# EDGAR Filing Document

**Accession Number:** 0001132597
**File Stem:** 0001132597-26-000058
**Filing Date:** 2026-2
**Character Count:** 227920
**Document Hash:** 9ce4973ed87434b2eba5540c8c8f301f
**Contains OCR:** False
**Source Format:** 

## Filing Content

## Filing Summary
**0001132597-26-000058.hdr.sgml**: 20260206

**ACCESSION NUMBER**: 0001132597-26-000058

**CONFORMED SUBMISSION TYPE**: 6-K

**PUBLIC DOCUMENT COUNT**: 82

**CONFORMED PERIOD OF REPORT**: 20260205

**FILED AS OF DATE**: 20260206

**DATE AS OF CHANGE**: 20260206

**FILER**: 

**COMPANY DATA:**
- **COMPANY CONFORMED NAME:** Itau Unibanco Holding S.A.
- **CENTRAL INDEX KEY:** 0001132597
- **STANDARD INDUSTRIAL CLASSIFICATION:** STATE COMMERCIAL BANKS [6022]
- **ORGANIZATION NAME:** 02 Finance
- **EIN:** 000000000
- **STATE OF INCORPORATION:** D5
- **FISCAL YEAR END:** 1231

**FILING VALUES:**
- **FORM TYPE:** 6-K
- **SEC ACT:** 1934 Act
- **SEC FILE NUMBER:** 001-15276
- **FILM NUMBER:** 26606511

**BUSINESS ADDRESS:**
- **STREET 1:** PC. ALFREDO EGYDIO DE SOUZA ARANHA, 100
- **STREET 2:** TORRE AE, 3 ANDAR, CEP 04344-902
- **CITY:** SAO PAULO
- **STATE:** D5
- **ZIP:** 00000
- **BUSINESS PHONE:** 55-11-5019-1723

**MAIL ADDRESS:**
- **STREET 1:** PC. ALFREDO EGYDIO DE SOUZA ARANHA, 100
- **STREET 2:** TORRE AE, 3 ANDAR, CEP 04344-902
- **CITY:** SAO PAULO
- **STATE:** D5
- **ZIP:** 00000

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** Itau Unibanco Banco Multiplo S.A.
- **DATE OF NAME CHANGE:** 20090226

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** BANCO ITAU HOLDING FINANCEIRA S A
- **DATE OF NAME CHANGE:** 20030319

**FORMER COMPANY:**
- **FORMER CONFORMED NAME:** BANCO ITAU SA
- **DATE OF NAME CHANGE:** 20010117

---

| | |
|:---|:---|
| **UNITED STATES** | **UNITED STATES** |
| **SECURITIES AND EXCHANGE COMMISSION** | **SECURITIES AND EXCHANGE COMMISSION** |
| **Washington, D.C. 20549** | **Washington, D.C. 20549** |
| **FORM 6-K** | **FORM 6-K** |
| **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** | **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** |
| **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** | **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** |
| **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** | **Report of Foreign Issuer<br>Pursuant to Rule 13a-16 or 15d-16<br>of the Securities Exchange Act of 1934** |
| **For the month of February, 2026** | **For the month of February, 2026** |
| **Comission File Number: 001-15276** | **Comission File Number: 001-15276** |
| **Itaú Unibanco Holding S.A.** | **Itaú Unibanco Holding S.A.** |
| (Exact name of registrant as specified in its charter) | (Exact name of registrant as specified in its charter) |
| **Itaú Unibanco Holding S.A.** | **Itaú Unibanco Holding S.A.** |
| (Translation of Registrant's Name into English) | (Translation of Registrant's Name into English) |
| **Praça Alfredo Egydio de Souza Aranha, 100 - Torre Conceição** | **Praça Alfredo Egydio de Souza Aranha, 100 - Torre Conceição** |
| **CEP 04344-902 São Paulo, SP, Brazil<br>(Address of principal executive office)** | **CEP 04344-902 São Paulo, SP, Brazil<br>(Address of principal executive office)** |
| **CEP 04344-902 São Paulo, SP, Brazil<br>(Address of principal executive office)** | **CEP 04344-902 São Paulo, SP, Brazil<br>(Address of principal executive office)** |
| Indicate by check mark whether the registrant files or will file annual reports under cover Form 20-F or Form 40-F. | Indicate by check mark whether the registrant files or will file annual reports under cover Form 20-F or Form 40-F. |
| Form 20-F ☒ | &nbsp;&nbsp;&nbsp;&nbsp; Form 40-F ☐ |
| Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1): | Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(1): |
| Yes ☐ | &nbsp;&nbsp;&nbsp;&nbsp;No ☒ |
| Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7): | Indicate by check mark if the registrant is submitting the Form 6-K in paper as permitted by Regulation S-T Rule 101(b)(7): |
| Yes ☐ | &nbsp;&nbsp;&nbsp;&nbsp;No ☒ |
| Indicate by check mark whether by furnishing the information contained in this Form, the registrant is also thereby furnishing information to the Commission pursuant to Rule 12g3-2(b) under the Securities Exchange Act of 1934. | Indicate by check mark whether by furnishing the information contained in this Form, the registrant is also thereby furnishing information to the Commission pursuant to Rule 12g3-2(b) under the Securities Exchange Act of 1934. |
| Yes ☐ | &nbsp;&nbsp;&nbsp;&nbsp;No ☒ |
| If "Yes" is marked, indicate below the file number assigned to the registrant in connection with Rule 12g3-2(b): | If "Yes" is marked, indicate below the file number assigned to the registrant in connection with Rule 12g3-2(b): |
| 82– __________________ | 82– __________________ |

---

------

**EXHIBIT INDEX**

---

| | |
|:---|:---|
| **99.1** | <u>[ITAÚ UNIBANCO - Risk and Capital Management - Pillar 3](riskandcapitalmanagement.htm)</u> |

---

------

.

---

| |
|:---|
| &nbsp;&nbsp;Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized. |
| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Date: February 4, 2026. |
| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;**Itaú Unibanco Holding S.A.**<br>By: /s/ Gustavo Lopes Rodrigues<br>Name: Gustavo Lopes Rodrigues<br>Title: Investor Relations Officer. |

---

## Exhibit 99.1

![](riskandcapitalmanagement001.jpg)

Risk and Capital Management - Pillar 3 Itaú Unibanco Holding S.A. Fourth Quarter of 2025

------

![](riskandcapitalmanagement002.jpg)

Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 4 Scope and main characteristics of risk management 4 Risk and Capital Governance 4 Risk Culture 6 Risk Appetite 7 Stress Testing 8 Recovery Plan 9 Capital Adequacy Assessment 10 Capital Adequacy 10 OV1: Overview of risk-weighted assets (RWA) 11 Links between financial statements and regulatory exposures 12 LIA: Explanations of differences between accounting and regulatory exposure amounts 12 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories 13 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements 13 PV1: Prudent valuation adjustments (PVA) 14 Institutions that comprise the Financial Statement of Itaú Unibanco Holding 14 Non Consolidated Institutions 18 Material Entities 18 Composition of Capital 18 CCA: Main features of regulatory capital instruments 18 CC1: Composition of regulatory capital 20 CC2: Reconciliation of regulatory capital to balance sheet 22 Macroprudential Indicators 23 CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer 23 GSIB1: Disclosure of G-SIB indicators 23 Leverage Ratio 23 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 24 LR2: Leverage ratio common disclosure 24 Liquidity Ratios 25 LIQA: Liquidity Risk Management Information 25 Framework and Treatment 25 LIQ1: Liquidity Coverage Ratio (LCR) 26 LIQ2: Net Stable Funding Ratio (NSFR) 27 Credit Risk 28 CRA: Qualitative information on credit risk management 28 CR1: Credit Quality of Assets 29 CR2: Changes in Stock of defaulted loans and debts securities 30 CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation 30 Exposure by industry 30 Exposure by remaining maturity 31 Overdue exposures 31

------

![](riskandcapitalmanagement003.jpg)

Exposure by geographical area in Brazil and by country 31 Largest debtors exposures 31 Restructured exposures 32 CRC: Qualitative disclosure related to Credit Risk Mitigation techniques 32 CR3: Credit Risk mitigation techniques – overview 33 CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects 34 CR5: Standardized Approach – exposures by asset classes and risk weights 36 CRE: Qualitative disclosure related to IRB models 38 CR6: IRB – Credit risk exposures by portfolio and PD range 41 CR7: IRB – Effect on RWA of credit derivatives used as CRM techniques 42 CR8: RWA flow statements of credit risk exposures under IRB 42 CR9: IRB – Backtesting of probability of default (PD) per portfolio 43 CMS1: Comparison of modelled and standardised RWA at risk level 44 CMS2: Comparison of modelled and standardised RWA for credit risk at asset class level 45 Counterparty Credit Risk (CCR) 45 CCRA: Qualitative disclosure related to CCR 45 CCR1: Analysis of CCR exposures by approach 46 CCR3: Standardized approach – CCR exposures by regulatory portfolio and risk weights 46 CCR5: Composition of collateral for CCR exposures 46 CCR6: CCR associated with credit derivatives exposures 47 CCR8: CCR associated with Exposures to central counterparties 47 Securitization Exposures 47 SECA: Qualitative disclosure requirements related to securitisation exposures 47 SEC1: Securitisation exposures in the banking book 48 SEC2: Securitisation exposures in the trading book 48 SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor 48 SEC4: Securitisation exposures in the banking book and associated capital requirements – bank acting as investor 48 Market Risk 49 MRA: Qualitative disclosure requirements related to market risk 49 MR1: Market risk under standardized approach 51 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 52 MR2: RWA flow statements of market risk exposures under an IMA 54 Exposures subject to market risk 54 MR3: IMA values for trading portfolios 55 MR4: Comparison of VaR estimates with gains/losses 55 Backtesting 55 Total Exposure associated with Derivatives 56 IRRBB 56 IRRBBA: IRRBB risk management objectives and policies 56 Framework and Treatment 57 IRRBB1 – Quantitative information on IRRBB 59

------

![](riskandcapitalmanagement004.jpg)

ORA – Qualitative Information on Operational Risk Management 60 OR1: Historical Operational Losses 61 OR2: Composition of Business Indicator (BI) 62 OR3: Capital Requirement for Operational Risk 62 Other Risks 63 Insurance products, pension plans and premium bonds risks 63 Social, Environmental and Climatic Risks 63 Model Risk 65 Regulatory or Compliance Risk 65 Reputational Risk 65 Cyber Risk 67 Country Risk 67 Business and Strategy Risk 68 Contagion Risk 68 Emerging Risks 68 Operational Risk 69 Crisis Management and Operational Resilience 69 Independent Validation of Risk Models 70 Glossary of Acronyms 71 Glossary of Regulations 74

------

![](riskandcapitalmanagement005.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 1 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Resolution BCB nº 54 and subsequent amendments, which addresses the disclosure of information on risks and capital management, the comparison between accounting and prudential information, the liquidity and market risk indicators, the calculation of risk-weighted assets (RWA), the calculation of the Total Capital ("Patrimônio de Referência" - PR), and the compensation of management members. 1 The referred Resolution brought several amendments in the disclosure format of the Pillar 3 information, besides changes in the scope and frequency of the information disclosed. All these amendments, implemented by the Central Bank, aim the convergence of the Brazilian financial regulation to the recommendations of the Basel Committee, seeking to harmonize the information disclosed by financial institutions at an international level, and taking into account the structural conditions of the Brazilian economy. The disclosure policy of the Risk and Capital Management Report presents the guidelines and responsibilities of the areas involved in its preparation, as well as the description of the information that must be disclosed and the integrity endorsement and approval governance, as established by the article 56 of the Resolution nº. 4,557. Key indicators Itaú Unibanco's risk and capital management focuses on maintaining the institution in line with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on December 31, 2025, are summarized below. Common Equity Tier I Ratio Tier I Ratio Total Capital Ratio 12.3% 13.8% 15.2% September 30, 2025 13.5% September 30, 2025 14.8% September 30, 2025 16.4% Common Equity Tier I Tier I Total Capital In R$ million In R$ million In R$ million R$185,595 R$208,161 R$228,589 September 30, 2025 R$195,917 September 30, 2025 R$215,466 September 30, 2025 R$238,430 RWA In R$ million R$1,505,475 September 30, 2025 R$1,454,242

------

![](riskandcapitalmanagement006.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 2 Prudential Metrics and Risk Management Itaú Unibanco invests in robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. The key prudential metrics related to regulatory capital and information on the bank's integrated risk management are presented below. KM1: Key metrics at consolidated level In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, as demonstrated by the Common Equity Tier I, Tier I Capital and Total CapitaI ratios. On December 31, 2025, the Total Capital (PR) reached R$228,589 million, R$208,161 million of Tier I and R$20,428 million of Tier II.

------

![](riskandcapitalmanagement007.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 3 a b c d e R$ million 12/31/2025 09/30/2025 06/30/2025 03/31/2025 12/31/2024 Available capital (amounts) Common Equity Tier 1 (CET1) 185,595 195,917 188,389 180,611 188,265 Common Equity Tier I (CET1) corresponds to line 1 deducting, as applicable, the amount established by: art. 4, caput, item I, paragraph "i", and §§ 8 and 9, of CMN Resolution no. 4.955, of October 21, 2021; or art. 3, caput, item I, paragraph "i", §§ 8 and 9, of BCB Resolution no. 199, of March 11, 2022. 185,552 195,874 188,346 180,568 188,265 Tier 1 208,161 215,466 215,381 202,344 206,196 Tier 1 considering the calculation of Principal Capital according to line 1a 208,118 215,423 215,338 202,301 206,196 Total capital 228,589 238,430 237,454 224,092 227,602 Total Capital considering the calculation of Common Equity Tier I according to line 1a 228,546 238,387 237,411 224,049 227,602 Excess of capital committed to ajusted permanent assets - - - - - Excess of resources invested in permanent assets considering Total Capital according to line 3a - - - - - Total capital detached - - - - - Risk-weighted assets (amounts) Total risk-weighted assets (RWA) 1,505,475 1,454,242 1,436,344 1,430,630 1,379,056 RWA corresponds to line 4 deducting, as applicable, the amount referring to item XII of the caput of art. 4 weighted by the Risk Weighting Factor (FPR) established in art. 82-A, both commands of Resolution 229 of May 12, 2022. 1,505,432 1,454,199 1,436,301 1,430,587 1,379,056 Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (%) 12.3% 13.5% 13.1% 12.6% 13.7% Common Equity Tier 1 ratio (CET1) considering: Numerator: corresponds to line 1a; Denominator: corresponds to line 4b 12.3% 13.5% 13.1% 12.6% 13.7% Tier 1 ratio (%) 13.8% 14.8% 15.0% 14.1% 15.0% Tier 1 ratio, considering: Numerator: corresponds to line 2a; Denominator: corresponds to line 4b 13.8% 14.8% 15.0% 14.1% 15.0% Total capital ratio (%) 15.2% 16.4% 16.5% 15.7% 16.5% Total capital ratio, considering: Numerator: corresponds to line 3a; Denominator: corresponds to line 4b 15.2% 16.4% 16.5% 15.7% 16.5% Additional CET1 buffer requirements as a percentage of RWA Capital conservation buffer requirement (%) 2.5% 2.5% 2.5% 2.5% 2.5% Countercyclical buffer requirement (%) (1) 0.1% 0.1% 0.1% 0.1% 0.1% Bank G-SIB and/or D-SIB additional requirements (%) 1.0% 1.0% 1.0% 1.0% 1.0% Total of bank CET1 specific buffer requirements (%) (2) 3.6% 3.6% 3.6% 3.6% 3.6% CET1 available after meeting the bank's minimum capital requirements (%) 3.6% 4.8% 5.0% 4.1% 4.9% CET1 available after meeting the bank's minimium capital requirements (%) considering CET1 as per line 1a 3.6% 4.8% 5.0% 4.1% 4.9% Basel III leverage ratio Total Basel III leverage ratio exposure measure 2,983,477 2,921,612 2,855,121 2,710,449 2,805,181 Total Basel III leverage ratio exposure measure corresponds to line 13 deducting, as applicable, the amount referring to item XII of the caput of art. 4 of Resolution 229 of May 12, 2022. 2,983,434 2,921,569 2,855,078 2,710,406 2,805,181 Basel III leverage ratio (%) 7.0% 7.4% 7.5% 7.5% 7.4% Basel III leverage ratio (%) considering: i. Numerator: corresponds to line 2a; ii. Denominator: corresponds to line 13a 7.0% 7.4% 7.5% 7.5% 7.4% Liquidity Coverage Ratio Total high-quality liquid assets (HQLA) 389,723 367,777 346,084 340,855 362,609 Total net cash outflow 181,290 168,176 161,856 173,512 163,863 LCR (%) 215.0% 218.7% 213.8% 196.4% 221.3% Net Stable Funding Ratio Total available stable funding 1,499,680 1,408,603 1,393,627 1,362,350 1,375,854 Total required stable funding 1,202,060 1,142,829 1,150,712 1,114,206 1,127,870 NSFR (%) 124.8% 123.3% 121.1% 122.3% 122.0% 1) The countercyclical capital buffer is fixed by the monetary authorities of the jurisdictions in which Itaú has exposure, the most relevant of which are Brazil, where the Financial Stability Committee (Comef) sets it at zero (BACEN Communiqué No. 43.228/25) and Chile, which is set at 0.5%. 2) The BACEN rules establish Capital Buffers, that corresponds to the sum of the Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,958.

------

![](riskandcapitalmanagement008.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 4 The Basel Index reached 15.2% on December 31, 2025, a decrease of 1.2 p.p. compared to September 30, 2025, due to the payment of dividends and interest on equity, share buybacks, and the growth of risk-weighted assets, partially offset by the positive impact of the period's result Besides, Itaú Unibanco has a R$108,151 million capital excess in relation to its minimum required Total Capital. It corresponds to 7,2 p.p. above the minimum requirement (8%) and higher than the Capital Buffer requirement of (R$53,686 million). Considering the Capital Buffers, the capital excess would be 3.6 p.p. The fixed assets ratio shows the commitment percentage of adjusted Total Capital with the adjusted permanent assets. Itaú Unibanco falls within the maximum limit of 50% of adjusted Total Capital, established by BACEN. On December 31, 2025, fixed assets ratio reached 19.4%, showing a surplus of R$69,887 million. OVA – Bank risk management approach Scope and Key Features of Risk Management Taking and managing risks is one of Itaú Unibanco's activities, and to do so effectively, the institution must have well-established objectives for risk management. In this context, the Risk Appetite articulates the set of guidelines from the Board of Directors (BoD) regarding strategy and risk-taking, defining the nature and level of acceptable risks for the organization, while the risk culture guides the necessary attitudes for managing them. Itaú Unibanco invests in robust risk and capital management processes that permeate the entire institution and form the foundation for strategic decisions to ensure business sustainability and maximize shareholder value. Among the processes for proper risk and capital management, the following stand out: the implementation of a continuous and integrated risk management framework; the Risk Appetite Framework, which consists of the Risk Appetite Statement (RAS) from the BoD, the Risk Appetite Policy, and a set of metrics for monitoring key risks according to defined limits; the stress testing program; the establishment of a Risk Committee; and the appointment, before the Central Bank of Brazil (BACEN), of a Chief Risk Officer (CRO) with clearly defined roles, responsibilities, and independence requirements. These processes are aligned with the guidelines of the BoD and Executives, who, through collegiate bodies, define global objectives expressed in goals and limits for the risk-managing business units. The capital control and management units, in turn, support Itaú Unibanco's management through risk and capital monitoring and analysis processes. The principles that underpin risk management, Risk Appetite, and the guidelines for how Itaú Unibanco employees should act in their daily decision-making are: • Sustainability and customer satisfaction: Itaú Unibanco's vision is to be the leading bank in sustainable performance and customer satisfaction. Therefore, it is committed to generating shared value for employees, customers, shareholders, and society, ensuring business continuity. Itaú Unibanco is focused on conducting business that benefits both the customer and the institution. • Risk culture: The institution's risk culture goes beyond policies, procedures, and processes, aiming to strengthen the individual and collective responsibility of all employees to do the right thing, at the right time, and in the right way, respecting ethical business practices. It is based on four principles (conscious risk-taking, discussion and action on institutional risks, and everyone's responsibility for risk management), which encourage open understanding and discussion of risks, keeping them within the levels determined by the Risk Appetite, and ensuring that each employee, regardless of position, area, or function, also assumes responsibility for managing the risks of their business. The Risk Culture is detailed in the "Risk Culture" section.

------

![](riskandcapitalmanagement009.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 5 • Risk Pricing: Itaú Unibanco operates and assumes risks in businesses that are well-known and understood, avoiding risks in which it lacks knowledge or competitive advantage, carefully evaluating the risk-return relationship. • Diversification: The institution has a low appetite for volatility in results and therefore operates on a diversified base of customers, products, and businesses, seeking risk differentiation and prioritizing less risky ventures. • Operational excellence: Itaú Unibanco aims to be an agile bank with robust and stable infrastructure to offer high-quality services. • Ethics and respect for regulations: For Itaú Unibanco, ethics are non-negotiable. The institution promotes an environment of integrity, guiding all employees to cultivate ethics in relationships and business and respect regulations, safeguarding the institution's reputation. Risk and Capital Governance The Board of Directors is the highest authority responsible for establishing guidelines, policies, and limits for risk and capital management. The Risk and Capital Management Committee (CGRC) supports the Board in fulfilling its duties related to risk and capital oversight. At the executive level, collegiate bodies chaired by Itaú Unibanco's Chief Executive Officer (CEO) are responsible for risk and capital management, exercising delegated responsibilities in these areas, and their decisions are monitored within the scope of the CGRC. To support this structure, the Risk Area has specialized departments aimed at ensuring, independently and centrally, that the institution's risks and capital are managed in accordance with established policies and procedures. Itaú Unibanco's risk management organizational structure complies with current regulations in Brazil and abroad. Domestically, the Bank follows the rules established by the Central Bank of Brazil (BACEN), particularly Resolution No. 4,557/17, which addresses the risk and capital management framework for financial institutions, as well as regulations from the Brazilian Securities and Exchange Commission (CVM) and the Private Insurance Superintendence (SUSEP), among other regulators and applicable standards. Internationally, Itaú Unibanco adheres to standards set by the Basel Committee on Banking Supervision, the United States Securities and Exchange Commission (SEC), and local regulations in the countries where it operates. Additionally, Itaú Unibanco complies with guidelines such as the Foreign Account Tax Compliance Act (FATCA), the Principles for Responsible Banking (PRB) of the United Nations Environment Programme – Finance Initiative, and the Guidelines for Multinational Enterprises of the Organization for Economic Cooperation and Development (OECD), among other representative examples. The Bank also adopts practices aligned with International Financial Reporting Standards (IFRS) and globally recognized corporate governance best practices. Furthermore, Itaú Unibanco has a governance framework for identifying and monitoring emerging risks—those newly identified risks with potentially material medium- to long-term impacts on the business, but for which there is still insufficient information for full assessment due to the number of unknown factors and impacts, as they are unprecedented and have not been addressed in the past. Risk management responsibilities at Itaú Unibanco are structured according to the three lines of governance model: • 1st line of governance: Business and corporate support areas are directly responsible for identifying, measuring, assessing, monitoring, reporting, controlling, and mitigating the risks they originate; • 2nd line of governance: The Risk Area aims to ensure, independently and centrally, that the institution's risks are managed according to established policies and procedures, defining parameters for the risk management

------

![](riskandcapitalmanagement010.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 6 process and its supervision. This control provides the BoD and executives with a comprehensive view of Itaú Unibanco's exposures, optimizing and accelerating corporate decision-making; • 3rd line of governance: Internal Audit, which reports to the Board of Directors, conducts independent evaluations of the activities carried out within the institution, enabling senior management to assess the adequacy of controls, the effectiveness of risk management, and compliance with internal policies and regulatory requirements. Itaú Unibanco uses robust, automated systems to fully comply with capital regulations and to measure risks, in accordance with current regulatory models and requirements. It also coordinates actions to ensure compliance with both qualitative and quantitative requirements set by regulators for minimum capital observation and risk monitoring. Ituber Culture Risk management is an intrinsic and transversal element in Ituber culture, which emphasizes the individual responsibility of each employee, regardless of hierarchical level, guiding decisions and attitudes based on ethics and the reduction of risks that may affect the business, customers and society. As an essential part of organizational culture, risk management influences performance evaluation, which considers each employee's alignment with the company's values, with emphasis on the following aspects: • For us, ethics are non-negotiable: integrity permeates all decisions and actions, strengthening risk management • We are driven by results: sustainable growth is prioritized, with attention to the risks and impacts of solutions, ensuring security and long-term vision • We don't have all the answers: decision making is data-driven, enabling risk identification and mitigation • We have each other's back: teamwork and flagging critical issues at the right time are essential to avoid or mitigate risks • We treasure diversity and inclusion: knowledge of socio-environmental opportunities and risks is essential for the development of responsible business. Ituber culture reinforces that risk management is not just a practice, but a value that permeates all dimensions of the business. To understand more about how Ituber culture and risk management support our business, access the Integrated Annual Report. Risk Appetite

------

![](riskandcapitalmanagement011.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 7 The Risk Appetite articulates the set of guidelines from the Board of Directors (BoD) regarding strategy and risk- taking, defining the nature and level of acceptable risks for the organization while considering the capacity for effective and prudent management, strategic objectives, competitive conditions, and the regulatory environment. The Risk Appetite framework consists of the Risk Appetite Statement (RAS) from the BoD, the Risk Appetite Policy, and a set of metrics for monitoring key risks according to defined limits. Considering Itaú Unibanco's strategic guidelines, the Risk Appetite and its dimensions are based on the following statement: "We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital." To make the RAS tangible, the Risk Appetite is organized in six dimensions, each composed of a set of metrics associated with the key risks involved, combining complementary measurement methods to obtain a comprehensive view of our exposures to acceptable types and levels of risk: • Capitalization: Reflects the Bank's level of protection against significant losses that could lead to regulatory non-compliance or insolvency. It establishes that Itaú Unibanco must have sufficient capital to withstand a severe recession or stress event without needing to adjust its capital structure under adverse circumstances. It is monitored through the tracking of Itaú Unibanco's capital ratios under normal and stressed conditions, as well as the institution's debt issuance ratings. • Liquidity: Reflects the Bank's level of protection against a prolonged funding stress period that could lead to a liquidity shortfall and eventual bankruptcy. It establishes that Itaú Unibanco's liquidity must endure extended periods of stress. It is monitored through the tracking of liquidity indicators. • Breakdown of results: Aims to ensure stability and sustainability of results, restricting excessive volatility and avoiding portfolio concentrations and significant deviations in pricing and provisions. It defines that business will primarily focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. It monitors Credit risk indicators, including social, environmental, and climate dimensions, Market and IRRBB risks, Underwriting risks, and Business & Profitability risks. The monitored metrics aim to ensure, through exposure concentration limits (e.g., industry sectors, counterparty quality, countries and geographic regions, and risk factors), an appropriate portfolio composition, targeting low earnings volatility and business sustainability. • Operational risk: Addresses operational risks that could compromise the Bank's business and operations, focusing on controlling events that could negatively impact business strategy and operations. • Reputation: Addresses risks that could impact the value of our brand and the institution's reputation among customers, employees, regulators, investors, and the general public. Risk monitoring in this dimension is carried out through ethical behavior and conservative adherence to regulatory standards. • Clients: Addresses risks that could impact customer satisfaction and experience, monitored through customer satisfaction tracking, events with direct customer impact, and suitability indicators. The metrics translate the RAS and dimensions into measurable indicators that capture the main risks incurred by the institution. They are periodically monitored and reported to the executive level, the Risk and Capital Management

------

![](riskandcapitalmanagement012.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 8 Committee (CGRC), and the BoD, which guide preventive actions to ensure exposures remain within established limits and aligned with our strategy. The Board of Directors is responsible for establishing and approving the Risk Appetite guidelines and limits, performing its duties with the support of the CGRC and the Chief Risk Officer (CRO). The Risk Appetite governance is documented in an internal policy, which is also established, reviewed, and approved by the BoD. Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Unibanco's results, liquidity and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short- and long- term risks, among other aspects, as defined in CMN Resolution 4,557. In this process, the main potential risks to the economy are assessed based on the judgment of the bank's team of economists, endorsed by the Chief Economist of Itaú Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itaú Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution's risk appetite metrics.

------

![](riskandcapitalmanagement013.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 9 Recovery and Resolution Plan In response to the latest international crises, the Central Bank issued Resolution No. 5,187, which requires the development of a Recovery and Resolution Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a report that contemplates the entire Conglomerate and contains the description of the following items: I. Critical functions: activities performed by the entities within the scope of recovery and resolution planning for third parties, whose discontinuity could compromise the stability of the National Financial System (SFN), the Brazilian Payment System (SPB), or the real economy, due to their market share, interconnections, complexity, or other factors that prevent them from being immediately replaced by the market. II. Institution's essential services: services provided to one or more entities within the scope of recovery and resolution planning, whose disruption would impair the functioning of a core business line; III. Bridge institution: an entity established or reorganized to which assets, rights, and obligations of the institution under resolution are transferred, in whole or in part, aiming at the general or partial continuity of its business or activity. IV. Core business lines: activities essential to the viability of the prudential conglomerate or economic group under normal conditions, as they are material sources of revenue, capital gains, or market value. V. Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery and Resolution Plan; VI. Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; VII. Recovery and Resolution strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VIII. Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; IX. Governance mechanisms necessary for the coordination and execution of the Recovery and Resolution Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed biennially, whenever there are material changes or as determined by Bacen, and is subjected to the approval of the Board of Directors.

------

![](riskandcapitalmanagement014.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 10 With this practice, Itaú Unibanco has been able to continuously demonstrate, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Unibanco's procedure is as follows: • Identification of material risks and assessment of the need for additional capital; • Preparation of the capital plan, both in normality and stress situations; • Internal assessment of capital adequacy; • Structuring of capital contingency and recovery and resolution plans; • Preparation of management and regulatory reports. By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and Normative Instruction 322. The result of the last ICAAP, which includes stress tests – dated as of December 2024 – showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. Capital Adequacy Itaú Unibanco, through the ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness and the availability of Itaú Unibanco's capital to support business growth, the Total Capital levels were maintained above the minimum requirements.

------

![](riskandcapitalmanagement015.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 11 OV1 – Overview of risk-weighted assets (RWA) According to CMN Resolution 4,958 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: • RWACPAD = portion related to exposures to credit risk, calculated using standardized approach. • RWACIRB = portion related to exposures to credit risk, calculated according to internal credit risk rating systems (IRB - Internal Ratings-Based approaches), authorized by the Central Bank of Brazil. • RWAMPAD = portion related to the market risk capital requirement, calculated using stadarndized approach. • RWAMINT = portion related to the market risk capital requirement, calculated according to internal model approaches, authorized by the Central Bank of Brazil. • RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. a b c RWA Minimum capital requirements R$ million 12/31/2025 09/30/2025 12/31/2025 Credit risk (excluding counterparty credit risk) 1,199,103 1,138,362 95,928 Of which: standardised approach for credit risk 1,119,760 1,062,874 89,581 Of which: foundation internal rating-based approach (F-IRB) - - - Of which: advanced internal rating-based approach (A-IRB) 79,343 75,488 6,347 Counterparty credit risk (CCR) 29,789 29,491 2,383 Of which: standardised approach for counterparty credit risk (SA-CCR) 20,340 20,812 1,627 Of which: Current Exposure Method approach (CEM) - - - Of which: other CCR 9,449 8,679 756 Equity investments in funds - look-through approach 6,433 4,360 515 Equity investments in funds - mandate-based approach - - - Equity investments in funds - fall-back approach 1,109 1,330 89 Securitisation exposures in banking book 12,838 9,528 1,027 Market risk 50,248 61,765 4,019 Of which: standardised approach 61,438 75,499 4,915 Of which: internal models approach (IMA) 30,685 33,578 2,454 Operational risk (1) 143,006 143,006 11,441 Payment Services risk (RWA SP) NA NA NA Amounts below the thresholds for deduction 62,949 66,400 5,036 Total 1,505,475 1,454,242 120,438 1) The operational risk-weighted assets by standardized approach (RWAopad) is calculated in accordance with BCB Resolution 356/2023 as of Jan/25. Increase of BRL 51 billion mainly related to the rise in the credit risk component (RWACPAD).

------

![](riskandcapitalmanagement016.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 12 Links between financial statements and regulatory exposures LIA: Explanations of differences between accounting and regulatory exposure amounts The main difference between the accounting carrying value and the amounts considered for regulatory purposes is the non-consolidation of non-financial companies (especially Insurance, Pension Plan and Capitalization companies) in the regulatory consolidated, a difference that also impacts the elimination of related parties transactions. Within the regulatory scope, the procedures for assessing the need for prudent valuation adjustments (PVAs) arising from the pricing of financial instruments, as well as the description of the systems and controls used to ensure its reliability are described below. The pricing methodology for the financial instruments subject to Resolution No. 4,277, of October 31st, 2013, conducted by an independent area from the business areas, considers, in addition to benchmarks, the risks listed in the closeout uncertainty, market concentration, early termination, model risk, investing and funding costs, unearned credit spread and others. The fair value measurement at Itaú Unibanco follows the principles enclosed in the main regulatory bodies, such as CVM and BACEN. The institution follows the best practices in terms of pricing policies, procedures and methodologies and is committed to secure the pricing of financial instruments in its balance sheet with prices quoted and disclosed by the market, and in the impossibility of doing so, expends its best efforts to estimate which would be the fair price at which financial assets would be effectively traded, maximizing the use of relevant observable data and, under specific conditions, these instruments can be valued on a model basis. In all of these situations, the organization has control over its pricing methods and model risk management. The process of independent price verification (IPV) follows the guidelines included in Resolution No. 4,277, with daily verification of prices and market inputs, which is performed by a team independent from the pricing team. This process is also subject to an independent evaluation by the internal control, internal audit and external audit teams. The institution has a hybrid model for assessing the need for prudent valuation adjustments with two components. The first component is a timely assessment model that assesses new products, operations and risk factors traded and verifies the compliance and liability with any components of the existing prudent valuation adjustments. The second is a periodic assessment that aims to analyze the existing prudent valuation adjustments in relation to adequate pricing. The process and methodology are evaluated periodically and independently by internal controls and internal audit. In the line Other Differences of the table LI2, are reported the transactions subject to credit risk and counterparty credit risk, which are not accounted for in the balance sheet or in the off-balance sheet amounts.

------

![](riskandcapitalmanagement017.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 13 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories R$ million, at the end of the period 12/31/2025 Carrying values as reported in published financial statements Carrying values under scope of regulatory consolidation Carrying values of items: Subject to credit risk framework Subject to counterparty credit risk framework Subject to the securitisation framework Subject to the market risk framework Not subject to capital requirements or subject to deduction from capital Assets Current and Non-current assets 3,061,050 2,677,995 2,266,591 338,936 32,172 506,484 40,296 Cash 37,144 37,072 37,072 - - 5,608 - Interbank investments 340,388 332,989 65,429 267,560 - 33,366 - Securities 925,416 562,220 528,457 - 32,172 163,902 1,591 Derivatives 73,311 73,402 - 71,376 - 12,833 2,026 Operations with credit granting characteristics 1,229,943 1,231,915 1,195,297 - - 191,750 36,618 Interbank and interbranch accounts 282,008 282,008 282,008 - - 24 - Current and deferred tax assets 92,994 88,623 88,562 - - - 61 Others assets 79,846 69,766 69,766 - - 99,001 - Permanent assets 35,227 61,220 44,438 - - - 16,782 Investments 9,047 35,661 35,273 - - - 388 Real estate 9,595 9,165 9,165 - - - - Real estate by lease - - - - - Goodwill and Intangible assets 16,585 16,394 - - - - 16,394 Total assets 3,096,277 2,739,215 2,311,029 338,936 32,172 506,484 57,078 Liabilities Current and Non-current liabilities 2,890,647 2,511,453 - 501,829 - 354,329 2,009,624 Deposits 1,114,482 1,125,298 - - - 83,113 1,125,298 Deposits received under securities repurchase agreements 456,158 456,420 - 442,380 - 86,279 14,040 Debt instruments 415,630 417,298 - - - 3,757 417,298 Borrowings and onlending 147,164 147,162 - - - 5,099 147,162 Derivatives 69,899 69,800 - 59,449 - 6,918 10,351 Interbank and interbranch accounts 109,961 109,670 - - - - 109,670 Provisions for financial guarantees, credit commitments and credits to be released 1,794 1,794 - - - - 1,794 Technical provision for insurance, pension plan and premium bonds 360,617 - - - - - - Other provisions 15,849 15,620 - - - - 15,620 Current and deferred tax liabilities 23,941 18,428 - - - - 18,428 Other liabilities 175,152 149,963 - - - 169,163 149,963 Total liabilities 2,890,647 2,511,453 - 501,829 - 354,329 2,009,624 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements R$ million 12/31/2025 Total Carrying values of items: Subject to credit risk framework Subject to counterparty credit risk framework Subject to the securitisation framework Subject to the market risk framework Asset carrying value amount under scope of regulatory consolidation 2,682,137 2,311,029 338,936 32,172 548,312 Liabilities carrying value amount under regulatory scope of consolidation 501,829 - 501,829 - 336,208 Total net amount under regulatory scope of consolidation 2,180,308 2,311,029 (162,893) 32,172 212,104 Off-balance sheet amounts 303,982 178,707 125,275 - - Differences in valuations - - - - - Other differences 468,583 (8,807) 477,390 - - Exposure amounts considered for regulatory purposes 2,952,873 2,480,929 439,772 32,172 152,155

------

![](riskandcapitalmanagement018.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 14 PV1: Prudent valuation adjustments (PVA) In R$ million 12/31/2025 Equity Interest rates FX Credit Commodities Total Of which: In the trading book Of which: In the banking book Closeout uncertainty, of which: - - - 4 - 4 - 4 Closeout cost - - - 4 - 4 - 4 Concentration - - - - - - - - Early termination - 40 - 55 - 95 - 95 Model risk 52 54 - 6 - 112 52 61 Operational risk - - - - - - - - Investing and funding costs - - - - - - - - Unearned credit spreads - - - - - - - - Future administrative costs - - - - - - - - Other - - - - - - - - Total adjustment 52 94 - 65 - 211 52 160 Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the associate institutions that comprise the financial statements and the Prudential Consolidation of Itaú Unibanco Holding S.A.. Associate institutions that comprise the financial statements and the Prudential Conglomerate Country (1) % Equity share on capital Acácia FIDC Direito Creditório Responsabilidade LTDA Brazil 100.00% Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% Angico FIDC Segmento Infraestrutura e Agronegócio de Responsabilidade Limitada Brazil 100.00% Banco Investcred Unibanco S.A. Brazil 50.00% Banco Itaú (Suisse) S.A. Switzerland 100.00% Banco Itaú Chile Chile 67.42% Banco Itaú Consignado S.A. Brazil 100.00% Banco Itaú International United States 100.00% Banco Itaú Paraguay S.A. Paraguay 100.00% Banco Itaú Uruguay S.A. Uruguay 100.00% Banco Itaú Veículos S.A. Brazil 100.00% Banco ItauBank S.A. Brazil 100.00% Banco Itaucard S.A. Brazil 100.00% Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditórios Brazil 93.99% Dibens Leasing S.A. - Arrendamento Mercantil Brazil 100.00% FIDC B2cycle NPL Brazil 100.00% FIDC Cloudw Akira I Brazil 96.88% FIDC Kiwify Brazil 83.23% FIDC Mobilitas Brazil 86.85% FIDC Sumup Solo Brazil 93.39% Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Brazil 53.88% Fundo De Invest Dir Creditórios Não Padron NPL II Brazil 100.00% Fundo de Investimento em Direitos Creditórios IA Brazil 100.00% Fundo de Investimento em Direitos Creditórios Soul Brazil 93.97% Fundo Fortaleza de Investimento Imobiliário Brazil 100.00% Fundo Kinea Ventures Brazil 99.92% IA II - Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada Brazil 100.00% Ideal Corretora de Titulos e Valores Mobiliarios S.A. Brazil 50.10% Ideal Holding Financeira S.A. Brazil 50.10% Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. Brazil 100.00% Iresolve Companhia Securitizadora de Créditos Financeiros S.A. Brazil 100.00% Itaú (Panamá) S.A. Panama 67.06% Itaú Administradora de Consórcios Ltda. Brazil 100.00% Itaú Administradora de Fondos de Inversión S.A Uruguay 100.00% Itaú Bank & Trust Bahamas Ltd. Bahamas 100.00% Itaú Bank & Trust Cayman Ltd. Cayman Islands 100.00% Itaú Bank, Ltd. Cayman Islands 100.00% Itaú BBA Europe S.A. Portugal 100.00% Itaú BBA International Plc. United Kingdom 100.00% Itaú BBA Trading S.A. Brazil 100.00% Itaú BBA Trading S.A. - Sucursal Uruguay Uruguay 100.00% Itaú BBA USA Securities Inc. United States 100.00% Itaú Chile New York Branch. United States 67.42% Itaú Cia. Securitizadora de Créditos Financeiros Brazil 100.00% 1) The institutions operate in their respective countries of origin.

------

![](riskandcapitalmanagement019.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 15 Associate institutions that comprise the financial statements and the Prudential Conglomerate (2) Country (1) % Equity share on capital Itaú Colombia S.A Colombia 67.06% Itaú Comisionista de Bolsa Colombia S.A. Colombia 67.06% Itaú Corredores de Bolsa Limitada Chile 67.42% Itaú Corretora de Valores S.A. Brazil 100.00% Itaú Fiduciaria Colombia S.A. Sociedad Fiduciaria Colombia 67.04% Itaú International Securities Inc. United States 100.00% Itaú Invest Casa de Bolsa S.A. Paraguay 100.00% Itau Isento Julho 28 FIC de Fundos Infra RF Incentivo Resp Limitada (3) Brazil - Itau Isento Marco 28 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada Brazil 6.76% Itau Isento Marco 29 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada Brazil 1.00% Itau Isento Setembro 28 Fundo de Investimento em Cotas de FIIF em Infra RF Resp Limitada Brazil 8.43% Itau Isento Setembro 29 FIC de Fundos Incentivados Brazil 0.38% Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Brazil 100.00% Itaú Unibanco Holding S.A. Brazil 100.00% Itaú Unibanco Holding S.A., Grand Cayman Branch Cayman Islands 100.00% Itaú Unibanco S.A. Brazil 100.00% Itaú Unibanco S.A., Miami Branch United States 100.00% Itaú Unibanco S.A., Nassau Branch Bahamas 100.00% Itaú Unibanco Veículos Administradora de Consórcios Ltda. Brazil 100.00% ITB Holding Ltd. Cayman Islands 100.00% Kinea CO-investimento Fundo de Investimento Imobiliario Brazil 99.98% Kinea Equity Infra I Warehouse Feeder MM Ficfi CP Brazil 100.00% Kinea FOF Imobiliário FIF Multimercado - Responsabilidade Limitada Brazil 75.49% Kinea I Private Equity FIP Multiestrategia Brazil 99.68% Kinea KP Fundo de Investimento Multimercado Crédito Privado Brazil 100.00% Licania Fund Limited Cayman Islands 100.00% Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Brazil 50.00% Microinvest S.A. Soc. de Crédito a Microempreendedor Brazil 100.00% NC 2025 Fundo de Investimento em Direitos Creditórios Brazil 100.00% NC 2025 I Fundo de Investimento em Direitos Creditórios Brazil 100.00% OCA Dinero Electrónico S.A. Uruguay 100.00% OCA S.A. Uruguay 100.00% Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Brazil 100.00% Pont Sociedad Anónima Paraguay 100.00% Redecard Instituição de Pagamento S.A. Brazil 100.00% Redecard Sociedade de Crédito Direto S.A Brazil 100.00% RT Itaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento Brazil 100.00% Tangerina Fundo de Investimento em Direitos Creditórios - Responsabilidade Limitada Brazil 100.00% Tarumã 2 FIF Fundo Incentivado em Investimento em Deb de Infra RF Cred Priv Resp Limitada Brazil 100.00% Tarumã Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado Brazil 100.00% Théros Fundo de Investimento nas Cadeias Produtivas Brazil 100.00% TOP 2025 I Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada Brazil 100.00% Vitex FIF Fundo Incentivado em Investimento em Debêntures de Infra RF Cred Priv Resp Limitada Brazil 100.00% 1) The institutions operate in their respective countries of origin. 2) The TOP 2025 Fundo de Investimento em Direitos Creditórios o Itaú Unibanco Holding Consolidated until September 30, 2025. 3) New corporate name of social da Itau Isento Marco 30 FIC de Fundos Incentivados de Inv Financeiro em Infra RF Resp Limitada

------

![](riskandcapitalmanagement020.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 16 Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the associate institutions that comprise only the financial statements. Associate institutions that comprise only the Financial Statements (2,3) Country (1) % Equity share on capital Administradora de Fondos de Ahorro Previsional Itaú S.A. Uruguay 100.00% Albarus S.A. Paraguay 100.00% Ank Platform S.A. Argentina 100.00% Avita Corretora de Seguros S.A. Brazil 80.00% Beta Correspondente e Tecnologia LTDA Brazil 100.00% Borsen Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% Cia. Itaú de Capitalização Brazil 100.00% Conexão Tecnologia de Pagamentos LTDA Brazil 100.00% Estrel Serviços Administrativos S.A. Brazil 100.00% FC Recovery S.A.U. Argentina 100.00% iCarros Ltda. Brazil 100.00% IGA Participações S.A. Brazil 100.00% Investimentos Bemge S.A. Brazil 86.81% Itaú Administradora General de Fondos S.A. Chile 67.42% Itaú Asesorías Financieras Limitada Chile 67.42% Itaú Asset Management Administradora de Fondos Patrimoniales de Inversión S.A. Paraguay 100.00% Itaú Bahamas Directors Ltd. Bahamas 100.00% Itaú Bahamas Nominees Ltd. Bahamas 100.00% Itaú BBA Assessoria Financeira S.A. Brazil 100.00% Itaú Chile Inversiones, Servicios y Administracion S.A. Chile 100.00% Itaú Chile Participaciones SpA Chile 100.00% Itaú Consultoria de Valores Mobiliários e Participações S.A. Brazil 100.00% Itaú Corredor de Seguros Colombia S.A. Colombia 67.41% Itaú Corredores de Seguros Limitada Chile 67.42% Itaú Corretora de Seguros S.A. Brazil 100.00% Itaú Europe S.A. Luxembourg 100.00% Itaú Holding Colombia S.A.S. Colombia 67.42% Itaú Institucional Renda Fixa Fundo de Investimento Brazil 100.00% Itaú International Holding Cayman Ltd. Cayman Islands 100.00% Itaú Rent Administração e Participações Ltda. Brazil 100.00% Itaú Seguros Paraguay S.A. Paraguay 100.00% Itaú Seguros S.A. Brazil 100.00% Itaú Sociedade Prestadora de Serviços Ativos Virtuais LTDA Brazil 100.00% Itaú Unibanco Asset Management Ltda. Brazil 100.00% Itau Unibanco Comercializadora de Energia Ltda. Brazil 100.00% Itaú USA Asset Management Inc. United States 100.00% Itaú Vida e Previdência S.A. Brazil 100.00% Itauseg Participações S.A. Brazil 100.00% Itauseg Saúde S.A. Brazil 100.00% ITB Holding Brasil Participações Ltda. Brazil 100.00% IU Corretora de Seguros Ltda. Brazil 100.00% Kinea Investimentos Ltda. Brazil 80.00% Kinea US Asset Management LLC United States 80.00% Mundostar S.A. Uruguay 100.00% PR Curitiba Mariano Torres Ltda. Brazil 100.00% Proserv - Promociones y Servicios, S.A. de C.V. Mexico 100.00% Provar Negócios de Varejo Ltda. Brazil 100.00% Recaudaciones y Cobranzas Limitada Chile 67.42% Recovery do Brasil Consultoria S.A. Brazil 100.00% Red Visual S.A. Uruguay 100.00% Resonet S.A. Uruguay 100.00% RJ Niteroi Icarai Ltda. Brazil 100.00% RT Alm 5 Fundo de Investimento Renda Fixa Brazil 100.00% RT Alm Soberano 2 Fundo de Investimento Renda Fixa Brazil 100.00% 1) The institutions operate in their respective countries of origin. 2) The FIC Promotora de Vendas Ltda. was part of Itaú Unibanco Holding Consolidado until 11/30/2025. 3) The Itaú International Holding Limited was part of Itaú Unibanco Holding Consolidado until 10/31/2025.

------

![](riskandcapitalmanagement021.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 17 Associate institutions that comprise only the Financial Statements Country (1) % Equity share on capital RT Defiant Multimercado - Fundo de Investimento Brazil 100.00% RT Endeavour Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% RT Mocah Fundo de Investimento Financeiro Renda Fixa - Responsabilidade Limitada Brazil 100.00% RT Multigestor 4 Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% RT Nation II Fundo de Investimento Financeiro Renda Fixa - Responsabilidade Limitada Brazil 100.00% RT Nation Renda Fixa - Fundo de Investimento Brazil 100.00% RT Valiant Renda Fixa - Fundo de Investimento Brazil 100.00% SP Alameda Franca LTDA Brazil 100.00% SP Amadeu Amaral Ltda. Brazil 100.00% SP Antonia Queiroz Ltda Brazil 100.00% SP Augusta Ltda Brazil 100.00% SP Av Juscelino Kubitschek Ltda Brazil 100.00% SP Av Morumbi Ltda Brazil 100.00% SP Av. Jabaquara Ltda. Brazil 100.00% SP Av. Rangel Pestana Ltda. Brazil 100.00% SP Bairro Moema Ltda. Brazil 100.00% SP Bairro Sumarezinho Ltda Brazil 100.00% SP Bairro Vila Guilherme Ltda. Brazil 100.00% SP Brooklin Rua Santo Amaro Ltda Brazil 100.00% SP Butanta Ltda Brazil 100.00% SP CEAGESP Ltda Brazil 100.00% SP Clelia Ltda Brazil 100.00% SP Eusebio Matoso Ltda Brazil 100.00% SP Itaberaba Ltda Brazil 100.00% SP Maracatins Ltda Brazil 100.00% SP Nova JK Ltda Brazil 100.00% SP Padre João Manuel Ltda. Brazil 100.00% SP Pássaros e Flores Ltda. Brazil 100.00% SP Rua Da Consolacao Ltda Brazil 100.00% SP Rua Das Palmeiras Ltda. Brazil 100.00% SP Santos Embare Ltda. Brazil 100.00% SP Santos Jose Menino Ltda. Brazil 100.00% SP Senador Queiros Ltda. Brazil 100.00% SP Serra De Bragança Ltda Brazil 100.00% SP Vila Clementino Ltda. Brazil 100.00% SP Vila Olimpia Araguari Ltda. Brazil 100.00% SPE IRA 01 LTDA Brazil 100.00% SPE IRA 02 LTDA Brazil 100.00% SPE IRA 03 LTDA Brazil 100.00% SPE IRA 04 LTDA Brazil 100.00% SPE IRA 05 LTDA Brazil 100.00% SPE IRA 06 LTDA Brazil 100.00% SPE IRA 07 LTDA Brazil 100.00% SPE IRA 08 LTDA Brazil 100.00% SPE IRA 09 LTDA Brazil 100.00% SPE IRA 10 LTDA Brazil 100.00% SPE IRA 11 LTDA Brazil 100.00% SPE IRA 12 LTDA Brazil 100.00% Spe Ira 13 Ltda Brazil 100.00% Spe Ira 14 Ltda Brazil 100.00% Spe Ira 15 Ltda Brazil 100.00% Spe Ira 16 Ltda Brazil 100.00% Spe Ira 17 Ltda Brazil 100.00% Spe Ira 18 Ltda Brazil 100.00% Spe Ira 19 Ltda Brazil 100.00% Spe Ira 20 Ltda Brazil 100.00% Spe Ira 21 Ltda Brazil 100.00% Spe Ira 22 Ltda Brazil 100.00% Spe Ira 23 Ltda Brazil 100.00% Spe Ira 24 Ltda Brazil 100.00% Spe Ira 25 Ltda Brazil 100.00% Spe Ira 26 Ltda Brazil 100.00% Spe Ira 27 Ltda Brazil 100.00% Zup I.T. Serviços em Tecnologia e Inovação S.A. Brazil 100.00% ZUP Innovation Corp. United States 100.00% 1) The institutions operate in their respective countries of origin.

------

![](riskandcapitalmanagement022.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 18 The institutions presented in the tables above represent the total scope of companies of Itaú Unibanco Holding. Non Consolidated Institutions The following institutions are the associates and the joint ventures not consolidated in the financial statements and Prudential Consolidation. Material entities The companies considered relevant and not consolidated in the Prudential Conglomerate are presented below, with information about total assets, stockholders' equity, country and activity: R$ million 12/31/2025 09/30/2025 Institutions Country Activity Total Assets Equity Total Assets Equity Cia. Itaú de Capitalização Brazil Premium bonds 6,347 818 6,005 943 Itaú Consultoria de Valores Mobiliários e Participações S.A. Brazil Financial institution holding company 1,378 1,280 1,340 1,248 Itaú Corretora de Seguros S.A. Brazil Insurance, pension plans and health brokers 2,533 875 2,250 843 Itaú Seguros S.A. Brazil Insurance 12,526 3,378 11,684 3,662 Itaú Vida e Previdência S.A. Brazil Pension plan 354,729 4,524 342,254 4,397 Itauseg Participações S.A. Brazil Non financial institution holding company 13,073 12,947 12,005 11,942 ITB Holding Brasil Participações Ltda. Brazil Financial institution holding company 58,345 56,794 54,489 53,307 Provar Negócios de Varejo Ltda. Brazil Other auxiliary activities for financial services 2,239 2,193 2,175 2,149 Composition of Capital CCA: Main features of regulatory capital instruments The authorized regulatory capital instruments may be extinguished according to the criteria established in Resolution nº 4,955, such as non-compliance with the minimum regulatory ratios, decree of temporary special administration regime or intervention, application of public resources or upon the Central Bank of Brazil determination. Should any criteria for the extinction of subordinated instruments be triggered, the area responsible for Itaú Unibanco's Capital management will activate the areas involved to execute the following action plan: Non consolidated Institutions Country (1) % Equity share on capital (2) Avenue Holding Cayman Cayman Islands 32.91% BANFUR International S.A. Panama 30.00% Biomas Serviços Ambientais, Restauração e Carbono S.A Brazil 16.67% BSF Holding S.A Brazil 49.00% Caja de Valores del Paraguay S.A. Paraguay 9.09% CIP S.A Brazil 22.89% Conectcar Instituição de Pagamento e Soluções de Mobilidade Eletrônica S.A. Brazil 50.00% Gestora de Inteligência de Crédito S.A Brazil 15.71% Kinea Private Equity Investimentos S.A. Brazil 80.00% Olímpia Promoção e Serviços S.A. Brazil 50.00% Porto Seguro Itaú Unibanco Participações S.A. Brazil 42.93% Pravaler S.A. Brazil 50.14% PREX Holding LLC United States 30.00% Rede Agro Fidelidade e Intermediação Brazil 12.82% Rias Redbanc S.A. Uruguay 25.00% Riblinor S.A. Uruguay 40.00% Tecnologia Bancária S.A. Brazil 28.75% Totvs Techfin S.A. Brazil 50.00% 1) The institutions operate in their respective countries of origin. 2) Considers only direct participation.

------

![](riskandcapitalmanagement023.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 19 • Treasury and products, through the payment agent of the subordinated instruments or straight through the central depository, will notify its holders and take actions to ensure that Itaú Unibanco's trading desks cease to trade such instruments; • The operational and accounting areas will carry out the necessary procedures for the proper treatment of the extinction; and • The Investor Relations area will communicate to the market of the extinction of the subordinated instruments. The table CCA - Main features of regulatory capital instruments, is available at www.itau.com.br/investor-relations, section "Results and Reports", "Regulatory Reports", "Pillar 3".

------

![](riskandcapitalmanagement024.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 20 CC1 - Composition of regulatory capital 1 12/31/2025 Value (R$ Thousand) Balance Sheet Reference Common Equity Tier I: instruments and reserves 1 Instruments Eligible for the Common Equity Tier I 136,909,898 (k) 2 Revenue reserves 57,481,239 (l) 3 Other revenue and other reserve 1,752,918 (m) 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 6,192,303 (j) 6 Common Equity Tier I before regulatory adjustments 202,336,358 Common Equity Tier I: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 211,633 8 Goodwill (net of related tax liability) 1,149,720 (e) 9 Intangible assets 15,632,730 (h) / (i) 10 Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution related to determination periods ended until December 31, 1998 53,059 (b) 11 Adjustments related to the market value of derivative financial instruments used to hedge the cash flows of protected items whose mark- to-market adjustments are not recorded in the books. (277,567) 12 Shortfall of provisions to expected losses - 15 Actuarial assets related to defined benefit pension funds - (d) 16 Shares or other instruments issued by the bank authorized to compose the Core Capital, acquired directly, indirectly or synthetically 12,731 (n) 17 Reciprocal cross-holdings in common equity - 18 Total value of adjustments related to net non-significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities - 19 Total value of adjustments related to net significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific adjustments - 21 Total value of adjustments related to tax credits arising from temporary differences that depend on the generation of income or future taxable income for their realization, above the limit of 10% of the Common Equity Tier I, disregarding specific deductions - 22 Amount that exceeds 15% of the Common Equity Tier I - 23 Of which: arising from net investments in the Common Equity Tier I of companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities - 25 Of which: arising from tax credits resulting from temporary differences that depend on the generation of income or future taxable income for their realization - 26 National specific regulatory adjustments (41,038) 26.a Deferred permanent assets - (g) 26.b Investment in dependence, financial institution abroad or non-financial entity that is part of the conglomerate, with respect to which the Central Bank of Brazil does not have access to information, data and documents - 26.d Increase of unauthorized capital - 26.e Excess of the amount adjusted of Common Equity Tier I - 26.f Deposit to cover capital deficiency - 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect - (i) 26.h Excess of resources invested on permanent assets - 26.i Total capital detached - 26.j Other residual differences concerning the Common Equity Tier I calculation methodology for regulatory purposes (41,038) 27 Other residual differences related to the calculation of the Common Equity Tier I for regulatory purposes - 28 Total regulatory deductions from the Common Equity Tier I 16,741,268 29 Common Equity Tier I 185,595,090 Additional Tier I Capital: instruments 30 Instruments eligible for the Additional Tier I Capital 21,542,997 31 Of which: classified as equity under applicable accounting standards - 32 Of which: classified as liabilities under applicable accounting standards 21,542,997 33 Instruments authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 34 Additional Tier 1 instruments issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 1,023,065 35 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 36 Additional Tier I Capital before regulatory adjustments 22,566,062

------

![](riskandcapitalmanagement025.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 21 Additional Tier I Capital: regulatory adjustments 37 Shares or other instruments issued by the bank authorized to compose the Additional Tier I Capital, acquired directly, indirectly or synthetically - 38 Reciprocal cross-holdings in additional Tier 1 instruments - 39 Total value of adjustments related to net non-significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 40 Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 41 National specific regulatory adjustments - 41.b Non-controlling interest in Additional Tier I Capital - 41.c Other residual differences concerning the Additional Tier I Capital calculation methodology for regulatory purposes - 42 Regulatory adjustments applied to the Additional Tier I Capital due to the insufficient Tier II Capital to cover deductions - 43 Total regulatory deductions from the Additional Tier I Capital - 44 Additional Tier I Capital (AT1) 22,566,062 45 Tier I 208,161,152 Tier II: instruments and provisions 46 Instruments eligible for Tier II 19,033,726 47 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 48 Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 1,361,714 49 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 50 Provisions 32,568 51 Tier II before regulatory adjustments 20,428,008 Tier II: regulatory adjustments 52 Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, indirectly or synthetically - 53 Reciprocal cross-holdings in Tier 2 instruments - 54 Total value of adjustments related to net non-significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 55 Total value of adjustments related to net significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 56 National specific regulatory adjustments - 56.b Non-controlling interest in Tier II - 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes - 57 Total regulatory deductions from Tier II Capital - 58 Tier II 20,428,008 59 Referential Equity (Tier I + Tier II) 228,589,160 60 Total risk-weighted assets 1,505,475,690 BIS Ratios and Additional Capital Buffers 61 Common Equity Tier I Ratio 12.3% 62 Tier I Ratio 13.8% 63 BIS Ratio 15.2% 64 Additional Capital Buffers (% of RWA) 3.6% 65 Of which: capital conservation buffer requirement 2.5% 66 Of which: bank-specific countercyclical buffer requirement 0.1% 67 Of which: capital buffer for institutions that are systemically important at global level (G-SIB) 1.0% 68 Common Equity Tier 1 capital available after meeting the bank's minimum capital requirements (% of RWA) 3.6% Amounts below the limit for deduction (non-weighted by risk) 72 Total value, subject to risk weighting, of non-significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as well as non-significant investments in the Additional Tier I, Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 2,761,816 73 Total value, subject to risk weighting, of significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 17,387,089 (f) / (a) 75 Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 7,792,711 (c) Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) 82 Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 83 Amount excluded from the Additional Tier I Capital due to the line 82 limit - 84 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 85 Amount excluded from Tier II due to the line 84 limit - 1) The adjustment to equity arising from the adoption of the criteria for setting aside provisions for expected losses set out in CMN Resolution No. 4,966 impacted capital in phases, as defined in CMN Resolution No. 5,199.

------

![](riskandcapitalmanagement026.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 22 CC2: Reconciliation of regulatory capital to balance sheet R$ million, at the end of the period 12/31/2025 Consolidated Balance Sheet (1) Balance Sheet as in published financial statements Under regulatory scope of consolidation Reference (2) Assets Current and Non-current assets 3,061,050 2,677,995 Cash 37,144 37,072 Interbank investments 340,388 332,989 Securities 925,416 562,220 Derivatives 73,311 73,402 Operations with credit granting characteristics 1,229,943 1,231,915 Interbank and interbranch accounts 282,008 282,008 Current and deferred tax assets 92,994 88,623 (b) / (c) Others assets 79,846 69,766 (b) / (d) Permanent assets 35,227 61,220 Investments 9,047 35,661 (a) / (e) / (f) Real estate 9,595 9,165 Goodwill and Intangible assets 16,585 16,394 (e) / (h) / (i) Total assets 3,096,277 2,739,215 Liabilities Current and Non-current liabilities 2,890,647 2,511,453 Deposits 1,114,482 1,125,298 Deposits received under securities repurchase agreements 456,158 456,420 Debt instruments 415,630 417,298 Borrowings and onlending 147,164 147,162 Derivatives 69,899 69,800 Interbank and interbranch accounts 109,961 109,670 Provisions for financial guarantees, credit commitments and credits to be released 1,794 1,794 Technical provision for insurance, pension plan and premium bonds 360,617 - Other provisions 15,849 15,620 Current and deferred tax liabilities 23,941 18,428 (b) / (c) Other liabilities 175,152 149,963 (b) / (c) Total stockholders' equity of controlling shareholders 196,146 196,132 Capital 136,910 136,910 (k) Other Revenues and Other Reserves 1,718 1,753 (m) Revenue reserves 57,531 57,482 (l) (Treasury shares) (13) (13) (n) Non-controlling interests 9,484 31,630 (j) Total stockholders' equity 205,630 227,762 Total liabilities and stockholders' equity 3,096,277 2,739,215 1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudencial Conglomerate and also by the eliminations of transactions with related parties. 2) Prudential information that is presented in the Template CC1 of this document.

------

![](riskandcapitalmanagement027.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 23 Macroprudential Indicators CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer The following table details the geographic distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer, according to Circular 3,769 of 29 October 2015: GSIB1: Disclosure of G-SIB indicators The GSIB1 table, disclosure of global systemically important bank (G-SIB) indicators, is available on the website www.itau.com.br/investor-relations, section "Reports", "Pillar 3 and Global Systemically Important Banks", within the period stipulated by BCB Resolution 54/20. Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748, which minimum requirement is of 3%. The ratio is intended to be a simple measure of non- risk-sensitive leverage, and so it does not take into account risk weights or risk mitigation. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. R$ million 12/31/2025 Amount of credit risk exposure to the non- banking private sector RWACPrNB Brazil 0 2.068.892 840.249 - Chile 0,50% 200.695 128.563 0,07% 970 Uruguay 0,75% 44.350 28.354 - Luxembourg 0,50% 4.776 2.762 - Spain 0,50% 3.211 2.499 - United Kingdom 2,00% 5.400 965 - France 1,00% 1,28 691 - Sweden 2,00% 773 504 - Germany 0,75% 356 333 - Netherlands 2,00% 279 177 - Norway 2,50% 155 83 - Denmark 2,50% 67 28 - Czech Republic 1,25% - - - Belgium 1,00% 25 - - Ireland 1,50% 4 - - Hong Kong 0,50% - - - Sum(1) 2.328.984 1.005.208 Total(2) 2.511.860 1.098.254 0,07% 970 (1) Sum of RWACPrNBi portions related to credit risk exposures to the non-banking private sector in Brazil and jurisdictions with a percentage of the countercyclical buffer with values greater than zero. (2) Total of RWA for non-bank private credit risk exposures to all jurisdictions in which the bank has exposure, including jurisdictions with no countercyclical buffer percentage applied or with a countercyclical percentage equal to zero. (3) Calculated according to Circular 3.769, employing the discretionary exclusion of jurisdiction. Geographical breakdown Countercyclical capital buffer rate Exposure values and/or risk- weighted assets Bank-specific countercyclical capital buffer rate Countercyclical capital buffer amount (3)

------

![](riskandcapitalmanagement028.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 24 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) R$ million 12/31/2025 09/30/2025 Total consolidated assets as published financial statements 3,096,277 2,996,463 Adjustment from differences of consolidation (357,062) (344,179) Total assets of the individual balance sheet or of the regulatory consolidation, in the case of Leverage Ratio on a consolidated basis 2,739,215 2,652,284 Adjustments for derivative financial instruments 60,312 67,765 Adjustment for securities financing transactions (ie repos and similar secured lending) 10,627 16,953 Adjustment for off-balance sheet items (ie conversion to credit equivalent amounts of off-balance sheet exposures) 248,219 232,402 Other adjustments (74,896) (47,792) Total Exposure 2,983,477 2,921,612 LR2: Leverage ratio common disclosure a b R$ million 12/31/2025 09/30/2025 Items shown in the Balance Sheet Balance sheet items except derivative financial instruments, securities received on loan and resales for settlement under repurchase transactions 2,403,586 2,315,717 Adjustments for equity items deducted in the calculation of Tier I (24,507) (23,315) Total exposure shown in the Balance Sheet 2,379,079 2,292,402 Transactions using Derivative Financial Instruments Replacement value for derivatives transactions 26,241 40,272 Potential future gains from derivatives transactions 32,028 37,368 Adjustment for collateral in derivatives transactions - - Adjustment related to the deduction of the exposure because of the qualified central counterparty (QCCP) in derivative transactions on behalf of clients in which there is no contractual obligation to reimburse due to bankruptcy or default of the entities responsible for the settlement and compensation of transactions (57,507) (37,641) Reference value for credit derivatives 87,131 83,702 Adjustment of reference value calculated for credit derivatives (32,849) (34,607) Total exposure for derivative financial instruments 55,044 89,094 Repurchase Transactions and Securities Lending (TVM) Investments in repurchase transactions and securities lending 267,560 263,199 Adjustment for repurchases for settlement and creditors of securities lending - - Amount of counterparty credit risk 10,627 16,954 Amount of counterparty credit risk in transactions as intermediary 22,948 27,561 Total exposure for repurchase transactions and securities lending 301,135 307,714 Off-balance sheet items Reference value of off-balance sheet transactions 719,309 680,821 Adjustment for application of FCC specific to off-balance sheet transactions (471,090) (448,419) Total off-balance sheet exposure 248,219 232,402 Capital and Total Exposure Tier I 208,161 215,466 Total Exposure 2,983,477 2,921,612 Leverage Ratio Basel III Leverage Ratio 7.0% 7.4%

------

![](riskandcapitalmanagement029.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 25 Liquidity Ratios LIQA: Liquidity Risk Management Information Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring in significant losses. In line with the fundraising strategy, Itaú Unibanco has diversified and stable sources of funding available, monitored through concentration and maturity indicators, in order to mitigate liquidity risks, in accordance with the institution's risk appetite. The governance of the liquidity risk management is based on advisory boards, subordinated to the Board of Directors or the executive structure of Itaú Unibanco. Such boards establish the institution's risk appetites, define the limits related to the liquidity control and monitor the liquidity indicators. The control of the liquidity risk is carried out by an area that is independent of the business areas, responsible for defining the composition of the reserve, estimating the cash flow and the exposure to liquidity risk in different time horizons and monitoring short and long term liquidity indicators (LCR and NSFR respectively). In addition, it proposes minimum limits to absorb losses in stress scenarios for each country where Itaú Unibanco operates and reports any non-compliance to the competent authorities. All activities are subject to verification by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of Resolution 4,557, BACEN Circular 3,749 and Circular 3,869, the Liquidity Risk Statement (DRL - LCR) and the Long Term Liquidity Statement (DLP - NSFR) are monthly sent to BACEN. Finally, the following items are periodically prepared and submitted to senior management for monitoring and decision support: • Stress of liquidity indicators based on macroeconomic scenarios, simulation of reverse stress based on risk appetite, and projection of the main liquidity indicators to support decisions; • Contingency and recovery plans for crisis situations, with actions that provide for a gradation according to the level of criticality determined by the easiness of implementation, taking into account the characteristics of the local market in which it operates, seeking a rapid restoration of liquidity indicators; • Reports and graphs that describe risk positions; • Concentration indicators of funding providers and time. The document "Public Access Report - Liquidity Risk Management and Control Policy" that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations,section "Itaú Unibanco", under "Corporate Governance", "Policies", "Reports".

------

![](riskandcapitalmanagement030.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ 26 LIQ1: Liquidity Coverage Ratio (LCR) 12/31/2025 (1) 09/30/2025 (1) Total unweighted value (In thousand R$) (2) Total weighted value (In thousand R$) (3) Total unweighted value (In thousand R$) (2) Total weighted value (In thousand R$) (3) High Quality Liquidity Assets (HQLA) Total High Quality Liquid Assets (HQLA) 389,722,978 367,777,276 Cash Outflows (4) . . Retail deposits and deposits from small business customers, of which: 691,564,370 72,275,461 654,107,092 67,696,023 Stable deposits 299,595,980 14,979,799 291,799,825 14,589,991 Less stable deposits 391,968,390 57,295,662 362,307,266 53,106,032 Unsecured wholesale funding, of which: 341,685,716 149,748,865 336,531,728 145,445,334 Operational deposits (all counterparties) and deposits in networks of cooperative banks 28,328,470 7,966,379 22,637,742 6,084,235 Non-operational deposits (all counterparties) 310,363,543 138,788,784 310,013,407 135,480,520 Unsecured debt 2,993,702 2,993,702 3,880,579 3,880,579 Secured wholesale funding 49,067,424 45,954,133 Additional requirements, of which: 113,531,193 30,952,335 120,749,088 28,509,122 Outflows related to derivative exposures and other collateral requirements 40,123,217 24,036,422 37,067,516 20,038,435 Outflows related to loss of funding on debt products 2,300,056 2,300,056 2,596,434 2,596,434 Credit and liquidity facilities 71,107,919 4,615,856 81,085,137 5,874,253 Other contractual funding obligations 116,425,597 116,425,597 112,120,745 112,120,745 Other contingent funding obligations 299,259,635 21,983,805 273,263,116 19,933,326 Total Cash Outflows 440,453,486 419,658,682 Cash Inflows (4) Secured lending (eg reverse repos) 171,671,279 1,355,833 146,164,463 950,802 Inflows from fully performing exposures 61,672,363 36,896,668 63,539,951 38,981,930 Other cash inflows 234,330,004 220,911,053 228,355,062 211,549,519 Total Cash Inflows 467,673,646 259,163,555 438,059,476 251,482,252 Total Adjusted Value (5) Total Adjusted Value (5) Total HQLA 389,722,978 367,777,276 Total net cash outflows 181,289,931 168,176,431 Liquidity Coverage Ratio (%) 215.0% 218.7% Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$389.7 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$181.3 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 215.0%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. __________________________________________________________________________________________ Itaú Unibanco

------

![](riskandcapitalmanagement031.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 27 a b c d e Value per residual effective maturity term (R$ thousand) 12/31/2025 No Maturity (1) Lower than six months (1) Greater than or equal to six months, and lower than 1 year (1) Greater than or equal to 1 year (1) Weighted Value (In thousand R$) (2) Available Stable Funding (ASF) (3) Capital - - - 246,319,350 246,319,350 Reference Equity, gross of regulatory deductions - - - 205,742,627 205,742,627 Other capital instruments not included in line 2 - - - 40,576,723 40,576,723 Retail Funding: 189,902,572 600,943,070 4,807,660 1,474,482 733,683,519 Stable Funding 101,123,107 221,036,353 261,843 21,308 306,321,545 Less Stable Funding 88,779,465 379,906,717 4,545,817 1,453,175 427,361,974 Wholesale Funding: 71,102,512 868,962,843 100,841,970 157,551,181 429,592,822 Operational deposits and deposits of member cooperatives 18,688,552 - - - 9,344,276 Other Wholesale Funding 52,413,960 868,962,843 100,841,970 157,551,181 420,248,546 Opertions in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 171,196,045 13,407,380 1,285,529 - Other liabilities, in which: 74,114,055 113,927,347 10,468,749 84,850,425 90,084,799 Derivatives whose replacement values are lower than zero 18,958,815 - - Other liability or equity elements not included above 74,114,055 94,968,532 10,468,749 84,850,425 90,084,799 Total Available Stable Funding (ASF) 1,499,680,491 Required Stable Funding (RSF) (3) Total NSFR high quality liquid assets (HQLA) 46,950,198 Operational deposits held at other financial institutions - - - - - Performing loans and securities (financial institutions, corporates and central banks) 1,908,923 592,172,277 157,140,150 755,400,925 878,761,599 Performing loans to financial institutions secured by Level 1 HQLA - 27,831,829 - 508,016 3,291,199 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions 1,681,810 26,678,304 11,013,121 16,915,714 26,832,957 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks, of which: 227,113 477,498,457 101,174,396 332,898,007 491,494,463 With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644. - - - 8,770,741 5,700,982 Performing residential mortgages, of which: - 15,021,639 13,379,623 174,370,526 120,684,973 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 120,492,284 98,949,898 Securities that are not in default and do not qualify as HQLA, including exchange-traded equities - 45,142,047 31,573,011 230,708,661 236,458,007 Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 169,282,325 15,913,341 1,633,657 - Other assets, in which: 81,972,665 151,632,581 8,956,505 132,108,357 261,028,657 Transactions with gold and commodities, including those with expected physical settlement - - Assets posted as initial margin for derivatives contracts and participation in mutual guarantee funds of clearinghouses or providers of clearing and settlement services which acts as central counterparty. - - 19,727,477 16,768,355 Derivatives whose replacement values are higher than or equal to zero 17,958,433 - 9,748,994 4,260,921 Derivatives whose replacement values are less than zero, gross of the deduction of any collateral provided as a result of deposit of variation margin - - 959,279 959,279 All other assets not included in the above categories 81,972,665 133,674,148 8,956,505 101,672,608 239,040,102 Off-balance sheet transactions 778,961,391 8,773,622 - - 15,319,091 Total Required Stable Funding (RSF) 1,202,059,545 NSFR (%) 124.8% 1) Corresponds to the total amount of Available Stable Funding (ASF) or Required Stable funding (RSF). 2) Corresponds to the amount after application of weighting factors. 3) Corresponds to the Available Stable Funding (ASF) or Required Stable Funding (RSF). R$ thousand Total Adjusted Value (1) 12/31/2025 09/30/2025 Total Available Stable Funding (ASF) 1,499,680,491 1,408,603,125 Total Required Stable Funding (RSF) 1,202,059,545 1,142,829,435 NSFR (%) 124.8% 123.3% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. Itaú Unibanco has an Available Stable Funding (ASF) amounted to 1,499.7 billion in the 4 quarter, mainly composed of Capital, Retail Funding and Wholesale. In addition, the Required Stable Funding (RSF) amounted to 1,202.1 billion in the 4 quarter, which is mostly composed of loans and financing granted to wholesale, retail, central economies and central bank operations. The table shows that the NSFR at the end of the quarter is 124.8%, above the limit of 100%, and therefore the institution has Available Stable Funding to support the Required Stable Funding comfortably in the long- term, according to the metric. LIQ2: Net Stable Funding Ratio (NSFR)

------

![](riskandcapitalmanagement032.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 28 Credit Risk CRA: Qualitative information on credit risk management Itaú Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the borrower's, issuer's or counterparty's credit rating; reduction of profits or income; benefits granted upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the institution's risk appetite for each market segment in which Itaú Unibanco operates. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itaú Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are also function of this structure. Itaú Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase, with the periodic monitoring of troubled assets, which are defined as: • Overdue Transactions for more than 90 days; • Restructured Operations; • Counterparties that present inability to pay, whether by legal measures, judicial reorganization, bankruptcy, loss, among others; • Significant deterioration in credit quality, which can be identified by deterioration in internal rating metrics, guarantees honored, among others. Additionally, if it is identified that a CNPJ may contaminate the counterparties, they may be marked as Troubled Assets. The monitoring contains information on significant exposures, including recovery history and prospects, as well as restructuring information. These analyzes are generated monthly for executives and quarterly for the Board of Directors through the Risk and Capital Management Committee (CGRC). There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. Such structure is subjected to internal and external auditing processes. The credit's portfolio, policies and strategies are continuously monitored so as to ensure compliance with the rules and laws in effect in each country. The key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itaú Unibanco's credit policy is based on internal factors, such as: client rating criteria, performance and evolution of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others.

------

![](riskandcapitalmanagement033.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 29 With respect to individuals, small and medium companies, retail public, the credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itaú Unibanco already has a relationship) models. For wholesale public e agro, the classification is based on information such as the counterparty's economic and financial situation, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itaú Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itaú Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itaú Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itaú Unibanco also has a specific structure and processes aimed at ensuring that other aspects of credit risk, such as country risk, are managed and controlled, described in the item "Other Risks". In compliance with CMN Resolution 4,557, the document "Public Access Report: Credit Risk Management and Control Policy", which describes the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section "Itaú Unibanco", under "Corporate Governance", "Policies", "Reports". CR1: Credit Quality of Asset R$ million 12/31/2025 Gross carrying values of Allowances, Unearned Revenues and ECL accounting provision (c) Allowances, Unearned Revenues and ECL accounting provision (c). Of Which: RWA CPAD Allowances, Unearned Revenues and ECL accounting provision (c). Of Which: RWA CIRB Net values (a+b-c) Defaulted exposures (a) Non- defaulted exposures (b) Loans 54,350 1,155,891 108,018 107,514 504 1,102,222 Debt Securities 4,751 722,781 3,055 - - 724,476 in which: Sovereigns - 388,895 124 - - 388,770 in which: Other Debts 4,751 333,886 2,931 - - 335,706 Off - balance sheet exposures - 716,866 1,794 1,793 1 715,073 Total 59,101 2,595,538 112,867 109,307 505 2,541,771

------

![](riskandcapitalmanagement034.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 30 CR2: Changes in Stock of Problem Assets R$ million Total Exposures classified as problem assets at the end of the previous period (09/30/2025) 30/09/202562,140 Value of transactions classified as problem assets in the current period 16,448 Value of exposures that are no longer characterized as problem assets in the current period (1,545) Amount written off (10,209) Other changes (7,733) Exposures classified as problem assets at end of the reporting period (12/31/2025) 31/12/202559,101 CRB: Additional disclosure related to the credit quality of assets The tables below contain additional disclosure related to the credit quality exposures reported in the table CR1. Where is informed breakdown of exposures by geographical area, industry and defaulted exposures. In addition, the total exposures by residual maturity by delay range, the total of restructured exposures and the percentage of the ten and one hundred largest exposures are reported. Exposure by industry Total Exposure Total problematic assets and debt securities R$ million 12/31/2025 R$ million 12/31/2025 Portfolio Portfolio Total Exposure (Net values) Total Exposure (Gross values) Problematic Assets Expected Credit Loss Write-off Companies 1,560,678 1,589,558 Companies 20,930 9,803 1,968 Public sector 487,555 487,763 Public sector - - 15 Energy 2,287 2,287 Energy - - - Petrochemical and Chemical 7,980 7,981 Petrochemical and Chemical - - - Sundry 477,288 477,495 Sundry - - 15 Private sector 1,073,123 1,101,795 Private sector 20,930 9,803 1,953 Sugar and Alcohol 3,980 4,067 Sugar and Alcohol 30 23 - Agribusiness and Fertilizers 40,124 40,873 Agribusiness and Fertilizers 626 266 52 Food and Beverage 54,366 55,790 Food and Beverage 974 522 111 Banks and Other Financial Institutions 111,193 111,420 Banks and Other Financial Institutions 85 26 10 Capital Assets 20,151 20,935 Capital Assets 1,046 406 32 Pulp and Paper 19,726 19,906 Pulp and Paper 71 28 2 Electronic and IT 24,230 25,067 Electronic and IT 707 400 61 Packaging 7,068 7,259 Packaging 117 72 15 Energy and Sewage 78,813 80,123 Energy and Sewage 946 495 3 Education 9,131 9,505 Education 171 96 25 Pharmaceuticals and Cosmetics 25,581 26,411 Pharmaceuticals and Cosmetics 481 254 126 Real Estate Agents 76,930 78,882 Real Estate Agents 2,532 893 141 Entertainment and Tourism 21,982 23,155 Entertainment and Tourism 617 362 125 Wood and Furniture 11,831 12,366 Wood and Furniture 348 188 57 Construction Material 13,607 14,316 Construction Material 316 197 54 Steel and Metallurgy 25,820 26,635 Steel and Metallurgy 530 270 54 Media 1,753 1,786 Media 17 10 1 Mining 13,534 13,660 Mining 105 21 7 Infrastructure Work 20,424 21,334 Infrastructure Work 194 79 45 Oil and Gas 20,924 21,514 Oil and Gas 278 160 35 Petrochemical and Chemical 27,907 28,772 Petrochemical and Chemical 416 183 16 Health Care 13,855 14,413 Health Care 236 115 30 Insurance and Reinsurance and Pension Plans 1,300 1,306 Insurance and Reinsurance and Pension Plans - - - Telecommunications 20,712 21,765 Telecommunications 123 73 5 Clothing and Footwear 11,815 12,230 Clothing and Footwear 224 129 30 Trading 6,502 6,631 Trading 83 43 12 Transportation 52,112 54,860 Transportation 1,118 539 193 Domestic Appliances 5,838 5,954 Domestic Appliances 86 37 10 Vehicles and Autoparts 47,097 48,350 Vehicles and Autoparts 557 292 75 Third Sector 1,401 1,411 Third Sector 6 4 - Publishing and Printing 6,913 7,194 Publishing and Printing 150 87 28 Commerce - Sundry 59,513 62,153 Commerce - Sundry 2,596 1,280 342 Industry - Sundry 10,486 10,615 Industry - Sundry 107 49 11 Sundry Services 146,907 150,136 Sundry Services 3,386 1,439 236 Sundry 59,597 61,001 Sundry 1,651 765 9 Individuals 981,093 1,065,081 Individuals 38,171 18,976 8,241 Total 2,541,771 2,654,639 Total 59,101 28,779 10,209

------

![](riskandcapitalmanagement035.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 31 Exposure by remaining maturity R$ million 12/31/2025 R$ million 12/31/2025 Remaining maturities of transactions (Net values) (1) Remaining maturities of transactions (Gross values) (1) up to 6 months 6 to 12 months 1 to 5 years above 5 years Total up to 6 months 6 to 12 months 1 to 5 years above 5 years Total 514,949 185,518 797,636 461,779 1,959,882 542,084 189,081 854,033 487,051 2,072,249 1) Do not consider the amount of credits to be released. Overdue exposures R$ million 12/31/2025 Gross portfolio Overdue amounts (1) Less than 30 days 9,144 31 to 90 days 15,103 91 to 180 days 13,161 181 to 365 days 16,905 above 365 days 666 Total 54,979 1) According to Resolution 54, the table follows the same scope as table CR1. Exposure by geographical area in Brazil and by country Total Exposure Total problematic assets and debt securities R$ million 12/31/2025 R$ million 12/31/2025 Portfolio Portfolio Total Exposure (Net values) Total Exposure (Gross values) Problematic Assets Expected Credit Loss Write-off Southeast 1,181,676 1,240,142 Southeast 30,145 15,320 5,350 South 208,404 221,676 South 6,673 3,236 1,169 North 33,208 37,358 North 1,576 816 359 Northeast 152,907 166,495 Northeast 6,524 3,534 1,591 Midwest 95,714 103,716 Midwest 3,619 1,864 735 National territory (1) 388,770 388,894 National territory (1) - - - Brazil 2,060,679 2,158,281 Brazil 48,537 24,770 9,204 Argentina 198 203 Argentina - - - Chile 211,912 216,510 Chile 7,495 2,561 660 Colombia 42,033 50,658 Colombia 1,782 731 268 United States 52,716 52,671 United States - - - Paraguay 34,922 35,595 Paraguay 374 292 29 United Kingdom 24,473 25,028 United Kingdom 511 155 - Swiss 3,088 3,089 Swiss - - - Uruguay 59,131 59,819 Uruguay 394 266 48 Other 52,619 52,785 Other 8 4 - Foreign 481,092 496,358 Foreign 10,564 4,009 1,005 Total 2,541,771 2,654,639 Total 59,101 28,779 10,209 1) Considers only Brazilian goverment bonds. Largest debtors exposures R$ million 12/31/2025 Loans, Debt Securities and Off-balance sheet exposures (CR1) (1) Exposure % of portfolio 10 largest debtors 462,700 17.0% 100 largest debtors 642,682 23.6% 1) According to Resolution 54, the table follows the same scope as table CR1, in which the exposure value considers sovereign debt securities. Restructured exposures

------

![](riskandcapitalmanagement036.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 32 R$ million 12/31/2025 Problem Assets Others Restructured Exposures (1) 13,235 5,073 1) Restructured exposures in place as a consequence of the new resolution 4.966 in the current competence. CRC: Qualitative disclosure related to Credit Risk Mitigation techniques Itaú Unibanco uses guarantees to increase its recovery capacity in operations subject to credit risk. The guarantees used can be financial, credit derivatives, fiduciary, real, legal structures with mitigation power and offsetting agreements. For these guarantees to be considered as credit risk mitigating instruments, it is necessary that they comply with the requirements and determinations of the that regulate them, whether internal or external, and that they are legally enforceable (effective), enforceable and regularly evaluated. The information regarding the possible concentration associated with the mitigation of credit risk considers these different mitigating instruments, segregating by type and by provider. For reasons of confidentiality, the institution determines the non-disclosure of information beyond the classification of the type of guarantor, but ensuring adherence to the general requirements. • Fiduciary Guarantees and credit derivatives: a third party assumes the responsibility for fulfilling the obligation contracted by the debtor, which falls on the general equity of that third party. Avals, sureties and CDS are examples of these guarantees. Fiduciary guarantees are segregated into the following providers: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions, Sovereigns, National Treasury or Central Bank. Itaú Unibanco also uses credit derivatives to mitigate the credit risk of its securities portfolios. These instruments are priced based on models that use the fair price of market variables, such as credit spreads, recovery rates, correlations and interest rates. They are also segregated into: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions and Sovereigns. • Real and Financial Guarantees: the borrower itself or a third party detaches one or more financial assets and/or one or more goods and/or one or more receivables, in such a way as to guarantee repayment to the creditor in the event of default. These guarantees are segregated by type: financial collateral, bilateral contracts, and assets. • Clearing and Settlement of Obligations Agreement and legal structures with mitigating power: the clearing agreement aims to reduce the risk of credit exposure of one party to the other, resulting from transactions entered into between them, so that, in case of maturity, after offsetting, the net amount owed by the debtor to the creditor is identified. It is commonly used in derivative transactions, but it can also cover other types of financial transactions. In legal structures with mitigation power and compensation agreements, mitigation is based on methodologies established and approved by the business units responsible for credit risk management and by the centralized credit risk control area. Such methodologies consider factors related to the legal enforceability of the guarantees, the costs necessary for such and the expected value in the execution, taking into account the volatility and liquidity of the market.

------

![](riskandcapitalmanagement037.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 33 To control the mitigating instruments, there is periodic monitoring that monitors the level of compliance with the use of each instrument when compared to internal measurement policies, even including corrective action plans when there is noncompliance, analyzing concentration, types, providers, formalization. The parameters used are: HE (Haircut of execution) which evaluates the probability of success in executing the guarantee, HV (Volatility Haircut) represents the liquidity of the collateral being offered, and LMM (Maximum Mitigation Limit) which is the mitigation ceiling for real guarantees. CR3: Credit Risk mitigation techniques - overview(1) R$ million 12/31/2025 Unsecured Exposures Secured Exposures Exposures secured by collateral Exposures secured by financial guarantees Exposures secured by credit derivatives Loans 948,710 110,679 7,973 102,706 - Debt securities 475,901 549 422 128 - in which: Sovereigns 172,381 3,899 1,626 2,273 - in which: Other Debts 469,856 1,197 1,198 - - Total 2,066,848 116,324 11,219 105,107 - Of which: problem assets 16,154 44 44 - - 1) The mitigating instruments contemplated in this table are those foreseen in BACEN Circular 3,809. There was an increase in exposures related to credit origination

------

![](riskandcapitalmanagement038.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 34 CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects R$ million 12/31/2025 Exposures before CCF and CRM Exposures post-CCF and CRM RWA and RWA density Asset classes On- balance sheet amount (a) Off- balance sheet amount (b) On- balance sheet amount (c) Off- balance sheet amount (d) RWA (e) Off- balance sheet amount [e/(c+d)] Sovereigns and their central banks 602,136 651 602,136 651 24,938 4% Non-central government public sector entities 7,811 320 7,811 135 5,345 67% Multilateral development banks - - - - - Banks and other Financial Institutions authorized by Brazil Central Bank 179,517 12,294 179,517 7,560 73,303 39% Covered bonds - - - - - - Corporate 488,165 188,461 488,165 112,440 474,324 79% Of which: specialised landings - 109 - 109 87 80% Of which: others 488,165 188,352 488,165 112,331 474,237 79% Subordinate debt, equity and other capital 34,206 - 34,206 - 60,305 176% Retail 355,767 484,249 355,767 49,723 268,027 66% Real Estate 240,103 6,210 240,103 4,649 110,050 45% Of which: exposures secured by residential real estate where repayment is not materially dependent on cash flows generated by property. 181,814 1,126 181,814 289 52,299 29% Of which: exposures secured by residential real estate where repayment is materially dependent on cash flows generated by property. 35,478 1,563 35,478 953 37,726 104% Of which: exposures secured by commercial real estate where repayment is not materially dependent on cash flows generated by property. 10,524 559 10,524 445 9,549 87% Of which: exposures secured by commercial real estate where repayment is materially dependent on cash flows generated by property. 3,718 3 3,718 3 3,489 94% Of which: Land acquisition, development and construction. 8,569 2,959 8,569 2,959 6,987 61% Problem assets 15,077 2,653 15,077 1,121 19,382 120% Other assets 84,111 - 84,111 - 84,086 100% Total 2,006,893 694,838 2,006,893 176,279 1,119,760 51%

------

![](riskandcapitalmanagement039.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 35

------

![](riskandcapitalmanagement040.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 36 CR5: Standardized Approach – exposures by asset classes and risk weights R$ million Risk weight (FPR) 12/31/2025 Asset classes 0% 20% 50% 100% 150% 200% Others Total credit exposures amount (post CCF and post-CRM) Sovereigns and their central banks 549,402 21,202 26,171 4,389 44 1,579 - 602,787 Asset classes 20% 50% 100% 150% Others Total credit exposures amount (post CCF and post-CRM) Non-central government public sector entities 365 - 1,591 720 5,270 7,946 Asset classes 0% 20% 30% 50% 100% 150% Others Total credit exposures amount (post CCF and post-CRM) Multilateral development banks - - - - - - - - Asset classes 20% 30% 40% 50% 75% 100% 150% Others Total credit exposures amount (post CCF and post- CRM) Banks and other Financial Institutions authorized by Brazil Central Bank 69,013 11,811 90,226 1,851 - 528 12,341 1,307 187,077 Asset classes 10% 15% 20% 25% 35% 50% 100% Others Total credit exposures amount (post CCF and post- CRM) Covered bonds - - - - - - - - -

------

![](riskandcapitalmanagement041.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 37 R$ million Risk weight (FPR) 12/31/2025 Asset classes 20% 50% 65% 75% 80% 85% 100% 130% 150% Others Total credit exposures amount (post CCF and post-CRM) Corporate - 51,691 233,109 - 109 71,777 236,486 - - 7,433 600,605 Of which: specialised landings - - - - 109 - - - - - 109 Of which: others - 51,691 233,109 - - 71,777 236,486 - - 7,433 600,496 Asset classes 100% 150% 250% 400% Others Total credit exposures amount (post CCF and post-CRM) Subordinate debt, equity and other capital - 3,769 - - 30,437 34,206 Asset classes 45% 75% 100% Others Total credit exposures amount (post CCF and post-CRM) Retail 77,788 279,567 254 47,881 405,490 R$ million Risk weight (FPR) 12/31/2025 Asset classes 0% 20% 25% 30% 35% 40% 45% 50% 60% 65% 70% 75% 85% 90% 100% 105% 110% 150% Others Total credit exposures amount (post CCF and post-CRM) Real Estate 38 49,578 29,964 84,080 3,500 17,832 4,242 11,073 1,006 1,113 5,732 2,428 2,551 860 7,370 395 1,798 21,176 16 244,752 Of which: exposures secured by residential real estate where repayment is not materially dependent on cash flows generated by property. 24 49,578 29,964 77,886 17,832 2,048 - 4,680 1 - - 86,0 - 4 182,103 Of which: no loan splitting applied 24 49,578 29,964 77,886 17,832 2,048 - 4,680 1 - - 86,0 - 4 182,103 Of which: others - - - - - - - - - - - - - - Of which: exposures secured by residential real estate where repayment is materially dependent on cash flows generated by property. 6,194 3,500 4,242 647 362 309 21,176 1 36,431 Of which: exposures secured by commercial real estate where repayment is not materially dependent on cash flows generated by property. 14 - - - - 359 1,113 2,065 2,361 5,057 - - 10,969 Of which: no loans splitting applied 14 - - - - 359 - - - - - - 373 Of which: others - - - - - - - 1,113 2,065 2,361 5,057 - - 10,596 Of which: exposures secured by commercial real estate where repayment is materially dependent on cash flows generated by property. 1,052 860 1,798 - 11 3,721 Of which: Land acquisition, development and construction. 9,025 190 2,313 - - 11,528

------

![](riskandcapitalmanagement042.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 38 R$ million Risk weight (FPR) Asset classes 50% 100% 150% Others Total credit exposures amount (post CCF and post-CRM) Problem Assets 69 9,562 6,523 44 16,198 Asset classes 0% 20% 100% 1250% Others Total credit exposures amount (post CCF and post-CRM) Other assets 26 - 84,085 - - 84,111

------

![](riskandcapitalmanagement043.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 39 Exposure amounts and CCFs applied to off-balance sheet exposures, categorised based on risk bucket of converted exposures. R$ milion 12/31/2025 Risk weight (2) On balance sheet exposure Off-balance sheet exposure (pre-CCF) Weighted average CCF (1) Total exposure (post- CCF and post-CRM) Less than 40% 828,364 4,759 57% 831,094 40 - 70% 480,743 317,660 29% 571,324 75% 254,934 260,083 10% 281,995 80 - 85% 66,133 40,170 21% 74,436 90 - 100% 300,091 67,242 67% 345,124 105 - 130% 2,591 79 22% 2,608 150% 42,021 4,845 53% 44,575 160% 20,517 - - 20,517 200% 1,579 - - 1,579 220 - 250% 9,920 - - 9,920 400% - - - - 1250% - - - - Total Exposure 2,006,893 694,838 25% 2,183,172 1) Weighting is based on off-balance sheet exposure (pre-CCF). 2) The FPRs applied to equity exposures follow the chronogram defined in Article 85 of BCB Resolution 229/2022. The increases in the total exposure fields in tables CR4 and CR5 occurred mainly in the lines for Central governments and their respective central banks, Non-financial legal entities, Financial institutions and other entities authorized by the Central Bank of Brazil, Retail exposures, and Exposures secured by real estate. CRE: Qualitative disclosure related to IRB models To calculate regulatory credit risk capital, two approaches can be used, the standardized and the IRB (Internal Ratings Based). standardized and IRB (Internal Ratings Based). Itaú Unibanco was approved to use the IRB approach by the Central Bank for its rural credit business unit (Agribusiness). The IRB approach allows the use of internal models to calculate regulatory capital for credit risk, To this end, internal estimates of Probability of Default (PD), Loss Given Default (LGD) and Exposure at Default (EAD) are used. A client's PD is directly associated with its internal credit risk rating. This rating is based on internal models used in the loan granting process. This classification is based on financial and qualitative aspects of individual customers. Since PD is the probability of a creditor defaulting, it is estimated based on the portfolio information. The calculation seeks to predict the possibility of default occurring in the next twelve months for each credit rating, using the average profile of the portfolio over the last five years, in accordance with BCB Resolution No. 303. In addition, we respect the 0.05% floor for PD values, as established in Chapter II of the regulation. The EAD is the expected value for the creditor's balance at the time of default. This value is derived from the balance at the time of valuation combined with possible movements that may the debtor balance up to the moment of default, considering the possibility of credit available to the client. In order to estimate the FCC (Credit Conversion Factor), credit conversion data was used considering the balances and credit conversion considering creditors' available balances and limits 12 months before the moment of default for revolving products. The financial institution stores data for a period of seven years, fulfilling the minimum requirement set out in Article 102 of Resolution No. 303. The LGD is the estimation of the percentage of EAD that the institution will fail to recover in the event of default. This estimation is based on the events of default that have occurred and the subsequent behavior of net recoveries

------

![](riskandcapitalmanagement044.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 40 at present values1. Using the minimum period required by Article 102 of Resolution No. 303 as a starting point, recovery data is stored for a workout period sufficient to capture at least 90% of the observed recovery flow and clients after the moment of default. In the process of assigning the LGD parameter to each customer within the institution, possible factors that mitigate potential future losses are taken into account in order to obtain a fair value of this parameter, these mitigations are in compliance with the Resolution No. 303. In addition to the parameter models, the agribusiness portfolio has a set of models that are used to rank and classify the risk of the different counterparties (Risk Rating and Behavior Score models), based on the size of the counterparty, the niche in which it operates and the commercial strategy of the segment. The models used in the concession process are developed by the modeling area in partnership with the credit analysis area, based on information from clients' financial statements, their history of behavior with the institution and in the market, in the evaluation of its management and governance process through internal data, bureaus and market information. These models assign a credit rating/score to each of the creditors allowing them to segregate very low-risk clients from higher-risk clients within an internal classification. Based on this internal classification assigned the risk parameters that will be used in the process of measuring and managing risk and, consequently, estimating capital in accordance with the methodology defined by the Central Bank in BCB Resolution 303. Each of the models listed above goes through an approval governance that involves the area area and the independent validation area. The area is in a segregated structure from the validation area in order to guarantee independence of action. The decision on whether or not to approve or not of the model is made in the Comitê Técnico de Avaliação de Modelos (Technical Committee for Model Evaluation) where information about the model is presented, such as scope, definition of use, replicability, stability, adherence, discrimination and, finally, the opinion of the validation area. After this process, the model is still subject to periodic annual evaluations in order to determine whether or not there is a need for adjustments to the model. This monitoring is carried out by the independent validation area and its results can be found in table CR9 of this report. Additionally, the operational risk and internal audit teams evaluate the adherence of the models in relation to the normative aspects of BCB Resolution 303 itself. EAD (in %) EAD covered by the various approaches Standardized approach Foundation Approach (F-IRB) Advanced Approach (A-IRB) Agribusiness 0% 0% 100% Wholesale 0% 0% 100% Retail 0% 0% 100% Portfolio Model component Number of models Description Agribusiness PD 1 Model used to measure the probability of default in each of the classifications. EAD 1 Model used to allocate the balance at the time of of default. LGD 1 Model that determines the portion of EAD that wil not be recovered. Portfolio Model RWACIRB (%) Agribusiness PD 100% Wholesale EAD 100% Retail LGD 100% [1] Deducted from economic recoveries are deducted from the costs necessary to recover the amounts, such as legal fees and collection costs.

------

![](riskandcapitalmanagement045.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 41 CR6: IRB – Credit risk exposures by portfolio and PD range (1)(2) R$ million 12/31/2025 Porfolio PD scale Original on- balance sheet gross exposure Off- balance sheet exposures pre CCF Average CCF EAD post CRM and post- CCF Average PD Number of obligors Average LGD Average maturity RWA RWA density EL Provisions Wholesale, excluding financial receivables and the subcategory "revenue-generating real estate development" - A-IRB 0.00 to <0.15 31,776 4,051 52.70% 33,911 0.08% 203 46.43% 2.7 8,882 26.19% 13 0.15 to <0.25 18,662 3,638 35.64% 19,959 0.18% 314 45.97% 2.4 8,114 40.65% 17 0.25 to <0.50 37,928 6,169 26.50% 39,564 0.31% 1,433 38.51% 2.0 16,333 41.28% 47 0.50 to <0.75 10,519 654 18.73% 10,641 0.57% 577 31.84% 2.0 4,911 46.14% 19 0.75 to <2.50 15,945 3,189 22.69% 16,669 1.33% 1,489 28.72% 2.0 9,123 54.73% 63 2.50 to <10.00 4,133 459 35.43% 4,295 4.27% 457 25.72% 1.9 3,019 70.29% 62 10.00 to <100.00 3,029 70 14.73% 3,039 30.00% 359 27.20% 2.3 3,727 122.61% 237 100.00 (Default) 2,832 37 18.15% 2,839 100.00% 418 40.69% 2.4 9,675 340.77% 1,155 Sub Total Sub Total 124,825 18,266 33.35% 130,917 3.31% 5,250 39.27% 2.3 63,784 48.72% 1,613 1,662 Other retail exposures, excluding retail receivables - A-IRB 0.00 to <0.15 - - - - - - - - - - - 0.15 to <0.25 - - - - - - - - - - - 0.25 to <0.50 - - - - - - - - - - - 0.50 to <0.75 - - - - - - - - - - - 0.75 to <2.50 - - - - - - - - - - - 2.50 to <10.00 - - - - - - - - - - - 10.00 to <100.00 - - - - - - - - - - - 100.00 (Default) 1 - - 1 100.00% 6 80.46% 1.0 - 21.74% 1 Sub Total Sub Total 1 - - 1 100.00% 6 80.46% 1.0 - - 1 1 Agribusiness 0.00 to <0.15 31,776 4,051 52.70% 33,911 0.08% 203 46.43% 2.7 8,881 26.19% 13 0.15 to <0.25 18,662 3,638 35.64% 19,959 0.18% 314 45.97% 2.4 8,113 40.65% 17 0.25 to <0.50 37,928 6,169 26.50% 39,564 0.31% 1,433 38.51% 2.0 16,331 41.28% 47 0.50 to <0.75 10,519 654 18.73% 10,641 0.57% 577 31.84% 2.0 4,910 46.14% 19 0.75 to <2.50 15,945 3,189 22.69% 16,669 1.32% 1,489 28.72% 2.0 9,123 54.73% 63 2.50 to <10.00 4,133 459 35.43% 4,295 4.26% 457 25.72% 1.9 3,019 70.29% 62 10.00 to <100.00 3,029 70 14.73% 3,039 27.99% 359 27.20% 2.3 3,726 122.61% 237 100.00 (Default) 2,834 37 18.15% 2,840 100.00% 424 40.71% 2.4 9,675 340.64% 1,156 Sub Total 124,826 18,266 33.35% 130,918 3.31% 5,256 39.27% 2.3 63,784 48.72% 1,614 1,663 1) Transactions subject to counterparty credit risk are excluded, in accordance with BCB Normative Instruction No. 532. 2) Considers RWA internal models.

------

![](riskandcapitalmanagement046.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 42 CR7: IRB – Effect on RWA of credit derivatives used as CRM techniques (1)(2) R$ million 12/31/2025 Pre-credit derivatives RWA Actual RWA Financial Institutions - F-IRB - - Wholesale, excluding financial receivables and the subcategory "revenue-generating real estate development" - F-IRB - - Wholesale, excluding financial receivables and the subcategory "revenue-generating real estate development" - A-IRB 63,784 63,784 Revenue-generating real estate development - F-IRB - - Revenue-generating real estate development - A-IRB - - Wholesale receivables - F-IRB - - Wholesale receivables - A-IRB - - Retail – qualifying revolving - A-IRB - - Residential mortgages - A-IRB - - Other retail exposures, excluding retail receivables - A-IRB - - Retail receivables - A-IRB - - Total 63,784 63,784 of which: rural credit business unity 63,784 63,784 1) Transactions subject to counterparty credit risk are excluded, in accordance with BCB Normative Instruction No. 532. 2) Considers RWA internal models. CR8: RWA flow statements of credit risk exposures under IRB (1)(2) a R$ million RWA amounts RWA as at end of previous reporting period (09/30/2025) 09/30/2025 62,006 Asset size 2,482 Asset quality (1,007) Model updates - Methodology and policy - Acquisitions and disposals - Foreign exchange movements 302 Other - RWA as at end of reporting period (12/31/2025) 12/31/2025 63,784 1) Transactions subject to counterparty credit risk are excluded, in accordance with BCB Normative Instruction No. 532. 2) Considers RWA internal models. CR9: IRB – Backtesting of probability of default (PD) per portfolio

------

![](riskandcapitalmanagement047.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 43 CR9: IRB – Backtesting of probability of default (PD) per portfolio R$ million 12/31/2025 Portfolio PD Range Weighted average PD Arithmetic average PD by obligors Arithmetic average PD by obligors Number of obligors Defaulted obligors in the year of which: new defaulted obligors in the year Average historical annual default rate End of previous year End of the year Wholesale, excluding financial receivables and the subcategory "revenue-generating real estate development" - A-IRB 0.00 to <0.15 0.08% 0.09% 204 203 4 1 0.18% 0.15 to <0.25 0.18% 0.18% 347 314 3 1 0.24% 0.25 to <0.50 0.31% 0.32% 1,345 1,433 58 2 0.48% 0.50 to <0.75 0.57% 0.58% 962 577 19 2 0.26% 0.75 to <2.50 1.33% 1.37% 1,364 1,489 86 1 1.35% 2.50 to <10.00 4.27% 4.37% 461 457 78 3 2.24% 10.00 to <100.00 30.00% 28.20% 186 359 89 4 11.73% 100.00 (Default) 100.00% 100.00% 211 418 - - - Subtotal 5,080 5,250 337 14 1.50% Other retail exposures, excluding retail receivables - A-IRB 0.00 to <0.15 - - - - - - - 0.15 to <0.25 - - - - - - - 0.25 to <0.50 - - 4 - - - - 0.50 to <0.75 - - 2 - - - - 0.75 to <2.50 - - 4 - 2 - - 2.50 to <10.00 - - 1 - 1 - - 10.00 to <100.00 - - - - 1 1 - 100.00 (Default) 100.00% 100.00% 3 6 - - - Subtotal 14 6 4 1 - Agribusiness 0.00 to <0.15 0.08% 0.09% 204 203 4 1 0.18% 0.15 to <0.25 0.18% 0.18% 347 314 3 1 0.24% 0.25 to <0.50 0.31% 0.32% 1,349 1,433 58 2 0.48% 0.50 to <0.75 0.57% 0.58% 964 577 19 2 0.26% 0.75 to <2.50 1.33% 1.37% 1,368 1,489 88 1 1.35% 2.50 to <10.00 4.27% 4.37% 462 457 79 3 2.24% 10.00 to <100.00 30.00% 28.20% 186 359 90 5 11.73% 100.00 (Default) 100.00% 100.00% 214 424 - - 100.00% Total 5,094 5,256 341 15 1.50%

------

![](riskandcapitalmanagement048.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 44 Regarding the result of the column "Historical average annual default rate", a model miscalibration was reported on November 2025, concerning the probability of default model for the Agribusiness segment, formally registered under AR002754, with the following description: "More than three consecutive warning indicators were reported at the CTAM meeting on 11/07/2025 for Wholesale models, triggering consequence management in accordance with the applicable governance framework. The affected models were: MRM24_365: PD Agro MRM21_594: Lifetime PD – Large Corporates MRM21_26: Lifetime PD – Middle Market" The new PD AGRO model (MRM25_681) was approved at the CTAM meeting on January 26, 2026, with effects observed as of the January 2026 closing, thereby addressing the aforementioned issue. CMS1: Comparison of modelled and standardised RWA at risk level 12/31/2025 RWA RWA for modelled approaches that banks have supervisory approval to use RWA for portfolios where standardised approaches are used Total Actual RWA (a + b) (ie RWA which banks report as current requirements) RWA calculated using full standardised approach (ie RWA used in capital floor computation) Credit risk (excluding counterparty credit risk) 79,343 1,119,760 1,199,103 1,229,199 Counterparty credit risk 26,631 29,789 30,987 Securitisation exposures in the banking book 12,838 12,838 12,838 Market risk 44,760 5,488 50,248 61,438 Operational risk 143,006 143,006 143,006 Residual RWA 70,491 70,491 70,491 Total 124,103 1,378,214 1,505,475 1,547,959

------

![](riskandcapitalmanagement049.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 45 CMS2: Comparison of modelled and standardised RWA for credit risk at asset class level 12/31/2025 RWA R$ milion RWA for modelled approaches that banks have supervisory approval to use (a) RWA for column (a) if re- computed using the standardised approach (b) Total Actual RWA (ie RWA which banks report as current requirements) (c) RWA calculated using full standardised approach (ie RWA used in capital floor computation) (d) Sovereign - - Of which: categorised as MDB/PSE in SA - - Banks and other financial institutions - - - - Equity - - Purchased receivables - - - - Corporates 79,343 109,439 79,343 109,439 Of which: F-IRB is applied - - - - Of which: A-IRB is applied 79,343 109,439 79,343 109,439 Retail - - - - Of which: qualifying revolving retail - - - - Of which: other retail - - - - Of which: retail residential mortgages - - - - Specialized lending - - - - Of which: income-producing real estate and high volatility commercial real estate - - - - Others - - 1,119,760 1,119,760 Total 79,343 109,439 1,199,103 1,229,199 Of which: rural credit business unity 79,343 109,439 79,343 109,439 Counterparty Credit Risk (CCR) CCRA: Qualitative disclosure related to CCR Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itaú Unibanco has well-defined rules for calculating its managerial and regulatory exposure to this risk, and the models developed are used both for the governance of consumption of limits and management of counterparties sub-limits, as well as for the allocation of capital, respectively. The managerial volatility of the potential credit risk (PCR) of derivatives (interpreted as the amount of potential financial exposure that an operation can reach until its maturity) and the volatility of repurchase agreements and foreign exchange transactions are monitored periodically to maintain the exposure at levels considered acceptable by the institution's management. The risk may be mitigated by the use of margin call, initial margin or other mitigating instrument. Currently, Itaú Unibanco does not have impact in the amount of collateral that the bank would be required to provide given a credit rating downgrade. The regulatory exposures of counterparty credit risk are presented as follows.

------

![](riskandcapitalmanagement050.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 46 CCR1: Analysis of CCR exposures by approach R$ million 12/31/2025 Replacement cost Potential future exposure Multiplier applied to the calculation of EAD EAD post mitigation RWA SA-CCR Approach 12,896 8,898 1.4 30,512 19,907 CEM Approach - - - - Simple Approach for CCR mitigation (for SFTs and asset loans) - - Comprehensive Approach for CCR mitigation (for SFTs and asset loans) 754,348 7,402 Total 27,309 CCR3: Standardised approach – CCR exposures by regulatory portfolio and risk weights R$ million Risk weight (FPR) 12/31/2025 Counterparties 0% 10% 20% 50% 65% 85% 100% 150% Others Total Sovereigns 326,191 - 2 6 - - - - - 326,199 Non-central government public sector entities 4 - - - 72 - - - - 76 Multilateral development banks - - - - - - - - - - Banks and other Financial Institutions authorized by Brazil Central Bank 52,436 - 2,673 - - - 45 1,851 3,323 60,328 Corporates 369,487 - 30 - 9,612 1,423 15,421 - - 395,973 Other Counterparties 1,328 - - - 1 - 823 132 - 2,284 Total 749,446 - 2,705 6 9,685 1,423 16,289 1,983 3,323 784,860 In the CCR1 and CCR3 tables, there was a decrease in exposures to financial institutions and non-financial legal entities CCR5: Composition of collateral for CCR exposures R$ million 12/31/2025 Collateral used in derivative transactions Collateral used in SFTs and asset loans Fair value of collateral received Fair value of posted collateral Fair value of collateral received Fair value of posted collateral Segregated Unsegregated Segregated Unsegregated Cash - domestic currency - - - - 448,788 265,439 Cash - other currencies - 1,423 2,812 3,759 7,557 5,190 Domestic sovereign debt - - 12,032 - 266,105 394,016 Government agency debt - - 30,856 - 2,095 4,511 Corporate bonds - - - - 109 60,929 Equity securities - - 1,204 - - 3,252 Other collateral - - 94 - - - Total - 1,423 46,998 3,759 724,654 733,337 Decrease in collateral received and posted associated with repurchase agreement (Repo) transactions.

------

![](riskandcapitalmanagement051.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 47 CCR6: CCR associated with credit derivatives exposures In R$ million 12/31/2025 Protection bought Protection sold Notionals Single-name credit default swaps 22,639 29,059 Index credit default swaps 5,502 5,502 Total return swaps - 52,573 Total notionals 28,141 87,134 Fair values 95 153 Positive fair value (asset) 166 449 Negative fair value (liability) (71) (296) CCR8: CCR associated with Exposures to central counterparties R$ million 12/31/2025 EAD (post-CRM) RWA Exposures to qualifying CCPs (QCCPs total) 2,480 Exposures for trades at QCCPs (excluding initial margin and default fund contributions); of which 13,011 433 (i) over-the-counter (OTC) derivatives - - (ii) Exchange-traded derivatives 12,988 433 (iii) Securities financing transactions 23 - (iv) Netting sets where cross-product netting has been approved - - Segregated initial margin - Non-segregated initial margin 6,472 2,035 Pre-funded default fund contributions 122 12 Unfunded default fund contributions - - Exposures to non-qualifying CCPs (Non-QCCPs total) - Exposures for trades at non-QCCPs (excluding initial margin and default fund contributions); of which - - (i) over-the-counter (OTC) derivatives - - (ii) Exchange-traded derivatives - - (iii) Securities financing transactions - - (iv) Netting sets where cross-product netting has been approved - - Segregated initial margin - Non-segregated initial margin - - Pre-funded default fund contributions - - Unfunded default fund contributions - - There were a decrease in the balance of established financial collateral. Securitisation Exposures SECA: Qualitative disclosure requirements related to securitisation exposures Currently, Itaú Unibanco coordinates and distributes issues of securitized securities in the capital market with or without a firm placement guarantee. In case of exercising the firm guarantee, the bank will assume the risk as an investor in the operation.

------

![](riskandcapitalmanagement052.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 48 Itaú Unibanco is also in the position of investor, where the institution acquires the operations with priority classes, senior, mezzanine or subordinated, of the issuing vehicles. The investment decision process involves various factors, including risk analysis of the underlying assets, risk profile of the assets, return attributed to the issues, subordination mechanisms, among others. Itaú Unibanco does not act as a sponsoring counterpart of any specific purpose company with the objective of operating in the securitisation market, nor does it manage entities that acquire securities issued or originated by their own. In relation to accounting, it should be noted that (i) assets representing third-party securitisations are accounted for as well as other assets owned by the Bank, according to the brazilian accounting standards; and (ii) securitisation credits originating from Itaú Unibanco's own portfolio remain accounted for in cases of credit assignment with co- obligation. In 2025, Itaú Unibanco did not carry out the sale of credit securitization assets without substantial risk retention and did not assign exposures with substantial risk retention, which have been honored, repurchased or written off as loss. SEC1: Securitisation exposures in the banking book R$ million a c d e g h i k 12/31/2025 Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Synthetic Subtotal Traditional Synthetic Subtotal Traditional Synthetic Subtotal Retail (total) - of which - - - - - - 15,774 - 15,774 residential mortgage - - - - - - - - - credit card - - - - - - 2,936 - 2,936 other retail exposures - - - - - - 12,838 - 12,838 re- securitisation - - - - - - - - - Wholesale (total) - of which - - - - - - 12,962 - 12,962 loans to corporates - - - - - - 9,456 - 9,456 commercial mortgage - - - - - - 3,506 - 3,506 lease and receivables - - - - - - - - - other wholesale - - - - - - - - - re- securitisation - - - - - - - - SEC2: Securitisation exposures in the trading book In Itaú Unibanco's current securitization portfolio, there are no exposures to be reported in table SEC2. SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor In Itaú Unibanco's current securitization portfolio, there are no exposures to be reported in table SEC3. SEC4: Securitisation exposures in the banking book and associated capital requirements - bank acting as investor

------

![](riskandcapitalmanagement053.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 49 R$ million a b c d e h i l m p 12/31/2025 Exposure values (by risk weight bands) Exposure values (by regulatory approach) RWA (by regulatory approach) Capital Requirements ≤20% 20% < FPR < 50% 50% ≤ FPR < 100% 100% ≤ FPR < 1.250% 1250% Standardized approach 1250% Standardized approach 1250% Standardized approach 1250% Total exposures 10 21,131 3,217 4,377 - 28,736 - 12,838 - 1,027 - Traditional securitisation 10 21,131 3,217 4,377 - 28,736 - 12,838 - 1,027 - Of which securitisation 10 21,131 3,217 4,377 - 28,736 - 12,838 - 1,027 - Of which retail underlying 10 8,696 3,043 4,025 - 15,775 - 8,492 - 679 - Of which wholesale - 12,435 174 352 - 12,961 - 4,346 - 348 - Of which re- securitisation - - - - - - - - - - - Synthetic securitisation - - - - - - - - - - - Of which securitisation - - - - - - - - - - - Of which retail underlying - - - - - - - - - - - Of which wholesale - - - - - - - - - - - Of which re- securitisation - - - - - - - - - - - Market Risk MRA: Qualitative disclosure requirements related to market risk Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, equity and commodity prices, as set forth by CMN. Price Indexes are also treated as a risk factor group. The institutional policy for market risk is in compliance with Resolution 4,557 and establishes the management structure and market risk control, which has the function of: • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives; • Provide a disciplined and well informed dialogue on the overall market risk profile and its evolution over time; • Increase transparency as to how the business works to optimize results; • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and • Monitoring and avoiding the concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Resolution 111. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. The market risk management is based on the following key metrics: • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval;

------

![](riskandcapitalmanagement054.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 50 • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; • Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value ("MtM - Mark to Market"); and • Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: • Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; • Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and • Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. The structure of limits and alerts is in alignment with the board of directors' guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders' equity, liquidity, complexity and market volatility, as well as the Itaú Unibanco's risk appetite. The consumption of market risk limits is monitored and disclosed daily through exposure and sensitivity maps. The market risk area analyzes and controls the adherence of these exposures to limits and alerts and reports them timely to the Treasury desks and other structures foreseen in the governance. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations.

------

![](riskandcapitalmanagement055.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 51 MR1: Market risk under standardized approach R$ million 12/31/2025 Risk factors RWA MPAD Interest Rates 46,904 Fixed rate denominated in reais (RWA JUR1) 14,936 Foreign exchange linked interest rate (RWA JUR2) 12,996 Price index linked interest rate (RWA JUR3) 18,972 Interest rate linked interest rate (RWA JUR4) - Stock prices (RWA ACS) 1,308 Exchange rates (RWA CAM) 1,861 Commodity prices (RWA COM) 5,877 RWADRC 4,517 RWACVA 971 Total 61,438 The Standardized Approach metric (RWAMPAD) remained stable relative to the prior quarter, with impacts distributed between price index and currency coupon. The Internal Model metric (RWAMINT) declined compared to the prior quarter, primarily due to currency coupon movements. In accordance with BCB Resolution No. 111, no instruments were reclassified to the trading book or the banking book during the current quarter

------

![](riskandcapitalmanagement056.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 52 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) In the internal models approach, the stressed VaR and VaR models are used. These models are applied to operations in the Trading Book with the following risk factors: interest rates, inflation rates, exchange rates, stocks and commodities. The VaR and stressed VaR models are used in the companies of the Prudential Conglomerate that are presented in the following table:

------

![](riskandcapitalmanagement057.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 53 Institution Model Considered for Market Risk Acácia FIDC Direitos Creditórios LTDA VaR and Stressed VaR Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR Angico FIDC Segmento Infraestrutura e Agronegócio de Responsabilidade Limitada VaR and Stressed VaR Banco Investcred Unibanco S.A. VaR and Stressed VaR Banco Itaú (Suisse) S.A. VaR and Stressed VaR Banco Itaú Chile VaR and Stressed VaR Banco Itaú Consignado S.A. VaR and Stressed VaR Banco Itaú International VaR and Stressed VaR Banco Itaú Paraguay S.A. VaR and Stressed VaR Banco Itaú Uruguay S.A. VaR and Stressed VaR Banco Itaú Veículos S.A. VaR and Stressed VaR Banco ItauBank S.A. VaR and Stressed VaR Banco Itaucard S.A. VaR and Stressed VaR Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditórios VaR and Stressed VaR Dibens Leasing S.A. - Arrendamento Mercantil VaR and Stressed VaR FIDC B2cycle NPL VaR and Stressed VaR FIDC Cloudw Akira I VaR and Stressed VaR FIDC Kiwify VaR and Stressed VaR FIDC Mobilitas VaR and Stressed VaR FIDC Sumup Solo VaR and Stressed VaR Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento VaR and Stressed VaR Fundo De Invest Dir Creditórios Não Padron NPL II VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios IA VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios Soul VaR and Stressed VaR Fundo Fortaleza de Investimento Imobiliário VaR and Stressed VaR Fundo Kinea Ventures VaR and Stressed VaR IA II - Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada VaR and Stressed VaR Ideal Corretora de Titulos e Valores Mobiliarios S.A. VaR and Stressed VaR Ideal Holding Financeira S.A. VaR and Stressed VaR Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. VaR and Stressed VaR Iresolve Companhia Securitizadora de Créditos Financeiros S.A. VaR and Stressed VaR Itaú (Panamá) S.A. VaR and Stressed VaR Itaú Administradora de Consórcios Ltda. VaR and Stressed VaR Itaú Administradora de Fondos de Inversión S.A VaR and Stressed VaR Itaú Bank & Trust Bahamas Ltd. VaR and Stressed VaR Itaú Bank & Trust Cayman Ltd. VaR and Stressed VaR Itaú Bank, Ltd. VaR and Stressed VaR Itaú BBA Europe S.A. VaR and Stressed VaR Itaú BBA International Plc. VaR and Stressed VaR Itaú BBA Trading S.A. VaR and Stressed VaR Itaú BBA Trading S.A. - Sucursal Uruguay VaR and Stressed VaR Itaú BBA USA Securities Inc. VaR and Stressed VaR Itaú Chile New York Branch. VaR and Stressed VaR Itaú Cia. Securitizadora de Créditos Financeiros VaR and Stressed VaR Itaú Colombia S.A VaR and Stressed VaR Itaú Comisionista de Bolsa Colombia S.A. VaR and Stressed VaR Itaú Corredores de Bolsa Limitada VaR and Stressed VaR Itaú Corretora de Valores S.A. VaR and Stressed VaR Itaú Fiduciaria Colombia S.A. Sociedad Fiduciaria VaR and Stressed VaR Itaú International Securities Inc. VaR and Stressed VaR Itaú Invest Casa de Bolsa S.A. VaR and Stressed VaR Itau Isento Julho 28 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada VaR and Stressed VaR Itau Isento Marco 29 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada VaR and Stressed VaR Itau Isento Marco 30 FIC de Fundos Incentivados de Inv Financeiro em Infra RF Resp Limitada VaR and Stressed VaR Itau Isento Setembro 28 Fundo de Investimento em Cotas de FIIF em Infra RF Resp Limitada VaR and Stressed VaR Itau Isento Setembro 29 FIC de Fundos Incentivados VaR and Stressed VaR

------

![](riskandcapitalmanagement058.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 54 Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On December 31, 2025, VaR represented 53% of the capital requirement, while the stressed VaR represented 47%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco's portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with three different confidence intervals (99%, 97.5% and 95%), in three different historical windows (250, 500 and 750 working days). This includes nine different samples, therefore ensuring the statistical quality of the historical VaR hypothesis. Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento VaR and Stressed VaR Microinvest S.A. Soc. de Crédito a Microempreendedor VaR and Stressed VaR NC 2025 Fundo de Investimento em Direitos Creditórios VaR and Stressed VaR NC 2025 I Fundo de Investimento em Direitos Creditórios VaR and Stressed VaR Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior VaR and Stressed VaR Pont Sociedad Anónima VaR and Stressed VaR Redecard Instituição de Pagamento S.A. VaR and Stressed VaR Redecard Sociedade de Crédito Direto S.A VaR and Stressed VaR RT Itaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR Tangerina Fundo de Investimento em Direitos Creditórios - Responsabilidade Limitada VaR and Stressed VaR Tarumã 2 FIF Fundo Incentivado em Investimento em Deb de Infra RF Cred Priv Resp Limitada VaR and Stressed VaR Tarumã Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado VaR and Stressed VaR Théros Fundo de Investimento nas Cadeias Produtivas VaR and Stressed VaR TOP 2025 I Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada VaR and Stressed VaR Vitex FIF Fundo Incentivado em Investimento em Debêntures de Infra RF Cred Priv Resp Limitada VaR and Stressed VaR

------

![](riskandcapitalmanagement059.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 55 Itaú Unibanco has a set of processes, which are periodically executed by the internal control teams, whose objective is to independently replicate the metrics that influence market risk capital by internal models. In addition to the results of the periodic processes, Itaú Unibanco assesses the process of measuring time horizons by risk factors and the estimate of the stress period for calculating the stressed VaR. The validation of the internal model includes several topics considered essential for the critical analysis of the model, such as, the evaluation of the model's limitations, the adequacy of the parameters used in the volatility estimate and the comprehensiveness and reliability of the input data. MR2: RWA flow statements of market risk exposures under an IMA Exposures subject to market risk The following table presents the exposures subject to market risk in the internal models approach, for calculating the capital requirement. a b e f R$ million VaR Stressed VaR Other Total RWA MINT RWAMINT - 09/30/2025 30/09/2025 17,274 15,568 736 33,578 Movement in risk levels (1,832) 1,464 - (368) Updates/changes to the internal model - - - - Methodology and regulation - - - - Acquisitions and disposals - - - - Foreign exchange movements 2 (3,308) - (3,306) Other - - 781 781 RWADRC - - RWACVA - - RWAMINT - 12/31/2025 31/12/2025 15,444 13,724 1,517 30,685 The Internal Model (RWAMINT) metric decreased compared to the previous quarter, with impacts mainly on currency coupons.

------

![](riskandcapitalmanagement060.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 56 MR3: IMA values for trading portfolios The following table presents the VaR and stressed VaR values determined by the internal market risk models. R$ million 12/31/2025 VaR (10 days, 99%) Maximum value 459 Average value 292 Minimum value 194 Quarter end 286 Stressed VaR (10 days, 99%) Maximum value 464 Average value 366 Minimum value 310 Quarter end 319 VaR remained stable compared to the previous quarter. Stressed VaR remained stable compared to the previous quarter. MR4: Comparison of VaR estimates with gains/losses Backtesting The effectiveness of the VaR model is validated by backtesting techniques, comparing daily hypothetical and actual results with the estimated daily VaR. The daily VaR is calculated over a one-day maintenance horizon, according to the 99% confidence level and using a historical period of 1,000 days. The percentage of capital requirement associated with this model is 100%. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: • Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; • Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and • Red (10 or more exceptions): need for improvement actions. The following chart shows the comparison between VaR and actual and hypothetical results:

------

![](riskandcapitalmanagement061.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 57 In relation to the hypothetical and actual results, there was no exception. The actual results do not include fees, brokerage fees and commissions. There are no profit reserves. Total Exposure associated with Derivatives The main purpose of the derivative positions is to manage risks in the Trading Book and in the Banking Book in the corresponding risk factors. Derivatives: Trading and Banking R$ million 12/31/2025 With Central Counterparty Without Central Counterparty Onshore Offshore Onshore Offshore Risk Factors Long Short Long Short Long Short Long Short Interest Rates 216,240 (436,303) 26,503 (25,655) 173,427 (275,215) 105,745 (124,946) Foreign Exchange 171,413 (172,533) 47,299 (40,693) 30,407 (53,961) 596,988 (523,320) Equities 22,760 (19,974) 5,329 (4,049) 1,725 (5,500) 1,288 (1,105) Commodities 891 (2,303) 2 (3,333) 708 (38) - - IRRBBA: IRRBB risk management objectives and policies BACEN's (Central Bank of Brazil) Circular 3,876, published in January 2018, states on methodologies and procedures for evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: • ∆EVE (Delta Economic Value of Equity) is defined as the difference between the present value of the sum of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; • ∆NII (Delta Net Interest Income) is defined as the difference between the result of financial intermediation of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is

------

![](riskandcapitalmanagement062.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 58 highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The institution uses an internal model to measure ∆EVE and ∆NII. ∆EVE results do not represent immediate impact in the stockholders' equity. Meanwhile, ∆NII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank's results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank's risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for ∆EVE and ∆NII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The ∆EVE and ∆NII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the ∆EVE and ∆NII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to pre-payment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, which are primary components of the market in price formation.

------

![](riskandcapitalmanagement063.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 59 IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange-traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: • ∆EVE and ∆NII are measured on the basis of the cash flows of the banking book instruments, broken down into their risk factors to isolate the effect of the interest rate and the spread components; • For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; • The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption; • The medium-term repricing attributed to non-maturity deposits is defined as 2,07 years; • The maximum-term repricing attributed to non-maturity deposits is defined as 30 years. The article 16 of the BCB Resolution 54 defines the need to publish ∆EVE and ∆NII, using the standard shock scenarios described in article 11 of the BACEN Circular 3,876. The table below are presented the main results due the change in the interest rates over the banking book in the standardized scenarios. It is important to note that, following the normative rules, the potential losses are represented by positive values and potential gains by negative values (between parentheses). • Parallel Up: increasing in the short-term and in the long-term interest rates; • Parallel Down: decreasing in the short-term and in the long-term interest rates; • Short-term increase: increasing in the short-term interest rates; • Short-term reduction: decreasing in the short-term interest rates; • Steepener: decreasing in the short-term interest rates and increasing the in the long-term interest rates; • Flattener: increasing in the short-term interest rates and decreasing the in the long-term interest rates.

------

![](riskandcapitalmanagement064.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 60 IRRBB1 – Quantitative information on IRRBB Potential Loss of Instruments Classified in the Banking Book arising from Interest Rate Variation Scenarios(1) (Losses are represented by positive values, while gains are represented by negative values between parentheses) The maximum variation of ΔEVE with standardized shocks, for the outlier test, was R$16,076 million as of December 31, 2025, under the Parallel Up shock scenario, which corresponds to a potential loss of 7.72% of Tier I capital—an amount below the 15% threshold that characterizes an institution as an outlier (according to Article 44 of Circular 3,876). The ΔNII, with standardized shocks over a one-year horizon, has a maximum loss of R$1,872 million under the Parallel Up shock scenario. R$ million ΔEVE ΔNII ΔEVE ΔNII Parallel Up 16,076 1,872 12,393 2,667 Parallel Down -18,802 -2,737 -14,394 -3,935 Short rate Up 10,908 9,047 Short rate Down -11,77 -9,798 Steepener -2,007 -2,374 Flattener 5,163 4,802 Maximum 16,076 1,872 12,393 2.667 Tier I 208.161 206,196 1) Losses in variation measurements are shown as positive values, as per Art. 13 §3º of Circular 3,876. 2) Values are calculated using internal models and standard regulatory shocks, as per Art. 39 §1º II of Circular 3,876. 12/31/2025 12/31/2024 Scenarios Standard Shocks (2) Standard Shocks (2) Standard Shocks (2) Standard Shocks (2)

------

![](riskandcapitalmanagement065.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 61 ORA – Qualitative Information on Operational Risk Management The qualitative information on operational risk management covers the policies, strategies, structures, and processes adopted by Itaú Unibanco to ensure the proper management of this risk. Operational Risk management at Itaú is carried out in accordance with the guidelines established in the Operational Risk Management Policy, available on the website www.itau.com.br/relacoes-com-investidores, under the sections "Itaú Unibanco", "Corporate Governance", "Policies", "Reports". To enable this management, the institution adopts the three-lines model, published by the Institute of Internal Auditors (IIA). The First Line, represented by the Business, Support, or Community areas, is directly responsible for identifying, assessing, responding to, monitoring, and reporting operational risks. The Second Line, represented by the Risk Area (AR), ensures, independently and centrally, that risks are managed in accordance with policies and procedures, defining parameters for the risk management process and overseeing its execution. Reporting to the Risk Area, the Compliance & OPRisk Department (DCOR) supports the first line by ensuring compliance and customer centricity through monitoring the effectiveness of risk management and issuing an independent opinion on the quality of the control environment. DCOR operates independently, with direct communication with managers and employees and access to all necessary information. The Third Line, in turn, is represented by Internal Audit, a segregated and independent area, with responsibilities defined in the Internal Audit Policy. Regarding the systems, routines, and procedures used to measure operational risk, the capture and reporting of data related to operational losses are the responsibility of the Finance areas, which must ensure the integrity, consistency, and alignment of this data with the financial statements. The consolidation and maintenance of the loss database are carried out by the Risk Area, ensuring compliance with regulatory guidelines and normative requirements. Reporting areas must also collaborate with the Risk Area by providing complementary information that adequately enriches and characterizes recorded events. With respect to management reporting, the scope and context of the reports submitted to the Executive Board, the Risk Committee, and the Board of Directors include periodicity, criteria for the inclusion of relevant information, and the recording of extraordinary incidents. Communication with senior management occurs through specific governance forums. Within the Board of Directors, reporting occurs in the Risk and Capital Management Committee, established in accordance with CMN Resolution No. 4,557/2017, which supports the Board in monitoring risk management, including operational risk and internal controls. The Audit Committee, regulated by CMN Resolution No. 4,910/2021, evaluates the quality and effectiveness of internal controls and receives periodic updates on the matter. Additionally, in compliance with CMN Resolution No. 4,968, an annual report on internal control systems is submitted to the Board of Directors. For the Executive Committee, communication takes place in specific forums, such as the Compliance & OpRisk Higher Commission (CSCOR), which includes the President of Itaú Unibanco, members of the Executive Committee—including the Chief Risk Officer (CRO)—and the Internal Audit Director. This quarterly forum is responsible for understanding risks in business and support processes, evaluating the results of the Internal Controls System, and defining guidelines for the management of operational and regulatory risks. Another forum is the Compliance & OpRisk Committee (CCOR) with MCE, held three times a year, with participation from the Executive Committee member responsible for the area and the Compliance & OpRisk Director. Its responsibilities include understanding the area's risks, responding to identified risks, monitoring action plans to improve the control environment, and addressing relevant methodological changes.

------

![](riskandcapitalmanagement066.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 62 Operational risk mitigation strategies are aligned with the Risk Management Policy and best practices, encompassing key stages. The Operational Risk Identification phase involves the continuous recognition of internal and external events that may affect strategic objectives. When a relevant risk is identified, it is recommended to extend the assessment to similar processes to ensure consistent mitigation across the institution. The Operational Risk Assessment stage considers inherent impact, the quality of the control environment, and changes in internal and external environments, guiding response actions. Operational Risk Response involves structured decisions to accept, avoid, transfer, or mitigate risks, ensuring alignment with the risk appetite and continuous review. In Monitoring, the objective is to continuously track the control environment, using granular data analysis to correct root causes and ensure alignment with the risk appetite, including during significant organizational changes. Finally, Operational Risk Reporting involves issuing independent opinions to governance and preparing regulatory reports. Additionally, Itaú continuously invests in training and development for its employees, promoting a culture of risk awareness, compliance, and ethics as fundamental pillars of the organization. These investments reinforce the institution's commitment to excellence in operational and regulatory risk management. OR1: Historical Operational Losses (1) T-2 T-3 T-4 T-5 T-6 T-7 T-8 T-9 Average of the last 10 annual periods Net loss amount 5,218 3,432 3,613 3,363 4,159 4,324 3,283 5,077 4,305 3,245 4,002 Number of operational loss events 24885 28886 32203 34798 32339 35137 37132 34531 30191 24999 31510 Total amount of operational losses in the loss database 0 13 11 11 1 0 1 8 4 5 6 Number of discarded loss events 0 28 27 18 15 4 2 22 18 22 17 Net loss amount related to discarded events 5,218 3,444 3,625 3,375 4,16 4,324 3,284 5,085 4,308 3,25 4007 Net loss amount 3,868 2,341 2,342 2,134 3,03 2,84 1,763 3,687 2,869 2,061 2693 Number of operational loss events 7762 8894 9580 9657 9038 9270 9235 8514 7273 5992 8522 Total amount of operational losses in the loss database 0 11 10 10 0 0 1 6 2 2 5 Number of discarded loss events 0 10 10 5 4 4 1 8 5 4 6 Net loss amount related to discarded events 3,868 2,351 2,352 2,145 3,031 2,84 1,763 3,693 2,871 2,063 2698 Loss threshold used in the ILM calculation: BRL 100,000.00 (one hundred thousand reais) or BRL 500,000.00 (five hundred thousand reais) With a threshold of BRL 100,000.00 (one hundred thousand reais) With a threshold of BRL 500,000.00 (five hundred thousand reais) Details of the RWAopad calculation 500000 1) T corresponds to December 31, 2024, the base date of the DRO used in the current capital for December 2025. T-1T

------

![](riskandcapitalmanagement067.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 63 OR2: Composition of Business Indicator (BI) T (1) T-1 T-2 Interest, lease and equity component (ILDC) 57,708 Interest and lease income (II) 382,760 303,084 274,202 Interest and lease expense (IE) (395,764) (224,585) (182,873) Interest-earning assets (IEA) 1,839,354 1,759,349 1,594,625 Equity income (DI) 23,208 14,536 18,529 Services component (SC) 57,403 Fee and commission income (FI) 41,657 45,177 44,150 Fee and commission expense (FE) (13,234) (13,303) (13,254) Other operating income (OOI) 19,183 14,886 5,440 Other operating expenses (OOE) (22,458) (11,871) (6,897) Financial Component (FC) 10,236 Net trading book result (NTB) 3,870 7,856 (8,232) Net banking book result (NBB) (1,634) (493) (8,624) Business Indicator (BI) 125,347 Business Indicator Component (BIC) 18,652 Revenues related to payment services excluded from the SC - - - Expenses related to payment services excluded from the SC - - - BI and components Disclosure related to the BI 1) T corresponds to 06/30/2025, the base date for capital inputs in effect for December 2025. OR3: Capital Requirement for Operational Risk 12/31/2025 Weighted Business Indicator (BIC) 18,652 Internal Loss Multiplier (ILM) 0.9593% Capital requirement for operational risk 17,894 RWAopad 223,676

------

![](riskandcapitalmanagement068.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 64 Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itaú Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. • Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go against institution's expectations, directly or indirectly associated with technical and actuarial bases used for calculating premiums, contributions and technical provisions; • Market Risk; • Credit Risk; • Operational risk; • Liquidity risk. In line with domestic and international best practices, Itaú Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itaú Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social, Environmental and Climatic Risks They are the possibility of losses due to exposure to social, environmental and/or climatic events related to the activities developed by the ITAÚ UNIBANCO HOLDING. Social, environmental and climatic factors are considered relevant to the business of ITAÚ UNIBANCO HOLDING, since they may affect the creation of shared value in the short, medium and long term. The Policy of Social, Environmental and Climatic Risks (SAC Risks Policy) establishes the guidelines and underlying principles for social, environmental and climatic risks management, addressing the most significant risks for the Institution's operation through specific procedures. Actions to mitigate the Social, Environmental and Climatic Risks are taken based on the mapping of processes, risks and controls, monitoring of new standards related to the theme and record of occurrence in internal systems. In addition to the identification, the phases of prioritization, response to risk, mitigation, monitoring and reporting of assessed risks supplement the management of these risks at ITAÚ UNIBANCO HOLDING. In the management of Social, Environmental and Climatic Risks, business areas manage the risk in its daily activities, following the Risks SAC Policy guidelines and specific processes, with the support of specialized

------

![](riskandcapitalmanagement069.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 65 assessment from dedicated technical teams located in Credit, which serves the Wholesale segment, Credit Risk and Modeling, and Institutional Legal teams, that act on an integrated way in the management of all dimensions of the Social, Environmental and Climatic Risks related to the conglomerate's activities. As an example of specific guidelines for the management of these risks, ITAÚ UNIBANCO HOLDING has specific governance for granting and renewing credit in senior approval levels for clients in certain economic sectors, classified as Sensitive Sectors (Mining, Steel & Metallurgy, Oil & Gas, Textiles ind. and Retail Clothing, Paper & Pulp, Chemicals & Petrochemicals, Agri - Meatpacking, Agri - Crop Protection and Fertilizers, Wood, Energy, Rural Producers and Real Estate), for which there is an individualized analysis of Social, Environmental and Climate Risks. ITAÚ UNIBANCO HOLDING also counts with specific procedures for the Institution's operation (stockholders' equity, branch infrastructure, technology and suppliers), credit, investments and key controls. SAC Risks area, Internal Controls and Compliance areas, in turn, support and ensure the governance of activities of the business and credit areas that serves the business. The Internal Audit, acts on an independent manner, assessing risk management, controls and governance. Governance also counts on the Social, Environmental and Climatic Risks Committee, whose main responsibility is to assess and deliberate about institutional and strategic matters, as well as to resolve on products, operations, and services, among others involving the Social, Environmental and Climatic Risks. Climate Risk includes: (i) physical risks, arising from changes in weather patterns, such as increased rainfall and temperature and extreme weather events, and (ii) transition risks, resulting from changes in the economy as a result of climate actions, such as carbon pricing, climate regulation, market risks and reputational risks. Considering its relevance, climate risk has become one of the main priorities for ITAÚ UNIBANCO HOLDING, which supports the Task Force on Climate-related Financial Disclosures (TCFD) and it is committed to maintaining a process of evoluution and continuous improvement within the pillars recommended by the TCFD. With this purpose, ITAÚ UNIBANCO HOLDING is strengthening the governance and strategy related to Climate Risk and developing tools and methodologies to assess and manage these risks. ITAÚ UNIBANCO HOLDING measures the sensitivity of the credit portfolio to climate risks by applying the Climate Risk Sensitivity Assessment Tool, developed by Febraban. The tool combines relevance and proportionality criteria to identify the sectors and clients within the portfolio that are more sensitive to climate risks, considering physical and transition risks. The sectors with the highest probability of suffering financial impacts from climate change, following the TCFD guidelines are: energy, transport, materials and construction, agriculture, food and forestry products.

------

![](riskandcapitalmanagement070.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 66 Model Risk Model risk is the risk arising from models used by Itaú Unibanco failing to consistently reflect the relationships among variables of interest, resulting in outcomes that systematically differ from observed results. The use of models has become increasingly prevalent within the institution, supporting strategic decisions in various contexts such as credit approval, transaction pricing, volatility curve estimation, capital calculation, among others. Due to the growing use of models—driven by the application of new technologies and the expanded use of data— Itaú Unibanco continues to enhance its governance related to the development, implementation, use, and monitoring of these models by defining guidelines, policies, and procedures aimed at ensuring quality and mitigating risks associated with each new methodology. The work performed by the areas responsible for models is assessed by the Operational Risk and Internal Audit teams to ensure adherence to these policies. Opportunities for improvement identified throughout these assessments are properly addressed through action plans, which are monitored by the three lines of defense and senior management until their completion. Regulatory or Compliance Risk Regulatory or Compliance Risk is the risk of sanctions, financial losses, or reputational damage resulting from failure to comply with legal and regulatory requirements, local and international market standards, commitments made with regulators, public commitments, self-regulatory codes, and codes of conduct adhered to by Itaú Unibanco. Compliance risk is managed through a structured process designed to identify changes in the regulatory environment, analyze the impacts on the institution's areas, and monitor actions aimed at ensuring adherence to regulatory requirements and the other commitments mentioned in the previous paragraph. Reputational Risk Itaú Unibanco understands reputational risk as the risk arising from internal practices and/or external factors that may generate a negative perception of Itaú Unibanco by customers, employees, shareholders, investors, regulatory bodies, government, suppliers, the press and the society in general. It can impact the bank's reputation, the value of its brand and/or result in financial losses. Besides, this can affect the maintenance of existing business relationships, access to sources of fundraising, the attraction of new business and talent to compose the company's staff or even the license to operate. The institution believes that its reputation is extremely important for achieving its long-term goals, which is why it seeks the alignment of the speech, the action and the ethical and transparent practice, essential to raise the confidence of Itaú Unibanco's stakeholders. Itaú Unibanco's reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institution, Itaú Unibanco's governance is structured in a way to ensure that potential risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products, including the use of new technologies.

------

![](riskandcapitalmanagement071.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 67 The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations, including BACEN Circular 3,978/20 among others, and cooperation with police and judicial authorities. It also seeks a continuously alignment with local and international best practices for preventing and fighting against illegal acts, through investing and training eligible employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Policies and Procedures; • Client Identification Process; • Know Your Customer (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; • Compliance with Sanctions; • Monitoring, Selection and Analysis of Suspicious Operations or Situations; • Reporting Suspicious Transactions to the Regulatory Bodies; and • Training. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee, Risk and Capital Management Commitee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itaú Unibanco, under "Corporate Governance", "Policies", "Corporate Policy for the Prevention of Unlawful Acts".

------

![](riskandcapitalmanagement072.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 68 In addition, Itaú Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false- positives. Itaú Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Cyber Risk Cyber risks refer to events that may cause financial losses, operational disruptions, data extraction, or damage to information stored in our systems. These risks may arise from intrusions by malicious individuals, infiltration of malware (such as computer viruses), intentional or accidental contamination of our networks and systems by third parties with whom we exchange information, exploitation of vulnerabilities, unauthorized access to confidential customer data and/or proprietary information by individuals inside or outside the Organization, as well as cyberattacks that compromise the availability of our services and the integrity of our information. Itaú Unibanco is committed to protecting corporate information and ensuring the privacy of customers and the general public in all operations. To achieve this, we adopt strict control processes focused on detecting, preventing, continuously monitoring, and responding immediately to threats and intrusion attempts into our infrastructure. These actions ensure effective risk management, support digital transformation, and are aligned with key regulators, external audits, market best practices, and certifications. As part of this strategy, we have adopted the concept of expanded perimeter protection, which considers that information must be protected wherever it resides: within the bank's infrastructure, in a cloud service provided by a third party, or in an international unit. This approach covers the entire information lifecycle — from collection, through processing, transmission, storage, analysis, and ultimately, destruction. The area responsible for this strategy is the Cyber Security Department, created to address the challenge of protecting the bank in an increasingly digital, complex, and constantly evolving environment. The Corporate Information Security and Cyber Security Policy is available at www.itau.com.br/relacoes-com- investidores, under the sections "Itaú Unibanco" > "Corporate Governance" > "Policies" > "Corporate Information Security and Cyber Security Policy". Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country. Itaú Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits.

------

![](riskandcapitalmanagement073.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 69 Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision- making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the Risk Area in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. Step-in Risk Step-in Risk is the possibility of losses occurring for entities that are part of the Prudential Conglomerate as a result of financial support to unconsolidated entities, in a stressful situation, in the absence or in addition to the obligations provided for in the contract. Itaú Unibanco has a structure for risk management and control, a dedicated team and a policy that defines roles and responsibilities. This structure covers (i) the identification of entities in relation to the potential generation of step-in risk, (ii) the assessment of risks in relationships, (iii) the monitoring, control and mitigation of step-in risk, (iv) the assessment of impact on capital and liquidity and (v) reports. It is part of the scope of Step-in Risk governance: Related Party audiences, mainly composed of controllers (individuals and legal entities), entities related to them and controlled and related entities (as defined in Res. 4,693/18), foundations, investments in non-consolidated entities, suppliers of critical products and services, assigness, buyers and sellers of relevant assets, third parties with products distributed by Itaú Unibanco and third parties to whom Itaú Unibanco distributes products, besides all the analysis of the international Units. Emerging Risks These are newly identified risks that have a potentially material impact on business in the medium and long term, but for which there is still insufficient information for a complete assessment, due to the number of factors and impacts not yet fully understood, as they have no precedent and, therefore, have never been addressed in the past. Their causes may originate from external events, leading to the rise of new risks or the intensification of risks already monitored by ITAÚ UNIBANCO HOLDING. Once identified, such risks begin to be monitored and reassessed annually or on demand, until they no longer represent a risk or until they can be adequately measured. In the latter case, they then follow the subsequent stages of risk management. This process is ensured by the governance of ITAÚ UNIBANCO HOLDING, allowing these risks to also be incorporated into risk management procedures. Examples include Geopolitical, Climate, and CyberSecurity risks, which have or have had aspects considered as emerging risks.

------

![](riskandcapitalmanagement074.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 70 Operational Risk The National Monetary Council, through Resolution 4,557 of February 23, 2017, defines operational risk as "the possibility of losses resulting from external events or from failures, deficiencies, or inadequacies in internal processes, people, or systems." This definition includes legal risk associated with inadequacies or deficiencies in contracts entered into by the Institution, sanctions resulting from non-compliance with legal requirements, and indemnities for damages to third parties arising from activities carried out by the Institution. Operational Risk management at Itaú is conducted in accordance with the guidelines of its risk governance framework and involves the following stages: Identification: Continuous identification of internal and external events that may adversely impact the achievement of strategic objectives in activities, projects, or products/services. When a relevant risk is identified, efforts must be made to extend the assessment to similar processes to ensure consistent mitigation across the bank. Assessment: Classification of residual risk, considering inherent impact and the quality of the control environment. The assessment must include potential changes in both internal and external environments, and its outcome should guide actions for responding to operational risk. Response: A structured set of decisions and actions adopted by the institution to accept, avoid, transfer, or mitigate operational risks. These responses must ensure that residual risk remains within the defined risk appetite and must be subject to continuous review and reporting to governance bodies. Monitoring: Tracking the quality of the control environment, preferably on an ongoing basis, using data analysis and exploration techniques with a granular view of customers or transactions, aiming for timely remediation of deficiencies through root-cause correction and realignment with Itaú's risk appetite. Reporting: Issuance of an independent opinion on the quality of the control environment to the appropriate governance levels, as well as preparation of regulatory reports. In line with the principles of CMN Resolution 4,557, the document "Public Access Report – Integrated Operational Risk and Internal Controls Management Policy" is available at www.itau.com.br/relacoes-com-investidores, under the sections "Itaú Unibanco", "Corporate Governance", "Policies", "Reports". Crisis Management and Operational Resilience Itaú Unibanco's Operational Resilience Program's purpose is to protect its employees, ensure the continuity of the critical functions of its business lines and sustain both the stability of the markets in which it operates and the confidence of its customers and strategic partners in its provision of services and products.To this end, it has policies that establish procedures, roles and responsibilities to be followed by the areas of Itaú Unibanco. The Program establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents.In order for the recovery to take place quickly and safely, PCN has defined corporate and customized actions for its business lines. In order for the BCP to reflect the priorities for resuming the business environment that supports the delivery of products and services, BIA (Business Impact Analysis) is applied. BIA identifies and assesses the impact on the business of process interruptions caused by failures due to human, natural, climatic, environmental, social and/or technological risks. Considering the dependence that some processes have on third-party services, the Operational Resilience Program conducts an assessment of the risk of unavailability of services provided with a view to resilience to threats of interruption.

------

![](riskandcapitalmanagement075.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 71 To assess the efficiency and identify points for improvement in contingency actions, contingency plan exercises are carried out throughout the year. The frequency of the exercises is established by the plan manager and can be: annual, biannual or shorter (bimonthly, quarterly, monthly, etc.), taking into account the criticality of the process or the complexity of the contingency. The Program establishes a frequent flow of acculturation with the company's senior management, as well as a constant analysis of high-impact scenarios and events to establish response plans in line with current threats. To assess efficiency and identify points for improvement in crisis response plans, tests are carried out at least once a year. Independent Validation of Risk Models Itaú Unibanco performs independent validation of its risk processes and risk models. This activity is carried out by a department that is segregated from both the business areas and the risk control areas, ensuring independence in the assessments. The validation methodology, defined in a specific internal policy, complies with regulatory requirements, such as those established in BACEN Circulars 303, 3,646, 3,674, 3,876 and Resolutions 4,966, 4,277, and 4,557. The validation stages include, among others: 1. Verification of the technical soundness and assumptions used in the models; 2. Qualitative and quantitative analysis of the models, including variable declaration, development of an independent calculator, and assessment of the adequacy of the technical references used; 3. When applicable, comparison with alternative models and external benchmarks; 4. Historical backtesting of the model; 5. Assessment of the adequacy of the model implementation in the systems used. Additionally, the validation area evaluates the stress testing program. The work performed by the independent validation area, as well as the validations of processes and models, is assessed by Internal Audit and submitted to specific committees composed of senior management members. Opportunities for improvement identified throughout the independent validation process are addressed through action plans, which are monitored by the three lines of defense and senior management until their completion. Glossary of Acronyms

------

![](riskandcapitalmanagement076.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 72 A • ASF – Available Stable Funding • AT1 – Additional Tier 1 Capital B • BACEN - Banco Central do Brasil (Central Bank of Brazil) • BCB - Banco Central do Brasil (Central Bank of Brazil) • BCP – Business Continuity Plan • BCBS - Basel Committee on Banking Supervision • BIA – Business Impact Analysis • BIS – Bank for International Settlements C • CCF – Credit Conversion Factor • CCP – Non-Qualified Central Counterparty • CCR – Counterparty Credit Risk • CEM - Current Exposure Method • CEO - Chief Executive Officer • CET 1 - Common Equity Tier I • CGRC - Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) • CMN - Conselho Monetário Nacional (National Monetary Council) • Comef - Comitê de Estabilidade Financeira (Financial Stability Committee) • CRI – Real State Receivables Certificate • CRM – Credit Risk Mitigation • CRO – Chief Risk Officer • CTAM – Comissão Técnica de Avaliação de Modelos (Technical Model Assessment Commission) • CVA - Credit Valuation Adjustment • CVM - Comissão de Valores Mobiliários (Brazilian Securities and Exchange Commission) D • DLP - Long- Term Liquidity Statement • DRL - Liquidity Risk Statement • D-SIB - Domestic Systemically Important Banks • DV - Delta Variation E • EAD – Exposure at Default • ECL – Expected Credit Losses • EMD – Entidades Multilaterais de Desenvolvimento (Multilateral Development Entities)

------

![](riskandcapitalmanagement077.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 73 • EVE – Economic Value of Equity F • FCC - Credit Conversion Credit • FEBRABAN - Brazilian Federation of Banks • FIDC - Credit Rights Investment Funds • FPR - Fator de Ponderação de Risco (Weighting Factor) G • GAP – Gap Analysis • GDP – Gross Domestic Product • Greeks – Sensitivities to Various Risk Factors • G-SIB – Global Systemically Important Banks H • HE – Haircut of Execution • HQLA – High Quality Liquid Assets • HV – Volatility Haircut I • ICAAP – Internal Capital Adequacy Assessment Process • IMA – Internal Models Approach • IPV – Independent Price Verification • IRB - Internal Ratings-Based • IRRBB – Interest Rate Risk in the Banking Book • IT – Information Technology K • KYC – Know your Customer • KYP – Know your Partner • KYS – Know your Supplier • KYE – Know your Employee L • LCR – Liquidity Coverage Ratio • LMM – Limite de Mitigação Máxima (Maximum Mitigation Limit) M • MtM – Mark to Market N • NII – Net Interest Income • NSFR – Net Stable Funding Ratio O

------

![](riskandcapitalmanagement078.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 74 • OTC – Over-the-Counter P • PCN – Plano de Continuidade de Negócios (Business Continuity Plan) • PCLT – Plano de Contingência de Local de Trabalho (Workplace Contingency Plan) • PCO – Plano de Contingência Operacional (Operational Contingency Plan) • PCR – Potential Credit Risk • PR – Patrimônio de Referência (Total Capital) • PRD – Plano de Recuperação de Desastres (Disaster Recovery Plan) • PVA - Prudent Valuation Adjustments Q • QCCP – Qualified Central Counterparties R • RA – Leverage Ratio • RAS – Risk Appetite Statement • RSF – Required Stable Funding • RWA - Risk Weighted Assets • RWACIRB - Portion relating to exposures to credit risk, using internal approach • RWACPAD - Portion relating to exposures to credit risk • RWACPrNB - amount of risk-weighted assets corresponding to credit risk exposures to the non-banking private sector, calculated for jurisdictions whose ACCPi is different from zero • RWAMINT - Portion relating to exposures to market risk, using internal approach • RWAMPAD - Portion relating to exposures to market risk, calculated using standard approach • RWAOPAD - Portion relating to the calculation of operational risk capital requirements • RWADRC - Portion relating to the calculation of capital required for exposures to the credit risk of financial instruments classified in the trading portfolio S • SA – Joint-Stock Company • SAC – Social, Ambiental e Climático (Social, Environmental and Climatic) • SA-CCR – Standardised Approach to Counterparty Credit Risk • SFN – Sistema Financeiro Nacional(National Financial System) • SFT – Securities Financing Transactions T • TCFD – Task Force on Climate-Related Financial Disclosures • TLAC – Total Loss-Absorbing Capacity

------

![](riskandcapitalmanagement079.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 75 • TVM – Títulos de valores mobiliários(Securities) V • VaR – Value at Risk Glossary of Regulations • BACEN Circular No. 3,644, of March 4th, 2013 • BACEN Circular No. 3,646, of March 04th, 2013 • BACEN Circular No. 3,674, of October 31st, 2013 • BACEN Circular No. 3,748, of February 26th, 2015 • BACEN Circular No. 3,749, of March 05th, 2015 • BACEN Circular No. 3,769, of October 29th, 2015 • BACEN Circular No. 3,809, of August 25th, 2016 • BACEN Circular No. 3,846, of September 13th, 2017 • BACEN Circular No. 3,869, of December 19th, 2017 • BACEN Circular Letter No. 3,907 of September 10th, 2018 • BACEN Circular Letter No. 3,876 of January 31st, 2018 • BACEN Circular Letter No. 3,082 of January 30th, 2012 • BACEN Circular Letter No. 3,978 of January 23rd, 2020 • BACEN Communication No. 43,228 of May 28th, 2025 • BACEN Normative Instruction No. 532 of October 24th, 2024 • BCB Resolution No. 54, of December 16th, 2020 • BCB Resolution No. 111, of July 6th, 2021 • BCB Resolution No. 229, of May 12th, 2022 • BCB Resolution No. 313, of April 26th, 2023 • CMN Resolution No. 2,682, of December 22nd, 1999 • CMN Resolution No. 4,955, of October 21st, 2021 • CMN Resolution No. 4,958, of October 21st, 2021 • CMN Resolution No. 4,502, of June 30th, 2016 • CMN Resolution No. 4,557, of February 23rd, 2017 • CMN Resolution No. 4,589, of June 29th, 2017 • CMN Resolution No. 4,693, of October 29th, 2018 • CMN Resolution No. 4,277, of October 31th, 2013 • CMN Resolution No. 5,177, of September 26th, 2024 • BCB Resolution No. 303, of March 16th, 2023

------

![](riskandcapitalmanagement080.jpg)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 76 • BCB Resolution No. 356, of November 28th, 2023 • CMN Resolution No. 4,966, of November 25th, 2021 • CMN Resolution No. 5,199, of December 23th, 2024

------