in increased credit losses and continue to harm our results of operations.

 Legislative and regulatory reforms may have a significant impact on our business and results of operations.

RISKS RELATING TO OUR BUSINESS

 The fiscal and economic challenges of some of the jurisdictions in which we operate could materially adversely affect the value and performance of our portfolio of government securities and our loans to government entities in such jurisdictions, as well as the value and performance of commercial, mortgage and consumer loans to private borrowers who have significant relationships with the government or could be directly affected by government action in such jurisdictions. A reduction in Puerto Rico government deposits could also adversely affect our net interest income.

21

 Our businesses are subject to extensive regulation and we from time to time receive requests for information from departments of the U.S. and Puerto Rico governments, including those that investigate compliance with consumer protection laws and regulations.

 We are exposed to credit risk from mortgage loans that have been sold or are being serviced subject to recourse arrangements.

 Defective and repurchased loans may harm our business and financial condition.

 As a holding company, we depend on dividends and distributions from our subsidiaries for liquidity.

 Increases in FDIC insurance premiums may have a material adverse effect on our earnings.

 Our business is susceptible to interest rate risk because a significant portion of our business involves borrowing and lending money, and investing in financial instruments. Reforms to and uncertainty regarding the London InterBank Offered Rate (LIBOR) also may adversely affect our business, financial condition and results of operations.

 If our goodwill, deferred tax assets or amortizable intangible assets become impaired, it may adversely affect our financial condition and future results of operations.

 Our compensation practices are subject to oversight by applicable regulators.

 We are subject to risk related to our own credit rating; actions by the rating agencies or having capital levels below well-capitalized could raise the cost of our obligations, which could affect our ability to borrow or to enter into hedging agreements in the future and may have other adverse effects on our business.

 We are subject to regulatory capital adequacy guidelines, and if we fail to meet these guidelines our business and financial condition will be adversely affected.

 The resolution of pending litigation and regulatory proceedings, if unfavorable, could have material adverse financial effects or cause significant reputational harm to us, which in turn could seriously harm our business prospects.

 Complying with economic and trade sanctions programs and anti-money laundering laws and regulations can increase our operational and compliance costs and risks. If we, and our subsidiaries, affiliates or third-party service providers, are found to have failed to comply with applicable economic and trade sanctions programs and anti-money laundering laws and regulations, we could be exposed to fines, sanctions and penalties, and other regulatory actions, as well as governmental investigations.

RISKS RELATING TO OUR OPERATIONS

 We are subject to a variety of cybersecurity risks that, if realized, may have an adverse effect on our business and results of operations. These cybersecurity risks have been heightened by the increase on our employees’ remote work capabilities and in the use of digital channels by our customers as a result of the COVID-19 pandemic.

 We rely on other companies to provide key components of our business infrastructure.

 Unforeseen or catastrophic events, including extreme weather events and other natural disasters, man-made disasters, acts of violence or war, or the emergence of pandemics or epidemics, could cause a disruption in our operations or other consequences that could have a material adverse effect on our financial condition and results of operations. Climate change could also have a material adverse impact on our business operations and that of our clients and customers.

RISKS RELATED TO ACQUISITION TRANSACTIONS

 Potential acquisitions of businesses or loan portfolios could increase some of the risks that we face, and may be delayed or prohibited due to regulatory constraints.

RISKS RELATING TO OUR RELATIONSHIP WITH EVERTEC

 We are dependent on EVERTEC, Inc. for certain of our core financial transaction processing and information technology and security services, which exposes us to a number of operational risks that could have a material adverse effect on us.

 Popular faces significant and increasing competition in the rapidly evolving financial services industry. If EVERTEC, Inc. is unable to meet constant technological changes and react quickly to meet new industry standards, we may be unable to enhance our current services and introduce new products and services in a timely and cost-effective manner, placing us at a competitive disadvantage and significantly affecting our business, financial condition and results of operations.

 The transition to new financial services technology providers, and the replacement of services currently provided to us by EVERTEC, Inc., will be lengthy and complex.

 The value of our remaining ownership interest in EVERTEC, Inc., and the revenues we derive from EVERTEC, Inc., could be materially reduced if we decided not to renew our agreements with EVERTEC, Inc. or were to terminate them before the expiration of their term. The EVERTEC Transaction (as defined below) could also result in a material reduction in the value of

22

our ownership interest in EVERTEC, Inc., will eliminate our rights to nominate directors to EVERTEC, Inc.’s board of directors and is expected to result in the elimination of the income we report from this investment.

 The proposed EVERTEC Transaction is subject to closing conditions and subjects Popular to additional risks.

RISKS RELATING TO AN INVESTMENT IN OUR SECURITIES

 Dividends on our Common Stock and Preferred Stock may be suspended and stockholders may not receive funds in connection with their investment in our Common Stock or Preferred Stock without selling their shares.

 Certain of the provisions contained in our Certificate of Incorporation have the effect of making it more difficult to change the Board of Directors, and may make the Board of Directors less responsive to stockholder control.

The above summary is subject in its entirety to the discussion of the risk factors set forth below.

Risk Factors

RISKS RELATING TO THE BUSINESS and economic ENVIRONMENT AND OUR INDUSTRY

The coronavirus (COVID-19) pandemic has significantly disrupted the global economy and the markets in which we operate, which adversely impacted, and may continue to adversely impact, our business, financial condition and results of operation. Its continued impact will depend on future developments, which are highly uncertain and difficult to predict, including the scope and duration of the pandemic, the direct and indirect impact of the pandemic on our employees, customers, clients, counterparties and service providers, as well as other market participants, and actions taken by governmental authorities and other third parties in response to the pandemic.

The COVID-19 pandemic has significantly disrupted and negatively impacted the global economy, disrupted global supply chains, created significant volatility in the financial markets, significantly increased unemployment levels worldwide and decreased consumer confidence and commercial activity generally, including in the markets in which we do business, leading to an increased risk of delinquencies, defaults and foreclosures. The COVID-19 pandemic also contributed to higher and more volatile credit loss expense and potential for increased charge-offs; loan and credit ratings downgrades; credit deterioration and defaults in many industries; a significant increase in the volatility of equity, fixed income and commodity markets; and a decrease in the rates and yields on U.S. Treasury securities and other investment securities, which led to decreased net interest income.

In response to the pandemic, governments across the world, including the governments of Puerto Rico (our primary market), the United States Virgin Islands (“USVI”) and the British Virgin Islands (“BVI”), as well as state governments in the United States mainland, including New York, New Jersey and Florida, where Popular Bank (“PB”) has branches, initially ordered the temporary closure of many businesses, implemented mandatory curfews and the institution of social distancing, shelter in place and other health and safety requirements. Although many of these restrictive measures have been eased or lifted, certain restrictive measures remain in place and additional restrictive measures may be implemented in the future as a result of a resurgence in the spread of the virus or new strains of the virus. The restrictions imposed by governments in response to the outbreak caused significant disruption to economic activity and an increase in unemployment in the markets in which we operate, including Puerto Rico, which has been facing significant fiscal and economic challenges for over a decade. For more information, refer to the Geographic and Government Risk section of the Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) section in the Annual Report on this Form 10-K. Further deterioration of the Puerto Rico, USVI, BVI and the broader U.S. economy would be expected to adversely affect the ability of our borrowers to comply with their financial obligations and adversely impact demand for our products and services. The disruption in economic activity could also adversely affect the financial condition of government entities in Puerto Rico, the USVI and BVI to which we have exposure.

The COVID-19 pandemic also significantly disrupted our operations and negatively impacted our business and financial condition. Many of BPPR’s and PB’s branches were temporarily closed in response to the pandemic. Currently, all BPPR’s and PB’s branches are operating, subject to measures to preserve the health and safety of our employees and customers. To protect the health and safety of our workforce, we have facilitated a significant portion of our workforce to work remotely, which further exposes the Corporation to heightened risks with respect to cybersecurity, information security and other operational incidents, as well as our ability to maintain an effective system of internal controls. Furthermore, although we have implemented a remote work protocol for many of our workers and instituted health and safety measures to protect employees that cannot work remotely, a disruption to our ability to deliver financial products or services to, or interact with, our customers could also result in losses or increased operational costs, regulatory fines, penalties and other sanctions, or harm our reputation.

23

Furthermore, in response to the pandemic, the Corporation implemented temporary measures to provide financial relief to customers through programs such as payment moratoriums, suspensions of foreclosures and other collection activity, as well as waivers of certain fees and service charges. By the end of the third quarter of 2020, the Corporation had reinstated the imposition of these fees and service charges and resumed its delinquent loan collection efforts. The Federal Government also approved several economic stimulus measures, including the Coronavirus Aid, Relief and Economic Security Act, or CARES Act, to cushion the economic fallout of the pandemic, including guaranteeing loans to small and medium-sized businesses through the Small Business Administration’s (“SBA”) Paycheck Protection Program (the “PPP”). However, there can be no assurance that measures taken by governmental authorities will be sufficient to offset the pandemic’s economic impact. In addition, moratoriums imposed by Federal or state law or provided voluntarily by the Corporation may limit our ability to determine the impact of the COVID-19 pandemic on the financial condition of certain of our customers and the credit quality of our loan portfolio until borrowers that benefit from such moratoriums are required to resume loan repayments. Such moratorium and stimulus programs have also imposed significant operational burdens on the Corporation, which also heighten the risk of operational incidents, including fraud and undetected errors. Our participation (or lack of participation) in certain governmental programs enacted in response to the pandemic, including the PPP, could further result in reputational harm, litigation and regulatory and other government action against the Corporation. For example, the Corporation may be exposed to the risk of litigation, from both customers and non-customers that approached the Corporation regarding PPP loans, regarding its process and procedures used in processing applications under the PPP and may be exposed to adverse action for the improper conduct of its employees in connection with such loans. Furthermore, the Corporation may also have credit risk with respect to PPP loans if the SBA determines that there have been deficiencies in the way a PPP loan was originated, funded, or serviced by the Corporation, and denies its liability under the guaranty, reduces the amount of the guaranty or, if it has already paid under the guaranty, seeks recovery of any loss related to the deficiency from the Corporation.

The extent to which the COVID-19 pandemic continues to impact our business, results of operations and financial condition (including our provision for credit losses, net charge offs, regulatory capital, liquidity ratios and the liquidity of the bank holding company and its operating subsidiaries), as well as the operations of our clients, customers, service providers and suppliers, will depend on future developments, which are highly uncertain and difficult to predict at this time, including the scope and duration of the pandemic, the appearance of new strains of the virus and actions taken by governmental authorities and other third parties in response to the pandemic, such as the speed and effectiveness of vaccination programs and the nature and length of economic stimulus initiatives. To the extent the pandemic continues to adversely affect our business, financial condition, liquidity or results of operations, it may also have the effect of heightening many of the other risks described in this section.

A significant portion of our business is concentrated in Puerto Rico, where economic and fiscal challenges have adversely impacted and may continue to adversely impact us.

Our credit exposure is concentrated in Puerto Rico, which accounted as of December 31, 2021 for approximately 84% of our total assets, 85% of our deposits and 82% of our revenues for the year ended December 31, 2021. As such, our financial condition and results of operations are dependent upon the general trends of the Puerto Rico economy and, in particular, the residential and commercial real estate markets and asset values in Puerto Rico. Puerto Rico entered recession in the fourth quarter of fiscal year 2006 and its gross national product (GNP) thereafter contracted in real terms every year between fiscal years 2007 and 2018 (inclusive), except fiscal year 2012. Pursuant to the latest Puerto Rico Planning Board (the “Planning Board”) estimates, published in March 2021, the Commonwealth’s real GNP increased by 1.8% in fiscal year 2019 due to the influx of federal funds and private insurance payments to repair damage caused by Hurricanes Irma and María. However, the planning Board estimates that the Commonwealth’s real GNP decreased by approximately 3.2% in fiscal year 2020 due primarily to the adverse impact of the COVID-19 pandemic and the measures taken by the government in response to the same. The Planning Board projected that the negative effects of COVID-19 would continue through fiscal year 2021, resulting in a contraction in real GNP of approximately -2%, followed by 0.8% GNP growth in the current fiscal year.

The Commonwealth’s government has also been facing significant fiscal challenges that may have been exacerbated by the COVID-19 pandemic. The historical structural imbalance between revenues and expenditures, on the one hand, and unfunded legacy pension obligations, on the other hand, coupled with the Commonwealth’s inability to access financing in the capital markets or from private lenders, resulted in the Commonwealth and various public corporations defaulting on and eventually seeking to restructure their debts and for the U.S. Congress to enact the Puerto Rico Oversight, Management and Economic Stability Act (“PROMESA”) in June 2016. PROMESA, among other things, established a seven-member federally-appointed oversight board (the “Oversight Board”) with broad powers over the finances of the Commonwealth and its instrumentalities and provided to the Commonwealth, its public corporations and municipalities, broad-based restructuring authority, including through a bankruptcy-type process similar to that of Chapter 9 of the U.S. Bankruptcy Code. For a discussion of risks related to the Corporation’s credit

24

exposure to the Commonwealth and its instrumentalities, see the Geographic and Government Risk section in the MD&A section of the Annual Report on this Form 10-K.

The credit quality of BPPR’s loan portfolio necessarily reflects, among other things, the general economic conditions in Puerto Rico and other adverse conditions affecting Puerto Rico consumers and businesses. The Commonwealth’s prolonged recession resulted in limited loan demand and in an increase in the rate of foreclosures and delinquencies on loans granted in Puerto Rico. The measures taken to address the fiscal crisis and those that may have to be taken in the future could affect many of our individual customers and customers’ businesses, which could cause credit losses that adversely affect us. Fiscal adjustments have resulted and may continue to result in significant resistance from local politicians and other stakeholders, which may lead to social and political instability. Any reduction in consumer spending because of these issues may also adversely impact our interest and non-interest revenues.

If global or local economic conditions worsen, including as a result of the COVID-19 pandemic, or the Government of Puerto Rico is unable to manage its fiscal crisis, including completing an orderly restructuring of its debt obligations while continuing to provide essential services, those adverse effects could continue or worsen in ways that we are not able to predict and that are outside of our control. Under such circumstances, we could experience an increase in the level of provision for loan losses, nonperforming assets, net charge-offs and reserve for credit losses. These factors could have a material adverse impact on our earnings and financial condition.

Further deterioration in collateral values of properties securing our commercial, mortgage loan and construction portfolios would result in increased credit losses and continue to harm our results of operations.

The value of properties in some of the markets we serve, in particular in Puerto Rico, declined during the past decade as a result of adverse economic conditions, although the value of properties in some of these markets have recently showed signs of recovery. The deterioration of the value of real estate collateral securing our commercial, mortgage loan and construction loan portfolios resulted in increased credit losses. As of December 31, 2021, approximately 29%, 25% and 2%, of our loan portfolio consisted of commercial loans secured by real estate, mortgage loans and construction loans, respectively.

Substantially our entire loan portfolio is located within the boundaries of the U.S. economy. Whether the collateral is in Puerto Rico, the USVI, the BVI or the U.S. mainland, the performance of our loan portfolio and the collateral value backing the transactions are dependent upon the performance of and conditions within each specific real estate market. General economic conditions in Puerto Rico (as impacted by the COVID-19 pandemic) and fiscal reforms aimed at addressing the current fiscal crisis could cause a further deterioration of the value of the real estate collateral securing our loan portfolios.

A further deterioration of the fair value of real estate properties for collateral dependent impaired loans would require increases in our provision for loan losses and allowance for loan losses. Any such increase would have an adverse effect on our future financial condition and results of operations. For more information on the credit quality of our construction, commercial and mortgage portfolio, see the Credit Risk section of the MD&A included in the Annual Report on this Form 10-K.

Legislative and regulatory reforms may have a significant impact on our business and results of operations.

Popular is subject to extensive regulation, supervision and examination by federal, New York and Puerto Rico banking authorities. Any change in applicable federal, New York or Puerto Rico laws or regulations (or laws and regulations in other jurisdictions in which we may do business, such as California) could have a substantial impact on our operations. Additional laws and regulations may be enacted or adopted in the future that could significantly affect our powers, authority and operations, which could have a material adverse effect on our financial condition and results of operations. Further, regulators in the performance of their supervisory and enforcement duties, have significant discretion and power to prevent or remedy unsafe and unsound practices or violations of laws by banks and bank holding companies. The exercise of this regulatory discretion and power could have a negative impact on Popular. Furthermore, the Commonwealth has enacted various reforms in response to its fiscal and economic problems and is likely to implement additional reforms as part of its obligations under PROMESA.

RISKS RELATING TO OUR BUSINESS

The fiscal and economic challenges of some of the jurisdictions in which we operate could materially adversely affect the value and performance of our portfolio of government securities and our loans to government entities in such jurisdictions, as well as the value and performance of commercial, mortgage and consumer loans to private borrowers

25

who have significant relationships with the government or could be directly affected by government action in such jurisdictions. A reduction in Puerto Rico government deposits could also adversely affect our net interest income.

We have direct and indirect lending and investment exposure to the Puerto Rico government, its public corporations and municipalities. A deterioration of the Commonwealth’s fiscal and economic condition, including as a result of the COVID-19 pandemic and/or actions taken by the Commonwealth government or the Oversight Board to address Puerto Rico’s fiscal crisis, could materially adversely affect the value and performance of our Puerto Rico government obligations, as well as the value and performance of commercial, mortgage and consumer loans to private borrowers who have significant relationships with the government or could be directly affected by government action, resulting in losses to us.

At December 31, 2021, our direct exposure to Puerto Rico government obligations was limited to obligations from various municipalities and amounted to $367 million. In addition, at December 31, 2021, the Corporation had $275 million in loans insured or securities issued by Puerto Rico governmental entities but for which the principal source of repayment is non-governmental. For additional discussion of the Corporation’s exposure to the Puerto Rico government and its instrumentalities and municipalities, refer to the Geographic and Government Risk section in the MD&A section of the Annual Report on this Form 10-K.

BPPR’s commercial loan portfolio also includes loans to private borrowers who are service providers, lessors, suppliers or have other relationships with the Puerto Rico government. These borrowers could be negatively affected by the fiscal measures to be implemented to address the Commonwealth’s fiscal crisis and the ongoing debt restructuring proceedings under PROMESA. Similarly, BPPR’s mortgage and consumer loan portfolios include loans to government employees which could also be negatively affected by fiscal measures such as employee layoffs or furloughs.

Furthermore, BPPR has a significant amount of deposits from the Commonwealth, its instrumentalities, and municipalities. The amount of such deposits may fluctuate depending on the financial condition and liquidity of such entities, as well as on the ability of BPPR to maintain these customer relationships. A significant portion of the Commonwealth’s deposits are expected be used by the Commonwealth pursuant to the Plan of Adjustment for the Commonwealth confirmed by the PROMESA Title III Court, which is expected to become effective on or about March 15, 2022. While a significant decrease in these deposits should not materially affect our liquidity since such deposits are collateralized, a significant decrease in the amount of such deposits could adversely affect our net interest income.

BPPR also has operations in the USVI and has credit exposure to USVI government entities. At December 31, 2021, BPPR’s direct exposure to USVI instrumentalities and public corporations amounted to approximately $70 million, of which $68 million is outstanding. The USVI has been experiencing several fiscal and economic challenges that could adversely affect the ability of its public corporations and instrumentalities to service their outstanding debt obligations. For additional information on the Corporation’s exposure to the USVI government, refer to the Geographic and Government Risk section in the MD&A section of the Annual Report on Form 10-K.

Our businesses are subject to extensive regulation and we from time to time receive requests for information from departments of the U.S. and Puerto Rico governments, including those that investigate compliance with consumer protection laws and regulations.

Our businesses are subject to extensive regulation and we from time to time self-report compliance matters to, or receive requests for information from, departments of the U.S. and Puerto Rico governments, including with respect to compliance with consumer protection laws and regulations. For example, BPPR has in the past received subpoenas and other requests for information from the departments of the U.S. government that investigate mortgage-related conduct, mainly concerning real estate appraisals and residential and construction loans in Puerto Rico. BPPR has also self-identified and reported to applicable regulators matters with respect to mortgage and other consumer lending practices.

Incidents of this nature and investigations or examinations by governmental authorities may result in judgments, settlements, fines, enforcement actions, penalties or other sanctions adverse to the Corporation which could materially and adversely affect the Corporation’s business, financial condition or results of operations, or cause serious reputational harm.

We are exposed to credit risk from mortgage loans that have been sold or are being serviced subject to recourse arrangements.

Popular is generally at risk for mortgage loan defaults from the time it funds a loan until the time the loan is sold or securitized into a mortgage-backed security. We have furthermore retained, through recourse arrangements, part of the credit

26

risk on sales of mortgage loans, and we also service certain mortgage loan portfolios with recourse. At December 31, 2021, we serviced $0.7 billion in residential mortgage loans subject to credit recourse provisions, principally loans associated with Fannie Mae and Freddie Mac programs. In the event of any customer default, pursuant to the credit recourse provided, we are required to repurchase the loan or reimburse the third-party investor for the incurred loss. The maximum potential amount of future payments that we would be required to make under the recourse arrangements in the event of nonperformance by the borrowers is equivalent to the total outstanding balance of the residential mortgage loans serviced with recourse and interest, if applicable. During 2021, we repurchased approximately $19 million in mortgage loans subject to credit recourse provisions. In the event of nonperformance by the borrower, we have rights to the underlying collateral securing the mortgage loan. As of December 31, 2021, our liability established to cover the estimated credit loss exposure related to loans sold or serviced with credit recourse amounted to $12 million. We may suffer losses on these loans when the proceeds from a foreclosure sale of the property underlying a defaulted mortgage loan are less than the outstanding principal balance of the loan plus any uncollected interest advanced and the costs of holding and disposing of the related property.

Defective and repurchased loans may harm our business and financial condition.

In connection with the sale and securitization of loans, we are required to make a variety of customary representations and warranties regarding Popular and the loans being sold or securitized. Our obligations with respect to these representations and warranties are generally outstanding for the life of the loan, and they relate to, among other things, compliance with laws and regulations, underwriting standards, the accuracy of information in the loan documents and loan file and the characteristics and enforceability of the loan.

A loan that does not comply with these representations and warranties may take longer to sell, may impact our ability to obtain third party financing for the loan, and be unsalable or salable only at a significant discount. If such a loan is sold before we detect non-compliance, we may be obligated to repurchase the loan and bear any associated loss directly, or we may be obligated to indemnify the purchaser against any loss, either of which could reduce our cash available for operations and liquidity. Management believes that it has established controls to ensure that loans are originated in accordance with the secondary market’s requirements, but mistakes may be made, or certain employees may deliberately violate our lending policies. We seek to minimize repurchases and losses from defective loans by correcting flaws, if possible, and selling or re-selling such loans. We have established specific reserves for probable losses related to repurchases resulting from representations and warranty violations on specific portfolios. At December 31, 2021, our reserve for estimated losses from representation and warranty arrangements amounted to $839 thousand, which was included as part of other liabilities in the consolidated statement of financial condition. Nonetheless, we do not expect any such losses to be significant, although if they were to occur, they would adversely impact our results of operations and financial condition.

As a holding company, we depend on dividends and distributions from our subsidiaries for liquidity.

We are a bank holding company and depend primarily on dividends from our banking and other operating subsidiaries to fund our cash needs. These obligations and needs include declaring dividends to our shareholders of our common stock, capitalizing subsidiaries, repaying maturing debt and paying debt service on outstanding debt. Our banking subsidiaries, BPPR and PB, are limited by law in their ability to make dividend payments and other distributions to us based on their earnings and capital position. Based on its current financial condition, PB may not declare or pay a dividend without the prior approval of the Federal Reserve Board and the NYSDFS. A failure by our banking subsidiaries to generate sufficient income and free cash flow to make dividend payments to us may have a negative impact on our financial condition, liquidity, results of operation and capital position and may affect our ability to pay dividends to our shareholders and to repurchase shares of our common stock. Additionally, adverse macroeconomic conditions caused by the COVID-19 pandemic could also result in restrictions from regulators on dividends and repurchases of our common stock, which could limit the capital we return to our shareholders. Also, a failure by the bank holding company to access sufficient liquidity resources to meet all projected cash needs in the ordinary course of business may have a detrimental impact on our financial condition and ability to compete in the market.

Increases in FDIC insurance premiums may have a material adverse effect on our earnings.

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the FDIC’s DIF and, as a result, BPPR and PB are subject to FDIC deposit insurance assessments. We are generally unable to control the amount of premiums that we are required to pay for FDIC insurance. If there are additional bank or financial institution failures, our level of non-performing assets increases, or our risk profile changes or our capital position is impaired, we may be required to pay even higher FDIC premiums. Any future increases or special assessments may materially adversely affect our results of operations. See the

27

“Supervision and Regulation—FDIC Insurance” discussion in Item 1. Business of this Form 10-K for additional information related to the FDIC’s deposit insurance assessments applicable to BPPR and PB.

Our business is susceptible to interest rate risk because a significant portion of our business involves borrowing and lending money, and investing in financial instruments. Reforms to and uncertainty regarding the London InterBank Offered Rate (LIBOR) also may adversely affect our business, financial condition and results of operations.

Our business and financial performance are impacted by market interest rates and movements in those rates. Since a high percentage of our assets and liabilities are interest bearing or otherwise sensitive in value to changes in interest rates, changes in rates, in the shape of the yield curve or in spreads between different types of rates can have a material impact on our results of operations and the values of our assets and liabilities. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, our net interest income, and therefore earnings, could be adversely affected. Interest rates are also highly sensitive to many factors over which we have no control and which we may not be able to anticipate adequately, including general economic conditions and the monetary and tax policies of various governmental bodies, particularly the Federal Reserve. For a discussion of the Corporation’s interest rate sensitivity, please refer to the “Risk Management” section of the MD&A of the Annual Report on this Form 10-K.

On July 27, 2017, the United Kingdom’s Financial Conduct Authority, which regulates the London Interbank Offered Rate (“LIBOR”), publicly announced that it intends to stop persuading or compelling banks to submit LIBOR rates after 2021. On November 30, 2020, the LIBOR administration announced that it would consider continuing publication of certain US dollar LIBOR settings until June 30, 2023, subject to applicable regulations. In response to this announcement, Federal regulators issued a statement that, among other things, encouraged all financial institutions to cease entering into new contracts that use LIBOR as a reference rate as soon as practicable and in any event by December 31, 2021. It is expected that a transition away from the widespread use of LIBOR to alternative rates will occur over the course of the next several years. As a result of this transition, interest rates on floating rate obligations, loans, deposits, derivatives and other financial instruments held by the Corporation and tied to LIBOR rates, as well as the revenue and expenses associated with those financial instruments, may be adversely affected. Any failure by market participants and regulators to successfully implement benchmark rates to replace LIBOR and effectively establish transitional arrangements to address the discontinuation of LIBOR could also result in disruption in the financial markets. Further, any uncertainty regarding the continued use and reliability of LIBOR as a benchmark interest rate could adversely affect the value of our floating rate obligations, loans, deposits, derivatives, and other financial instruments tied to LIBOR rates.

Regulators, industry groups and certain committees (e.g., the Alternative Reference Rates Committee) have, among other things, published recommended fallback language for LIBOR-linked financial instruments, identified recommended alternatives for certain LIBOR rates (e.g., the Secured Overnight Financing Rate as the recommended alternative to U.S. Dollar LIBOR), and proposed implementations of the recommended alternatives in floating rate instruments. At this time, it is difficult to predict whether these recommendations and proposals will be broadly accepted, whether they will continue to evolve, and what the effect of their implementation may be on the markets for floating-rate financial instruments. The Corporation has adopted fallback language for LIBOR-linked financial instruments and is implementing alternative rates for the origination of new loans. However, certain contractual documents governing the Corporation’s LIBOR-linked financial instruments may not provide effective fallback language in the event LIBOR rates cease to be published, which may present the Corporation with legal and regulatory risk if, for example, the Corporation is unable to amend these financial instruments prior to such cessation.

If our goodwill, deferred tax assets or amortizable intangible assets become impaired, it may adversely affect our financial condition and future results of operations.

As of December 31, 2021, we had approximately $ 720 million, $657 million and $15 million, respectively, of goodwill, net deferred tax assets and amortizable intangible assets recorded on our balance sheet. If our goodwill, deferred tax assets or amortizable intangible assets become impaired, we may be required to record a significant charge to earnings.

Under GAAP, we review our amortizable intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable. Goodwill is tested for impairment at least annually. Factors that may be considered a change in circumstances, indicating that the carrying value of the goodwill or amortizable intangible assets may not be recoverable, include a decline in Popular’s stock price related to macroeconomic conditions in the global market as well as the weakness in the Puerto Rico economy and fiscal situation, declines in our market capitalization, reduced future earnings estimates, continuance of a low interest rate environment and the continued impact of the COVID-19 pandemic, which may exacerbate these and other circumstances, could in turn result in an impairment of goodwill. The goodwill impairment evaluation

28

process requires us to make estimates and assumptions with regards to the fair value of our reporting units. Actual values may differ significantly from these estimates. Such differences could result in future impairment of goodwill that would, in turn, negatively impact our results of operations and the reporting unit where the goodwill is recorded.

The determination of whether a deferred tax asset is realizable is based on weighting all available evidence. The realization of deferred tax assets, including carryforwards and deductible temporary differences, depends upon the existence of sufficient taxable income of the same character during the carryback or carryforward period. The analysis considers all sources of taxable income available to realize the deferred tax asset, including the future reversal of existing taxable temporary differences, future taxable income exclusive of reversing temporary differences and carryforwards, taxable income in prior carryback years and tax-planning strategies. Similarly, the COVID-19 pandemic’s impact on the expected profitability of our businesses may affect the realizability of our deferred tax assets in our Puerto Rico and U.S. operations.

If we are required to record a charge to earnings in our consolidated financial statements because an impairment of the goodwill, deferred tax assets or amortizable intangible assets is determined, our financial condition and results of operations would be adversely affected.

Our compensation practices are subject to oversight by applicable regulators.

Our success depends, in large part, on our ability to retain key senior leaders, and competition for such senior leaders can be intense in most areas of our business. Our compensation practices are subject to review and oversight by the Federal Reserve Board. We also may be subject to limitations on compensation practices by the FDIC or other regulators, which may or may not affect our competitors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking agencies and the SEC, to adopt rules prohibiting incentive-based payment arrangements that encourage inappropriate risks by providing excessive compensation or that could lead to a material financial loss at specified regulated entities having at least $1 billion in total assets (including Popular, PNA, BPPR and PB). The U.S. financial regulators proposed revised rules in 2016, which have not been finalized. Compliance with such revised rules may substantially affect the way in which we structure compensation for our executives and other employees. In addition, in 2015, the SEC proposed rules directing national securities exchanges and associations to establish listing standards requiring companies to adopt policies that require executive officers to pay back incentive-based compensation that they were awarded erroneously. Those rules have not been adopted. In October 2021, the SEC reopened the comment period on these proposed rules. For a more detailed discussion of these proposed rules, see the “Supervision and Regulation—Incentive Compensation” section in Item 1. Business of this Form 10-K.

The scope and content of the U.S. banking regulators’ policies on executive compensation are continuing to develop and are likely to continue evolving. It cannot be determined at this time whether compliance with such policies will adversely affect the ability of Popular and our subsidiaries to hire, retain and motivate key employees. Limitations on our compensation practices could have a negative impact on our ability to attract and retain talented senior leaders in support of our long-term strategy.

We are subject to risk related to our own credit rating; actions by the rating agencies or having capital levels below well-capitalized could raise the cost of our obligations, which could affect our ability to borrow or to enter into hedging agreements in the future and may have other adverse effects on our business.

Actions by the rating agencies could raise the cost of our borrowings since lower rated securities are usually required by the market to pay higher rates than obligations of higher credit quality. Our credit ratings were reduced substantially in 2009, and, although one of the three major rating agencies upgraded our senior unsecured rating back to “investment grade” during 2021, the remaining two rating agencies have not upgraded their current “non-investment grade” rating. The market for non-investment grade securities is much smaller and less liquid than for investment grade securities. Therefore, if we were to attempt to issue preferred stock or debt securities into the capital markets, it is possible that there would not be sufficient demand to complete a transaction and the cost could be substantially higher than for more highly rated securities.

In addition, changes in our ratings and capital levels below well-capitalized could affect our relationships with some creditors and business counterparties. For example, a portion of our hedging transactions include ratings triggers or well-capitalized language that permit counterparties to either request additional collateral or terminate our agreements with them based on our

29

below investment grade ratings. Although we have been able to meet any additional collateral requirements thus far and expect that we would be able to enter into agreements with substitute counterparties if any of our existing agreements were terminated, changes in our ratings or capital levels below well capitalized could create additional costs for our businesses.

Our banking subsidiaries have servicing, licensing and custodial agreements with third parties that include ratings covenants. Upon failure to maintain the required credit ratings, the third parties could have the right to require us to engage a substitute fund custodian and increase collateral levels securing the recourse obligations. Popular services residential mortgage loans subject to credit recourse provisions. Certain contractual agreements require us to post collateral to secure such recourse obligations if our required credit ratings are not maintained. Collateral pledged by us to secure recourse obligations approximated $32 million at December 31, 2021. We could be required to post additional collateral under the agreements. Management expects that we would be able to meet additional collateral requirements if and when needed. The requirements to post collateral under certain agreements or the loss of custodian funds could reduce our liquidity resources and impact its operating results. The termination of those agreements or the inability to realize servicing income for our businesses could have an adverse effect on those businesses. Other counterparties are also sensitive to the risk of a ratings downgrade and the implications for our businesses and may be less likely to engage in transactions with us, or may only engage in them at a substantially higher cost, if our ratings remain below investment grade.