POPULAR, INC. (BPOP) Business, 2023

General

Popular

is

a diversified,

publicly-owned financial

holding company,

registered under

the Bank

Holding Company

Act

of

1956, as

amended (the “BHC Act”), and subject to supervision and regulation by the Board of Governors of the Federal Reserve System (the

“Federal Reserve Board”). Popular was incorporated in 1984 under the laws of the Commonwealth of Puerto Rico and is the

largest

financial institution

based in Puerto

Rico, with

consolidated assets of

$70.8 billion, total

deposits of

$63.6 billion

and stockholders’

equity of $5.1 billion at

December 31, 2023. At December 31,

2023, we ranked among the

50 largest U.S. bank holding companies

based on total assets according to information gathered

and disclosed by the Federal Reserve Board.

We operate in two principal markets:

●

Puerto Rico:

We

provide retail,

mortgage and

commercial banking

services through

our principal

banking subsidiary,

Banco

Popular

de

Puerto

Rico

(“Banco

Popular”

or

“BPPR”),

as

well

as

auto

and

equipment

leasing

and

financing,

investment

banking,

broker-dealer

and

insurance

services

through

specialized

subsidiaries.

BPPR’s

deposits

are

insured

under

the

Deposit Insurance

Fund (“DIF”)

of the

Federal Deposit

Insurance Corporation (“FDIC”).

The banking

operations of

BPPR are

primarily based in Puerto Rico, where BPPR has the

largest retail banking franchise.

●

Mainland

United

States:

We

provide

retail,

mortgage

and

commercial

banking

services

through

our

New

York-chartered

banking subsidiary,

Popular Bank (“PB” or

“Popular U.S.”), which has

branches in New York,

New Jersey and Florida;

as well

as investment and

insurance services, and commercial

direct financing leases through

specialized subsidiaries. PB’s deposits

are insured under the DIF of the FDIC.

●

BPPR

also

conducts

banking

operations

in

the

U.S.

Virgin

Islands,

the

British

Virgin

Islands

and

New

York.

In

addition

to

BPPR’s commercial

banking operations

in New

York

that include

direct loan

origination and

participating loans

originated by

PB,

BPPR

offers

or

holds

financial

products

on

a

National

scale

in

the

U.S.

market,

including

personal

loans

previously

originated under

the E-Loan

brand, purchased

personal loans

originated by

third parties,

and

gathering insured

institutional

deposits via online deposit gathering platforms. In the U.S. and British

Virgin Islands, BPPR offers a range of banking products,

including loans and deposits to both retail and

commercial customers.

For further information about the Corporation’s results segregated by

its reportable segments, see “Reportable Segment Results” in

the Management’s Discussion

and Analysis of

Financial Condition and Results

of Operations section

(“MD&A”) and Note

37 to the

Consolidated Financial Statements included in this Form

10-K.

Transformation Initiative:

The

Corporation

launched

a

significant,

multi-year,

broad-based

technological

and

business

process

transformation

during

the

second half of 2022. The

needs and expectations of our

clients, as well as the

competitive landscape, have evolved, compelling us

to make important investments in our technological infrastructure and adopt more agile practices. We

believe these investments will

result in an enhanced digital experience for our clients, as

well as better technology and more efficient processes for our employees,

and make us a more efficient and

profitable company, allowing us to

achieve a 14% return on tangible common equity target by

the

end of 2025.

Our technology and business transformation

will be a significant

priority for the Corporation over

the next three years

and beyond. Refer to the Overview section

of Management’s Discussion and Analysis included in

this Form 10-K for information on

recent significant events that have impacted or will

impact our current and future operations.

Lending Activities

We concentrate our lending activities in the following areas:

(1) Commercial.

Commercial loans are comprised of (i) commercial and industrial (“C&I”) loans and leases to commercial customers

for

use

in

normal

business

operations

and

to

finance

working

capital

needs,

equipment

purchases

or

other

projects,

and

(ii)

commercial real

estate (“CRE”) loans

(excluding construction loans)

for income-producing real

estate properties as

well as

owner-

occupied properties. C&I

loans are underwritten

individually and usually

secured with the

assets of the

company and the

personal

guarantee

of

the

business

owners. CRE

loans consist

of

loans

for

income-producing real

estate

properties and

the financing

of

owner-occupied facilities

if there

is real

estate as

collateral. Non-owner-occupied

CRE loans

are generally

made to

finance office

and

industrial buildings,

healthcare facilities,

multifamily buildings

and

retail shopping

centers

and are

repaid through

cash

flows

related to the operation, sale or refinancing of the

property.

(2) Mortgage. Mortgage

loans include residential

mortgage loans to

consumers for the

purchase or refinancing

of a

residence and

also include residential construction loans made

to individuals for the construction of refurbishment

of their residence.

(3) Consumer.

Consumer loans

are mainly

comprised of

unsecured personal

loans, credit

cards, and

automobile loans,

and to

a

lesser extent home equity lines of credit (“HELOCs”)

and other loans made by banks to individual

borrowers.

(4) Construction.

Construction loans are CRE loans to companies,

community or homeowners’ associations, or developers used for

the construction of a commercial or residential property for which repayment will be generated by the sale or permanent financing of

the property.

Our construction loan

portfolio primarily consists

of retail, residential

(land and condominiums),

office and warehouse

product types.

(5) Lease Financings. Lease financings are offered by

BPPR and are primarily comprised of automobile loans/leases made through

automotive dealerships.

Business Concentration

Since our

business activities

are currently concentrated

primarily in

Puerto Rico,

our results

of operations

and financial

condition are dependent upon the general trends of

the Puerto Rico economy and, in particular,

the residential and commercial real

estate markets. The concentration of our

operations in Puerto Rico exposes us

to greater risk than other

banking companies with a

wider

geographic

base.

Our

asset

and

revenue

composition

by

geographical

area

is

presented

in

“Financial

Information

about

Geographic Areas” below and in Note 37 to the

Consolidated Financial Statements included in this

Form 10-K.

Our loan portfolio is diversified by loan category.

However, approximately 55% of our loan portfolio at December 31, 2023 consisted

of real estate-related

loans, including residential

mortgage loans, construction

loans and commercial

loans secured by

commercial

real estate. The table below presents the distribution

of our loan portfolio by loan category at

December 31, 2023.

Loan category

(Dollars in millions)

BPPR

%

PB

%

POPULAR

%

C&I

$4,796

$2,330

$7,126

CRE

4,695

5,888

10,583

Construction

Leasing

1,732

-

-

1,732

Consumer

6,726

6,969

Mortgage

6,392

1,304

7,696

Total

$24,511

$10,554

$35,065

Except for

the Corporation’s

exposure to

the Puerto

Rico Government

sector,

no individual

or single

group of

related accounts

is

considered material

in relation

to our

total assets

or deposits,

or in

relation to

our overall

business.

For a

discussion of

our loan

portfolio, our

deposits portfolio

and our

exposure to

the Government

of Puerto

Rico, see

“Financial Condition

– Loans”,

“Financial

Condition

–

Deposits”

and

“Credit

Risk

–

Geographical and

Government

Risk” in

the

MD&A

and

to

Note

-

Commitment and

Contingencies to the Consolidated Financial Statements

included in this Form 10-K.

Credit

Administration

and

Credit

Policies

Interest

from our

loan portfolios

is our

principal source

of revenue.

Whenever we

make loans,

we expose

ourselves

to

credit

risk.

Credit

risk

is

controlled

and

monitored

through

active

asset

quality

management,

including

the

use

of

lending

standards,

thorough

review

of

potential

borrowers

and through

active

asset quality

administration.

Business

activities

that

expose

us to

credit

risk are

managed

within

the

Board

of Director’s

Risk Management policy,

and the Credit Risk Tolerance

Limits policy,

which establishes

limits

that

consider

factors

such

as maintainin

g

a prudent

balance

of risk-taking

across

diversified

risk types

and business

units,

compliance

with regulator

y

guidance,

and

controlling

the

exposure

to lower

credit

quality

assets.

We maintain

comprehensive

credit policies

for all lines of

business in order

to mitigate credit

risk. Our credit

policies

are

approved by

our Board

of Directors.

These policies set

forth,

among

other

things,

the objectives, scope and

responsibilities of the

credit

management cycle.

Our

internal

written

procedures

establish

underwriting

standards

and

procedures

for

monitoring

and

evaluating

loan

portfolio

quality

and

require

prompt

identificatio

n

and

quantificatio

n

of

asset

quality

deterioration

or

potential

loss

to

ensure

the

adequacy

of

the

allowance

for

credit

losses.

These

written

procedures

establish

various

approval

and

lending

limit

levels,

ranging

from

bank

branch

or

department

officers

to

managerial

and

senior

management

levels.

Approval

levels are

primarily

determined

by the

amount,

type

of loan

and risk

characteristics

of the credit

facility.

Our

credit

policies

and

procedures

establish

documentation

requirements

for

each

loan

and

related

collateral

type,

when

applicable,

during

the

underwriting,

closing

and

monitoring

phases.

For

commercial

and

construction

loans,

during

the

initial

loan

underwriting

process,

the

credit

policies

require,

at

a

minimum,

historical

financial

statements

or

tax

returns

of

the

borrower,

an analysis

of financial

information

contained

in

a

credit

approval

package,

a

risk

rating

determination

and

reports

from

credit

agencies

and appraisal

s

for

real

estate-related

loans when applicable

.

The credit

policies

also

set

forth

the

required

closing

documentation

depending

on the

loan

and the

collateral

type.

Although

we originat

e

most

of our

loans

internally

in both

the

Puerto

Rico

and mainlan

d

United

States

markets,

we

occasionally

purchase

or

participate

in

loans

originated

by

other

financial

institutions.

When

we

purchase

or

participate

in

loans

originated

by

others,

we

conduct

the

same

underwriting

analysis

of

the borrower

s

and apply

the

same

criteria

as we do

for

loans

originated

by us. This also

includes

a review

of the

applicable

legal

documentation.

Refer

to

the

Credit

Risk

section

of

the

MD&A

included

in

this

Form

10-K

for

information

related

to

management

committees and divisions with responsibilities for establishing

policies and monitoring the Corporation’s credit risk.

Loan

extensions

,

renewals

and restructurings

Loans with

satisfactory

credit profiles

can be

extended, renewed

or restructured

.

Some commercia

l

loan facilities

are

structured

as lines

of credit, which

are mainly

one year

in term

and therefore

are required

to be renewed

annually.

Other

facilities

may be restructure

d

or extended

from time

to time based

upon changes

in the

borrower’s

business

needs,

use

of

funds,

timing

of

completion

of

projects

and

other

factors.

If

the

borrower

is

not

deemed

to

have

financial

difficulties

,

extensions,

renewals

and restructurings

are done

in the

normal

course

of busines

s

and the

loans

continue

to be recorde

d

as performing.

We

evaluate

various

factors

to

determine

if

a

borrower

is

experiencing

financial

difficulties.

Indicators

that

the

borrower

is

experiencing

financial difficultie

s

include,

for example:

(i)

the borrower

is currently

in default on

any of its debt

or it is

probable tha

t

the borrower

would be

in payment

default on

any of

its debt

in th

e

foreseeable

future

without

the modification

;

(ii)

the

borrower

has declare

d

or is in

the

process

of declarin

g

bankruptcy;

(iii)

there

is significan

t

doubt

as to

whether

the

borrower

will

continue

to

be

a

going

concern;

(iv)

the

borrower

has

securities

that

have

been

delisted,

are

in

the

process

of

being

delisted,

or

are

under threa

t

of bein

g

delisted

from

an exchange

;

(v) based

on estimates

and projection

s

that

only

encompass

the

current

business

capabilities

,

the

borrower

forecasts

that

its

entity-specifi

c

cash

flows

will

be

insufficien

t

to

service

the

debt

(both

interest

and

principal)

in

accordance

with

the

contractual

terms

of

the

existing

agreement

through

maturity;

and

(vi)

absent

the

current

modification,

the

borrower

cannot

obtain

funds

from

sources

other

than

the

existing

creditors

at

an

effective

interest

rate

equal to the current market

interest

rate for similar

debt for a non-troubled

debtor.

We

have

specialized

workout

officers

who

handle

the majority

of

commercial

loans

that

are

past

due

days

and

over,

borrowers

experiencing

financial

difficulties

,

and loans

that

are considere

d

problem

loans

based

on their

risk profile

.

As a

general

policy,

we

do

not

advance

additional

money

to

borrowers

who

have

loans

that

are

days

past

due

or

over.

In

commercial

and

construction

loans,

certain

exceptions

may

be approve

d

under

certain

circumstances,

including

(i) when

past

due

status

is administrativ

e

in nature,

such

as expiration

of a loan

facility

before

the

new documentatio

n

is executed,

and not as

a result

of paymen

t

or credit

issues;

(ii) to

improve

our collateral

position

or

otherwise

maximize

recovery

or

mitigate

potential

future

losses;

and

(iii)

with

respect

to

certain

entities

that,

although

related

through

common

ownership,

are

not

cross

defaulted

nor

cross-collateralized

and

are

performing

satisfactorily

under

their

respective

loan

facilities.

Such

advances

are

underwritten

and

approved

following

our

credit

policy

guidelines

and

limits,

which

are

dependent

on

the

borrower’s

financial

condition,

collateral

and guarantee,

among

others.

In addition

to the legal

lending limit

established under

applicable

state banking

law, discusse

d

in detail

below,

business

activities

that

expose the

Corporation to

credit

risk

are managed

within

guidelines described

in the

Credit

Risk Tolerance

Limits

policy.

Limits are defined for

loss and credit

performance metrics, portfolio composition and

concentration, and industry and

name-

level,

which

monitors

lending

concentration

to

a

single

borrower

or

a

group

of

related

borrowers,

including

specific

lending

limits

based

on industr

y

or other

criteria,

such

as a percentage

of the

banks’

capital.

Refer to Note 2 and Note 9 to the Consolidated Financial Statements included

in this Form 10-K, for additional information

on loan modifications to borrowers with financial difficulties.

Competition

The

financial

services

industry

in

which

we

operate

is

highly

competitive.

In

Puerto

Rico,

our

primary

market,

the

banking

business

is

highly

competitive

with

respect

to

originatin

g

loans,

acquiring

deposits

and

providing

other

banking

services.

Most

of

our

direct

competitio

n

for

our

products

and

services

comes

from

commercial

banks and

credit unions.

The

principal

competitors

for

BPPR

include

locally

based

commercial

banks

and

a

few

large

U.S.

and

foreign

banks

with

operations in

Puerto Rico.

While

the

number of

banking competitors

in Puerto

Rico

has been

reduced

in

recent years

as

a

result

of

consolidations,

these

transactions

have

allowed

some

of

our

competitors

to

gain

greater

resources,

such

as

a

broader range of products

and services.

We

also

compete

with

specialized

players

in th

e

local

financial

industry

that

are

not subjec

t

to

the

same

regulatory

restrictions

as domestic

banks

and bank holdin

g

companies.

Those

competitors

include

brokerage

firms,

mortgage

companies,

insurance

companies,

automobile

and

equipment

finance

companies,

local

and

federal

credit

unions

(locally

known

as

“cooperativas”),

credit car

d

companies,

consumer

finance

companies,

institutional

lenders

and other

financial

and non-financia

l

institutions

and

entities.

Credit

unions

generally

provide

basic

consumer

financial

services.

These

competitors

collectively

represent a significant

portion of the

market and have

a lower cost structure

and fewer regulatory

constraints.

In

the

United

States

we

continue

to

face

substantial

competitive

pressure

as

our

footprint

resides

in

the

two

large,

metropolitan markets of

New York

City / Northern

New Jersey and

the greater Miami

area.

There is a

large number of

community

and

regional

banks

along

with

national

banking

institutions

present

in

both

markets,

many

of

which

have

a

larger

amount

of

resources than us.

In both

Puerto Rico

and the

United States,

the primary

factors in

competing

for business

include

pricing,

convenience

of branch

locations

and other

delivery

methods,

range of

products offered,

and the

level of

service delivered.

We must

compete

effectively

along

all

these

parameters

to

be

successful.

We

experience

pricing

pressure

as

some

of

our

competitors

seek

to

increase

market

share

by

reducing

prices

for

services

or

the

rates

charged

on

loans,

increasing

the

interest

rates

offered

on

deposits

or offering

more flexible

terms. Increased

competition

could require

that we

increase

the rates

offered

on deposits

and

lower the rates

charged on loans,

which could adversely

affect our profitability.

Economic

factors,

along

with

legislative

and

technological

changes,

have

an

ongoing

impact

on

the

competitive

environment

within

the financia

l

services

industry.

We work

to anticipat

e

and adap

t

to dynamic

competitive

conditions

whether

through developing

and marketing

innovative

products

and services,

adopting

or developin

g

new technologie

s

that

differentiat

e

our products

and

services,

cross-marketing,

or

providing

personalized

banking

services.

We

strive

to

distinguish

ourselves

from

other

banks

and

financial

services

providers

in our

marketplace

by providin

g

a high

level

of service

to enhance

customer

loyalty

and to attrac

t

and retain

business.

However,

we can

provide

no assurance

as

to

the

effectiveness

of

these

efforts

on

our

future

business

or

results

of

operations,

and

as

to

our

continued

ability

to

anticipate

and

adapt

to

changing

conditions,

and

to

sufficientl

y

improve

our

services

and/or

banking

products,

in

order

to

successfully

compete

in

our

primary

service

areas.

Human Capital Management

Popular

seeks

to

embody

our

purpose

of “putting

people

at the

center

of progress”

throughout

its human

capital

management.

Attracting,

developing

and

retaining

top

talent

in

an

environment

that

promotes

wellness,

diversity,

inclusion,

learning

and

transparency

are

fundamental

pillars

of

our

long-term

strategy.

As

of

December

31,

2023,

Popular

has

approximately

9,237

employees,

none of whom

are represented

by a collective

bargaining group.

Nurturing Well-Being: Employee Health & Financial

Security

Popular believes

that the

health and

financial

wellness of

Popular’s employees

is essential

to enable

Popular to

effectively

serve

its customers

and contribute

positively

to the

communities

where it

operates.

Our health

and wellness

program includes

health,

pharmacy,

vision and

dental insurance,

as well

as other

wellness

initiatives.

Our programs

seek to

ensure that

healthcare

being

both accessible

and affordable

for our

employees,

with Popular

covering

up to

90% of

health

insurance

premiums,

a figure

that

surpasses

regional

benchmarks.

In

2023,

we

launched

a

leadership

guide

on

mental

health

to

support

leaders

in

promoting

emotional

wellness

within

their

teams

and

engaging

with

team

members

who

may

be

facing

mental

health

challenges.

Additionally,

the Corporation

promotes employee

health and

wellbeing by

encouraging

annual physical

exams and

maintaining

a

health

and

wellness

center

at

its

Puerto

Rico-based

corporate

offices

staffed

with

healthcare

providers,

where

employees

can

complete

their

physical

exam,

receive

acute

care

or visit

a nutritionist

or

psychologist

free

of charge.

Our

health

and

wellness

center received

over 15,680 visits

from employees

during 2023.

Popular

also seeks

to foster

work-life

balance by

providing

paid time

off benefits

to our

employees,

including community

service

leave,

paid

parental

leave

and

flexible

work

arrangements.

Our

hybrid

work

model,

accessible

to

approximately

half

of

our

workforce,

underscores our

commitment to

flexible work

environments.

Moreover,

we continuously

offer activities

and workshops

centered on

physical fitness

and personal financial

management.

Popular

further

provides

a 401(k)

savings

and investment

plan, in

which

98% of

employees

participate.

Popular

matches

$0.50

for every

dollar

the employee

contributes

to the

401(k)

plan,

up to

8% of

their

salary.

Moreover,

Popular

offers

a profit

-sharing

plan,

contingent

upon

the

achievement

of

pre-set

financial

goals,

to

further

align

employee

compensation

with

its

collective

success.

The

profit-sharing

plan

allows

employees

to

receive

up to

8%

of

their

eligible

compensation

(capped

at

$70,000),

of

which

the

first

4%

is

paid

in

cash

and

anything

beyond

such

percent

is

paid

to

the

employee’s

Savings

and

Investment

Plan

account. Popular

regularly

evaluates employees’

base compensation

to better

compete with

the salaries

paid in similar

positions

in

other

companies.

Our

ongoing

enhancements

to

our

employees’

compensation

includes

market-aligned

salary

adjustments,

merit increases

and raising

our hourly

pay rates to

$15 per hour

in Puerto Rico

and $16 per

hour in the Virgin

Islands as

of 2023,

and $17

per hour

in Florida

and $20 per

hour in

New York

and New Jersey

as of 2022.

In 2023,

we invested

more than

$22.5M

in enhancing

our employees’

compensation.

Empowering Growth: Our Commitment to Talent Development

We

are

committed

to

fostering

the

continuous

development

and

upskilling

of

our

employees

and

believe

it

is

fundamental

to

maintaining

our

competitive

edge.

Towards

that

end,

Popular

provides

development

opportunities

aimed

at

strengthening

our

employees’

knowledge,

abilities

and skills

to support

their

personal

growth which,

in turn,

seeks

to enhance

Popular’s

business

strategies

and

organizational

competencies.

Our

40,000

square

foot

Development

Center

in

San

Juan,

Puerto

Rico

and

our

satellite

facilities

in New

York,

South Florida,

and the Virgin

Islands offer

year-round

training sessions,

activities

and workshops.

In 2023,

we transitioned

back to

in-person

sessions,

but also

continued

offering

virtual

training

programs.

Our seven

corporate

academies

had

more

than

8,000

registrations

from

our

employees

during

2023,

approximately

1,600

more

than

in

2022.

Our

commitment

to continuous

learning

is further

supported

by offering

our employees

access to

LinkedIn

Learning,

which provides

an extensive

library

of over

16,000

e-learning

courses.

In 2023,

users

totaled

61% of

our employees,

an increase

of 24%

from

2022, for a

total of 17,006

hours logged

during the year.

Our

focus

on

training

and

development

has

provided

internal

growth

opportunities

to

our

workforce.

As

a

result,

the

Corporation’s

internal mobility

rate in 2023

was 36%. This

included employees

who applied

or were selected

for vacancies,

were

promoted,

or

had

lateral

movements.

Additionally,

we

invested

in

the

education

of

over

practitioners

through

Accelerated

Development

Programs

focused

on

data

science,

analytics,

process

excellence,

and

program

management.

The

Corporation

also

offered

its

employees

advanced

training

in

software

engineering,

including,

but

not

limited

to,

coding

and

software

development.

Leadership

development

remains

a

priority

at

Popular,

as

we

believe

it

is

vital

for

driving

results,

maintaining

employee

engagement

and achieving

our strategic

objectives.

With this

in mind,

we launched

a new

leadership

program

in 2023

focused

on

exploring

the

role

Popular’s

leaders

play

in

creating

the

right

environment

for

our

culture

to

thrive.

Our

organizational

development

strategy

aims

to

enhance

both

organizational

and

leadership

effectiveness

by

preparing

us

to

meet

future

challenges.

In

2023,

we

facilitated

organizational

development

interventions

that

focused

on

change

management,

team

alignment, and

leader effectiveness.

Enhancing Leadership Continuity through Strategic

Succession Planning

Popular’s business

strategy further

takes into

account succession

planning to

ensure effective

leadership transitions.

Succession

plans for

senior management

are developed

by the CEO

and presented

to the Board

of Directors.

Popular’s succession

planning

also

leverages

our

Executive

Talent

Management

Program

(the

“Program”)

that

seeks

to

identify

high-potential

and

high-

performing

managers,

which

are

provided

with

learning

opportunities

to

enhance

their

skills

and

prepare

them

for

senior

management positions.

Diversity, Equity and Inclusion

Popular

is

committed

to

fostering

a

diverse,

equitable

and

inclusive

workplace.

As

of

December

31,

2023,

64.5%

of

the

Corporation’s

employees were

female, and

35.5% were male.

Women accounted

for 63% of first

and mid-level

management and

36.6%

of

executive-level

management

as

of

such

date.

We

have

recently

enriched

our

talent

pool

with

the

inclusion

of

professionals

from Latin America,

thereby enhancing

multicultural

diversity

within our organization.

Central to

our diversity

efforts

is our

multidisciplinary

Diversity,

Equity and

Inclusion

(“DEI”)

Council,

which is

overseen

by our

Corporate

Diversity

Officer.

Our

DEI Policy

is committed

to attracting,

retaining

and developing

a diverse

employment

population;

fostering

a work

environment

where

employees

are

treated

equitably

and

with

respect;

and

seeking,

creating,

and

maintaining

business

relationships

with

diverse suppliers.

We

are

committed

to

fair

pay

and

conduct

related

pay

analyses

on

an

annual

basis.

The

results

for

revealed

a

1.8

percentage

point

improvement

in

Puerto

Rico

and

the

Virgin

Islands

and

a

6.4

percentage

point

improvement

in

the

United

States

in

our

gender-related

pay

differences

compared

to

the

end

of

2022.

Our

commitment

to

gender

equality

has

been

recognized

in the Bloomberg

Gender Equality

Index for two

consecutive

years (2021-2022

and 2022-2023).

Our

Employee

Resource

Groups

(“ERGs”)

are

key

resources

that

support

our

DEI

strategy.

In

2023,

our

existing

ERGs

witnessed

substantial

growth

in

membership.

Popular

Pride,

our

ERG

focused

on

the

LGBTQ+

community,

seeks

to

enhance

organizational

awareness

and engagement

of LGBTQ

issues.

Network

of Women

in Popular,

focused

on empowering

women,

and

Popular

Embrace,

focused

on

functional

diversity,

also

achieved

notable

milestones,

including

partnering

with

our

human

resources

division

to

educate

and

promote

specific

wellness

initiatives

and

efforts.

Additionally,

during

we

established

a

Black/African

American ERG in

the US.

Popular also

supports victims

of gender-based

violence and

provides a

special leave

of 15 days

eligible to

employees

located in

Puerto Rico

in order to

handle situations

related to gender

violence, domestic

violence or

stalking.

Employee Experience

Popular

aims

to

provide

an

exceptional

employee

experience

that

inspires

its

employees

to

deliver

outstanding

service

to

customers

and communities.

We

recognize

the

dynamic

nature

of employee

needs

and

expectations

and

have implemented

a

more

robust

approach

to measure

and

understand

the

employee’s

journey.

In

2023,

we revised

our

comprehensive

Employee

Engagement

&

Experience

Survey

program

to

(i)

increase

our

assessments

from

biennial

to

quarterly

and

annually

and

(ii)

include

additional

surveys

that

measure

the

end-to-end

employee

journey

from

recruiting

and

onboarding

to

offboarding.

We

believe that

the insights

received from

these surveys

have allowed

us to

introduce

people initiatives

that have

helped us

reduce

our turnover

rate to 7.9%

as of the

end of 2023,

a 2.9 percentage

point improvement

from 2022.

Our voluntary

turnover rate

also

saw a notable

decrease to

6.4%, down

2.4 percentage

points from

the previous

year.

Furthermore,

the survey

has enabled

us to

monitor

our employee

loyalty

score

and identify

initiatives

to maintain

or enhance

our current

score

of 84%,

which positions

us

within the 75th

percentile of

the Qualtrics

global benchmark

and above the

average benchmark

of the financial

industry.

Board Oversight in Human Capital

The

Talent

and

Compensation

Committee

of

the

Corporation’s

Board

of

Directors

has

oversight

responsibility

for

the

Corporation’s

human capital

management.

As part

of its

responsibilities,

the Talent

and Compensation

Committee

reviews and

advises

management

on the

Corporation’s

general

compensation

philosophy,

programs

and policies,

and

on the

Corporation’s

talent

acquisition

and development,

workforce

engagement,

succession

planning,

culture,

diversity,

equity

(including

pay equity)

and inclusion,

among other human

capital topics.

We

encourage

you

to

review

our Corporate

Sustainability

Report

published

on www.popular.com

for more

detailed

information

regarding

the Corporation’s

human capital

management

programs

and initiatives.

The information

on the

Corporation’s

website,

including

the

Corporation’s

Corporate

Sustainability

Report,

is

not,

and

will

not

be

deemed

to

be,

a

part

of

this

Form

10-K

or

incorporated

into any of the

Corporation’s

filings with

the SEC.

Regulation and Supervision

Described below are the material elements of selected laws and regulations applicable to Popular, Popular North America

(“PNA”)

and

their

respective

subsidiaries.

Such

laws

and

regulations

are

continually

under

review

by

Congress

and

state

legislatures

and

federal

and

state

regulatory

agencies.

Any

change

in

the

laws

and

regulations

applicable

to

Popular

and

its

subsidiaries could have a material effect on the

business of Popular and its subsidiaries. We will continue to

assess our businesses

and risk management and compliance practices

to conform to developments in the regulatory

environment.

General

Popular and PNA are bank holding companies subject to consolidated supervision

and regulation by the Federal Reserve

Board under

the Bank

Holding Company Act

of 1956

(as amended, the

“BHC Act”). BPPR

and PB

are subject to

supervision and

examination by applicable

federal and state

banking agencies including,

in the

case of BPPR,

the Federal Reserve

Board and the

Office of

the Commissioner

of Financial

Institutions of

Puerto Rico

(the “Office

of the

Commissioner”), and, in

the case

of PB,

the

Federal

Reserve

Board

and

the

New

York

State

Department

of

Financial

Services

(the

“NYSDFS”).

Popular’s

broker-dealer

/

investment adviser

subsidiary,

Popular Securities,

LLC (“PS”)

and investment

advisor subsidiary

Popular Asset

Management LLC

(“PAM”)

are subject

to

regulation by

the SEC,

the Financial

Industry

Regulatory Authority

(“FINRA”), and

the Securities

Investor

Protection Corporation, among others. Other of our non-bank subsidiaries conduct reinsurance and

insurance producer and agency

activities, which are

subject to other

federal, state and

Puerto Rico laws

and regulations as

well as licensing

and regulation by

the

Puerto Rico Office of the Commissioner of Insurance and,

for one insurance agency subsidiary, the NYSDFS.

Enhanced Prudential Standards

Under

the

Dodd-Frank

Wall

Street

Reform

and

Consumer

Protection

Act

(the

“Dodd-Frank

Act”),

as

modified

by

the

Economic

Growth,

Regulatory

Relief,

and

Consumer

Protection

Act

and

the

federal

banking

regulators’

“Tailoring

Rules,”

banking

organizations are

categorized based

on status

as

a U.S.

G-SIB,

size

and four

other risk-based

indicators. Among

bank

holding companies with $100

billion or more in

total consolidated assets, the

most stringent standards apply

to U.S. G-SIBs,

which

are subject to Category I standards and the

least stringent standards apply to Category IV organizations, which have between $100

billion and $250 billion in total consolidated assets and less than $75 billion in all four other risk-based indicators and

which are also

not U.S. G-SIBs. Bank holding companies with total consolidated assets of $50 billion or more are subject to risk committee and risk

management requirements. As of December 31, 2023,

Popular had total consolidated assets of $70.8 billion.

Transactions with Affiliates

BPPR

and

PB

are

subject

to

restrictions

that

limit

the

amount

of

extensions

of

credit

and

certain

other

“covered

transactions” (as defined in Section

23A of the Federal

Reserve Act) between BPPR or

PB, on the

one hand, and Popular,

PNA or

any

of

our

other

non-banking

subsidiaries,

on

the

other

hand,

and

that

impose

collateralization

requirements

on

such

credit

extensions. A bank may not engage in any covered transaction if the aggregate amount of the bank’s covered transactions with that

affiliate would exceed 10% of

the bank’s capital stock and

surplus or the aggregate amount of

the bank’s covered transactions with

all affiliates would exceed 20% of the bank’s capital stock and surplus. In addition,

any transaction between BPPR or PB, on the one

hand, and Popular, PNA

or any of our other non-banking

subsidiaries, on the other,

is required to be carried out

on an arm’s length

basis.

Source of Financial Strength

The

Dodd-Frank Act

requires bank

holding companies,

such

as Popular

and

PNA, to

act

as

a source

of

financial

and

managerial strength to their subsidiary banks. Popular

and PNA are expected to commit resources

to support their subsidiary banks,

including at times when Popular

and PNA may not be

in a financial position to

provide such resources. Any capital loans

by a bank

holding company

to any

of its

subsidiary depository

institutions are

subordinated in

right of

payment to

depositors and

to certain

other indebtedness of such subsidiary depository institution. In the

event of a bank holding company’s bankruptcy,

any commitment

by

the

bank

holding

company

to

a

federal

banking

agency

to

maintain

the

capital

of

a

subsidiary

depository

institution

will

be

assumed by

the bankruptcy

trustee and

entitled to

a priority

of payment.

BPPR and

PB are

currently the

only insured

depository

institution subsidiaries of Popular and PNA.

Resolution Planning and Resolution-Related Requirements

A

bank holding

company with

$250 billion

or more

in total

consolidated assets

(or that

is a

Category III

firm based

on

certain risk-based indicators described in the Tailoring

Rules) is required to report periodically to the FDIC

and the Federal Reserve

Board

such

company’s

plan

for

its

rapid

and

orderly

resolution

in

the

event

of

material

financial

distress

or

failure.

In

addition,

insured depository institutions with total

assets of $50 billion or

more are required to

submit to the FDIC

periodic contingency plans

for

resolution

in

the

event

of

the

institution’s

failure.

In

2018,

the

FDIC

issued

a

moratorium

on

resolution

plans

for

insured

depository institutions

with more

than $50

billion in

assets. The

moratorium is

still in

effect for

insured depository

institutions with

more than

$50 billion

but less

than $100

billion in

assets. On

August 29,

2023, the

FDIC proposed

amendments to

the resolution

planning requirements

for insured

depository institutions

with $50

billion or

more in

total assets.

The amendments

would require

insured depository institutions with between $50 billion and

$100 billion in assets to submit informational filings on

a two-year cycle,

with an interim supplement updating key information

submitted in the off years.

On August

29, 2023,

the Federal

Reserve Board,

FDIC and

Office of

the Comptroller

of the

Currency (“OCC”)

issued a

proposed

rule

that

would

require

bank

holding

companies

and

insured

depository

institutions

with

$100

billion

or

more

in

consolidated assets (as well as their insured depository institution affiliates) to maintain minimum

amounts of eligible long-term debt

(generally, debt

that is unsecured, has

a maturity greater than one

year from issuance and satisfies

additional criteria), subject to a

three-year phase-in

period. The

proposal would

also apply

“clean holding

company” requirements

to Category

II through

IV bank

holding companies, which would, among other things, prohibit

entering into derivatives and certain other

financial contracts with third

parties.

As of December 31, 2023, Popular,

PNA, BPPR and PB’s total assets were below

the thresholds for applicability of these

rules, except that BPPR would be subject to the

FDIC’s proposed amendments to its resolution planning requirements applicable to

insured depository institutions

with more than

$50 billion but

less than $100

billion in assets

(if those amendments

are adopted as

proposed).

FDIC Insurance

Substantially all the deposits of BPPR and PB are insured up to applicable limits by the Deposit Insurance Fund (“DIF”) of

the

FDIC,

and

BPPR

and

PB

are

subject

to

FDIC

deposit

insurance

assessments

to

maintain

the

DIF.

Deposit

insurance

assessments are

based on

the average

consolidated total

assets of

the insured

depository institution

minus the

average tangible

equity of the institution during the assessment period. For larger

depository institutions with over $10 billion in assets,

such as BPPR

and PB, the FDIC uses a “scorecard” methodology, which considers CAMELS ratings, among

other measures, that seeks to capture

both the probability that an individual large institution will

fail and the magnitude of the impact on the DIF

if such a failure occurs. The

FDIC has the ability

to make discretionary adjustments to the

total score based upon significant

risk factors that are not

adequately

captured in the calculations. The initial base deposit insurance assessment rate for larger depository institutions ranges from 3 to 30

basis points on an annualized basis.

After the effect of

potential base-rate adjustments, the total base assessment rate could

range

from 1.5 to 40 basis points on an annualized

basis.

In

October

2022,

the

FDIC

finalized

a

rule

that

increased

initial

base

deposit

insurance

assessment

rates

by

basis

points, beginning with the first quarterly assessment period of 2023. The FDIC, as required under the Federal Deposit Insurance Act

(“FDIA”), established

a plan

in September

2020 to

restore the

DIF reserve

ratio to

meet or

exceed the

statutory minimum

of 1.35

percent within

eight years. The

increased assessment is

intended to improve

the likelihood that

the DIF

reserve ratio would

reach

the required minimum by the statutory deadline

of September 30, 2028.

As

of

December

31,

2023,

we

had

a

DIF

average

total

asset

less

average

tangible

equity

assessment

base

of

approximately $66 billion.

On

November 16,

2023,

the

FDIC finalized

a

rule

that

imposes

a special

assessment to

recover the

costs to

the

DIF

resulting

from

the

FDIC’s

use,

in

March

2023,

of

the

systemic

risk

exception to

the

least-cost resolution

test

under the

FDIA

in

connection with the

receiverships of Silicon

Valley Bank

and Signature Bank.

The FDIC estimated

in approving the

rule that those

assessed losses

total approximately $16.3

billion. The

rule provides

that this

loss estimate

will be

periodically adjusted, which

will

affect

the

amount

of

the

special assessment.

Under the

rule, the

assessment

base

is

the

estimated uninsured

deposits that

an

insured depository

institution reported

in its

Consolidated Reports of

Condition and Income

(“Call Report”)

at December

31, 2022,

excluding the

first

$5 billion

in estimated

uninsured deposits.

For a

holding company

that

has more

than one

insured depository

institution

subsidiary,

such

as

Popular,

the

$5

billion

exclusion

is

allocated

among

the

company’s

insured

depository

institution

subsidiaries in

proportion to

each insured

depository institution’s

estimated uninsured

deposits. The

special

assessments will

be

collected at

an annual

rate of

approximately 13.4 basis

points per year

(3.36 basis

points per

quarter) over eight

quarters in

and 2025,

with the

first assessment

period beginning

January 1,

2024. Because

the estimated

loss pursuant

to the

systemic risk

determination

will

be

periodically adjusted,

the

FDIC

retains the

ability to

cease

collection

early,

extend the

special

assessment

collection period and

impose a final

shortfall special assessment

on a one-time

basis. Popular expects the

special assessments to

be

tax

deductible. The

total

of

the assessments

for Popular

is

estimated at

$71.4 million

and such

amount

was recorded

as

an

expense in

the quarter

of adoption

(the quarter

ended December

31, 2023).

As of

December 31,

2023, the

FDIC’s loss

estimate

described in the final rule

had increased by approximately $4.1 billion to $20.4

billion, or approximately 25%. If such increase

in the

FDIC’s

loss

estimate

remains

unchanged and

is

assessed

in

the

same

manner,

the

Corporation estimates

that

the

incremental

expense for the special assessments could be approximately

$18 million.

Brokered Deposits

The FDIA

and regulations

adopted thereunder

restrict the

use of

brokered deposits

and the

rate of

interest payable

on

deposits for institutions

that are less

than well capitalized.

Popular does not

believe the brokered

deposits regulations have

had or

will have a material effect on the funding or liquidity

of BPPR and PB.

Capital Adequacy

Popular, PNA,

BPPR and PB are

each required to comply

with applicable capital adequacy standards

established by the

federal

banking

agencies

(the

“Capital

Rules”),

which

implement

the

Basel

III

framework

set

forth

by

the

Basel

Committee

on

Banking Supervision (the “Basel Committee”) as

well as certain provisions of the Dodd-Frank

Act.

Among other

matters, the

Capital Rules:

(i) impose

a capital

measure called

“Common Equity

Tier

1” (“CET1”)

and the

related regulatory capital ratio of CET1 to risk-weighted assets; (ii) specify that Tier 1 capital consists of CET1 and “Additional Tier 1

capital” instruments meeting

certain revised requirements;

and (iii) mandate

that most deductions/adjustments to

regulatory capital

measures be made

to CET1

and not to

the other components

of capital.

Under the Capital

Rules, for most

banking organizations,

including

Popular,

the

most

common

form

of

Additional

Tier

capital

is

non-cumulative

perpetual preferred

stock

and

the

most

common form of Tier

2 capital is subordinated notes and

a portion of the

allocation for loan and lease losses,

in each case, subject

to the Capital Rules’ specific requirements.

Pursuant to the Capital Rules, the minimum

capital ratios are:

4.5% CET1 to risk-weighted assets;

6.0% Tier 1 capital (that is, CET1 plus Additional Tier 1 capital) to risk-weighted

assets;

8.0% Total capital (that is, Tier 1 capital plus Tier 2 capital) to risk-weighted assets; and

4% Tier 1 capital to average consolidated assets as reported

on consolidated financial statements (known as the

“leverage ratio”).

The Capital Rules also impose

a “capital conservation buffer,”

composed entirely of CET1, on top

of these minimum risk-

weighted

asset

ratios. The

capital

conservation

buffer

is

designed

to

absorb

losses

during

periods

of

economic stress.

Banking

institutions

with

a

ratio

of

CET1

to

risk-weighted

assets

above

the

minimum

but

below

the

capital

conservation

buffer

will

face

constraints on

dividends, equity repurchases

and compensation based

on the

amount of

the shortfall and

eligible retained

income

(that is,

four quarter trailing

net income, net

of distributions

and tax

effects not

reflected in net

income). Thus, Popular,

BPPR and

PB are required to maintain such additional capital conservation buffer of 2.5% of CET1, effectively resulting in minimum ratios of

(i)

CET1 to risk-weighted assets

of at least 7%,

(ii) Tier 1

capital to risk-weighted assets of

at least 8.5%, and

(iii) Total

capital to risk-

weighted assets of at least 10.5%.

In addition, under

prior risk-based capital rules,

the effects of

accumulated other comprehensive income

or loss (“AOCI”)

items included in stockholders’

equity (for example, marks-to-market of securities

held in the available

for sale portfolio) under

U.S.

GAAP were reversed

for the

purposes of determining

regulatory capital ratios.

Pursuant to the

Capital Rules, the

effects of certain

AOCI

items

are

not

excluded;

however,

banking

organizations

that

are

not

subject

to

Categories

I

or

II

standards

under

the

framework for

banking organizations

with $100

billion or

more in

assets, including

Popular,

BPPR and

PB, may

make a

one-time

permanent election to continue to

exclude these items. Popular,

BPPR and PB have

made this election in order

to avoid significant

variations in

the level

of capital

depending upon

the impact

of interest

rate fluctuations

on the

fair value

of their

available for

sale

securities portfolios.

The

Capital

Rules

preclude certain

hybrid

securities, such

as

trust

preferred

securities, from

inclusion

in

bank

holding

companies’ Tier 1 capital. Trust preferred securities no

longer included in Popular’s Tier 1 capital may nonetheless be included as a

component of

Tier 2 capital.

Popular has

not issued

any trust

preferred securities since

May 19,

2010. As

of December

31, 2023,

Popular has

$193 million

of trust

preferred securities

outstanding which

no longer

qualify for

Tier

1 capital

treatment, but

instead

qualify for Tier 2 capital treatment.

The Capital Rules also provide for a number of deductions

from and adjustments to CET1.

Banking organizations that are

not subject to Category

I or II standards

are subject to rules that

provide for simplified capital requirements relating

to the threshold

deductions

for

certain

mortgage

servicing

assets,

deferred

tax

assets,

investments

in

the

capital

of

unconsolidated

financial

institutions and inclusion of minority interests

in regulatory capital.

Failure

to

meet

capital

guidelines

could

subject

Popular

and

its

depository

institution

subsidiaries

to

a

variety

of

enforcement remedies, including the termination of deposit insurance by the FDIC

and to certain restrictions on our business. Refer

to “Prompt Corrective Action” below for further

discussion.

In

December 2017,

the Basel

Committee published

standards that

it

described as

the finalization

of the

Basel III

post-

crisis regulatory

reforms. Among other

things, these

standards revise

the Basel

Committee’s standardized approach

for credit

risk

(including

by

recalibrating

risk

weights

and

introducing

new

capital

requirements

for

certain

“unconditionally

cancellable

commitments,” such

as

unused credit

card

lines of

credit) and

provide

a new

standardized approach

for operational

risk capital.

Under the

current U.S.

capital rules,

operational risk

capital requirements

and a

capital floor

apply only

to advanced

approaches

institutions, and not to Popular, BPPR and PB.

On

July

27,

2023,

the

federal

banking

regulators

proposed

revisions

to

the

Capital

Rules

to

implement

the

Basel

Committee’s

standards

and

make

other

changes

to

the

Capital

Rules,

including

the

ability

of

banking

organizations

in

Categories III and

IV to

elect not to

recognize most elements

of AOCI in

regulatory capital. The

proposal introduces revised

credit

risk, equity risk, operational risk, credit valuation adjustment risk and market risk requirements, among other changes. However,

the

revised capital requirements of the proposed rule would not apply to Popular, BPPR, or PB because

they have less than $100 billion

in total consolidated assets and trading assets and

liabilities below the threshold for market risk

requirements.

In

December

2018,

the

federal

banking

agencies

approved

a

final

rule

modifying

their

regulatory

capital

rules

and

providing an

option to

phase in

over a

period of

three years

the day-one

regulatory capital

effects of

the Current

Expected Credit

Loss (“CECL”) model

of ASU 2016-13.

The final

rule also revised

the agencies’

other rules to

reflect the update

to the

accounting

standards. Popular has availed itself

of the option to

phase in over a period

of three years the

day one effects on

regulatory capital

from the

adoption of

CECL. In

2020, federal

bank regulators

adopted a

rule that

allowed banking

organizations to

elect to

delay

temporarily

the

estimated

effects

of

adopting

CECL

on

regulatory

capital

until

January

and

subsequently

to

phase

in

the

effects through January 2025.

Refer to the Consolidated Financial Statements in this Form 10-K., Note 21 and Table 9 of

Management’s Discussion and

Analysis for the capital ratios of Popular, BPPR and PB under Basel III. Refer

to the Consolidated Financial Statements in this Form

10-K Note 2 for more information regarding CECL.

Prompt Corrective Action

The

FDIA

requires,

among

other

things,

the

federal

banking

agencies

to

take

prompt

corrective

action

in

respect

of

insured

depository

institutions

that

do

not

meet

minimum

capital

requirements.

The

FDIA

establishes

five

capital

tiers:

“well

capitalized,”

“adequately

capitalized,”

“undercapitalized,”

“significantly

undercapitalized,”

and

“critically

undercapitalized”.

A

depository institution’s capital tier will depend upon how its

capital levels compare with various relevant capital

measures and certain

other factors.

An insured

depository institution will

be deemed

to be

(i) “well

capitalized” if

the institution

has a

total risk-based

capital

ratio of 10.0% or greater, a CET1 capital ratio of 6.5%

or greater, a Tier 1

risk-based capital ratio of 8.0% or greater, and a leverage

ratio of 5.0% or

greater, and is

not subject to any order

or written directive by

any such regulatory authority to

meet and maintain a

specific capital level for any capital

measure; (ii) “adequately capitalized” if the institution

has a total risk-based capital ratio

of 8.0%

or greater, a

CET1 capital ratio of 4.5%

or greater, a

Tier 1 risk-based capital

ratio of 6.0% or greater,

and a leverage ratio of

4.0%

or greater

and is

not “well

capitalized”; (iii)

“undercapitalized” if

the institution

has a

total risk-based

capital ratio

that is

less than

8.0%, a CET1 capital

ratio less than 4.5%,

a Tier 1

risk-based capital ratio of

less than 6.0% or

a leverage ratio of

less than 4.0%;

(iv) “significantly

undercapitalized” if

the institution

has a

total risk-based

capital ratio

of less

than 6.0%,

a CET1

capital ratio

less

than 3%, a Tier

1 risk-based capital ratio of less than 4.0% or

a leverage ratio of less than 3.0%;

and (v) “critically undercapitalized”

if

the

institution’s

tangible

equity

is

equal

to

or

less

than

2.0%

of

average

quarterly

tangible

assets.

An

institution

may

be

downgraded to, or deemed

to be in, a

capital category that is

lower than indicated by

its capital ratios if

it is determined to

be in an

unsafe

or

unsound

condition

or

if

it

receives

an

unsatisfactory

examination

rating

with

respect

to

certain

matters.

An

insured

depository institution’s capital category is determined solely for the purpose of applying prompt corrective action

regulations, and the

capital category

may not

constitute an

accurate representation

of the

institution’s overall

financial condition

or prospects

for other

purposes.

The FDIA generally prohibits an insured depository institution from making any capital

distribution (including payment of a

dividend) or

paying any

management fee to

its holding

company, if

the depository

institution would thereafter

be undercapitalized.

Undercapitalized

depository

institutions

are

subject

to

restrictions

on

borrowing

from

the

Federal

Reserve

System.

In

addition,

undercapitalized

depository

institutions

are

subject

to

growth

limitations

and

are

required

to

submit

capital

restoration

plans.

A

depository institution’s

holding company must

guarantee the capital

restoration plan, up

to an

amount equal to

the lesser

of 5%

of

the

depository

institution’s

assets

at

the

time

it

becomes

undercapitalized

or

the

amount

of

the

capital

deficiency,

when

the

institution fails to comply with the

plan. The federal banking agencies may not

accept a capital restoration plan without determining,

among other things,

that the plan

is based

on realistic assumptions

and is

likely to succeed

in restoring the

depository institution’s

capital. If a depository institution fails to submit an

acceptable plan, it is treated as if it is

significantly undercapitalized.

Significantly

undercapitalized

depository

institutions

may

be

subject

to

a

number

of

requirements

and

restrictions,

including orders to

sell sufficient voting

stock to become

adequately capitalized, requirements to

reduce total assets

and cessation

of receipt

of deposits

from correspondent

banks. Critically

undercapitalized depository

institutions are

subject to

appointment of

a

receiver or conservator.

The capital-based prompt

corrective action provisions

of the FDIA

apply to

the FDIC-insured depository

institutions such

as

BPPR

and

PB,

but

they

are

not

directly

applicable

to

holding

companies

such

as

Popular

and

PNA,

which

control

such

institutions. As of December 31, 2023,

both BPPR and PB met the quantitative requirements

for ‘well capitalized’ status.

Restrictions on Dividends and Repurchases

The

principal

sources

of

funding

for

Popular

and

PNA

have

included

dividends

received

from

their

banking

and

non-

banking subsidiaries, asset sales

and proceeds from

the issuance of

debt and equity.

Various statutory

provisions limit the amount

of

dividends an

insured depository

institution may

pay to

its

holding company

without regulatory

approval. A

member bank

must

obtain the approval of the

Federal Reserve Board for any

dividend, if the total of

all dividends declared by the

member bank during

the calendar year would exceed the total of its net income for that year,

combined with its retained net income for the preceding two

years, after

considering those

years’ dividend

activity,

less any

required transfers to

surplus or

to a

fund for

the retirement

of any

preferred stock. During the year

ended December 31, 2023, BPPR declared

cash dividends of $200

million, a portion of

which was

used by Popular for the payments of the cash dividends on its

outstanding common stock. At December 31, 2023, BPPR needed to

obtain prior approval of the Federal Reserve Board before declaring a dividend

in excess of $387 million due to its

retained income,

declared dividend activity and transfers to statutory reserves over the

three year’s ended December 31, 2023. In addition, a member

bank may

not declare

or pay

a dividend

in an

amount greater

than its

undivided profits

as reported

in its

Report of

Condition and

Income, unless the member bank has received the approval of

the Federal Reserve Board. A member bank also may not permit

any

portion of its permanent capital to

be withdrawn unless the withdrawal has

been approved by the Federal Reserve Board.

Pursuant

to

these

requirements, PB

may

not

declare

or

pay

a

dividend without

the

prior

approval

of

the

Federal

Reserve

Board

and

the

NYSDFS.

During the year

ended December 31,

2023, PB

declared cash dividends

of $50

million, a portion

of which

was used

by

Popular for the payments of the cash dividends on

its outstanding common stock.

It is Federal Reserve Board policy that bank holding companies generally should pay dividends on common

stock only out

of net

income available to

common shareholders

over the past

year and

only if

the prospective rate

of earnings retention

appears

consistent with the organization’s current and

expected future capital needs, asset quality

and overall financial condition. Moreover,

under Federal Reserve Board policy, a bank

holding company should not maintain dividend levels that place undue pressure on the

capital of depository

institution subsidiaries or that

may undermine the bank

holding company’s ability to

be a source

of strength to

its

banking subsidiaries.

Federal Reserve

policy

also

provides that

a

bank

holding company

should

inform

the

Federal

Reserve

reasonably in advance of declaring or paying a dividend that

exceeds earnings for the period for which the dividend is

being paid or

that could result in a material adverse change

to the bank holding company’s capital structure.

The

Federal Reserve

Board

also restricts

the

ability of

banking

organizations to

conduct stock

repurchases. In

certain

circumstances, a banking organization’s repurchases

of its common stock may

be subject to a

prior approval or notice requirement

under other regulations or policies of the Federal Reserve. Any redemption or

repurchase of preferred stock or subordinated debt is

subject to the prior approval of the Federal Reserve.

Subject to compliance with certain conditions, distributions of U.S. sourced dividends to a corporation

organized under the

laws

of the

Commonwealth of

Puerto Rico

are subject

to

a withholding

tax

of 10%

instead of

the 30%

applied to

other “foreign”

corporations. Accordingly, dividends from current or accumulated earnings and profits

paid by PNA to Popular, Inc. sourced from the

U.S. operations of PB are subject to a 10%

tax withholding.

Refer to

Part II,

Item 5,

“Market for

Registrant’s Common

Equity,

Related Stockholder

Matters and

Issuer Purchases

of

Equity Securities” for further information on Popular’s

distribution of dividends and repurchases of equity

securities.

See

“Puerto

Rico

Regulation”

below

for

a

description

of

certain

restrictions

on

BPPR’s

ability

to

pay

dividends

under

Puerto Rico law.

Interstate Branching

The Dodd-Frank

Act amended

the Riegle-Neal

Interstate Banking

and Branching

Efficiency Act

of 1994

(the “Interstate

Banking

Act”)

to

authorize

national

banks

and

state

banks

to

branch

interstate

through

de

novo

branches. For

purposes

of

the

Interstate Banking Act, BPPR is treated as a state bank and is subject to the same restrictions on interstate branching as other state

banks.

Activities and Acquisitions

In general, the BHC Act limits the activities

permissible for bank holding companies to the business of banking, managing

or controlling banks and such other activities as the Federal Reserve Board has determined to be so closely related to banking as to

be

properly

incidental

thereto.

A

company

who

meets

management

and

capital

standards

and

whose

subsidiary

depository

institutions meet management,

capital and

Community Reinvestment Act

(“CRA”) standards may

elect to

be treated

as a

financial

holding company

and engage

in a

substantially broader

range of

nonbanking financial

activities, including

securities underwriting

and dealing, insurance underwriting and making

merchant banking investments in nonfinancial

companies.

In order for a bank holding company to elect to be treated as a financial

holding company, (i) all of its depository institution

subsidiaries

must

be

well capitalized

(as described

above)

and

well managed

and

(ii)

it

must

file a

declaration with

the Federal

Reserve Board that it elects to be a “financial holding

company.” As noted above, a bank

holding company electing to be a financial

holding company must itself be and remain

well capitalized and well managed. The Federal Reserve Board’s

regulations applicable

to bank holding companies separately define

“well capitalized” for bank holding companies,

such as Popular,

to require maintaining

a tier 1 capital

ratio of at least

6% and a total capital

ratio of at least 10%.

Popular and PNA have elected

to be treated as

financial

holding

companies.

A

depository

institution

is

deemed

to

be

“well

managed”

if,

at

its

most

recent

inspection,

examination

or

subsequent review

by the

appropriate federal banking

agency (or

the appropriate state

banking agency), the

depository institution

received

at

least

a

“satisfactory”

composite

rating

and

at

least

a

“satisfactory”

rating

for

the

management

component

of

the

composite

rating.

If,

after

becoming

a

financial

holding

company,

the

company

fails

to

continue

to

meet

any

of

the

capital

or

management requirements

for financial

holding company

status, the

company

must

enter into

a confidential

agreement with

the

Federal

Reserve

Board

to

comply

with

all

applicable capital

and

management

requirements.

If

the

company

does

not

return

to

compliance

within

days,

the

Federal

Reserve

Board

may

extend

the

agreement

or

may

order

the

company

to

divest

its

subsidiary banks or the

company may discontinue, or

divest investments in companies

engaged in, activities permissible only

for a

bank holding company that has elected to be treated as a financial

holding company. In addition, if a depository institution subsidiary

controlled by a financial holding company does not

maintain a CRA rating of at least “satisfactory,” the financial holding company

will

be subject to restrictions on certain new activities

and acquisitions.

The Federal Reserve Board

may in certain circumstances limit

our ability to conduct

activities and make acquisitions that

would otherwise be permissible for

a financial holding company.

Furthermore, a financial holding company must obtain

prior written

approval from the Federal Reserve Board before acquiring a nonbank company with $10 billion or more in total consolidated assets.

In addition, we

are required to

obtain prior Federal

Reserve Board approval

before engaging in

certain banking and

other financial

activities both in the United States and abroad.

The “Volcker

Rule” adopted

as part

of the

Dodd-Frank Act

restricts the

ability of

Popular and

its subsidiaries,

including

BPPR and PB as

well as non-banking subsidiaries, to

sponsor or invest in

“covered funds,” including private funds,

or to engage in

certain types

of proprietary

trading. Popular

and its

subsidiaries generally

do not

engage in

the businesses

subject to

the Volcker

Rule; therefore, the Volcker Rule does not have a material effect on our

operations.

Anti-Money Laundering Initiative and the USA PATRIOT Act

A major focus of governmental policy relating to financial institutions in

recent years has been aimed at combating money

laundering and

terrorist financing.

The USA

PATRIOT

Act of

2001 (the

“USA PATRIOT

Act”) strengthened

the ability

of the

U.S.

government to help prevent, detect and prosecute international money

laundering and the financing of terrorism. Title

III of the USA

PATRIOT

Act imposed

significant compliance

and due

diligence obligations,

created new

crimes and

penalties and

expanded the

extra-territorial jurisdiction of the United States. Failure of a financial institution to comply with the USA PATRIOT Act’s requirements

could have serious legal and reputational consequences

for the institution.

The

Anti-Money

Laundering

Act

of

(“AMLA”),

which

amended

the

Bank

Secrecy

Act

(the

“BSA”),

is

intended

to

comprehensively

reform

and

modernize

U.S.

anti-money

laundering

laws.

Among

other

things,

the

AMLA

codifies

a

risk-based

approach to anti-money laundering compliance for financial institutions; requires the U.S. Department of the Treasury to

promulgate

priorities

for

anti-money

laundering

and

countering

the

financing

of

terrorism

policy;

requires

the

development

of

standards

for

testing technology and

internal processes for BSA

compliance; expands enforcement-

and investigation-related authority,

including

a

significant

expansion

in

the

available

sanctions

for

certain

BSA

violations;

and

expands

BSA

whistleblower

incentives

and

protections. Many of

the statutory provisions

in the AMLA

will require additional

rulemakings, reports and

other measures, and

the

impact

of

the

AMLA

will

depend on,

among

other

things,

rulemaking and

implementation guidance.

In

June

2021,

the

Financial

Crimes Enforcement Network, a bureau of

the U.S. Department of the

Treasury,

issued the priorities for anti-money laundering

and

countering the

financing of

terrorism policy

required under AMLA.

The priorities

include: corruption, cybercrime,

terrorist financing,

fraud, transnational crime, drug trafficking, human trafficking and

proliferation financing.

Federal regulators

regularly examine BSA/Anti-Money

Laundering and sanctions

compliance to

enhance their

adequacy

and effectiveness, and the frequency and extent of such examinations

and related remedial actions have been

increasing.

Community Reinvestment Act

The

CRA

requires

banks

to

help

serve

the

credit

needs

of

their

communities,

including

extending

credit

to

low-

and

moderate-income individuals

and geographies.

Should

Popular

or our

bank

subsidiaries

fail

to

serve

adequately

the community,

potential penalties may include regulatory denials of applications to expand branches, relocate offices or branches, add subsidiaries

and affiliates, expand

into new financial activities

and merge with or

purchase other financial institutions.

On October 24, 2023,

the

OCC,

the

Federal

Reserve

Board,

and

the

FDIC

jointly

issued

a

final

rule

to

modernize

the

federal

banking

agencies’

CRA

regulations and respond to changes in the

banking industry. Among other

items, the final rule introduces new tests

under which the

performance of banks will

be assessed and includes

data collection and reporting requirements,

many of which are

applicable only

to banks with over

$10 billion in assets, such

as BPPR and PB.

The effective date of

the final rule is

April 1, 2024; however,

banks

will not be required to begin complying with certain provisions

of the final rule until January 1, 2026, with data reporting requirements

becoming applicable on January 1, 2027.

Interchange Fees Regulation

The Federal Reserve Board

has established standards for

debit card interchange fees

and prohibited network exclusivity

arrangements and routing restrictions. The

maximum permissible interchange fee that

an issuer may receive

for an electronic debit

transaction is

the sum

of

21 cents

per transaction

and 5

basis points

multiplied by

the value

of

the transaction.

Additionally,

the

Federal Reserve

Board allows

for an

upward adjustment

of

no more

than 1

cent

to

an issuer’s

debit card

interchange fee

if the

issuer develops and implements policies and procedures

reasonably designed to achieve certain fraud-prevention

standards.

In

October

2023,

the

Federal

Reserve

Board

proposed

amendments

to

its

rules

on

interchange

fees.

The

proposed

changes would establish a

maximum permissible interchange fee of

no more than

14.4 cents per transaction

plus four basis points

multiplied by

the value

of the

transaction. The

fraud prevention

adjustment would

be increased

to 1.3

cents per

transaction. The

proposed rule would also establish an automatic update of the interchange fee cap every other year based on a survey of debit card

issuers.

Consumer Financial Protection Act of 2010

The Consumer

Financial Protection

Bureau (the

“CFPB”) supervises

“covered persons”

(broadly defined

to include

any

person offering or

providing a consumer financial

product or service and

any affiliated service

provider) for compliance with

federal

consumer financial laws. The CFPB

also has the broad power

to prescribe rules applicable to

a covered person or service

provider

identifying

as

unlawful,

unfair,

deceptive,

or

abusive

acts

or

practices

in

connection

with

any

transaction

with

a

consumer

for

a

consumer financial product or service, or the offering of

a consumer financial product or service. We are subject to examination and

regulation by the CFPB.

On October

19, 2023,

the CFPB

proposed a

new rule

to implement

Section 1033

of the

Consumer Financial

Protection

Act

that

would require

a provider

of

payment accounts

or

products, such

as a

bank, to

make data

available to

consumers upon

request regarding the products or services they obtain from the provider. Any such data

provider would also have to make such data

available to third

parties, with the consumer’s

express authorization and through

an interface that satisfies

formatting, performance

and security standards, for the purpose of such third parties providing the consumer with financial products or services requested by

the

consumer.

Data

that

would

be

required

to

be

made

available under

the

rule

would

include

transaction

information,

account

balance, account

and routing

numbers, terms and

conditions, upcoming bill

information, and certain

account verification data.

The

proposed

rule

is

intended

to

give

consumers

control

over

their

financial

data,

including

with

whom

it

is

shared,

and

encourage

competition in the provision of consumer financial products or services. For banks with at least $850 million and less than $50 billion

in

total

assets,

compliance

with

the

proposed

rule’s

requirements

would

be

required

approximately

two

and

a

half

years

after

adoption of the final rule. For

banks with at least $50 billion and

less than $500 billion in total

assets, compliance with the proposed

rule’s requirements would be required approximately

one year after adoption of the final rule.

On

January

17,

2024,

the

CFPB

proposed

a

rule

that

would

significantly

reform

the

regulatory

framework

governing

overdraft practices applicable

to banks such

as BPPR and

PB that have

more than $10

billion in assets.

The proposed rule

would

modify

or

eliminate

several

long-standing

exclusions

from

requirements

generally

applicable

to

consumer

credit

that

previously

exempted certain overdraft practices.

The proposal would also generally require banks to restructure many overdraft fees, overdraft

lines

of credit,

and other

overdraft practices

as separate

consumer credit

accounts that

would be

subject to

those requirements.

These changes

to the

regulatory framework could

result in

BPPR and

PB, among

other things,

facing higher

compliance costs

in

charging

overdraft

fees,

experiencing

a

decreased

ability

to

recover

amounts

extended

as

overdraft

protection,

reducing

the

availability of overdraft protection, and/or charging lower

overdraft fees.

Office of Foreign Assets Control Regulation

The

U.S.

Treasury

Department

Office

of

Foreign

Assets

Control

(“OFAC”)

administers

economic

sanctions

that

affect

transactions

with

designated

foreign

countries,

nationals

and

others.

The

OFAC-administered

sanctions

targeting

countries

take

many

different

forms.

Generally,

however,

they

contain

one

or

more

of

the

following

elements:

(i)

restrictions

on

trade

with

or

investment in a sanctioned country; and (ii) a blocking

of assets in which the government of the

sanctioned country or other specially

designated nationals have an interest, by prohibiting

transfers of property subject to U.S. jurisdiction (including

property in the United

States or the possession or control of U.S.

persons outside of the United States). Blocked assets (e.g., property

and bank deposits)

cannot

be

paid

out,

withdrawn, set

off

or

transferred

in

any

manner without

a

license

from

OFAC.

Failure

to

comply

with these

sanctions could have serious legal and reputational

consequences.

Protection of Customer Personal Information and

Cybersecurity

The privacy

provisions of

the Gramm-Leach-Bliley Act

of 1999

generally prohibit financial

institutions, including

us, from

disclosing nonpublic personal financial information of consumer customers to third

parties for certain purposes (primarily marketing)

unless

customers

have

the

opportunity

to

opt

out

of

the

disclosure.

The

Fair

Credit

Reporting

Act

restricts

information

sharing

among affiliates for marketing purposes and governs

the use and provision of information to consumer

reporting agencies.

The federal

banking regulators have

also issued guidance

and proposed rules

regarding cybersecurity that

are intended

to

enhance cyber

risk management

standards among

financial institutions.

A

financial institution

is expected

to

establish lines

of

defense

and

to

maintain

risk

management

processes

that

are

designed

to

address

the

risk

posed

by

compromised

customer

credentials. A

financial institution’s

management is

expected to

maintain sufficient

business continuity

planning processes

for the

rapid

recovery,

resumption

and

maintenance

of

the

institution’s

operations

after

a

cyber-attack

involving

destructive

malware.

A

financial

institution

is

also

expected

to

develop

appropriate

processes

to

enable

recovery

of

data

and

business

operations

and

address rebuilding

network capabilities

and restoring

data if

the institution

or its

critical service

providers fall

victim to

this type

of

cyber-attack. If

we fail

to observe

the regulatory

guidance, we

could be

subject to

various regulatory

sanctions, including financial

penalties. In November 2021, the U.S. federal bank regulatory

agencies issued a final rule requiring banking

organizations, including

Popular,

PNA,

BPPR and

PB,

to

notify their

primary federal

banking regulator

within

36 hours

of

determining that

a “notification

incident”

has

occurred.

A

notification

incident

is

a

“computer-security

incident”

that

has

materially

disrupted

or

degraded,

or

is

reasonably likely

to materially

disrupt or

degrade, the

banking organization’s

ability to

deliver services

to

a material

portion of

its

customer base,

jeopardize the viability

of key

operations of the

banking organization, or

impact the stability

of the

financial sector.

The final rule also requires specific and immediate

notifications by bank service providers that

become aware of similar incidents.

State and foreign regulators

have also been increasingly active

in implementing privacy and cybersecurity

standards and

regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and

providing detailed requirements with respect to these

programs, including data encryption requirements. In New York,

the NYSDFS

requires

financial

institutions

regulated

by

the

NYSDFS,

including

PB,

to,

among

other

things,

(i)

establish

and

maintain

a

cybersecurity program designed

to enhance the

confidentiality, integrity

and availability of

their information systems;

(ii) implement

and maintain a written

cyber security policy setting forth

policies and procedures for the

protection of their information systems

and

nonpublic

information;

and

(iii)

designate

a

Chief

Information

Security

Officer.

On

November

1,

2023,

the

NYSDFS

adopted

amendments to

its

cybersecurity regulations

that

represent

a

significant

update

to

the

regulation of

cybersecurity practices.

The

amendments

generally

fall

within

the

following

five

categories:

(i)

increased

mandatory

controls

associated

with

common

attack

vectors,

(ii)

enhanced

requirements

for

privileged

accounts,

(iii)

enhanced

notification

obligations,

(iv)

expansion

of

cyber

governance

practices

and

(v)

additional cybersecurity

requirements for

larger companies.

Most

of

the

amendments

will

become

effective 180 days after adoption.

On

July

6,

2023,

the

SEC

adopted

new

rules

that

would

require

registrants,

such

as

Popular,

to

(i)

report

material

cybersecurity incidents

on Form

8-K and,

(ii) disclose

in Annual

Report on

Form 10-K

cybersecurity policies

and procedures

and

governance practices, including at the board and

management levels.

Many states and foreign

governments have also recently implemented or

modified their data breach notification

and data

privacy

requirements. The

California Consumer

Privacy Act

(“CCPA”)

imposes privacy

compliance obligations

with regard

to

the

collection,

use

and

disclosure of

personal

information of

California residents,

and the

November 2020

amendment to

the

CCPA

creates the California Privacy Protection Agency, a watchdog privacy agency, and further expands the scope of businesses covered

by the law

and certain rights relating

to personal information. The

substantive obligations under the

2020 amendment to the

CCPA

became effective

on January

1, 2023.

In European

Union, the

General Data

Protection Regulation heightens

privacy compliance

obligations

and

imposes

strict

standards

for

reporting

data

breaches.

We

expect

this

trend

to

continue

and

are

continually

monitoring developments in the jurisdictions in which

we operate.

See

“Puerto

Rico

Regulation”

below

for

a

description

of

legislations

and

regulations

on

information

privacy

and

cybersecurity in Puerto Rico.

Climate-Related and ESG Developments

In

recent

years,

federal,

state

and

international

lawmakers

and

regulators

have

increased

their

focus

on

financial

institutions’

and

other

companies’

risk

oversight,

disclosures

and

practices

in

connection

with

climate

change

and

other

environmental, social and

governance (“ESG”) matters.

For example,

on October

24, 2023, the

Federal Reserve, FDIC,

and OCC

finalized

interagency

guidance

on

principles

for

climate-related

financial

risk

management

applicable

to

regulated

financial

institutions with more

than $100 billion

in total consolidated

assets. The principles

are intended to

support efforts by

large financial

institutions to

focus on key

aspects of climate-related

financial risk management

and cover six

areas: (1)

governance; (2) policies,

procedures,

and

limits; (3)

strategic planning;

(4)

risk

management; (5)

data,

risk measurement,

and reporting;

and

(6)

scenario

analysis.

On

December

21,

2022,

the

NYSDFS

proposed

guidance

on

climate-related

financial

risk

management

applicable

to

NYSDFS-regulated banking

and mortgage

organizations, including

PB.

The

proposed guidance

would address

material financial

risks related to

climate change faced

by these organizations in

the context of

risk assessment, risk management,

and risk appetite

setting. On March 21, 2022, the SEC issued a proposed rule on the enhancement and

standardization of climate-related disclosures

for investors. The

proposed rule would

require public issuers,

including the Company,

to significantly expand

the scope of

climate-

related disclosures in

their SEC filings.

The SEC

also announced plans

to propose rules

to require enhanced

disclosure regarding

human capital management and board diversity for

public issuers.

Incentive Compensation

The Federal Reserve Board reviews, as

part of its regular,

risk-focused examination process, the incentive compensation

arrangements of

banking organizations, such

as Popular,

that are

not “large,

complex banking

organizations.” Deficiencies will

be

incorporated into

the

organization’s supervisory

ratings, which

can

affect

the

organization’s ability

to

make

acquisitions and

take

other

actions. Enforcement

actions may

be taken

against

a

banking

organization if

its

incentive compensation

arrangements, or

related

risk-management

control

or

governance

processes,

pose

a

risk

to

the

organization’s

safety

and

soundness

and

the

organization is not taking prompt and effective measures

to correct the deficiencies.

The

Federal

Reserve

Board,

OCC

and

FDIC

have

issued

comprehensive

final

guidance

on

incentive

compensation

policies intended to discourage excessive risk-taking in

the incentive compensation policies of banking organizations

in order to not

undermine

the

safety

and

soundness

of

such

organizations.

The

guidance,

which

covers

all

employees

that

have

the

ability

to

materially affect

the risk

profile of an

organization, either individually

or as

part of

a group,

is based

upon the key

principles that

a

banking organization’s incentive compensation arrangements should (i) provide incentives that do not encourage risk-taking beyond

the

organization’s

ability

to

effectively

identify

and

manage

risks,

(ii)

be

compatible

with

effective

internal

controls

and

risk

management, and (iii)

be supported by

strong corporate governance,

including active and

effective oversight

by the

organization’s

board of directors.

The Dodd-Frank Act requires the U.S. financial regulators, including the Federal Reserve Board, the other federal banking

agencies

and

the

SEC,

to

adopt

rules

prohibiting

incentive-based

payment

arrangements that

encourage

inappropriate

risks

by

providing excessive

compensation or

that could

lead to

a material

financial loss

at specified

regulated entities

having at

least $1

billion in total

assets (including Popular,

PNA, BPPR and

PB). The U.S.

financial regulators proposed revised

rules in 2016,

which

have not been finalized.

In October

2022, the SEC

adopted a final

rule requiring securities

exchanges to adopt

rules mandating, in

the case of

a

restatement, the

recovery or

“clawback” of

excess incentive-based

compensation paid

to current

or former

executive officers

and

requiring listed

issuers to

disclose any

recovery analysis where

recovery is

triggered by

a restatement.

The excess

compensation

would be based

on the amount

the executive officer

would have received

had the incentive-based

compensation been determined

using the restated

financials. The Nasdaq

Stock Market’s listing

standards pursuant to the

SEC’s rule became

effective October 2,

2023. Popular’s clawback policy adopted in accordance

with these listing standards is included as

Exhibit 97.1.

Regulation of Broker-Dealers

Our subsidiary,

PS, is a

registered broker-dealer with the

SEC and subject to

regulation and examination by

the SEC as

well

as

FINRA

and

other

self-regulatory

organizations.

These

regulations

cover

a

broad

range

of

issues,

including

capital

requirements;

sales

and

trading

practices;

use

of

client

funds

and

securities;

the

conduct

of

directors,

officers

and

employees;

record-keeping and recording;

supervisory procedures to

prevent improper trading

on material

non-public information; qualification

and

licensing

of

sales

personnel;

and

limitations

on

the

extension

of

credit

in

securities

transactions.

In

addition

to

federal

registration, state securities

commissions require the

registration of certain

broker-dealers. PS is

registered with 35

U.S. state and

territory securities commissions.

Regulation of Reinsurers, Insurance Producers and Agents

Popular’s subsidiaries that are engaged in

insurance agency and producer activities are

subject to regulatory supervision

by the Puerto

Rico Office of

the Commissioner of Insurance

and to insurance laws

and regulations requiring licensing

of insurance

producers and

agents. Popular’s

reinsurance subsidiaries

are subject

to

licensure and

regulatory supervision

by the

Puerto Rico

Office of the Commissioner of Insurance and

to insurance laws and regulations requiring, among

other things, minimum capital and

solvency standards, financial reporting, restrictions on

the amount of dividends payable, record

keeping and examinations.

Puerto Rico Regulation

As

a

commercial

bank

organized

under

the

laws

of

Puerto

Rico,

BPPR

is

subject

to

supervision,

examination

and

regulation by the Office of the Commissioner of Financial Institutions, pursuant to the Puerto Rico Banking Act of 1933, as amended

(the “Banking Law”).

Section 27

of the

Banking Law

requires that

at

least ten

percent (10%)

of the

yearly net

income of

BPPR be

credited

annually to a reserve

fund. The apportionment must be

done every year until the

reserve fund is equal to

the total of paid-in

capital

on common and preferred stock. During 2023, $44.5

million was transferred to the statutory reserve

account.

Section

of

the

Banking

Law

also

provides that

when

the

expenditures

of

a

bank

are

greater

than

its

receipts, the

excess of the

former over the latter

must be charged against

the undistributed profits of

the bank, and the

balance, if any,

must be

charged against

the reserve

fund.

If the

reserve fund

is

not sufficient

to

cover such

balance in

whole or

in part,

the outstanding

amount must be charged against

the capital account and no

dividend may be declared until capital

has been restored to its

original

amount and the reserve fund to 20% of the original

capital.

Section 16 of the

Banking Law requires every

bank to maintain a

legal reserve that, except

as otherwise provided by

the

Office of

the Commissioner,

may not be

less than 20%

of its

demand liabilities, excluding

government deposits (federal,

state and

municipal) that

are secured

by collateral.

If a

bank is

authorized to

establish one

or more

bank branches

in a

state of

the United

States or in a foreign country, where such branches are subject to the reserve requirements of that state

or country, the Office of the

Commissioner

may

exempt

said

branch

or

branches

from

the

reserve

requirements

of

Section

16.

Pursuant

to

an

order

of

the

Federal

Reserve

Board

dated

November

24,

1982,

BPPR

has

been

exempted

from

the

reserve

requirements

of

the

Federal

Reserve

System

with

respect

to

deposits

payable

in

Puerto

Rico.

Accordingly,

BPPR

is

subject

to

the

reserve

requirement

prescribed by the Banking Law. During 2023, BPPR was in compliance

with the statutory reserve requirement.

Section 17 of the Banking Law permits a bank to make loans to

any one person, firm, partnership or corporation, up to an

aggregate amount of

fifteen percent (15%)

of the paid-in

capital and reserve fund

of the bank.

As of December

31, 2023, the

legal

lending limit

for BPPR

under this

provision was

approximately $341

million. In

the case

of loans

which are

secured by

collateral

worth at

least 25% more

than the amount

of the

loan, the

maximum aggregate amount

of such secured

loans is

increased to

one

third of

the paid-in capital

of the bank,

plus its reserve

fund. In no

event may the

total of unsecured

and secured loans

to any one

person, firm, partnership or corporation exceed an aggregate amount of 33 1/3% of the paid-in capital and reserve fund of the bank.

If the institution is well capitalized and had been rated

1 in the last examination performed by the Office

of the Commissioner or any

regulatory agency,

its legal

lending limit

shall also

include 15%

of 50%

of its

undivided profits

and for

loans secured

by collateral

worth at

least 25%

more than

the amount

of the

loan, the

capital of

the bank

shall also

include 33

1/3% of

50% of

its undivided

profits. Institutions rated 2

in their last

regulatory examination may include this

additional component in their

legal lending limit

only

with the previous authorization of the Office of the Commissioner. There are no restrictions under Section 17 on the amount of loans

that are wholly secured

by bonds, securities and

other evidence of indebtedness

of the Government of

the United States or

Puerto

Rico,

or

by

current

debt

bonds,

not

in

default,

of

municipalities

or

instrumentalities

of

Puerto

Rico.

During

2023,

BPPR

was

in

compliance with the lending limit requirements of Section

17 of the Banking Law.

Section

of

the

Banking Law

authorizes a

bank to

conduct certain

financial

and

related

activities directly

or

through

subsidiaries, including finance leasing of personal property and originating and servicing

mortgage loans. BPPR engages in finance

leasing through

its wholly-owned

subsidiary,

Popular Auto,

LLC, which

is organized

and operates

in Puerto

Rico. The

origination

and servicing of mortgage loans is conducted by

Popular Mortgage, a division of BPPR.

With

respect to

information privacy,

Puerto

Rico

law

requires businesses

to

implement information

security

controls to

protect

consumers’

personal

information

from

breaches,

as

well

as

to

provide

notice

of

any

breach

to

affected

customers.

In

addition, as

noted above

in “Regulation

of

Reinsurers, Insurance

Producers and

Agents”, Popular’s

reinsurance subsidiaries

are

subject to

licensure and regulatory

supervision by the

Puerto Rico Office

of the

Commissioner of Insurance

and to insurance

laws

and regulations.

Available Information

We maintain an

Internet website at www.popular.com.

Via the “Investor

Relations” link at our

website, our annual reports

on

Form 10-K,

quarterly reports

on

Form 10-Q,

current

reports on

Form 8-K

and amendments

to

such

reports filed

or furnished

pursuant to Section 13(a) or

15(d) of the Securities Exchange Act

of 1934, as amended (the

“Exchange Act”), are available, free

of

charge, as

soon as

reasonably practicable

after such

forms are

electronically filed

with, or

furnished to,

the SEC.

The SEC

also

maintains an

internet website at

http://www.sec.gov that

contains reports, proxy

and information statements,

and other information

regarding issuers that file electronically with the

SEC. You may obtain copies of our filings on the SEC site.

We have

adopted a

written code

of ethics

that applies

to all

directors, officers

and employees

of Popular,

including our

principal executive officer

and senior financial

officers, in accordance

with Section 406

of the Sarbanes-Oxley

Act of 2002

and the

rules

of

the

SEC

promulgated

thereunder.

Our

Code

of

Ethics

is

available

on

our

corporate

website,

www.popular.com,

in

the

section entitled “Corporate Governance.” In the event that we make changes to, or provide waivers from, the provisions of this Code

of Ethics that

the SEC requires

us to disclose,

we intend to

disclose these events

on our corporate

website in such

section. In

the

Corporate Governance

section

of our

corporate

website,

we

have also

posted the

charters

for

our Audit

Committee, Talent

and

Compensation

Committee,

Risk

Management

Committee,

Corporate

Governance

and

Nominating

Committee

and

Technology

Committee, as well as our Corporate Governance Guidelines. In addition, information concerning

purchases and sales of our equity

securities by our executive officers and directors is

posted on our website.

All

website

addresses

given

in

this

document

are

for

information

only

and

are

not

intended

to

be

active

links

or

to

incorporate any website information into this Form

10-K.