Public companies are required to disclose risks that can affect the business and impact the stock. These disclosures are known as “Risk Factors”. Companies disclose these risks in their yearly (Form 10-K), quarterly earnings (Form 10-Q), or “foreign private issuer” reports (Form 20-F). Risk factors show the challenges a company faces. Investors can consider the worst-case scenarios before making an investment. TipRanks’ Risk Analysis categorizes risks based on proprietary classification algorithms and machine learning.

Grupo Aval Acciones y Valores SA Pfd disclosed 74 risk factors in its most recent earnings report. Grupo Aval Acciones y Valores SA Pfd reported the most risks in the “Finance & Corporate” category.

Risk Overview Q4, 2018

Risk Distribution

46% Finance & Corporate

26% Legal & Regulatory

14% Macro & Political

8% Ability to Sell

4% Production

3% Tech & Innovation

Finance & Corporate - Financial and accounting risks. Risks related to the execution of corporate activity and strategy

This chart displays the stock's most recent risk distribution according to category. TipRanks has identified 6 major categories: Finance & corporate, legal & regulatory, macro & political, production, tech & innovation, and ability to sell.

Risk Change Over Time

S&P500 Average

Sector Average

Risks removed

Risks added

Risks changed

Grupo Aval Acciones y Valores SA Pfd Risk Factors

New Risk (0)

Risk Changed (0)

Risk Removed (0)

No changes from previous report

The chart shows the number of risks a company has disclosed. You can compare this to the sector average or S&P 500 average.

The quarters shown in the chart are according to the calendar year (January to December). Businesses set their own financial calendar, known as a fiscal year. For example, Walmart ends their financial year at the end of January to accommodate the holiday season.

Risk Highlights Q4, 2018

Main Risk Category

Finance & Corporate

With 34 Risks

Finance & Corporate

With 34 Risks

Number of Disclosed Risks

No changes from last report

S&P 500 Average: 31

No changes from last report

S&P 500 Average: 31

Recent Changes

0Risks added

0Risks removed

10Risks changed

Since Dec 2018

0Risks added

0Risks removed

10Risks changed

Since Dec 2018

Number of Risk Changed

From last report

S&P 500 Average: 1

From last report

S&P 500 Average: 1

See the risk highlights of Grupo Aval Acciones y Valores SA Pfd in the last period.

Risk Word Cloud

The most common phrases about risk factors from the most recent report. Larger texts indicate more widely used phrases.

Risk Factors Full Breakdown - Total Risks 74

Finance & Corporate

Total Risks: 34/74 (46%)Below Sector Average

Share Price & Shareholder Rights11 | 14.9%

Share Price & Shareholder Rights - Risk 1

Changed

We are controlled by Mr. Sarmiento Angulo, whose interests could differ from the interests of other common, preferred shareholders and ADS holders.

Mr. Sarmiento Angulo beneficially owns 97.3% of our common shares outstanding and 42.9% of our preferred shares outstanding, as of April 17, 2019, and, accordingly, controls our group. See "Item 7. Major Shareholders and Related Party Transactions-A. Major shareholders". The preferred shares do not have any voting rights and thus will not affect such control of our group. Mr. Sarmiento Angulo will continue to have the right to control decisions, regardless of how our minority shareholders may vote on these issues and regardless of the interests of such shareholders, including holders of ADSs and underlying preferred shares. In addition to Mr. Sarmiento Angulo's beneficial ownership through Grupo Aval, as of April 17, 2019, he beneficially owns 8.3% of Banco de Bogotá, 13.3% of Banco de Occidente, 15.5% of Banco AV Villas, 0.8% of Banco Popular and 10.9% of Corficolombiana. Circumstances may occur in which Mr. Sarmiento Angulo may have an interest in pursuing transactions that, in his judgment, enhance the value of his several investments in the financial sector. These transactions may not necessarily be in Grupo Aval's interest or that of its shareholders even if holders of the ADSs or the underlying preferred shares disagree. Due to his control, Mr. Sarmiento Angulo has, and will have, the power to: - elect a majority of our directors and appoint our executive officers, set our management policies and exercise overall control over our company and subsidiaries;- agree to sell or otherwise transfer his controlling stake in our company; and - determine the outcome of substantially all actions requiring shareholder approval, including transactions with related parties, corporate reorganizations, acquisitions and dispositions of assets, and dividends. In addition, the concentration of ownership may have the effect of delaying, preventing or deterring a change of control of our company, could deprive our shareholders of an opportunity to receive a premium for the ADSs or underlying preferred shares as part of a sale of our company and might ultimately affect the market price of the ADSs and the underlying preferred shares.

Share Price & Shareholder Rights - Risk 2

We may engage in additional transactions with our controlling shareholder in the future.

In the future we may engage, as we have done in the past, in business and financial transactions with our controlling shareholder and other shareholders that may present potential conflicts of interest between our company and these shareholders. For example, we may incur indebtedness, or acquire shares in Banco de Bogotá, Banco de Occidente, Banco Popular, Banco AV Villas and Corficolombiana from entities that are beneficially owned by Mr. Sarmiento Angulo. While we believe that these transactions will be carried out on an arm's-length basis, commercial and financial transactions between us and our controlling shareholder could create the potential for, or could result in, conflicts of interests between us and our other shareholders. To the extent that the price we pay for any assets acquired from our controlling shareholder exceeds the market value of such assets or is not as productive a use of our cash as other uses, our results of operations and financial condition could be adversely affected.

Share Price & Shareholder Rights - Risk 3

The relative illiquidity of the Colombian securities markets may impair the ability of preferred shareholders and holders of ADSs to sell preferred shares underlying the ADSs.

Our preferred shares are listed on the Colombian Stock Exchange, which is relatively small and illiquid compared to securities exchanges in major financial centers. In addition, a small number of issuers represent a disproportionately large percentage of the market capitalization and trading volume on the Colombian Stock Exchange. A liquid trading market for the preferred shares or ADSs may not develop on the Colombian Stock Exchange or New York Stock Exchange, respectively. A limited trading market could impair the ability of a holder of preferred shares or ADSs to sell preferred shares (in the case of an ADS holder, obtained upon withdrawal of such shares from the ADR facility) on the Colombian Stock Exchange in the amount and at the price and time desired by such holder, and could increase the volatility of the market price of the preferred shares and the ADSs.

Share Price & Shareholder Rights - Risk 4

An active market for our preferred shares and the ADSs may not continue to develop or be maintained and the market price of our preferred shares and the ADSs may fluctuate in response to numerous factors.

The market price of our ADSs and preferred shares may fluctuate significantly in response to numerous factors, many of which are beyond our control, including actual or anticipated fluctuations in our operating results, economic downturns, political events in Colombia, Central America or other jurisdictions where we operate, developments affecting the banking industry, exchange rates, changes in financial estimates by securities analysts or our failure to perform in line with such estimates, departures of key personnel, and sales of our preferred shares in the future, including by our banking subsidiaries who may have to sell our preferred shares obtained from investors who entered into loans with them to acquire our preferred shares in our offering of preferred shares in 2011, or the "Preferred Shares Local Offering". Furthermore, common shares may be converted into preferred shares on a 1-1 basis provided that our preferred shares do not exceed 50% of our total subscribed share capital. Preferred shares are available for deposit into the ADS Program. Our banking subsidiaries extended credit through loans to finance the acquisition of preferred shares in the Preferred Shares Local Offering of which, nine loans, representing Ps 84.7 billion (U.S.$26.1 million), remained outstanding on December 31, 2018. The final loan will mature in 2021. Depending on the characteristics of the borrower, our banking subsidiaries may have required collateral, which may have included a pledge of the preferred shares that were subject to the financing. Such a pledge would permit our banking subsidiaries through a court procedure to seek the sale of the preferred shares if the borrower defaults. Our banking subsidiaries had, on an aggregate basis, pledges over 65,122,771 preferred shares (0.9% of our total preferred shares) related to loans made to third parties at December 31, 2018. All the loans are full-recourse loans. Under the terms of the pledges, each borrower is limited from selling the pledged shares until the loan is repaid. Under Colombian law, our banking subsidiaries must seek to sell any repossessed shares as banks are not permitted to hold shares issued by their parent. If changes in general economic conditions or other factors cause these borrowers to default on their loans, our subsidiaries will have to sell our preferred shares into the market, or alternatively, upon repayment of the loans, these borrowers will not be restricted from selling such shares in the market. As a result, the market price of our preferred shares and ADSs may decline.

Share Price & Shareholder Rights - Risk 5

Holders of ADSs and underlying preferred shares may face difficulties in protecting their interests because we are subject to different corporate rules and regulations than those available in other jurisdictions, and our preferred shareholders have limited rights.

Holders of ADSs are not direct shareholders of our company and are unable to enforce the rights of shareholders under our by-laws and Colombian law. Under Colombian law, holders of our preferred shares may have fewer rights than shareholders of a corporation incorporated in the United States. Even if a holder of ADSs surrenders its ADSs and becomes a direct shareholder, a holder of our preferred shares under Colombian law may have fewer alternatives to protect its interests relative to actions by our board of directors or executive officers, and these alternatives may be less well-defined than under the laws of those other jurisdictions. The Colombian securities markets are not as highly regulated or supervised as the U.S. securities markets or the markets in some other jurisdictions. In addition, rules and policies against self-dealing or for preserving shareholder interests may be less well-defined and enforced in Colombia than in the United States and certain other countries, which may put holders of our preferred shares and the ADSs at a potential disadvantage. Corporate disclosures also may be less complete or informative than for a public company in the United States or in certain other countries. Our by-laws contain an arbitration clause that provides for the exclusive jurisdiction of an arbitral tribunal to be seated at the Bogotá Chamber of Commerce. The arbitration provision provides that any conflict arising among shareholders, or between shareholders and Grupo Aval, in connection with the by-laws must be resolved by an arbitral tribunal. In addition, holders of the ADSs and our preferred shares are not entitled to vote for the election of directors or to influence our management policies. Under our by-laws and Colombian law, holders of preferred shares (and, consequently, holders of ADSs) have no voting rights in respect of preferred shares, other than in limited circumstances.

Share Price & Shareholder Rights - Risk 6

Our status as a foreign private issuer allows us to follow alternate standards to the corporate governance standards of the NYSE, which may limit the protections afforded to investors.

We are a "foreign private issuer" within the meaning of the NYSE corporate governance standards. Under the NYSE rules, a foreign private issuer may elect to comply with the practices of its home country and not to comply with certain corporate governance requirements applicable to U.S. companies with securities listed on the NYSE. We currently follow Colombian practices concerning corporate governance and intend to continue to do so. Accordingly, you will not have the same protections afforded to shareholders of companies that are subject to all NYSE corporate governance requirements. For example, Colombian law requires that at least 25% of our board of directors consist of "independent" directors within the meaning of Colombian law, whereas NYSE rules generally require that a majority of a domestic U.S. company's board consist of "independent" directors within the meaning of NYSE rules. In addition, NYSE rules require non-executive directors of domestic U.S. listed companies to meet on a regular basis without management being present. There is no similar requirement under Colombian law, and our non-executive directors do not meet formally without management present. See "Item 6. Directors, senior management and employees-C. Board practices-Principal differences between Colombian and U.S. corporate governance practices".

Share Price & Shareholder Rights - Risk 7

Preemptive rights may not be available to holders of preferred shares or ADSs.

Colombian law and our by-laws require that, whenever we issue new common shares, we must offer the holders of common shares the right to subscribe a number of shares of such class sufficient to maintain their existing percentage ownership of our aggregate share capital. On the other hand, holders of preferred shares, including holders of ADSs, are entitled to preemptive rights only when so declared at a meeting of holders of our common shares. Our common shareholders may decide not to provide for such preemptive rights. Also, U.S. holders of ADSs may not be able to exercise their preemptive rights through JPMorgan Chase Bank, N.A., which acts as ADR depositary for our ADR facility, unless a registration statement under the Securities Act is effective with respect to such rights or an exemption from the registration requirement thereunder is available. Although we are not obligated to do so, we or our shareholders, as applicable, could consider at the time of any preemptive rights offering the costs and potential liabilities associated with any such registration statement, the benefits to us from enabling the holders of the ADSs to exercise those rights and any other factors deemed appropriate at the time, and will then make a decision as to whether to file a registration statement. Accordingly, we might decide not to file a registration statement in some cases. If holders of ADSs are unable to exercise these rights because a registration statement has not been filed and no exemption from the registration requirement under the Securities Act is available, the ADR depositary may attempt to sell the holders' preemptive rights and distribute the net proceeds from that sale, if any, to such holders, provided that, the meeting of holders of our common shares decides that holders of preferred shares are entitled to preemptive rights. The ADR depositary, after consultation with us, will have discretion as to the procedure for making preemptive rights available to the holders of ADSs, disposing of such rights and making any proceeds available to such holders. If by the terms of any preemptive rights offering or for any other reason the ADR depositary is unable or chooses not to make those rights available to any holder of ADSs, and if it is unable or for any reason chooses not to sell those rights, the depositary may allow the rights to lapse. Whenever the rights are sold by the ADR depositary or such rights lapse, or if the common shareholders' meeting does not grant preemptive rights to the holders of preferred shares, the equity interests of the holders of ADSs will be proportionately diluted.

Share Price & Shareholder Rights - Risk 8

We are traded on more than one market and this may result in price variations; in addition, investors may not be able to easily move shares for trading between such markets.

Trading in our ADSs on the NYSE or preferred shares on the Colombian Stock Exchange take place in different currencies (U.S. dollars on the NYSE and pesos on the Colombian Stock Exchange), and at different times (resulting from different time zones, different trading days and different public holidays in the United States and Colombia). The trading prices of our shares on these two markets may differ due to these and other factors. Any decrease in the price of our preferred shares on the Colombian Stock Exchange could cause a decrease in the trading price of our ADSs on the NYSE. Investors could seek to sell or buy our shares to take advantage of any price differences between the markets through a practice referred to as arbitrage. Any arbitrage activity could create unexpected volatility in both our share prices on one exchange, and the shares available for trading on the other exchange. In addition, holders of ADSs will not be immediately able to surrender their ADSs and withdraw the underlying preferred shares for trading on the other market without effecting necessary procedures with the depositary. This could result in time delays and additional cost for holders of ADSs.

Share Price & Shareholder Rights - Risk 9

If holders of ADSs surrender their ADSs and withdraw preferred shares, they may face adverse Colombian tax consequences.

Although Colombian tax law does not specifically refer to the tax consequences applicable to an ADS holder withdrawing the underlying preferred shares, we believe, based on the advice of our Colombian counsel, that such a transaction should not result in a taxable event under Colombian law in the case of non-resident entities and non-resident individuals given the nature of the transaction. Nevertheless, this issue is not free from doubt, and the Colombian tax authorities may have a different interpretation of the law, or the law may change, and the Colombian tax authorities may assess taxes on the conversion of ADSs into preferred shares based upon the difference between the market value of the preferred shares and the adjusted tax basis of the ADSs. Furthermore, an investor who surrenders ADSs and withdraws preferred shares will be subject to income taxes on any gain associated with the sale of such preferred shares if such sale exceeds 10% of the issued and outstanding shares of the listed company during a taxable year.

Share Price & Shareholder Rights - Risk 10

Judgments of Colombian courts with respect to our preferred shares will be payable only in pesos.

If proceedings are brought in Colombian courts seeking to enforce the rights of holders of our preferred shares, we will not be required to discharge our obligations in a currency other than Colombian pesos. Under Colombian law, an obligation in Colombia to pay amounts denominated in a currency other than Colombian pesos may only be satisfied in Colombian currency at the exchange rate, as determined by the Colombian Central Bank and published by the Superintendency of Finance, also known as Tasa Representativa del Mercado, in effect on the date the judgment is obtained, and such amounts are then adjusted to reflect exchange rate variations through the effective payment date. The then-prevailing exchange rate may not afford non-Colombian investors with full compensation for any claim arising out of or related to our obligations under the preferred shares, or indirectly, the ADSs.

Share Price & Shareholder Rights - Risk 11

U.S. investors in our preferred shares or the ADSs may find it difficult or impossible to enforce service of process and enforcement of judgments against us and our officers and directors.

We are incorporated under the laws of Colombia, and all of our subsidiaries are incorporated in jurisdictions outside the United States. In addition, our executive offices are located outside of the United States. All of our directors and officers reside outside of the United States, and all or a substantial portion of our assets and the assets of most of our officers and directors are, and will most likely continue to be, located outside of the United States. As a result, it may be difficult or impossible for U.S. investors to serve legal process within the United States upon us or any of these persons or to enforce a judgment against us for civil liabilities in U.S. courts. In addition, you should not assume that courts in the countries where we or our subsidiaries are incorporated or where our or our subsidiaries' assets are located (i) would enforce judgments of U.S. courts obtained in actions against us or our subsidiaries based upon the civil liability provisions of applicable U.S. federal and state securities laws or (ii) would enforce, in original actions, liabilities against us or our subsidiaries based on those laws. There is also substantial doubt that the courts of Colombia would enter judgment in original actions brought in those courts predicated on U.S. federal or state securities laws. We have been advised by our Colombian counsel that there is no legal basis for original actions to be brought against us or our directors and executive officers in a Colombian court predicated solely upon the provisions of the U.S. federal or state securities laws. In addition, certain remedies available under provisions of the U.S. securities laws may not be admitted or enforced by Colombian courts. Grupo Aval's by-laws contain an arbitration provision that provides for the exclusive jurisdiction of an arbitral tribunal to be seated at the Bogotá Chamber of Commerce. The arbitration provision provides that any conflict arising among shareholders, or between shareholders and Grupo Aval, in connection with the by-laws must be resolved by the arbitral tribunal. See "Item 4. Information on the Company-B. Business overview-Service of process and enforcement of judgments".

Accounting & Financial Operations3 | 4.1%

Accounting & Financial Operations - Risk 1

Our ability to pay dividends on the ADSs or underlying preferred shares may be limited by Colombian law and because we are a holding company dependent on dividends from subsidiaries.

Under Colombian law, a company may only distribute dividends to the extent such distribution is fully supported by accurate financial statements demonstrating the financial condition of the company. Any dividends distributed in violation of this provision may not be reclaimed from shareholders who received such payments in good faith, and any subsequent distribution of profits may be suspended. In addition, dividends may not be distributed until losses from previous fiscal years have been absorbed. Dividends must be approved at the ordinary annual shareholders' meeting. Our ability to pay dividends on the preferred shares represented by ADSs will be contingent upon the financial condition of our subsidiaries. Any of our banking subsidiaries may be restricted from paying dividends to us if such subsidiary does not meet its required technical capital ratios or does not have sufficient retained earnings. In addition, we conduct substantially all of our operations through subsidiaries and are dependent on dividends from our subsidiaries to meet our obligations.

Accounting & Financial Operations - Risk 2

Holders of ADSs may encounter difficulties in the exercise of dividend rights and in the limited voting rights of our preferred shares.

Holders of ADSs may encounter difficulties in exercising rights with respect to the preferred shares underlying ADSs. If we make a distribution to holders of underlying shares in the form of securities or rights to acquire securities, the depositary is allowed, in its discretion, to sell those securities or rights on behalf of ADS holders and instead distribute the net proceeds to the ADS holders Also, under some circumstances, you may not be able to exercise your limited voting rights by giving instructions to the depositary.

Accounting & Financial Operations - Risk 3

Our financial results may be negatively affected by changes to accounting standards.

We report our results and financial position in accordance with IFRS as issued by the IASB. Changes to IFRS or interpretations thereof may cause our future reported results and financial position to differ from current expectations, or historical results to differ from those previously reported due to the adoption of accounting standards on a retrospective basis. Such changes may also affect our regulatory capital and ratios. We monitor potential accounting changes and when possible, we determine their potential impact and disclose significant future changes in our audited consolidated financial statements that we expect as a result of those changes. Currently, there are a number of issued but not yet effective IFRS standards, as well as potential IFRS changes, such as IFRS 16, some of which could be expected to impact our reported results, financial position, regulatory capital or demand changes in our internal control process in the future. In particular, IFRS 9, requires us to record credit losses on loans at inception on an expected loss basis instead of recording credit losses on an incurred loss basis. For further information about developments in financial accounting and reporting standards, see Note 2 to the audited consolidated financial statements, "Note 2 – Basis of Preparation of the audited consolidated financial statements and Summary of Significant Accounting Policies".

Debt & Financing14 | 18.9%

Debt & Financing - Risk 1

A significant part of Corficolombiana's investments are in relatively illiquid assets, and Corficolombiana may fail to realize any profits from these investments for a considerable period of time or lose some or all of the principal amount of these investments.

As of December 31, 2018, 72.5% of Corficolombiana's investments were held in privately-held companies. There are often no readily ascertainable market prices for such securities or for those investments of Corficolombiana in listed companies with low or medium trading volumes. As a result, there may be limited or no marketability for these investments, and they may decline in value while Corficolombiana might be seeking to dispose of them. Because there is significant uncertainty as to the valuation of illiquid investments, the stated values of such investments may not necessarily reflect the values that could be realized by Corficolombiana. In addition, in some cases, Corficolombiana may be prevented by contract from selling such investments for a period. Corficolombiana's ability to dispose of investments may also be dependent on factors beyond its control. Thus, it is possible that investments in privately-held companies will only be disposed over a substantial length of time, if at all, exposing the investment returns to risks of declines in market prices during the intended disposition period. Accordingly, under certain conditions, Corficolombiana may be forced to either sell securities at lower prices than it had expected to realize or defer-potentially for a considerable period-sales that it had planned to make. As mentioned above, Episol, a wholly-owned affiliate of Corficolombiana, is a minority (33%) non-controlling shareholder in Concesionaria Ruta del Sol and Odebrecht is the majority controlling and operating shareholder with a 62% stake. As of December 31, 2018, the investment of Episol in Concesionaria Ruta del Sol of Ps 111.8 billion (approximately U.S.$34.4 million) was fully impaired and carried at zero value.

Debt & Financing - Risk 2

Corficolombiana's new investment projects depend on its ability to access financing.

Corficolombiana may directly, or through its operating subsidiaries, enter into new investment projects such as infrastructure projects (e.g. toll road concessions) that require significant financing. Corficolombiana or its operating subsidiaries may experience difficulties in accessing debt and equity financing resources required to fund such projects and/or may obtain them at higher costs and/or lower tenors than initially expected. As a result, Corficolombiana's investment objectives may attain lower returns due to higher financing costs, delays in the investment schedule or any eventual stoppage of the investment project, which could also result in the payment of penalties to its counterparties, including the government entities in the case of development of new highways and toll roads. If Corficolombiana is unable to obtain adequate financing on terms satisfactory to it, its ability to continue to grow or support its business and respond to business challenges could be significantly limited.

Debt & Financing - Risk 3

We are subject to counterparty risk in our banking business.

Our banks and, to a lesser extent, Corficolombiana, Porvenir and our international banking operations, are exposed to counterparty risks in addition to credit risks associated with lending activities. Counterparty risk may arise from, for example, investing in securities of third parties, entering into derivative contracts under which counterparties have obligations to make payments to us, or executing securities, futures, currency or commodity trades from proprietary trading activities that fail to settle at the required time due to non-delivery by the counterparty or systems failure by clearing agents, exchanges, clearing houses or other financial intermediaries. These risks could materially and adversely affect our results of operations and financial condition.

Debt & Financing - Risk 4

Our banks are subject to market and operational risks associated with derivatives transactions.

Our banks and, to a lesser extent, Corficolombiana, Porvenir and our international banking operations, enter into derivatives transactions primarily for hedging purposes and, on a limited basis, on behalf of customers. Those transactions subject us to market and operational risks, including basis risk (the risk of loss associated with variations in the spread between the asset yield and the funding and/or hedge cost) and credit or default risk (the risk of insolvency or other inability of a counterparty to perform its obligations to us). Market practices and documentation for derivatives transactions in Colombia and the countries where we operate, may differ from those in other countries. For example, documentation may not incorporate terms and conditions of derivatives transactions as commonly understood in other countries. In addition, the execution and performance of these transactions depend on our banks' ability to develop adequate control and administration systems, and to hire and retain qualified personnel. Moreover, our banks' ability to monitor and analyze these transactions depends on their information technology (IT) systems. These factors may further increase risks associated with derivatives transactions and could materially and adversely affect our results of operations and financial condition.

Debt & Financing - Risk 5

Our banking subsidiaries are subject to liquidity risk, which may result in increases in funding costs.

The principal sources of funding for our banking subsidiaries are savings deposits, time deposits and checking accounts, which together represented 71.2% and 73.3% of consolidated total liabilities at December 31, 2018 and 2017, respectively. Because our banking subsidiaries rely primarily on deposits for funding, a sudden or unexpected shortage of funds in the banking systems in which we operate and overnight money markets may prevent our banking subsidiaries from meeting their obligations or obtaining necessary funding without incurring higher costs or selling certain assets at prices below prevailing market values, which could materially and adversely affect our results of operations and financial condition. The liquidity of our financial entities could also be impacted by reputational events affecting our entities.

Debt & Financing - Risk 6

Default by one or more of our largest borrowers could adversely affect our results of operations and financial condition.

The aggregate outstanding loans to our banks' ten largest single borrowers represented 5.8% of our consolidated total loan portfolio at December 31, 2018. Default on loans by one or more of these borrowers may adversely affect our results of operations and financial condition. Among our largest impaired exposures, as of December 31, 2018, Electricaribe (Ps 712.1 billion) was fully provisioned, Concesionaria Ruta del Sol (Ps 1,016.2 billion) was provisioned at 31.3% and the Sistema Integrado de Transporte Público (SITP) companies, with a combined exposure representing Ps 518.9 billion, was provisioned at 36.4%. While we have undertaken negotiations with these borrowers, there can be no assurance as to the timing or the terms of the final resolution of these matters, given the inherent uncertainties in such situations, we can provide no assurance that these matters will not be material to our business, financial position, results of operations or cash flows in the future.

Debt & Financing - Risk 7

Downgrades in our long-term credit ratings or in the credit ratings of our banking subsidiaries would increase the cost of, or impair access to, funding and may impact our ability to maintain regulatory capital ratios.

Our credit ratings and those of our banking subsidiaries are an important component of our and their ability to obtain funding. Rating agencies regularly evaluate us, and their ratings of our debt are based on numerous dynamic, complex and inter-related factors and assumptions, including our financial strength, conditions affecting the financial services industry generally and the sovereign credit rating of Colombia and the jurisdictions we operate in. Our banking subsidiaries may be required to raise additional capital in the future to maintain regulatory capital ratios and provide liquidity to meet commitments and business needs, particularly if asset quality or earnings were to deteriorate. For example, if regulatory capital ratios of a banking subsidiary decline as a result of decreases in the value of the loan portfolio or otherwise, such bank subsidiary will be required to improve its capital ratios by either raising additional capital or disposing of assets. Since February 6, 2019, we are subject to the inspection and surveillance of the Superintendency of Finance as the financial holding of the Aval Financial Conglomerate and we might be required in the future to raise additional capital to comply with new regulatory adequacy rules applicable to us at the conglomerate level. Furthermore, Decree 1477 of 2018 modified the capital adequacy requirements applicable to financing entities in Colombia. As a result, our banking subsidiaries will migrate to Basel III capital requirements in 2020. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation. For a summary of our and our banking subsidiaries current credit ratings and outlook, see "Item 5. Operating and Financial Review & Prospects-Liquidity & Capital Resources-Funding". Adverse changes in credit ratings or outlooks could increase the cost of funding in the capital markets or borrowings, or reduce the feasibility of refinancing existing debt or issue new debt required to finance our future projects. In addition, lenders and counterparties in derivatives transactions are sensitive to the risk of a ratings or outlook downgrade. Our ability to raise deposits may also be impacted by a change in credit ratings or outlooks, which could make us less successful when competing for deposits. Any occurrence that may limit our and our banking subsidiaries' access to funding, such as a downgrade in credit ratings or outlook, or a decline in the confidence of debt purchasers, depositors, or counterparties in the capital markets may adversely affect capital costs, ability to raise capital, and liquidity. Moreover, we and our banking subsidiaries may need to raise capital when many other financial institutions are also seeking to raise capital which, in turn, would require us to compete with numerous other institutions for investors. An inability to raise additional capital on acceptable terms, when needed, or a downgrade in our or our banking subsidiaries' credit ratings or outlook could have a materially adverse effect on our and our banking subsidiaries' financial conditions and results of operations.

Debt & Financing - Risk 8

Our banking subsidiaries' loan portfolios are subject to risk of prepayment, which may result in reinvestment of assets on less profitable terms.

The loan portfolios of our banking subsidiaries are subject to prepayment risk, which results from the ability of a borrower to pay a loan prior to maturity. Generally, in a declining interest rate environment, prepayment activity increases with the effect of reducing weighted average lives of interest-earning assets and adversely affecting results. Prepayment risk also has an adverse effect on credit card and collateralized mortgage obligations, since prepayments could shorten the weighted average life of these portfolios, which may result in a mismatch in funding or in reinvestment at lower yields.

Debt & Financing - Risk 9

Declines in the value of our banks' sovereign debt portfolios could have an adverse effect on our results of operations.

Our Colombian banks' portfolio of securities primarily consists of securities issued or guaranteed by the Colombian government. LB Panamá's securities portfolios primarily consist of securities issued by corporate and sovereign issuers. We are exposed to significant credit, market and liquidity risks associated with debt securities. Both at December 31, 2018 and 2017, debt securities represented 9.9% of our consolidated total assets; 49.8% and 45.9%, respectively, of these securities were issued by the Colombian Central government, and 10.5% and 9.2% of these securities, respectively, were issued or backed by Central American governments at the end of each period. A significant decline in the value of these government securities could materially and adversely affect our debt securities portfolio and, consequently, our financial condition and results of operations. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation-Mandatory investments".

Debt & Financing - Risk 10

Changed

A deterioration in asset quality, including the loan portfolios of our banking subsidiaries, may have an adverse effect on our results of operations and financial condition.

Changes in the financial condition or credit profiles of customers of our banking subsidiaries and increases in inflation or interest rates and foreign exchange volatility could have a negative effect on the quality of our banks' loan portfolios, potentially requiring them to increase impairment losses on loans and accounts receivable or resulting in reduced profitability. In particular, the percentage of non-performing loans may increase in the future as a result of factors beyond our control, such as economic conditions and political events affecting Colombia generally or specific sectors of the economy. A substantial number of our banks' customers are individuals and small and medium sized enterprises, or "SMEs", and these customers are potentially more susceptible to downturns in the economy than large corporations and high-income individuals. For example, unemployment directly affects the ability of individuals to obtain and repay consumer and residential mortgage loans. Consequently, our banking subsidiaries may experience higher levels of non-performing loans, which could result in increased impairment losses on loans and other accounts receivable due to defaults by, or deterioration in the credit profiles of, individual borrowers. Non-performing loans and resulting loan losses may increase materially in the future and adversely affect our results of operations and financial condition. Existing loan loss allowances may not be adequate to cover any increases in non-performing loans or deterioration in the credit quality of loan portfolios. As a result, our banking subsidiaries may be required to increase impairment losses on loans and accounts receivables, which may adversely affect our results of operations and financial condition. In addition, there is no precise method for predicting loan and credit losses, such that loan loss allowances may not be sufficient to cover actual losses. If we and our banking subsidiaries are unable to manage the level of non-performing or other poor credit quality loans, our results of operations and financial condition might be materially and adversely affected. Default rates generally increase with the age of loans, the level of non-performing loans may lag behind the rate of growth in loans but may increase when growth slows or the loan portfolios become more mature. As a result, historic loan loss experience may not necessarily be indicative of future loan loss experience.

Debt & Financing - Risk 11

Changed

Our banking subsidiaries may be unable to realize on collateral or guarantees of secured loans, which may adversely affect their results of operations and financial condition.

Our banking subsidiaries originate loans that are secured by collateral, including real estate and other assets that are generally located in Colombia and the countries where we operate. The value of collateral may significantly fluctuate or decline due to factors beyond the control of our subsidiaries, including, for example, prevailing economic and political conditions in the relevant jurisdiction. At December 31, 2018, 38.4% of consolidated past due loans were secured. An economic slowdown may lead to a downturn in the Colombian or Central American real estate markets, which may, in turn, result in declines in the value of real estate securing loans to levels below the principal balances of these loans. Any decline in the value of the collateral securing these loans or any other collateral securing these loans may result in reduced recoveries from collateral realization and have an adverse effect on our results of operations and financial condition. We may also not have sufficiently recent information on the value of collateral, which may result in an inaccurate assessment for impairment losses of our loans secured by such collateral. If this were to occur, we may need to make additional impairments to cover actual impairment losses of our loans, which may materially and adversely affect our results of operations and financial condition. Our banking subsidiaries also make loans on the basis of guarantees from relatives, affiliates or associated persons of their principal borrowers. To the extent that guarantors encounter financial difficulties due to economic conditions, personal or business circumstances, or otherwise, the ability of our banks to enforce such guarantees may be impaired. In addition, our banking subsidiaries may face difficulties in enforcing their rights as secured creditors against borrowers, collateral or guarantees. In particular, timing delays, documentary and procedural problems in realizing against collateral, as well as debtor-protective judicial interpretations of the law, may make it difficult to foreclose on collateral, realize against guarantees or enforce judgments in our favor, which could materially and adversely affect our results of operations and financial condition.

Debt & Financing - Risk 12

Our policies and procedures may not be able to detect money laundering and other illegal or improper activities fully or on a timely basis, which could expose us to fines and other liabilities.

We and our subsidiaries are required to comply with applicable anti-money laundering laws, anti-terrorism financing laws, anti-bribery and other regulations. These laws and regulations require us, among other things, to adopt and enforce "know your customer" policies and procedures, and to report suspicious or large transactions to the applicable regulatory authorities. While we and our financial institutions have adopted policies and procedures aimed at detecting and preventing the use of banking networks for money laundering activities and by terrorists and terrorist-related organizations and individuals generally, such policies and procedures may not completely eliminate instances where they may be used by other parties to engage in money laundering and other illegal or improper activities. If we or any of our subsidiaries fail to fully comply with applicable laws and regulations, the relevant government authorities to which they report have the power and authority to impose fines and other penalties. In addition, our businesses and reputation could suffer if customers use our financial institutions for money laundering or illegal or improper purposes.

Debt & Financing - Risk 13

A significant amount of debt securities in pension and severance funds managed by our pension and severance fund businesses are issued or guaranteed by the Colombian government.

Our pension and severance fund management business, like our banks and other participants in the banking industry, is subject to the risk of loss in value of sovereign debt securities. A significant decline in the value of the securities issued or guaranteed by the Colombian government could adversely affect the debt securities portfolio of our pension and severance fund management business and, consequently, our pension and severance fund management business's results of operations and financial condition.

Debt & Financing - Risk 14

We are subject to fluctuations in interest rates and other market risks, which may materially and adversely affect our results of operations and financial condition.

Market risk refers to the probability of variations in income or in the market value of assets and liabilities due to changes in markets, including variations in market rates of interest and foreign currency exchange rates. Changes in interest rates affect the following areas, among others, of our banks' businesses: net interest income, the volume of loans originated, market value of securities holdings, asset quality, and gains from sales of loans and securities. We do not manage market risk on a group-wide basis and are not subject to regulation or supervision of market risk on a group-wide basis. Changes in short-term interest rates may affect interest margins quickly and, therefore, net interest income, which is the most important component of our revenue. Increases in interest rates may reduce the volume of loans originated by our banking subsidiaries. Sustained high interest rates may discourage customers from borrowing and may result in increased delinquencies in outstanding loans and deterioration in the quality of assets. Increases in interest rates may reduce the value of our assets, including the financial assets of our banks, the investments of Corficolombiana and the assets managed by Porvenir. Our banking subsidiaries hold a substantial portfolio of loans and debt securities that have both fixed and floating interest rates. In addition, we may incur costs (which, in turn, will affect our results of operations) if our banking subsidiaries implement strategies to reduce future interest rate exposure. Increases in interest rates may reduce gains or require our banking subsidiaries to record losses on sales of their loans or securities. We have regional exposure to fluctuations in interest rates. If there are significant increases in such rates in any of the countries in which BAC Credomatic operates, our operating margins may be adversely affected and our results of operations may experience significant adverse consequences.

Corporate Activity and Growth6 | 8.1%

Corporate Activity and Growth - Risk 1

Acquisitions and strategic partnerships may not perform in accordance with expectations, may fail to receive required regulatory approvals or may disrupt our operations and adversely affect our credit rating and profitability.

A component of our strategy is to identify and pursue growth-enhancing strategic opportunities. As part of that strategy, we have acquired interests in various financial institutions in recent years. We regularly evaluate strategic acquisitions and alliances, inside and outside of Colombia. Strategic acquisitions and alliances could expose us to risks with which we have limited or no experience, as in the case of any significant acquisition outside of Colombia. In addition, potential acquisitions in Colombia and elsewhere may be subject to regulatory approval. We may be unsuccessful in obtaining any such approval or we may not obtain approvals on terms that are acceptable for us particularly in view of our subsidiaries' and our combined significant market share in the Colombian banking industry. We must necessarily base any assessment of potential acquisitions and alliances on assumptions with respect to operations, profitability and other matters that may subsequently prove to be incorrect. Future acquisitions and alliances, as well as other investments, may not produce anticipated synergies or perform in accordance with our expectations and could adversely affect our operations and profitability. In addition, new demands on our existing organization and personnel resulting from the integration of new acquisitions could disrupt our operations and adversely affect our operations and profitability.

Corporate Activity and Growth - Risk 2

We may not be able to manage our growth successfully.

We have been expanding the scope of our operations over the past few years and we expect that this expansion will continue. As we continue to grow, we must improve our operational, technical and managerial knowledge and compliance systems in order to effectively manage our operations across the expanded group. Failure to successfully integrate, monitor and manage expanded operations could have a material adverse effect on our reputation and financial results. Our future growth will also depend on our access to internal and external financing sources. We may be unable to access such financing on commercially acceptable terms or at all.

Corporate Activity and Growth - Risk 3

Corficolombiana's due diligence process for evaluating prospective investments may not identify all risks or ensure investment returns.

Before making investments, Corficolombiana conducts due diligence based on the facts and circumstances applicable to each investment. When conducting due diligence, it may be required to evaluate important and complex business, financial, tax, accounting, environmental and legal issues. Outside consultants, legal advisors, accountants and investment banks may be involved in the due diligence process to varying degrees depending on the type of investment, but it may be unable to engage these third parties in a timely manner, or at all. Nevertheless, the due diligence investigation carried out by Corficolombiana with respect to any investment may not reveal or highlight all relevant risks of such investment opportunity. Moreover, such an investigation will not necessarily result in the investment being successful.

Corporate Activity and Growth - Risk 4

Changed

Corficolombiana might have minority investments in companies and therefore, it might not control them.

Corficolombiana's investments include non-controlling equity interests, and it may also dispose of a portion of its majority equity securities in portfolio companies over time in a manner that results in Corficolombiana retaining minority investments. Those investments will be subject to the risk that the company in which the investment is made may take business, financial or management decisions with which we do not agree. Similarly, the majority stakeholders or the management of the company may take risks or otherwise act in a manner contrary to our interests. If any of the foregoing were to occur, the values of these investments could decrease or we may not be able to dispose of them, which would adversely affect Corficolombiana's results of operations and financial condition. Any wrongdoing by these companies or their management might result in reputational or legal risks to us.

Corporate Activity and Growth - Risk 5

Any failure of risk management processes, including credit and market risk, could materially and adversely affect our banking businesses, results of operations and financial condition.

Credit risk is the principal risk inherent in the business of our banks. Although we have group-wide risk management guidelines, each bank is responsible for managing its own risk. Each bank's policies and procedures, which are designed to identify, monitor and manage risk, may prove to be insufficient. Furthermore, our banks may not be able to upgrade risk management systems on a timely basis. For example, our banks' risk management systems utilize an internal credit rating system to assess the risk profile of each customer. As this process involves detailed analyses of the customer's credit risk, taking into account quantitative and qualitative factors, it is necessarily subject to human error. Due to limitations in the availability of information, our assessment of credit risk associated with a particular customer may not be based on complete, accurate or reliable information. Personnel of our banking subsidiaries may fail to detect risks before they occur, or may not effectively implement their risk management systems, which may increase exposure to credit risk. As a result, any failure by our banking subsidiaries to effectively implement or consistently follow or refine risk management systems may result in higher risk exposures for our banking subsidiaries, which could materially and adversely affect our results of operations and financial condition.

Corporate Activity and Growth - Risk 6

A variety of issues outside of Corficolombiana's control could affect the timing and performance of its investments, which may result in additional costs and reputational harm to Corficolombiana, reductions or delays in revenues or the payment of liquidated damages.

Many of Corficolombiana's investments, including in the energy and gas and infrastructure sectors, involve challenging engineering, permitting, procurement and construction phases that may occur over extended periods, sometimes several years. These investments may also encounter difficulties as a result of delays in design, engineering information or materials to be completed or procured by them, the customer or a third party, delays or difficulties in equipment and material delivery, schedule changes, delays due to failure to timely obtain permits or rights of way or meet other regulatory requirements or permitting conditions accidents and catastrophic events, weather-related delays, protests, legal challenges or other political activity, and other factors. In the energy and gas sector, Corficolombiana, through Promigas, is exposed to a variety of inherent hazards and operating risks in gas distribution such as leaks, explosions and mechanical problems which could cause substantial financial losses. If any of Corficolombiana's investments or projects fail to comply with the applicable professional standards or contractual requirements, Corficolombiana or its subsidiaries could be exposed to significant monetary damages or violations. A catastrophic event at one of the investments could also result in significant professional or product liability, and warranty or other claims as well as reputational harm, especially if public safety is impacted. For example, on January 15, 2018, the Chirajara bridge, which was under construction and located on KM64 Bogotá – Villavicencio, partially collapsed and on November 26, 2018, an accident occurred during the construction of La Pala bridge located at KM65 Bogotá-Villavicencio. These events caused several casualties and injured workers. Concesionaria Vial de los Andes S.A, or "Coviandes", of which Corficolombiana owns 59.8%, and Infrastructure Construction S.A.S, or "Coninvial", of which 60% is owned by Episol, a Corficolombiana wholly-owned subsidiary, are involved in the construction of this road infrastructure through a concession agreement. While we believe these constructions have adequate insurance coverage, there is no certainty as to what possible contingencies could accrue against us or whether such insurance will cover all such possible contingencies. Many of these difficulties and delays are beyond Corficolombiana's control and could negatively impact its ability to achieve its anticipated return from its investments. Delays and additional costs may be substantial and not recoverable from third parties or insurance providers, and in some cases, may cause substantial financial losses. Failure to meet any of their schedules or performance obligations could also result in additional costs or penalties, including liquidated damages, and such amounts could exceed profits from these projects. In extreme cases, the above-mentioned factors could cause project cancellations, and Corficolombiana may not be able to replace such projects with similar projects or at all. Such delays or cancellations may impact Corficolombiana's investments, its reputation or relationships with customers and could have a material adverse effect on Corficolombiana's business, results of operations or financial condition.

Legal & Regulatory

Total Risks: 19/74 (26%)Above Sector Average

Regulation13 | 17.6%

Regulation - Risk 1

The Colombian Central Bank may impose requirements on the ability of Colombian residents, including us, to obtain loans denominated in foreign currency.

Under Colombian exchange control requirements, the Colombian Central Bank may impose certain mandatory deposit requirements in connection with foreign currency-denominated loans obtained by Colombian residents, including us. When the Colombian peso appreciated against foreign currencies in 2008, such mandatory deposit requirement was set at 40% of the amounts to be disbursed under any credit facility denominated in a foreign currency. Future measures or requirements imposed by the Colombian Central Bank, such as mandatory deposit requirements, may adversely affect our and our clients' ability to obtain loans in foreign currency.

Regulation - Risk 2

Changes in credit card regulations may adversely affect BAC Credomatic's business.

The credit card business is an important business segment for BAC Credomatic, representing 18.3% and 18.0% of its total loan portfolio for December 31, 2018 and 2017, respectively. The adoption of new laws and regulations or the revision of the current regulatory regime for credit cards in any of the jurisdictions in which BAC Credomatic operates may have an adverse effect on BAC Credomatic's results of operations and financial condition.

Regulation - Risk 3

BAC Credomatic and our Central American operations are subject to significant compliance risks in connection with a multi-jurisdictional regulatory regime.

BAC Credomatic's businesses are subject to regulation under Costa Rican, Guatemalan, Honduran, Nicaraguan, Panamanian, Salvadoran, Grand Cayman, British Virgin Islands, Bahamian and U.S. federal, state and other foreign laws, regulations and policies. BAC Credomatic thus is subject to a multi-jurisdictional regulatory regime. In addition, any changes to the regulatory regime of one of the Central American countries may lead to corresponding changes to the regulatory regime of other countries in the region. BAC Credomatic's businesses are regularly reviewed or investigated by regulators, which could lead to enforcement actions, fines and penalties or the assertion of private litigation claims and damages. Regulation of financial institutions varies across the different Central American jurisdictions in which we operate. These differences are particularly pronounced in the assessment of credit risk and investments. These asymmetries may affect the expected results of our operations in each jurisdiction, and as a consequence could adversely affect our consolidated results of operations in Central America.

Regulation - Risk 4

Restrictions on purchasing our preferred shares may affect the market liquidity of our preferred shares and ADSs.

Under Colombian securities regulations, as a general rule, any transaction involving the sale of publicly traded shares of any Colombian company, including any sale of our preferred shares for the equivalent of 66,000 Unidades de Valor Real, or "UVRs" (approximately U.S.$5,293.9), or more, must be effected through the Colombian Stock Exchange. UVR is a Colombian inflation-adjusted monetary index calculated by the board of directors of the Colombian Central Bank and generally used for pricing home-mortgage loans (one UVR = Ps 260.7 (U.S.$0.08) and 66,000 UVRs = Ps 17,203,942.8 at December 31, 2018). Any transfer of preferred shares underlying the ADSs may be required to be sold through the Colombian Stock Exchange, which could limit their liquidity or affect their market price.

Regulation - Risk 5

Banking regulations, accounting standards and corporate disclosure applicable to us differ from those in the United States and other countries.

Colombian banking regulations may differ in material respects from regulations applicable to banks in other countries, including those in the United States. For example, in Colombia, we are not subject to regulations applicable to financial institutions, although our banking subsidiaries, Corficolombiana, Porvenir and certain of our other subsidiaries are subject to such regulations. As of February 6, 2019, Grupo Aval is subject to supervision as the financial holding company of the Aval Financial Conglomerate. In addition, capital adequacy requirements for banks and financial conglomerates under Colombian regulations differ from those under U.S. regulations and may differ from those of other countries. Colombia and other countries in which we operate have different corporate disclosure and accounting standards for our industry than those applicable in the United States. Financial reporting disclosure requirements in the jurisdictions in which we operate differ in certain significant respects from those required in the United States. There are also material differences between IFRS (as issued by the IASB) and Colombian IFRS. Accordingly, our separate financial statements may not be the same as the information available to holders of shares issued by a U.S. company. Furthermore, since January 1, 2015 we began preparing our financial statements in accordance with IFRS as issued by the IASB and, as a result, some of our financial data may not be easily comparable from period to period.

Regulation - Risk 6

Porvenir operates in a highly regulated market, which limits its flexibility to manage its businesses.

Porvenir's operations are regulated by Law 100 of 1993, as amended, the Organic Statute of the Financial System (Estatuto Orgánico del Sistema Financiero), or "EOSF", Decree 2555 of 2010 issued by the Ministry of Finance, as amended, and regulations issued by the Superintendency of Finance and, to the extent applicable, Colombian Corporation Law. These regulations limit the range of assets in which pension fund administrators, or "AFPs", can invest and also set investment limits, depending on the type of mandatory pension or severance fund managed by each AFP. AFPs can manage four types of mandatory pension funds (i) Lower Risk Funds ("Fondo Conservador"), (ii) Mid-Risk Funds ("Fondo Moderado"), (iii) High Risk Funds ("Fondo de Mayor Riesgo") and (iv) Planned Retirement Funds ("Fondo Especial de Retiro Programado"), and two types of severance portfolios (i) Short Term portfolios ("Portafolio de Corto Plazo") and (ii) Long Term portfolios ("Portafolio de Largo Plazo"). In addition, each AFP is legally required to provide a minimum return on investment for each mandatory of its pension and severance funds. This minimum return is determined pursuant to specified formulas established in Decree 2555 of 2010, as amended, which vary according to the type of fund. If a fund's return for any month is lower than the minimum return, the AFP must cover the difference within a period of five days. To do so, the AFP must first apply funds from a stabilization reserve (a portion of the AFP's capital invested in the fund equal to 1% of the value of each pension fund under management). If the stabilization reserve is insufficient to cover the difference, the AFP must provide resources from its own capital. If the AFP does not have enough resources to cover the difference, the Superintendency of Finance may order the capitalization of the AFP. If, notwithstanding the above, an AFP fails to observe either the minimum return or the stabilization reserve requirements or fails to comply with the order of capitalization, the Superintendency of Finance may take possession (tomar posesión) of the AFP, in which case the Colombian Deposit Insurance Fund (Fondo de Garantías de Instituciones Financieras), or "FOGAFIN", must supply funds to cover the shortfall. Although Porvenir has never failed to meet the minimum requirements, failure to do so could require us to increase our investment in Porvenir, seek capital from alternative sources or forfeit our investment, or lead to the dissolution of the AFP and the transfer of the fund to another AFP. If Porvenir is unable to fulfill the minimum return or the stabilization reserve requirements, or if new laws or decrees impose more onerous requirements, Porvenir's business may be materially adversely affected. In 2009, the regulatory system began to shift the management of mandatory pension funds from a single-fund pension system to a multi-funds system, allowing pension funds to be more specifically tailored to the individual needs of customers according to their risk profiles. The Colombian government has for several years announced that it is considering presenting to the Colombian Congress a bill to amend current pension fund regulation to improve access to coverage, reduce inequality, and consolidate the financial sustainability of the system. As a result of the accession process of the Colombian government to become a member country of the Organization for Economic Co-operation and Development (OECD) further regulation amending the current pension fund regulation may be expected. The future regulation may not provide a favorable business environment and may adversely affect our results of operations and the financial condition of our pension and severance fund management business. Furthermore, Porvenir manages voluntary pension funds (fondos de pensiones de jubilación e invalidez) created by Decree 2513 of 1987 as supplementary savings vehicles for pensions, which are independent and different from the mandatory pension funds and benefit from tax incentives. Subject to certain limits, savings in voluntary pension funds are considered as exempt income for purposes of the Income Tax (Impuesto de Renta) under rules defined in article 1261-1 of the Tax Statute. These exemptions have been subject to modifications through tax reforms such as Law 1607 of 2012, Law 1819 of 2016 and more recently, Law 1943 of 2018, also known as Ley de Financiamiento. Changes in the applicable regulation to voluntary pension funds, in particular with respect to its tax benefits, could reduce the interest in this type of savings products and generate an adverse effect on the management fees received by Porvenir for the administration of these funds.

Regulation - Risk 7

Regulatory actions may result in fines, penalties or restrictions that could materially and adversely affect our businesses and financial performance.

Our Colombian banks, as well as Corficolombiana, Porvenir and our international banking operations, are subject to regulation and supervision by financial authorities. These regulatory authorities have broad powers to adopt regulations and other requirements affecting or restricting virtually all aspects of our subsidiaries' organization and operations, including, for example, the imposition of anti-money laundering measures and the authority to regulate the terms and conditions of credit that can be applied by Colombian banks. Failure to comply with applicable regulations could subject our banking subsidiaries to fines or sanctions or even revocation of licenses or permits to operate. In the event that any of these subsidiaries encounters significant financial problems, is in danger of insolvency or becomes insolvent, or is otherwise deemed as non-viable, the financial authorities would have broad powers to intervene in our management and operations, including suspending or removing management and, in extreme circumstances, putting our banks, Corficolombiana, Porvenir and our international banking operations, into conservatorship or receivership or taking control of our banks, Corficolombiana, Porvenir and our other subsidiaries. Since February 6, 2019, Grupo Aval is subject to the inspection and supervision of the Superintendency of Finance as the financial holding of the Aval Financial Conglomerate and are required to comply with capital adequacy and additional regulations applicable to financial conglomerates that will become effective on November 2019 and February 2020. As a result, we may become subject to more stringent regulation. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation".

Regulation - Risk 8

Changes in banking laws and regulations in Colombia and the other countries in which we operate could adversely affect our consolidated results.

Banking and financial services laws and regulations are subject to ongoing review and revision, including changes in response to global regulatory trends. As a result, governments have been actively considering new banking laws and regulations, and reviewing and revising existing laws and regulations, particularly in relation to capital adequacy and accounting standards. In addition, various international developments, such as the adoption of risk-based capital, leverage and liquidity standards by the Basel Committee on Banking Supervision in December 2010, known as "Basel III", will continue to impact us in the coming years. To prepare for the implementation of the Basel III accords in Colombia, the Ministry of Finance, in consultation with the Superintendency of Finance, effected an internal review of regulations applicable to financial institutions. Decree 2555 of 2010 was amended in 2012, 2015 and 2018, modifying certain capital adequacy requirements for Colombian credit institutions. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation". Moreover, Congress, through the enactment of Law No. 1735 of 2014, created a new type of financial institution with the sole purpose of offering electronic deposits and payments (Sociedades Especializadas en Depósitos y Pagos Electrónicos or "SEDPEs") in order to promote financial inclusion. Regulation of the operations of the SEDPEs as well as know-your-customer requirements, were included by the Colombian government in Decrees 1491 of 2015 and 2076 of 2017. SEDPEs' activities may create a new competitive environment that could adversely affect our consolidated results of operations. On September 21, 2017, the Colombian Congress passed Law 1870 to strengthen the regulation and supervision of financial conglomerates, also known as Law of Financial Conglomerates (Ley de Conglomerados Financieros). This law sets out the principles for supervising and regulating financial conglomerates. The regulation establishes criteria for identifying members of the Financial Conglomerates, as well as their controlling Financial Holding Companies, and provides the Colombian government and Superintendency of Finance with tools to regulate and supervise financial conglomerates with respect to capital adequacy, corporate governance standards, risk management, internal control and criteria for identifying, administering, monitoring and revealing conflicts of interest. Law 1870 also enables the Superintendency to require changes in the structure of a financial conglomerate when the existing structure does not allow sufficient disclosure of information or a comprehensive and consolidated supervision, to conduct on-site visits and withdrawal of operating licenses. Law 1870 of 2017 was approved in September 2017 and came into effect on February 6, 2019. As a result, the Superintendency of Finance now exerts supervision over Grupo Aval as the financial holding company of the Aval Financial Conglomerate. The Ministry of Finance also enacted Decree N° 774 of May 2018, regarding capital adequacy of financial conglomerates allowing for an 18 month transition period, coming into effect on November 8, 2019 and Decree N° 1486 of August 2018 regarding the criteria for the identification of related companies, policies on conflicts of interest and limits of exposure and concentration of risks applicable to financial conglomerates, allowing for an 18 month transition period, coming into effect on February 6, 2020. We cannot assure that such Law and its regulatory decrees will not have a material impact on us. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation-Regulatory framework for Colombian Financial Conglomerates". Central America has also been impacted by regulatory changes regarding banking laws and regulations. In Honduras, on October 2018, the National Commission of Banks and Insurances (NCBI) modified its 2017 regulation, with respect to capital adequacy, capital conservation buffer and leverage ratio requirements applicable to Honduran financial institutions. The 2017 regulation required, among others, that in a given period (originally in a three-year-period but now extended to December 2022 with the amendment) financial institutions maintain a capital conservation buffer ratio (originally equivalent to 3.0% but now of 2.5%) above the minimum capital adequacy ratio of 10% or above the minimum capital adequacy ratio defined by the NCBI for a financial institution in an individual basis. Financial institutions are also required to maintain a minimum leverage ratio of 4%. Minimum leverage ratio is calculated by dividing the primary capital (as defined in those regulations) by the sum of the total assets and the unweighted contingent assets (net of impairment, depreciation, and amortization estimates). Financial institutions with a minimum leverage ratio below such limit are required to gradually adjust it within the timeframe stated in the regulation. On June 25, 2018, the Central Bank of Costa Rica increased the minimum capital requirement for commercial private banks to 15,610 million colones (Ps 83.6 billion or U.S.$25.7 million). The Superintendency of Securities also increased such requirement in March, 2018 for securities brokers and investment fund management companies to 199 million colones (Ps 1,066 million or U.S.$328,096) and 136 million colones (Ps 729 million or U.S.$224,226), respectively. Even though our subsidiaries were already in compliance, these recent changes evidence the growing focus of the Costa Rican authorities to regulate capital requirements. Furthermore, in December 2018 the Costa Rican Congress passed Law No. 9635 entitled "Tax Reform – Law of Strengthening of Public Finances". Such reform includes two major amendments to the Costa Rican tax legislation. First, the sales tax law was replaced by a value added tax (VAT) with the general rate remaining at 13%. However, reduced rates of 1%, 2%, and 4% were imposed on the sale of certain goods and services. The second change introduced several modifications to the income tax law that includes, among others, a specific treatment for capital income and the introduction of a capital gains tax. Further or similar regulation in Costa Rica may adversely impact the result of our subsidiaries in such country. In Panamá, in January 2018, the Superintendency of Banks enacted a new regulation (Rule 002-2018) in relation to liquidity risk management applicable to Panamanian banks that operate with a general (local) or international license. Such rule became effective on July 2018 and required, among others, the senior management to be responsible for developing and implementing a liquidity risk management strategy, in accordance with the bank's risk tolerance. In addition, this rule established a short-term liquidity coverage ratio and defined it as the quotient of two amounts: the first amount corresponds to the value of liquid assets of high quality (as defined in those regulations) and the second corresponds to the net outflows of cash in 30 days. More recently, in January 2019, the Panamanian Congress, through the enactment of Law No. 70 of 2019, modified the Criminal Code, the Tax Code and other regulations in order to include tax evasion as a criminal offence. Prior to the enactment of this Law, tax evasion was not considered a crime. In Nicaragua, in July 2018, Law No. 796, also known as "Law of the Financial Analysis Unit", was enacted. This law grants the Financial Analysis Unit of Nicaragua additional powers for the purpose of gathering information from Nicaraguan financial institutions and was authorized to exchange such information with other entities in order to prevent money laundering and other crimes established therein. The Nicaraguan Congress also enacted Law 977 in July 2018, known as the "Anti Money Laundering, Finance of Terrorism and Proliferation of Weapons of Mass Destruction Law", which seeks to strengthen the regulatory framework applicable to such crimes, based on the recommendations of the country´s evaluations carried out by the Financial Action Task force of Latin America (GAFILAT). As a result of the ongoing sociopolitical situation in Nicaragua since April 2018, laws and regulations could quickly and adversely change. Nicaragua's assets represented 1.9% of our total consolidated gross assets as of December 31, 2018. Except for the 2017 amendment to the Credit Card Act in Honduras, during recent years, legislators in Central America have attempted to enact regulation to impose maximum interest rates for certain types of loans or for the acquiring business. Although the scope of these legislative initiatives has varied, these initiatives have primarily focused on personal loans and, particularly, on credit card loans. In Costa Rica, for example, Congress is discussing an initiative against usury (legislative bill number 20,172) that, if approved, will regulate the maximum rates that may be charged on loans. The enactment of any of these bills or similar regulations in the countries where we operate could have an adverse effect on the results of the operations and financial condition in such jurisdiction. The regulation of credit cards in other Central American countries, such as in Costa Rica, continues to be a matter of discussion with ongoing initiatives to regulate the interest rate and other conditions related to the issuance of credit cards or the acquiring business. The adoption of new laws or regulations, or changes in the interpretations or enforcement of existing laws or regulations may have an adverse effect on our results of operations and financial condition.

Regulation - Risk 9

We and our subsidiaries are subject to anti-corruption laws and other laws in the jurisdictions in which we operate and violation of these regulations could harm our business.

We and our subsidiaries are subject to numerous, and sometimes conflicting, legal regimes on matters as diverse as anti-corruption, taxation, internal and disclosure control obligations, securities and derivatives regulation, anti-competition regulations, data privacy and labor relations. Compliance with diverse legal requirements is costly, time-consuming and requires significant resources. Violations of one or more of these regulations in the conduct of our business or the business of our subsidiaries could result in significant fines, criminal sanctions against us or our officers, prohibitions on doing business and damage to our reputation. Violations of these laws or regulations in connection with the performance of our obligations to our customers, as well as in connection with the performance of our subsidiaries' obligations, could also result in liability for significant monetary damages, fines or criminal prosecution, unfavorable publicity and other reputational damage, restrictions on our ability to process information and allegations by our customers that we have not performed our contractual obligations. Because of the varying degrees of development of the legal systems of the countries in which we operate, local laws might be insufficient to protect our rights due in part to a lack of multiple instances and/or deficiencies in the access to justice. In particular, practices in the local business community may not conform to international business standards and could violate anti-corruption laws or regulations, including the U.S. Foreign Corrupt Practices Act. Our employees, and joint venture partners, or other third parties with which we associate could take actions that violate policies or procedures designed to promote legal and regulatory compliance or applicable anti-corruption laws or regulations. Violations of these laws or regulations by us or our subsidiaries, our employees or any of these third parties could subject us to criminal or civil enforcement actions (whether or not we participated or knew about the actions leading to the violations), including fines or penalties, disgorgement of profits and suspension or disqualification from work, including governmental contracting, any of which could materially adversely affect our business, including our results of operations and our reputation.

Regulation - Risk 10

Colombian insolvency laws may limit the ability of our banking subsidiaries to collect on monetary obligations and enforce rights against collateral or under guarantees.

Insolvency laws in certain countries in which we operate provide that creditors of an insolvent debtor are prohibited from initiating collection proceedings outside the bankruptcy or reorganization process of such debtor. In addition, all collection proceedings outstanding at the beginning of the bankruptcy or reorganization process must be suspended and such creditors are prevented from enforcing their rights against the collateral and other assets of the insolvent debtor. In some countries in which we operate once a non-merchant individual has ceased paying his or her debts, such individual can initiate a voluntary insolvency proceeding before a notary public or mediator to reach an out-of-court agreement with creditors. The terms of any agreement reached in accordance with the respective law and with a group (two or more) of creditors that represent the majority of the total amount of the claims will be mandatorily applicable to all relevant creditors. The insolvency law also provides other protections to debtors. A perception that loans to individuals may be difficult or impossible to recover could cause our banking subsidiaries to enhance credit requirements and result in decreased lending to individuals by making access to credit more expensive. In addition, increased difficulties in enforcing debt and other monetary obligations due to insolvency laws in countries in which we operate, could have an adverse effect on our results of operations and financial condition.

Regulation - Risk 11

Changed

Changes in government policies and actions, as well as judicial decisions in Colombia and other countries in which we operate could significantly affect the local economy and, as a result, our results of operations and financial condition.

Our results of operations and financial condition may be adversely affected by changes in Colombian and Central American governmental policies and actions, and judicial decisions, involving a broad range of matters, including interest rates, fees, exchange rates, exchange controls, inflation rates, taxation, banking and pension fund regulations and other political or economic developments affecting Colombia and other countries in which we operate. Colombian and Central American governments have historically exercised substantial influence over their economies, and their policies are likely to continue to have a significant effect on companies, including us. In 2018, presidential elections were held in Colombia and Mr. Iván Duque Márquez was elected for the presidential period 2018-2022 with 54% of the votes in the second round. President Duque is a former Senator from the Democratic Center party, and his agenda includes (i) tackling corruption, (ii) fighting against the increase of cocaine production, (iii) increasing focus on rule of law, (iv) entrepreneurship and (v) social equity. The president of Colombia has considerable power to determine governmental policies and actions relating to the economy, and may adopt policies that negatively affect us. Moreover, regulatory uncertainty, public dialogue on reforms during Mr. Duque´s presidential period and other countries where we operate, or the approval of reforms may be disruptive to our business or the economy and may result in a material and adverse effect on our financial condition and results and operations.

Regulation - Risk 12

Changed

Colombian law and similar regulations in countries in which we operate, impose or might impose limitations on interest rates, and future additional restrictions on interest rates or banking fees could negatively affect our profitability.

The Colombian Commercial Code ("Código de Comercio") limits the amount of interest our Colombian subsidiaries may charge on commercial transactions, including transactions of our banking subsidiaries. In the future, regulations in Colombia or other countries in which we operate, could impose increased limitations regarding interest rates or banking fees. Law 1430 of December 2010, as amended, authorizes the Colombian government to impose or place limits on tariffs and fees charged by banks and other financial institutions where the government has determined that there is insufficient competition in a relevant market. Additionally, the law requires the Superintendency of Finance to implement a monitoring scheme of the tariffs and fees charged by the financial institutions in their relevant markets and to report the results of this evaluation semi-annually to the Colombian government. The Colombian government issued Decree 4809 of 2011 and Decree 1854 of 2015, which (i) requires banks to provide each of their clients with statements of all fees charged to such clients on an annual basis, (ii) sets a limit on the fees that banks may charge to their clients for withdrawals from automated teller machines of other banks and (iii) establishes that transactions through the internet may not cost more than those made through other channels. Accordingly, the Superintendency of Finance has issued External Circular 012 of 2012, setting the rules and principles that must be followed by banking and financial institutions at the time of establishing, publishing and promoting their tariffs and fees. A significant portion of our banks' revenues and operating cash flow is generated by credit services and any such increased limitations would materially and adversely affect our results of operations and financial condition.

Regulation - Risk 13

Changed

We might face uncertainty regarding consumer protection laws.

Law 1328 of 2009 as amended by Law 1748 of 2014, also referred to as the "financial reform law", created a new customer protection regime with respect to financial institutions. The financial reform law provides a bill of rights for consumers of financial services and products, including the right to receive clear, complete and reliable information about the services and products offered by financial institutions. The law also contains specific obligations for financial institutions, including a duty to maintain a financial ombudsman in charge of consumer protection and procedures regulating the responsibilities and functions of the ombudsman, a duty to create a financial consumer attention center pursuant to terms set by the Superintendency of Finance, an obligation to provide services and products under the same conditions offered to the general public, and a prohibition on the inclusion of predatory or abusive clauses in contracts with consumers. Any violation of this law and its implementing regulations by our banking subsidiaries could result in monetary or administrative sanctions or restrictions on our operations. Decree 4809 of 2011 regulates certain fees charged by Colombian financial institutions. The most salient of these regulations include a cap of 20 Unidades de Valor Real or "UVR" (an inflation indexed unit) for ATM fees charged to clients for transactions conducted through ATMs owned by a third party, the requirement that ATM fees be disclosed to clients with the possibility to opt out of the transaction before it takes place, and the prohibition of charging higher fees for internet transactions than for non-internet transactions as well as charging fees for failed internet transactions. These and similar restrictions could affect the profitability of our business by decreasing our fee income. Law 1555 of 2012 allows consumers of financial services to prepay obligations denominated in pesos owed to financial institutions, without incurring any penalty. The law also requires that financial institutions disclose the possibility of such prepayment to borrowers prior to the extension of any loan. Although this law does not apply to loans having a balance that exceeds 880 times the legal monthly minimum wages, nor to financial obligations acquired prior to its effective date (July 9, 2012), its application may substantially affect our banking business profits. On July 7, 2016, the Colombian Congress enacted Law 1793 regarding costs charged to customers of financial entities and as a result customers are now able to use the total balance in their savings accounts and electronic deposits without having the obligation to preserve a minimum amount of deposits. Moreover, financial entities are prohibited from charging financial costs on savings accounts following 60 days of inactivity and have the obligation to recognize a minimum positive rate return in savings accounts. Additionally, the Colombian Congress often discusses initiatives related to the rights of financial consumers. These initiatives cover various areas, including consumer data protection, financial costs, financial education and information delivered by financial institutions to customers.

Litigation & Legal Liabilities3 | 4.1%

Litigation & Legal Liabilities - Risk 1

Changed

Grupo Aval and certain of its subsidiaries and officers are defendants in government enforcement actions and/or subject to ongoing governmental investigations relating the Ruta del Sol Project Sector 2 that could cause us to incur penalties and other sanctions, impact our ability to conduct our business, harm our reputation and negatively impact our financial results.

On December 21, 2016, the United States Department of Justice ("DOJ") announced that Odebrecht S.A. ("Odebrecht"), a global construction conglomerate based in Brazil, pled guilty and agreed to pay a monetary penalty to resolve charges with authorities in the United States, Brazil and Switzerland arising out of their schemes to pay approximately U.S.$800 million in bribes to government officials in twelve countries around the world, including U.S.$11.5 million in Colombia, where Odebrecht admitted to offering bribes in order to obtain and extend infrastructure contracts. Odebrecht further admitted to effecting these payments directly from its Brazilian headquarters through its division of structured operations. Soon after Odebrecht's guilty plea, Colombia's Attorney General's Office (the "Fiscalía General de la Nación" or "Fiscalía") initiated several lines of investigations that have identified and incarcerated Colombian recipients of the Odebrecht bribes; the Fiscalía also established that Odebrecht effected payments through its "division of structured operations", directly from its Brazilian headquarters, to obtain the contract for the construction of "Ruta del Sol Project Sector 2" toll road concession awarded to Concesionaria Ruta del Sol S.A.S. ("CRDS") in 2009 and also to obtain the amendment to the contract in connection with the Ocaña-Gamarra addition to the Ruta del Sol II toll road in 2014. The Concession Contract No. 001 of 2010, for the construction of Ruta del Sol Sector 2 (the "Concession Contract"), was entered into on January 14, 2010 and the amendment in connection with the Ocaña-Gamarra addition was entered into on March 14, 2014. Episol S.A.S. ("Episol"), a wholly-owned subsidiary of Corficolombiana and an indirect subsidiary of Grupo Aval, is a minority (33%) non-controlling shareholder in CRDS and Odebrecht is the majority controlling and operating shareholder with a participation of 62%. A third shareholder, CSS Constructores S.A., has a 5% participation in CRDS. Episol, and the former president of Corficolombiana are among the defendants in a class action lawsuit brought by the Procuraduría General de la Nación before the Administrative Tribunal of Cundinamarca ("TAC") relating to the alleged payment of bribes in connection with the Ruta del Sol Project Sector 2. The TAC ruled in December 2018 that Episol, along with Odebrecht, and other defendants, including the former president of Corficolombiana, were jointly liable for the damages to the Nation caused by the payment of bribes confessed by Odebrecht related to the Ruta del Sol Project Sector 2, ordered the defendants to jointly and severally pay the Ministry of Transportation Ps 715.6 billion, and debarred them from contracting with Colombian state entities and from assuming government positions for a period of 10 years. Episol and the other defendants filed an appeal of this ruling before Colombia's Supreme Court for administrative law matters (Consejo de Estado). Grupo Aval, Corficolombiana, Episol, Grupo Aval's president and Grupo Aval's chief financial officer, Corficolombiana's Vice President of Investments and Corficolombiana's Vice President of Investment Banking, the former president of Corficolombiana and other defendants have been charged by the Colombian Superintendency of Industry and Commerce ("SIC") with alleged violations of Colombian antitrust regulations in connection with the Ruta del Sol Project Sector 2. The proceeding is ongoing. Grupo Aval is also subject to investigations by the DOJ and by the SEC concerning the Ruta del Sol Project Sector 2. Grupo Aval is cooperating with the DOJ's and SEC's investigations, as it has done with all prior government inquiries into this matter. On April 1, 2019, Jose Elias Melo, the former president of Corficolombiana, was found guilty in a court of first instance of bribery and undue interest in connection with the 2009 bid for the Ruta del Sol Project Sector 2. Mr. Melo has announced his intention to appeal the court's decision. For further information about the foregoing proceedings and investigations, see "Item 8. Financial Information-A. Consolidated statements and other financial information-Legal Proceedings". We have not recorded any accrual for the SIC proceeding and the TAC class action, however, there can be no assurance as to the terms of the final resolution and the timing of these matters. At this time it is not possible to predict the scope, duration or likely outcome of the DOJ and SEC investigations. Similarly, it is not possible to predict at this time whether additional investigations or proceedings relating to Ruta del Sol Project Sector 2 may arise. We and our subsidiaries are exposed to a variety of potential material negative consequences as a result of the proceedings and investigations noted above, which could result in judgments, settlements, admissions of wrongdoing, criminal convictions, fines, penalties, injunctions, cease and desist orders, debarment or other relief and we and our subsidiaries could be exposed to other litigation as a result of these proceedings and investigations, including actions initiated by shareholders. Such investigations and proceedings, which are the subject of extensive media coverage and political interest in Colombia, could also have significant collateral consequences for our company and our subsidiaries, including damage to reputation, loss of customers and business, the inability to offer certain products and services, disqualification or losing permission to operate certain businesses for a period, the dissemination of potentially damaging information that may come to light in the course of the investigations and proceedings and other direct and indirect adverse effects. Management will need to continue to direct substantial time and attention to resolving such matters, which could prevent them from focusing on our core businesses. We can provide no assurance that the outcome of any such investigations and proceedings will not be material to our business, financial position, results of operations or our financial position.

Litigation & Legal Liabilities - Risk 2

We may face legal and other challenges to maximizing revenue from credit card fees and other fees from customers.

As part of their credit card business, our banking subsidiaries face pressures related to the fees and commissions charged to merchants (merchant discounts) and the pricing of bank interchange fees charged by issuer banks to acquiring banks. Banks and card processors in Colombia have been subject to administrative investigations regarding the fees and commissions that are charged to the merchants by the acquiring banks and in respect to the banking interchange fees. In the past, the Superintendency of Industry and Commerce (Superintendencia de Industria y Comercio) has conducted investigations on the practices of the Asociación Gremial de Instituciones Financieras Credibanco (the Visa franchisee in Colombia) and Redeban Multicolor S.A. (the MasterCard franchisee in Colombia), the entities used by most Colombian banks to manage the credit card system in Colombia, relating to alleged price fixing schemes among Colombian banks relating to fees and commissions charged to merchants. The Superintendency of Industry and Commerce has also conducted investigations into certain Colombian banks in the past, including our Colombian banking subsidiaries, for alleged price fixing of bank interchange fees charged during the period from May 2007 to October 2008. Similar investigations may be carried out by the relevant authorities in the future, which may result in penalties, lower fees charged to merchants and bank interchange fees, lead to changes in commercial strategies that may adversely affect our results of operations and financial condition. In addition, fees charged for other banking services may continue to be reduced in the future as a result of regulatory measures and/or pressure from retailers and interest groups.

Litigation & Legal Liabilities - Risk 3

Our businesses face constitutional actions, class actions and other legal actions involving claims for significant monetary awards against financial institutions, which may affect our businesses.

Under the Colombian Constitution and similar regulations in other countries in which we operate, individuals may initiate constitutional actions (acciones populares), or class actions (acciones de grupo), to protect their collective or class rights, respectively. Individuals may also initiate constitutional actions for the protection of their fundamental rights. These actions are known as tutelage actions. Colombian financial institutions, including our banking subsidiaries, Corficolombiana and Porvenir, have been, and continue to be, subject to these actions with regard to fees, financial services, mortgage lending and interest rates, the outcomes of which are uncertain. In addition, the number of such actions could increase in the future and could significantly affect our businesses.

Taxation & Government Incentives2 | 2.7%

Taxation & Government Incentives - Risk 1

New or higher taxes resulting from changes in tax regulations or the interpretation thereof in Colombia and other countries in which we operate could adversely affect our results of operations and financial condition.

New tax laws and regulations, and uncertainties with respect to future tax policies, pose risks to us. In recent years, Colombian tax authorities have imposed additional taxes in a variety of areas, such as taxes on financial transactions, to fund Colombia's war against terrorism and taxes created in order to fund post-conflict programs related to the peace negotiations with guerrilla forces. The Colombian government is also obliged by Law 1473 of 2011, also known as Law of Fiscal Rule to significantly reduce its fiscal deficit over the following years. This, in addition to pressure from rating agencies could lead to higher taxation rates on our business and that of our borrowers. Changes in tax-related laws and regulations, and interpretations thereof, can impact tax burdens by increasing tax rates and fees, creating new taxes, limiting tax deductions, and eliminating tax-based incentives and non-taxed income. In addition, tax authorities or courts may interpret tax regulations differently than we do, which could result in tax litigation and associated costs and penalties. Between 2012 and 2018, the Colombian Congress passed four tax reforms submitted by the Colombian government. The Colombian government may implement new changes in the tax rules applicable to our securities which could have a material adverse effect on our results of operations and financial condition or that may adversely affect our shareholders or holders of ADSs. ADSs do not have the same tax benefits as equity investments in Colombia. Although ADSs represent our preferred shares, they are subject to a different tax regulatory regime. Accordingly, the tax benefits applicable in Colombia to equity investments, in particular those relating to dividends and profits from sale, may not apply or apply differently in the case of our ADSs. Until December 31, 2016, in order to avoid double taxation, our Colombian subsidiaries usually distributed dividends from profits that had already been subject to income tax at the corporate level. These dividends were usually not taxable for Grupo Aval in Colombia, and dividends paid by Grupo Aval to its shareholders in Colombia from these sources of income also were usually not taxable, in each case provided that such profits had been taxed at the subsidiary level. However, on December 29, 2016, the Colombian government enacted a new tax reform (Law 1819) eliminating this treatment and introducing other substantial changes to the then current tax legal framework, including, pursuant to certain rules, taxation on dividends distributed to residents and non-residents from profits generated from 2017 onwards, a modified corporate income tax regime, and an increase in the Value Added Tax rate, among others. Law 1819 of 2016, also repealed Article 36-1 of the Colombian Tax Code which established that capital gains obtained in a sale of shares listed on the Colombian Stock Exchange were not subject to income tax in Colombia, provided that the shares sold by the same beneficial owner during each fiscal year did not represent more than 10% of the issued and outstanding shares of the listed company. See "Item 4. Information on the Company-B. Business overview-Supervision and regulation-Tax Reforms". In addition to the tax reform approved in December 2016, the Colombian Congress enacted Law 1943 on December 28, 2018, also known as the Financing Law, introducing changes to the then current tax legal framework, including, pursuant to certain rules, a reduction of the corporate income tax rate from 37% in 2018 to 33% in 2019, to 32% for 2020, 31% for 2021 and 30% for 2022 and onwards. Among others, the Financing Law also introduced an increase in the dividend tax on distributions to foreign nonresident entities and individuals from 5% to 7.5%, as well as a surtax for financial institutions of 4% in 2019 and 3% in years 2020 and 2021.

Taxation & Government Incentives - Risk 2

Colombian tax haven regulations could adversely affect our results of operations and financial condition.

Decree 1966 of 2014, as amended by National Decree 2095 of 2014, put into effect article 260-7 of Colombia's Tax Code, which regulates applicable rules for tax havens. Accordingly, a number of jurisdictions, including countries in which our banking subsidiaries operate, were either declared tax havens for Colombian tax purposes or temporarily excluded from such list subject to the completion of tax information exchange treaties within a short timeframe. Article 260-7 of the Colombian Tax Code was reformed by Law 1819 of 2016. This reform establishes a new legal framework and provides criteria pursuant to which certain jurisdictions may be classified as non-cooperative jurisdictions with low or no taxation or as jurisdictions with preferential tax regimes. This legal framework established a higher tax-withholding rate on Colombian source payments to those jurisdictions and entities considered part of such a jurisdiction. In October 2016, Panamá ratified to the Convention on Mutual Administrative Assistance in Tax Matters developed by the OECD as a multilateral instrument of tax cooperation to tackle tax evasion and avoidance. The convention facilitates bilateral agreements for the automatic exchange of information by participating jurisdictions. Panamá also agreed to enter into a Double Taxation Agreement (DTA) with Colombia, however, such treaty has not been signed yet. The treaty is expected to include provisions regarding the automatic exchange of financial information. Failure to execute this treaty or the designation of Panamá as a tax haven could have a negative impact on our customer base and on our business, financial condition and results of operations. As a result, some of our clients with financial products offered by our banking subsidiaries in such jurisdictions may have experienced, among other effects, an increase in their withholding tax rates, transfer pricing regulation, increased likelihood of being found in violation of tax regulations by the Colombian authorities and elevated information disclosure requirements which could have a negative impact on our business, financial condition and results of operations.

Environmental / Social1 | 1.4%

Environmental / Social - Risk 1

Failure to protect personal information could adversely affect our reputation and our business.

Our banks manage and hold confidential personal information of customers in the normal course of their banking operations. Although our banks have procedures and controls to safeguard personal information in our possession, unauthorized disclosures or unauthorized access to privileged information, fraud or interfering with regular banking and other services could subject our banks and us to legal actions, administrative sanctions and damages. For example, we face risks related to security breaches in connection with debit and credit card transactions that typically involve the transmission of personal information of our customers through various third parties, including retailers and payment processors. We and some of these parties have in the past been the target of security breaches and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches affecting any of these third parties could affect us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches relating to them, including costs to replace compromised debit and credit cards and address fraudulent transactions. Although we employ a variety of physical, procedural and technological safeguards to protect personal information from mishandling, misuse or loss, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. Similarly, when personal information is collected, compiled, processed, transmitted or stored by third parties on our behalf, our policies and procedures require that the third party agrees to maintain the confidentiality of the information, establish and maintain policies and procedures designed to preserve the confidentiality of the information, and permit us to confirm the third party's compliance with the terms of the agreement. Any failure to protect personal information could result in reputational damage and have an adverse effect on our results of operations and financial condition.

Macro & Political

Total Risks: 10/74 (14%)Above Sector Average

Economy & Political Environment5 | 6.8%

Economy & Political Environment - Risk 1

Adverse economic and political conditions in Colombia and other countries in which we operate, including variations in the exchange rates or downgrades in credit ratings of sovereign debt securities, may have an adverse effect on our results of operations and financial condition.

Our principal subsidiaries in Colombia are financial institutions (four commercial banks, a pension and severance fund administrator and a merchant bank), and the majority of our operations, properties and customers are located in Colombia. As a consequence, our results of operations and financial condition are materially affected by economic and political conditions in Colombia. Colombia is subject to economic, political and other uncertainties, including changes in monetary, exchange control and trade policies that could affect the overall business environment in Colombia, which would, in turn, affect our results of operations and financial condition. For example, the Central Bank of Colombia (the "Colombian Central Bank" or "Central Bank"), could sharply raise or lower interest rates, which could negatively affect our net interest income and asset quality,and also restrict our growth. Extreme variations in exchange rates could also negatively affect the foreign currency positions of our borrowers. Any of these events could have an adverse effect on our results of operations and financial condition. Decreases in the growth rate of the Colombian economy, periods of negative growth, material increases in inflation or interest rates, or high fluctuations in the exchange rate could result in lower demand for, or affect the cost of risk and the pricing of, our services and products. Due to the fact that a large percentage of the costs and expenses of our subsidiaries is fixed, we may not be able to reduce costs and expenses upon the occurrence of any of these events, in which case our profitability could be affected. In the case of our pension and severance fund management business, economic conditions may affect the businesses and financial capacity of employers, which may result in a reduction in employee-contributor head counts or decrease the ability of employers to create new jobs or increase employee incomes. BAC Credomatic's results of operations and financial condition depend on economic, political and social conditions in the countries where it operates, primarily in Central America. The political, economic and social environments in such countries are affected by many different factors, including significant governmental influence over local economies, substantial fluctuations in economic growth, high levels of inflation, exchange rate movements, exchange controls or restrictions on expatriation of earnings, high domestic interest rates, drug trafficking and other forms of organized crime, wage and price controls, changes in tax policies, imposition of trade barriers, changes in the prices of commodities and unexpected changes in regulation. The results of operations and financial condition of our Central American operations could be affected by changes in economic and other policies of each country's government, which have exercised and continue to exercise substantial influence over many aspects of the private sector, and by other social and political developments in each country. During the past several decades, El Salvador, Guatemala, Honduras, Nicaragua and Panamá have experienced civil strife and political instability that have included a succession of regimes with differing economic policies and programs. Previous governments have imposed, among other measures, controls on prices, exchange rates, local and foreign investment, and international trade. They have also restricted the ability of companies to dismiss employees, expropriated private sector assets and prohibited the remittance of profits to foreign investors. Adverse economic, political and social developments, including allegations of corruption against the Colombian government and governments of other countries in which we operate in Central America may adversely affect demand for banking services and create uncertainty regarding our operating environment, which could have a material adverse effect on our subsidiaries and, consequently, on our company. In addition, changes in political administrations may result in changes in governmental policy, which could affect our subsidiaries and, consequently, our business. Downgrades in credit ratings of debt securities issued or guaranteed by governments in countries in which we operate may increase our and our subsidiaries' cost of funding or limit the ability of borrowing funds from customary sources of capital.

Economy & Political Environment - Risk 2

The Colombian and Central American economies remain vulnerable to external shocks.

A significant decline in economic growth of any of Colombia's or Central America's major trading partners could have a material adverse effect on each country's trade balance and economic growth. In addition, a "contagion" effect, where an entire region or class of investments becomes less attractive to, or subject to outflows of funds by, international investors could negatively affect Colombia or Central American countries in which we operate. Lower than expected economic growth may result in asset quality deterioration and could negatively affect our business. Pension funds, such as those managed by Porvenir, invest globally and thus are affected by regional and global economic factors. Lower economic growth of Colombia's major trading partners or a contagion effect in the region or globally may lead to lower pension funds returns, which may in turn result in decreases in assets under management and affect our business, results of operations or financial condition. In recent years, pension fund returns have been subject to increased volatility in international financial markets. Foreign investments represented 31.2% of Porvenir's total assets under management at December 31, 2018. Fluctuations in commodity prices and volatility in exchange rates in the past have led to a deceleration in growth. In particular, the oil industry remains an important determinant of Colombia's economic growth. Substantial or extended declines in international oil prices or oil production may have an adverse effect on the overall performance of the Colombian economy and could have an adverse impact on the results of operations and financial condition of oil industry companies, which could have an adverse impact on our loans to oil industry companies. Our banking subsidiaries do not maintain a significant overall exposure to oil industry clients and have not been materially impacted by the decrease in international oil prices, however, continuing falling market prices, such as the one experienced during 2014 and 2015, pose significant challenges to Colombia's near-term outlook and may impair the ability of some of the clients of our banking subsidiaries to repay their debt obligations. As of December 31, 2018, our combined exposure to the oil sector is 1.2% of the consolidated loan portfolio, with the principal exposure being to companies which own or run oil pipelines (0.61%) in which Empresa Colombiana de Petróleos S.A. "Ecopetrol". Ecopetrol is Colombia's largest oil producer, with a majority ownership by the Colombian Government and a BBB- (S&P) long-term corporate credit rating. As of December 31, 2018, our exposure to oil service companies and suppliers to the oil sector (0.27% and 0.31% of the consolidated loan portfolio, respectively) was immaterial. We do not believe this exposure will materially affect our results. Although the growth of the Colombian economy is expected to be steady in the future, there is no guarantee that the past decade´s average growth will be maintained. A low rate of growth of the Colombian economy, a slowdown in the growth of customer demand, an increase in market competition, or changes in governmental regulations, could adversely affect the rate of growth of our loan portfolio and our cost of risk and, accordingly, increase our required loan loss allowances. All of these conditions could lead to a general decrease in demand for borrowings. In addition, the effect on consumer confidence of any actual or perceived deterioration of household incomes in the Colombian or Central American economies may have a material adverse effect on our results of operations and financial condition.

Economy & Political Environment - Risk 3

Colombia has experienced and continues to experience internal security issues that have had or could have a negative effect on the Colombian economy.

Colombia has experienced internal security issues, primarily due to the activities of guerrilla groups such as the National Liberation Army (Ejército de Liberación Nacional), or "ELN", urban militias, paramilitary groups, former members of the Revolutionary Armed Forces of Colombia (Fuerzas Armadas Revolucionarias de Colombia), or "FARC", and drug cartels. In remote regions of the country with minimal governmental presence, these groups have exerted influence over the local population and funded their activities by protecting, and rendering services to drug traffickers. The Colombian government reached a peace deal with the FARC in November 2016. Under Juan Manuel Santos' administration, the Colombian government also began negotiations with ELN in October 2016, which, had continued under a slower pace during the government of President Duque until January 17, 2019. As a result of an attack made by ELN to a police academy in Bogotá, the Colombian President cancelled peace talks. Any breakdown in peace, renewed or continuing drug-related crime and guerilla and paramilitary activities may have a negative impact on the Colombian economy in the future. Our business or financial condition could be adversely affected by rapidly changing economic or social conditions, including the Colombian government's response to the peace deal with the FARC, or any peace negotiation with ELN or other group, which may result in legislation that increases our tax burden, or that of other Colombian companies, which could, in turn, impact the overall economy, or legislation that could directly impact our business, such as those requiring more flexible credit conditions for, or the employment of, former FARC members.

Economy & Political Environment - Risk 4

Political and economic instability in the region may affect the Colombian economy and, consequently, our results of operations and financial condition.

Some of Colombia's neighboring countries, particularly Venezuela, have experienced and continue to experience periods of political and economic instability. According to figures from the United Nations, more than two million Venezuelans have emigrated amid food and medicine shortages and profound political divisions in their country. Approximately half of those migrants have opted to live in Colombia, and many have arrived with only what they could carry. Providing migrants with access to healthcare, utilities and education may have a negative impact on Colombia's economy if the Government is not able to respond adequately to legalize migrants, generate programs to help them find formal jobs, and increase tax revenue and consumption. Moreover, diplomatic relations with Venezuela and Ecuador have from time to time been tense and affected by events surrounding the Colombian military forces' confrontations with guerilla groups, particularly on Colombia's borders with each of Venezuela and Ecuador. More recently, the Colombian government joined an international campaign against Nicolás Maduro asking him to relinquish power, which has further increased diplomatic tensions with Venezuela. On November 19, 2012, the International Court of Justice placed a sizeable area of the Caribbean Sea within Nicaragua's exclusive economic zone, which until then had been deemed by Colombia as part of its own exclusive economic zone. A worsening of diplomatic relations between Colombia and Nicaragua involving the disputed waters could result in the Nicaraguan government taking measures, or a reaction among the Nicaraguan public, which would be detrimental to Colombian-owned interests in that country, including those owned by us through BAC Credomatic. Further economic and political instability in Colombia's neighboring countries or any future deterioration in relations with Venezuela, Ecuador, Nicaragua and other countries in the region may result in the closing of borders, the imposition of trade barriers and a breakdown of diplomatic ties, or a negative effect on Colombia's trade balance, economy and general security situation, which may adversely affect our results of operations and financial condition. Finally, political conditions such as changes in the United States policies related to immigration and remittances could affect the regions in which we operate. Economic conditions in the United States and the region generally may be impacted by the new United States-Mexico-Canada Agreement. This could have an indirect effect on the Colombian economy and the countries in which we operate.

Economy & Political Environment - Risk 5

Difficult market conditions can adversely affect Corficolombiana's business.

Corficolombiana may be adversely affected by lower than expected returns on investments, reduced opportunities to realize value from investments, and failure to find suitable investments to deploy capital effectively. During periods of difficult market conditions (which may span across one or more industries, sectors or geographies), portfolio companies may experience adverse operating performance, decreased revenues, financial losses, difficulty in obtaining access to financing or increased funding costs. Negative financial performance of portfolio companies may materially and adversely affect Corficolombiana's results of operations and cash flow. If the operating performance of those portfolio companies (as well as valuation multiples) does not improve following any such downturn or other portfolio companies experience adverse operating performance, Corficolombiana may be forced to sell those assets at values that are less than projected or even at a loss. Portfolio companies may also have difficulties expanding their businesses and operations or meeting debt service and other obligations as they become due. Furthermore, negative market conditions could potentially result in a portfolio company entering bankruptcy proceedings, thereby potentially resulting in a complete loss of the investment. Even if such conditions improve broadly and significantly over the long term, adverse conditions and/or other events in particular sectors may cause our performance to suffer further.

International Operations1 | 1.4%

International Operations - Risk 1

We may be unsuccessful in addressing the challenges and risks presented by our operations in countries outside Colombia.

We conduct banking businesses outside our historical home market of Colombia primarily through BAC Credomatic. Our Central American operations may involve risks to which we have not previously been exposed. Some of these operations are in countries that may present different or greater risks than those in Colombia. For example, BAC Credomatic has a significant consumer finance business, including credit card operations, in the Central American countries in which it operates. At December 31, 2018, BAC Credomatic's consumer loan portfolio totaled U.S.$6.3 billion (Ps 20.4 trillion) (including mortgages, vehicles and other personal loans), which represented 38.8% of BAC Credomatic's total loan portfolio, and U.S.$ 3.0 billion (Ps 9.6 trillion) in credit card loans, which represented 18.3% of BAC Credomatic's total loan portfolio. We may face delays in payments by customers and higher delinquency rates in these countries, which could necessitate higher impairments for loan losses and, consequently, have a negative effect on our financial performance.

Natural and Human Disruptions1 | 1.4%

Natural and Human Disruptions - Risk 1

Changed

Natural disasters, acts of war or terrorism, rioting or other external events could disrupt our businesses and affect our results of operations and financial condition.

We are exposed to natural disasters, such as earthquakes, volcanic eruptions, tornadoes, tropical storms and hurricanes. Heavy rains or abnormally low rainfall in Colombia and other countries in which we operate, attributable in part to the La Niña and El Niño weather patterns, have resulted in severe flooding and mudslides and prolonged droughts in the past. These are recurring weather phenomena that may contribute to flooding, mudslides, droughts or other natural disasters on an equal or greater scale in the future. In addition to severe weather and natural disasters, acts of war or terrorism, rioting and other adverse external events could have a significant impact on our ability to conduct business and may, among other things, affect the stability of our deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral of secured loans, cause significant property damage, cause us to incur additional expenses and/or result in loss of revenue. In the event of such circumstances, our disaster recovery plans may prove to be ineffective, which could have a material adverse effect on our ability to conduct our businesses, particularly if such an occurrence affects computer-based data processing, transmission, storage and retrieval systems or destroys customer or other data. In addition, if a significant number of our employees and senior managers were unavailable because of a natural disaster, our ability to conduct our businesses could be compromised. Natural disasters, acts of war or similar events could also result in substantial volatility in our results of operations for any fiscal quarter or year.

Capital Markets3 | 4.1%

Capital Markets - Risk 1

We may be adversely affected by fluctuations between the value of the Colombian peso or other local currencies where we operate, and the U.S. dollar as a result of U.S. dollar-denominated indebtedness and as a result of our Central American operations.

We face exposure to fluctuations in the rate of exchange between local currencies and the U.S. dollar, particularly given the fact that the currencies in countries where we and BAC Credomatic operate have historically experienced significant devaluations and depreciations. Fluctuations in the rate of exchange rate between the value of the Colombian peso or other local currencies where we operate, and the U.S. dollar, may also negatively affect our leverage ratios as measured by regulators or by rating agencies. The types of instruments exposed to foreign exchange rate risk include, for example, investments in foreign subsidiaries, foreign currency-denominated loans and securities, foreign currency-denominated debt and various foreign exchange derivative instruments whose values fluctuate with changes in the level or volatility of currency exchange rates or foreign interest rates. We are subject to impacts on our statement of income and/or statement of financial position derived from fluctuations of the Colombian Peso, in particular, against the U.S. dollar, where most of our foreign long-term debt is denominated, and the Colombian peso, and between the U.S. dollar and each of the currencies in our Central American operations, as 38.4% of our average consolidated assets for the year ended December 31, 2018 and 41.5% of our average consolidated liabilities for the year ended December 31, 2018 are foreign currency-denominated. On a consolidated basis we have U.S.$3.5 billion (Ps 11.3 trillion) of long-term debt denominated in U.S. dollars as of December 31, 2018. Our significant dollar-denominated investments in Central America can affect our business. Fluctuations in the exchange rate between the Colombian peso and the U.S. dollar may affect the value of these debt and investments on our statement of financial position and cause us to recognize gains or losses in our statement of income. Any substantial fluctuation in the U.S. dollar relative to the Colombian peso could affect our results of operations and our ability to meet our future payment obligations and increase or decrease the peso value of our risk-weighted assets and goodwill, thereby affecting capital ratios of our banking subsidiaries. The exchange rate fluctuation between the Colombian peso and U.S. dollar also affects our results as the functional currency of LB Panamá, which consolidates BAC Credomatic, is the U.S. Dollar. See "Item 5. Operating and financial review and prospects-Results of operations for the year ended December 31, 2018 compared to the year ended December 31, 2017-Banco de Bogotá Subsidiary Analysis-LB Panamá" for a description of the effect of such fluctuation on LB Panamá's results. A substantial portion of BAC Credomatic's earnings, assets and liabilities are in Costa Rican colones, Guatemalan quetzals, Honduran lempiras, Nicaraguan córdobas, Panamanian balboas and U.S. dollars. As a result, our Central American operations are subject to risks relating to foreign currency exchange rate fluctuations between these currencies and pesos. We are exposed to changes in the values of current holdings and future cash flows denominated in other currencies. The types of instruments exposed to foreign exchange rate risk include, for example, investments in foreign subsidiaries, foreign currency-denominated loans and securities, foreign currency-denominated debt and various foreign exchange derivative instruments whose values fluctuate with changes in the level or volatility of currency exchange rates or foreign interest rates. Hedging instruments used to mitigate this risk include currency swaps and deposits as of December 31, 2018. Foreign exchange rate risks associated with U.S. dollar-denominated liabilities are hedged with the net investment that Grupo Aval maintains in BAC Credomatic through Banco de Bogotá. The difference between the U.S. dollar-denominated debt and the net investment in BAC Credomatic (including any goodwill associated with the acquisition) may result in a net U.S. dollar asset position which Grupo Aval, through Banco de Bogotá and LB Panamá may hedge with forward contracts. For more information see Note 9 to the audited consolidated financial statements. In accordance with its market risk policies, BAC Credomatic maintains a U.S. dollar net asset position (long U.S. dollar position) which is intended to hedge its shareholders' equity against possible devaluations of each of the local currencies in the countries where it operates against the U.S. dollar.

Capital Markets - Risk 2

We are subject to trading risks with respect to our trading activities.

Our banking subsidiaries, Corficolombiana, Porvenir and our other subsidiaries are allowed to engage in proprietary trading, and we might derive a portion of our profits from such trading activities. As a result, any reduction in trading income could adversely affect our results of operations and financial condition. Our trading income is volatile and dependent on numerous factors beyond our control, including, among others, market trading activity, interest rates, exchange rates and general market volatility. A significant decline in our trading income, or large trading losses, could adversely affect our results of operations and financial condition. Declines in the market price for securities and expected losses could result in impairment losses as well as increased unrealized losses on other securities. Losses in the Colombian equity markets could result in further losses from impairment or sale of these securities as well as increases in unrealized losses. Any significant increases in exposure to any of these non-traditional risks, or a significant increase in credit risk or bankruptcy of any of the counterparties, could materially and adversely affect our results of operations and financial condition.

Capital Markets - Risk 3

Exchange rate volatility may adversely affect the Colombian economy, the market price of the ADSs and the dividends payable to holders of the ADSs.

Pursuant to Colombian law, the Colombian Central Bank has the power to intervene in the exchange market in order to consolidate or dispose of international reserves, as well as to control any volatility in the exchange rate, acting through a variety of mechanisms, including discretionary ones. During recent years, the Colombian Central Bank has employed a floating exchange rate system with periodic interventions. From time to time, there have been significant fluctuations in the exchange rate between the Colombian peso and the U.S. dollar. For example, the peso depreciated 8.9% against the U.S. dollar in 2018, appreciated 0.6% in 2017, appreciated 4.7% in 2016, depreciated 31.6% in 2015 and depreciated 24.2% in 2014. Unforeseen events in international markets, fluctuations in interest rates, changes in capital flows, political developments or inflation rates may cause exchange rate instability that could, in turn, depress the value of the Colombian peso, thereby decreasing the U.S. dollar value of the dividends paid to holders of the ADSs.

Ability to Sell

Total Risks: 6/74 (8%)Above Sector Average

Competition2 | 2.7%

Competition - Risk 1

Competition and consolidation in the Colombian and Central American banking and financial industry could adversely affect our market position.

We operate in a competitive market. Since the 1990s, when the Colombian financial system was deregulated, there has been an ongoing process of consolidation that has included foreign bank participants entering the Colombian market. We expect that consolidation will lead to the creation of larger local financial institutions, including additional foreign banks, presenting the risk that we could lose a portion of our market share in the industry, adversely affecting our results of operations. Various banking institutions, which have recently been incorporated in Colombia, target the microcredit and small and medium enterprises segments. Local subsidiaries of international financial institutions have entered the market targeting corporate clients. The businesses of these new credit institutions may affect our market position in the individual, small and medium enterprises and our merchant banking operation. To a lesser extent, we also face competition from non-bank competitors, such as brokerage companies, department stores (for some credit products), cooperatives, leasing and factoring companies, mutual fund and pension fund management companies and insurance companies. In addition, the pace of consolidation in the Colombian and Central American financial services industry has increased, which may also increase competition in the markets where we operate. See "Item 4. Information on the Company-B. Business overview-Competition". Furthermore, our banking subsidiaries may face challenges as new competitors enter the market or existing competitors may adjust their services with unique product or service offerings or approaches to providing banking services. New entrants could take advantage of regulatory arbitrage to compete with substantially lower cost structures. Non-traditional providers of banking services, such as Internet based e-commerce providers, mobile telephone companies, internet search engines and crowd-funding websites may offer and/or increase their offerings of financial products and services directly to customers. Several of these competitors may have long operating histories, large customer bases, strong brand recognition and significant financial, marketing and other resources. Technological advances and heightened e-commerce activities have increased consumers' access to products and services, which has in turn intensified competition among banks and nonbanks in offering loans. Existing competitors and market entrants may adopt more aggressive pricing and rates and devote more resources to technology, infrastructure and marketing. If we are unable to successfully compete with current and new competitors, or if we are unable to anticipate and adapt our offerings to changing banking industry trends, including innovation, digitalization and technological changes, our business may be adversely affected. Our ability to maintain our competitive position depends mainly on our ability to anticipate and fulfill the needs of new and current customers through the development of innovative services and products, and our ability to offer adequate services and strengthen our customer base through cross-selling. Our failure to effectively anticipate or adapt to emerging technologies or changes in customer behavior, including among younger customers, could delay or prevent our access to new digital-based markets which would in turn have an adverse effect on our competitive position and business. Our efforts to offer new services and products may not succeed if product or market opportunities develop more slowly than expected or if the profitability of these opportunities is undermined by competitive pressures. As we expand the range of our products and services, some of which may be at an early stage of development in the Colombian and Central American market, we will be exposed to new and potentially increasingly complex risks and development expenses. Our employees and our risk management systems may not be adequate to handle such risks. In addition, the cost of developing products that are not launched is likely to affect our results of operations. Any or all these factors, individually or collectively, could have a material adverse effect on us.

Competition - Risk 2

The credit card industry is highly competitive and entails significant risks, including the possibility of overindebtedness of customers, which could have a material adverse effect on us.

The credit card business is subject to a number of risks and uncertainties, including the possibility of overindebtedness of our customers, despite our focus on low-risk, middle- and high-income customers. The credit card industry is characterized by higher consumer default than other segments of the credit markets, and defaults are highly related to macroeconomic indicators that are beyond our control. Part of our current growth strategy is to increase volume and number of cards in the credit card portfolio, at the same or a higher rate than the market, which may increase our exposure to risk in our loan portfolio. If Colombian and Central American economic growth rate slows or turns negative, or if we fail to effectively analyze the creditworthiness of our customers (including the targeting of certain sectors), we may be faced with unexpected losses that could have an adverse effect on our results of operations and financial condition.

Demand1 | 1.4%

Demand - Risk 1

Most of Corficolombiana's investments are concentrated in five industries.

The majority of Corficolombiana's investment portfolio is concentrated in the energy and gas, infrastructure, agribusiness, hotels and financial services. Energy and gas and infrastructure account for 86.7% of Corficolombiana's total investment portfolio as of December 31, 2018. During periods of difficult market conditions or slowdowns in these sectors, Corficolombiana may experience decreased revenues, difficulty in obtaining access to financing and increased funding costs.

Sales & Marketing2 | 2.7%

Sales & Marketing - Risk 1

We are subject to market risk in our banking business.

Our bank subsidiaries are directly and indirectly affected by changes in market conditions. Market risk, or the risk that the value of assets and liabilities or revenues will be adversely affected by variation in market conditions, is inherent in the products and instruments associated with our operations, including loans, deposits, securities, bonds, long-term debt, short-term borrowings, proprietary trading in assets and liabilities and derivatives. Changes in market conditions that may affect our financial condition and results of operations include fluctuations in interest and currency exchange rates, securities prices, changes in the implied volatility of interest rates and foreign exchange rates, among others.

Sales & Marketing - Risk 2

Our ability to make payments on the ADSs may be adversely affected if we become unable to convert Colombian pesos to U.S. dollars or to transfer U.S. dollars abroad.

The Colombian government does not currently restrict the ability of Colombian persons or entities to convert Colombian pesos to U.S. dollars. However, the government may impose foreign exchange controls on dividend payments and remittances of interest and principal if the foreign currency reserves of the Central Bank fall below a level equal to the value of three months of imports into Colombia. Colombian law also allows the imposition of a deposit requirement with the Central Bank in connection with any foreign exchange transaction that may increase the cost of foreign exchange transactions or limit the amount of such transactions for a particular time. No such foreign exchange controls are currently applicable. Nevertheless, such restrictions may be imposed in the future, and any such restrictions could prevent, restrict or increase the price of our access to U.S. dollars, which we need to pay our foreign currency-denominated obligations.

Brand / Reputation1 | 1.4%

Brand / Reputation - Risk 1

Changed

We are subject to reputational risk, and our reputation is closely tied to that of our controlling shareholder, our senior management and members of the Board of Directors, and that of our subsidiaries.

Damage to our reputation may limit our ability to attract customers, employees and investors. Harm to our reputation can arise from employee or former employee misconduct, legal and regulatory non-compliance, ethical issues, allegations of money laundering, and failing to deliver minimum standards of service and quality, among others. In particular, our success has been attributable, in part, to the high esteem in which our controlling shareholder Mr. Sarmiento Angulo, our president, Mr. Sarmiento Gutiérrez and our subsidiaries' senior management and members of the Board of Directors are held in Colombia. Reputation plays an integral role in our business operations, which are based on customer confidence and trust. If the public image or reputation of any of the foregoing is damaged as a result of negative publicity or otherwise, business relationships with customers of the entire group may deteriorate, which would adversely affect our results of operations and financial condition. Any perceived or real difficulties experienced by any one of our subsidiaries would harm the reputation of Grupo Aval as a whole, which would also have an adverse effect on our results of operations and financial condition.

Production

Total Risks: 3/74 (4%)Below Sector Average

Manufacturing1 | 1.4%

Manufacturing - Risk 1

We are subject to operational risks.

Our business depends on the ability of our banking subsidiaries to process large numbers of transactions efficiently and accurately. Operational risks and losses can result from fraud, employee error, failure to properly document transactions or to obtain proper internal authorization, failure to comply with regulatory requirements, breaches of conduct of business rules, equipment failures, natural disasters or the failure of external systems, among others. Our, and our banking subsidiaries' currently adopted procedures may not be effective in controlling each of the operational risks faced by our banking subsidiaries.

Employment / Personnel2 | 2.7%

Employment / Personnel - Risk 1

We depend on our senior management and our Board of Directors, and the loss of their services could have an adverse effect on our business.

We are highly dependent on our senior management teams and Board of Directors at both the group and subsidiary levels, all of whom possess considerable experience and expertise and have strong relationships with customers, participants of the Colombian business. The loss of the services of any of these members of our, or our subsidiaries', senior management and members of the Board of Directors, could have an adverse effect on our business. Accordingly, our success is dependent on appropriately managing the risks related to executing a succession plan for senior management and members of the Board of Directors on a timely basis.

Employment / Personnel - Risk 2

We depend on BAC Credomatic's current senior management, and the loss of their services could have a material adverse effect on BAC Credomatic's business.

We have retained most of the senior management of BAC Credomatic, who have worked on average over 15 years at BAC Credomatic. The loss of services of any of BAC Credomatic's senior officers could have an adverse effect on BAC Credomatic's business.

Tech & Innovation

Total Risks: 2/74 (3%)Below Sector Average

Cyber Security1 | 1.4%

Cyber Security - Risk 1

We are subject to cybersecurity threats.

We and our subsidiaries are highly dependent on information systems to process transactions, respond to customer queries in a timely manner, operate our technological infrastructure and maintain profitable operations across the jurisdictions in which we operate. Cybersecurity risks for financial institutions such as ourselves have increased significantly due to the proliferation of new technologies, the use of the Internet and automated processes, the diversification of channels to perform financial transactions, hand in hand with the development of new techniques of organized crime, hackers, hacktivists, terrorists and other external parties. In addition, we are introducing new products and services, such as our digital channels, that are changing processes, which may result in new operational risks that we may not fully appreciate or identify. As a result, we and our subsidiaries are susceptible to malware, ransomware, computer hackers, disgruntled employees and other causes that could affect the IT infrastructure that supports our service channels. In particular, specialized and highly coordinated attacks have proliferated in the financial sector, in Latin America particularly, over the last year. We and our subsidiaries devote significant resources to maintaining and regularly upgrading our systems to implement technology that protects our networks against cyber-attacks. For example, we have implemented risk analysis processes and controls and have developed specialized teams in care and response to incidents (Computer Security Incident Response Team - CSIRT) to handle incidents and emergencies. These teams work in a coordinated manner in the face of joint threats. Although we have experienced cyber-attacks in the past, such as malware and ransomware infections, which have required immediate attention from CSIRT and resulted in some temporary interruptions to non-operational areas, these attacks have not had a material impact on our business. There can be no assurance that any future cyber-attacks will not occur, or how frequent such attacks could occur and what effect such events or perceived events could have on our business. We also outsource certain services and, although we require that our service providers adhere to our security standards, we cannot assure you that any of our service providers will not experience cyber-attacks that would affect the provision of our services or interrupt our business. In the event of a breakdown or improper operation of our or a third party's systems or improper or unauthorized action by third parties or our employees, we could suffer financial loss, an impairment to our liquidity, a disruption of our businesses, regulatory sanctions or damage to our reputation. While many of our agreements with third party vendors include indemnification provisions, we may not be able to recover sufficiently, or at all, to adequately offset any losses. Furthermore, although we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. If one or more of these events occur, it could result in a security impact on our systems and jeopardize our or subsidiaries customers', or counterparties' personal, confidential, proprietary or other information processed, stored in, and transmitted through our and our third-party providers' computer systems. Furthermore, such events could cause interruptions or malfunctions in our or our subsidiaries customers', counterparties' or third parties' operations, which could result in reputational damage with our or our subsidiaries customers', reduced demand for our services and products, additional costs to us (such as repairing systems, adding new personnel or technologies), regulatory investigations, litigation or enforcement, or regulatory fines or penalties, all or any of which could adversely affect our business, financial condition or results of operation. Given the increasing sophistication of cyber-attacks, a cyber-attack could occur and persist for an extended period of time without detection. We expect that any investigation of a cyber-attack would be inherently unpredictable and that it would take time before such investigation is completed. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which would further increase the costs and consequences of a cyber-attack. More generally, publicized information concerning security and cyber related problems could inhibit the use or growth of electronic or web-based applications or solutions as means of conducting commercial transactions. Such publicity may also cause damage to our reputation. As a result of any of the above, our business, financial condition or results of operations, and reputation could be adversely affected.

Technology1 | 1.4%

Technology - Risk 1

Failure of our information systems could materially and adversely affect the effectiveness of our risk management and internal control processes as well as our results of operations and financial condition.

We and our subsidiaries are highly dependent on the ability to collect and process, on a timely basis, a large amount of financial and other information, and services and products, at a time when transaction processes have become more complex with increasing volumes. A partial or complete failure of any of these systems could materially and adversely affect our decision-making process, risk management and internal control systems as well as our ability to respond on a timely basis to changing market conditions. In addition, Grupo Aval's and our subsidiaries' ability to remain competitive will depend in part on our ability to upgrade our IT infrastructure and implement digitalization of products and services on a timely and cost-effective basis. We and our subsidiaries must continually make significant investments and improvements in our and their IT infrastructure in order to ensure the proper functioning of financial control, accounting and other data collection and processing systems and to remain competitive. In addition, as our banking subsidiaries open new branches and channels, they will need to improve their IT infrastructure, including maintaining and upgrading their software and hardware systems and their back-office operations. If there are technological impediments, unforeseen complications, errors or breakdowns in implementing new systems, our business, financial condition or results of operations may be adversely affected.

See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.

FAQ

What are “Risk Factors”?

Risk factors are any situations or occurrences that could make investing in a company risky.

The Securities and Exchange Commission (SEC) requires that publicly traded companies disclose their most significant risk factors. This is so that potential investors can consider any risks before they make an investment.

They also offer companies protection, as a company can use risk factors as liability protection. This could happen if a company underperforms and investors take legal action as a result.

It is worth noting that smaller companies, that is those with a public float of under $75 million on the last business day, do not have to include risk factors in their 10-K and 10-Q forms, although some may choose to do so.

How do companies disclose their risk factors?

Publicly traded companies initially disclose their risk factors to the SEC through their S-1 filings as part of the IPO process.

Additionally, companies must provide a complete list of risk factors in their Annual Reports (Form 10-K) or (Form 20-F) for “foreign private issuers”.

Quarterly Reports also include a section on risk factors (Form 10-Q) where companies are only required to update any changes since the previous report.

According to the SEC, risk factors should be reported concisely, logically and in “plain English” so investors can understand them.

How can I use TipRanks risk factors in my stock research?

Use the Risk Factors tab to get data about the risk factors of any company in which you are considering investing.

You can easily see the most significant risks a company is facing. Additionally, you can find out which risk factors a company has added, removed or adjusted since its previous disclosure. You can also see how a company’s risk factors compare to others in its sector.

Without reading company reports or participating in conference calls, you would most likely not have access to this sort of information, which is usually not included in press releases or other public announcements.

A simplified analysis of risk factors is unique to TipRanks.

What are all the risk factor categories?

TipRanks has identified 6 major categories of risk factors and a number of subcategories for each. You can see how these categories are broken down in the list below.

1. Financial & Corporate

Accounting & Financial Operations - risks related to accounting loss, value of intangible assets, financial statements, value of intangible assets, financial reporting, estimates, guidance, company profitability, dividends, fluctuating results.
Share Price & Shareholder Rights – risks related to things that impact share prices and the rights of shareholders, including analyst ratings, major shareholder activity, trade volatility, liquidity of shares, anti-takeover provisions, international listing, dual listing.
Debt & Financing – risks related to debt, funding, financing and interest rates, financial investments.
Corporate Activity and Growth – risks related to restructuring, M&As, joint ventures, execution of corporate strategy, strategic alliances.

2. Legal & Regulatory

Litigation and Legal Liabilities – risks related to litigation/ lawsuits against the company.
Regulation – risks related to compliance, GDPR, and new legislation.
Environmental / Social – risks related to environmental regulation and to data privacy.
Taxation & Government Incentives – risks related to taxation and changes in government incentives.

3. Production

Costs – risks related to costs of production including commodity prices, future contracts, inventory.
Supply Chain – risks related to the company’s suppliers.
Manufacturing – risks related to the company’s manufacturing process including product quality and product recalls.
Human Capital – risks related to recruitment, training and retention of key employees, employee relationships & unions labor disputes, pension, and post retirement benefits, medical, health and welfare benefits, employee misconduct, employee litigation.

4. Technology & Innovation

Innovation / R&D – risks related to innovation and new product development.
Technology – risks related to the company’s reliance on technology.
Cyber Security – risks related to securing the company’s digital assets and from cyber attacks.
Trade Secrets & Patents – risks related to the company’s ability to protect its intellectual property and to infringement claims against the company as well as piracy and unlicensed copying.

5. Ability to Sell

Demand – risks related to the demand of the company’s goods and services including seasonality, reliance on key customers.
Competition – risks related to the company’s competition including substitutes.
Sales & Marketing – risks related to sales, marketing, and distribution channels, pricing, and market penetration.
Brand & Reputation – risks related to the company’s brand and reputation.

6. Macro & Political

Economy & Political Environment – risks related to changes in economic and political conditions.
Natural and Human Disruptions – risks related to catastrophes, floods, storms, terror, earthquakes, coronavirus pandemic/COVID-19.
International Operations – risks related to the global nature of the company.
Capital Markets – risks related to exchange rates and trade, cryptocurrency.

Become an Expert with TipRanks Premium

What am I Missing?

Make informed decisions based on Top Analysts' activity

Know what industry insiders are buying

Get actionable alerts from top Wall Street Analysts

Find out before anyone else which stock is going to shoot up

Get powerful stock screeners & detailed portfolio analysis

Subscribe Now See Plans & Pricing