riskandcapitalmanagement

Risk and Capital Management - Pillar 3 First quarter of 2026

Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 4 Scope and main characteristics of risk management 4 Risk and Capital Governance 5 Ituber Culture 6 Risk Appetite 6 Stress Testing 8 Recovery and Resolution Plan 8 Capital Adequacy Assessment 9 Capital Adequacy 10 OV1: Overview of risk-weighted assets (RWA) 10 Links between financial statements and regulatory exposures 11 LIA: Explanations of differences between accounting and regulatory exposure amounts 11 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories 12 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements 13 PV1: Prudent valuation adjustments (PVA) 13 Institutions that comprise the Financial Statement of Itaú Unibanco Holding 14 Non Consolidated Institutions 18 Material Entities 18 Composition of Capital 19 CCA: Main features of regulatory capital instuments 19 CC1: Composition of regulatory capital 20 CC2: Reconciliation of regulatory capital to balance sheet 22 Macroprudential Indicators 23 CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer 23 GSIB1: Disclosure of G-SIB indicators 23 Leverage Ratio 23 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 24 LR2: Leverage ratio common disclosure 24 Liquidity Ratios 25 LIQA: Liquidity Risk Management Information 25 Framework and Treatment 25 LIQ1: Liquidity Coverage Ratio (LCR) 26 LIQ2: Net Stable Funding Ratio (NSFR) 27 Credit Risk 28 CRA: Qualitative information on credit risk management 28 CR1: Credit Quality of Assets 29 CR2: Changes in Stock of defaulted loans and debts securities 30 CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation 30 Exposure by industry 30 Exposure by remaining maturity 31 Overdue exposures 31

Exposure by geographical area in Brazil and by country 31 Largest debtors exposures 32 Restructured exposures 32 CRC: Qualitative disclosure related to Credit Risk Mitigation techniques 32 CR3: Credit Risk mitigation techniques – overview 33 CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects 34 CR5: Standardized Approach – exposures by asset classes and risk weights 36 CRE: Qualitative disclosure related to IRB models 40 CR8: RWA flow statements of credit risk exposures under IRB 42 CMS1: Comparison of modelled and standardised RWA at risk level 42 Counterparty Credit Risk (CCR) 42 CCRA: Qualitative disclosure related to CCR 42 CCR1: Analysis of CCR exposures by approach 43 CCR3: Standardized approach – CCR exposures by regulatory portfolio and risk weights 43 CCR5: Composition of collateral for CCR exposures 43 CCR6: CCR associated with credit derivatives exposures 44 CCR8: CCR associated with Exposures to central counterparties 44 Securitization Exposures 45 SECA: Qualitative disclosure requirements related to securitisation exposures 45 SEC1: Securitisation exposures in the banking book 45 SEC2: Securitisation exposures in the trading book 45 SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor 45 SEC4: Securitisation exposures in the banking book and associated capital requirements – bank acting as investor 46 Market Risk 46 MRA: Qualitative disclosure requirements related to market risk 46 MR1: Market risk under standardized approach 48 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 48 MR2: RWA flow statements of market risk exposures under an IMA 51 Exposures subject to market risk 51 MR3: IMA values for trading portfolios 52 MR4: Comparison of VaR estimates with gains/losses 52 Backtesting 52 Total Exposure associated with Derivatives 53 IRRBB 53 IRRBBA: IRRBB risk management objectives and policies 53 Framework and Treatment 54 ORA – Qualitative Information on Operational Risk Management 55 OR1: Operational Loss History 57 OR2: Composition of Business Indicator (BI) 57 OR3: Capital Requirement for Operational Risk 58

Other Risks 58 Insurance products, pension plans and premium bonds risks 58 Social, Environmental and Climatic Risks 58 Operational and Compliance Risk 59 Model Risk 60 Independent Validation of Risk Models 60 Cyber Risk 62 Crisis Management and Operational Resilience 63 Country Risk 63 Business and Strategy Risk 63 Step-in Risk 64 Emerging Risks 64 Glossary of Acronyms 65 Glossary of Regulations 68

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 3 The Basel Index reached 15.2% on December 31, 2025, a decrease of 1.2 p.p. compared to September 30, 2025, due to the payment of dividends and interest on equity, share buybacks, and the growth of risk‑weighted assets, partially offset by the positive impact of the period’s result R$ million 03/31/2026 12/31/2025 09/30/2025 06/30/2025 03/31/2025 Available capital (amounts) Common Equity Tier 1 (CET1) 186.771 185.595 195.917 188.389 180.611 Common Equity Tier I (CET1) corresponds to line 1 deducting, as applicable, the amount established by: art. 4, caput, item I, paragraph “i”, and §§ 8 and 9, of CMN Resolution no. 4.955, of October 21, 2021; or art. 3, caput, item I, paragraph “i”, §§ 8 and 9, of BCB Resolution no. 199, of March 11, 2022. 186.742 185.552 195.874 188.346 180.568 Tier 1 209.183 208.161 215.466 215.381 202.344 Tier 1 considering the calculation of Principal Capital according to line 1a 209.154 208.118 215.423 215.338 202.301 Total capital 230.527 228.589 238.430 237.454 224.092 Total Capital considering the calculation of Common Equity Tier I according to line 1a 230.498 228.546 238.387 237.411 224.049 Excess of capital committed to ajusted permanent assets - - - - - Excess of resources invested in permanent assets considering Total Capital according to line 3a - - - - - Total capital detached - - - - - Risk-weighted assets (amounts) Total risk-weighted assets (RWA) 1.560.810 1.505.475 1.454.242 1.436.344 1.430.630 RWA corresponds to line 4 deducting, as applicable, the amount referring to item XII of the caput of art. 4 weighted by the Risk Weighting Factor (FPR) established in art. 82-A, both commands of Resolution 229 of May 12, 2022. 1.560.781 1.505.432 1.454.199 1.436.301 1.430.587 Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (%) 12,0% 12,3% 13,5% 13,1% 12,6% Common Equity Tier 1 ratio (CET1) considering: Numerator: corresponds to line 1a; Denominator: corresponds to line 4b 12,0% 12,3% 13,5% 13,1% 12,6% Tier 1 ratio (%)(3) 13,4% 13,8% 14,8% 15,0% 14,1% Tier 1 ratio, considering: Numerator: corresponds to line 2a; Denominator: corresponds to line 4b 13,4% 13,8% 14,8% 15,0% 14,1% Total capital ratio (%) 14,8% 15,2% 16,4% 16,5% 15,7% Total capital ratio, considering: Numerator: corresponds to line 3a; Denominator: corresponds to line 4b 14,8% 15,2% 16,4% 16,5% 15,7% Additional CET1 buffer requirements as a percentage of RWA Capital conservation buffer requirement (%) 2,5% 2,5% 2,5% 2,5% 2,5% Countercyclical buffer requirement (%) (1) 0,1% 0,1% 0,1% 0,1% 0,1% Bank G-SIB and/or D-SIB additional requirements (%) 1,0% 1,0% 1,0% 1,0% 1,0% Total of bank CET1 specific buffer requirements (%) (2) 3,6% 3,6% 3,6% 3,6% 3,6% CET1 available after meeting the bank's minimum capital requirements (%) 3,2% 3,6% 4,8% 5,0% 4,1% CET1 available after meeting the bank's minimum capital requirements (%) considering CET1 as per line 1a 3,2% 3,6% 4,8% 5,0% 4,1% Basel III leverage ratio Total Basel III leverage ratio exposure measure 3.230.125 2.983.477 2.921.612 2.855.121 2.710.449 Total Basel III leverage ratio exposure measure corresponds to line 13 deducting, as applicable, the amount referring to item XII of the caput of art. 4 of Resolution 229 of May 12, 2022. 3.230.082 2.983.434 2.921.569 2.855.078 2.710.406 Basel III leverage ratio (%) 6,5% 7,0% 7,4% 7,5% 7,5% Basel III leverage ratio (%) considering: i. Numerator: corresponds to line 2a; ii. Denominator: corresponds to line 13a 6,5% 7,0% 7,4% 7,5% 7,5% Liquidity Coverage Ratio Total high-quality liquid assets (HQLA) 371.058 389.723 367.777 346.084 340.855 Total net cash outflow 190.159 181.290 168.176 161.856 173.512 LCR (%) 195,1% 215,0% 218,7% 213,8% 196,4% Net Stable Funding Ratio Total available stable funding 1.491.577 1.499.680 1.408.603 1.393.627 1.362.350 Total required stable funding 1.222.668 1.202.060 1.142.829 1.150.712 1.114.206 NSFR (%) 122,0% 124,8% 123,3% 121,1% 122,3% (1) The countercyclical capital buffer is fixed by the monetary authorities of the jurisdictions in which Itaú has exposure, the most relevant of which are Brazil, where the Financial Stability Committee (Comef) sets it at zero (BACE (2) The BACEN rules establish Capital Buffers, that corresponds to the sum of the Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,958. 3) The Tier I follows the instructions of the Central Bank of Brazil and is not limited to the 1.5% rate of CMN Resolution No. 4,958. If it were limited, the Tier I would be 14.6%

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 4 Besides, Itaú Unibanco has a R$ 105,663 million capital excess in relation to its minimum required Total Capital. It corresponds to 6,8 p.p. above the minimum requirement (8%) and higher than the Capital Buffer requirement of (R$ 55,524 million). Considering the Capital Buffers, the capital excess would be 3,2 p.p. The fixed assets ratio shows the commitment percentage of adjusted Total Capital with the adjusted permanent assets. Itaú Unibanco falls within the maximum limit of 50% of adjusted Total Capital, established by BACEN. On March 31, 2026, fixed assets ratio reached 20.7%, showing a surplus of R$ 67,456 million. OVA – Bank risk management approach Scope and Key Features of Risk Management Taking and managing risks is one of Itaú Unibanco’s activities, and to do so effectively, the institution must have well-established objectives for risk management. In this context, the Risk Appetite articulates the set of guidelines from the Board of Directors (BoD) regarding strategy and risk-taking, defining the nature and level of acceptable risks for the organization, while the risk culture guides the necessary attitudes for managing them. Itaú Unibanco invests in robust risk and capital management processes that permeate the entire institution and form the foundation for strategic decisions to ensure business sustainability and maximize shareholder value. Among the processes for proper risk and capital management, the following stand out: the implementation of a continuous and integrated risk management framework; the Risk Appetite Framework, which consists of the Risk Appetite Statement (RAS) from the BoD, the Risk Appetite Policy, and a set of metrics for monitoring key risks according to defined limits; the stress testing program; the establishment of a Risk Committee; and the appointment, before the Central Bank of Brazil (BACEN), of a Chief Risk Officer (CRO) with clearly defined roles, responsibilities, and independence requirements. These processes are aligned with the guidelines of the BoD and Executives, who, through collegiate bodies, define global objectives expressed in goals and limits for the risk-managing business units. The capital control and management units, in turn, support Itaú Unibanco’s management through risk and capital monitoring and analysis processes. The principles that underpin risk management, Risk Appetite, and the guidelines for how Itaú Unibanco employees should act in their daily decision-making are: • Sustainability and customer satisfaction: Itaú Unibanco's vision is to be the leading bank in sustainable performance and customer satisfaction. Therefore, it is committed to generating shared value for employees, customers, shareholders, and society, ensuring business continuity. Itaú Unibanco is focused on conducting business that benefits both the customer and the institution. • Risk culture: The institution's risk culture goes beyond policies, procedures, and processes, aiming to strengthen the individual and collective responsibility of all employees to do the right thing, at the right time, and in the right way, respecting ethical business practices. It is based on four principles (conscious risk-taking, discussion and action on institutional risks, and everyone's responsibility for risk management), which encourage open understanding and discussion of risks, keeping them within the levels determined by the Risk Appetite, and ensuring that each employee, regardless of position, area, or function, also assumes responsibility for managing the risks of their business. The Risk Culture is detailed in the "Risk Culture" section. • Risk Pricing: Itaú Unibanco operates and assumes risks in businesses that are well-known and understood, avoiding risks in which it lacks knowledge or competitive advantage, carefully evaluating the risk-return relationship.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 5 • Diversification: The institution has a low appetite for volatility in results and therefore operates on a diversified base of customers, products, and businesses, seeking risk differentiation and prioritizing less risky ventures. • Operational excellence: Itaú Unibanco aims to be an agile bank with robust and stable infrastructure to offer high-quality services. • Ethics and respect for regulations: For Itaú Unibanco, ethics are non-negotiable. The institution promotes an environment of integrity, guiding all employees to cultivate ethics in relationships and business and respect regulations, safeguarding the institution's reputation. Risk and Capital Governance The Board of Directors is the highest authority responsible for establishing guidelines, policies, and limits for risk and capital management. The Risk and Capital Management Committee (CGRC) supports the Board in fulfilling its duties related to risk and capital oversight. At the executive level, collegiate bodies chaired by Itaú Unibanco's Chief Executive Officer (CEO) are responsible for risk and capital management, exercising delegated responsibilities in these areas, and their decisions are monitored within the scope of the CGRC. To support this structure, the Risk Area has specialized departments aimed at ensuring, independently and centrally, that the institution’s risks and capital are managed in accordance with established policies and procedures. Itaú Unibanco’s risk management organizational structure complies with current regulations in Brazil and abroad. Domestically, the Bank follows the rules established by the Central Bank of Brazil (BACEN), particularly Resolution No. 4,557/17, which addresses the risk and capital management framework for financial institutions, as well as regulations from the Brazilian Securities and Exchange Commission (CVM) and the Private Insurance Superintendence (SUSEP), among other regulators and applicable standards. Internationally, Itaú Unibanco adheres to standards set by the Basel Committee on Banking Supervision, the United States Securities and Exchange Commission (SEC), and local regulations in the countries where it operates. Additionally, Itaú Unibanco complies with guidelines such as the Foreign Account Tax Compliance Act (FATCA), the Principles for Responsible Banking (PRB) of the United Nations Environment Programme – Finance Initiative, and the Guidelines for Multinational Enterprises of the Organization for Economic Cooperation and Development (OECD), among other representative examples. The Bank also adopts practices aligned with International Financial Reporting Standards (IFRS) and globally recognized corporate governance best practices. Furthermore, Itaú Unibanco has a governance framework for identifying and monitoring emerging risks—those newly identified risks with potentially material medium- to long-term impacts on the business, but for which there is still insufficient information for full assessment due to the number of unknown factors and impacts, as they are unprecedented and have not been addressed in the past. Risk management responsibilities at Itaú Unibanco are structured according to the three lines of governance model: • 1st line of governance: Business and corporate support areas are directly responsible for identifying, measuring, assessing, monitoring, reporting, controlling, and mitigating the risks they originate; • 2nd line of governance: The Risk Area aims to ensure, independently and centrally, that the institution’s risks are managed according to established policies and procedures, defining parameters for the risk management process and its supervision. This control provides the BoD and executives with a comprehensive view of Itaú Unibanco’s exposures, optimizing and accelerating corporate decision-making;

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 8 scenarios of crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short- and long- term risks, among other aspects, as defined in CMN Resolution 4,557. In this process, the main potential risks to the economy are assessed based on the judgment of the bank's team of economists, endorsed by the Chief Economist of Itaú Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itaú Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution’s risk appetite metrics. Recovery and Resolution Plan In response to the latest international crises, the Central Bank issued Resolution No. 5,187, which requires the development of a Recovery and Resolution Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a report that contemplates the entire Conglomerate and contains the description of the following items: I. Critical functions: activities performed by the entities within the scope of recovery and resolution planning for third parties, whose discontinuity could compromise the stability of the National Financial System (SFN), the Brazilian Payment System (SPB), or the real economy, due to their market share, interconnections, complexity, or other factors that prevent them from being immediately replaced by the market. II. Institution's essential services: services provided to one or more entities within the scope of recovery and resolution planning, whose disruption would impair the functioning of a core business line; III. Bridge institution: an entity established or reorganized to which assets, rights, and obligations of the institution under resolution are transferred, in whole or in part, aiming at the general or partial continuity of its business or activity.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 12 be the fair price at which financial assets would be effectively traded, maximizing the use of relevant observable data and, under specific conditions, these instruments can be valued on a model basis. In all of these situations, the organization has control over its pricing methods and model risk management. The process of independent price verification (IPV) follows the guidelines included in Resolution No. 4,277, with daily verification of prices and market inputs, which is performed by a team independent from the pricing team. This process is also subject to an independent evaluation by the internal control, internal audit and external audit teams. The institution has a hybrid model for assessing the need for prudent valuation adjustments with two components. The first component is a timely assessment model that assesses new products, operations and risk factors traded and verifies the compliance and liability with any components of the existing prudent valuation adjustments. The second is a periodic assessment that aims to analyze the existing prudent valuation adjustments in relation to adequate pricing. The process and methodology are evaluated periodically and independently by internal controls and internal audit. In the line Other Differences of the table LI2, are reported the transactions subject to credit risk and counterparty credit risk, which are not accounted for in the balance sheet or in the off-balance sheet amounts. LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories R$ million, at the end of the period 03/31/2026 Carrying values as reported in published financial statements Carrying values under scope of regulatory consolidation Carrying values of items: Subject to credit risk framework Subject to counterparty credit risk framework Subject to the securitisation framework Subject to the market risk framework Not subject to capital requirements or subject to deduction from capital Assets Current and Non-current assets 3,162,262 2,769,441 2,306,713 382,964 36,471 498,059 43,293 Cash 39,723 39,646 39,646 - - 9,565 - Interbank investments 357,134 349,280 57,556 291,724 - 21,710 - Securities 968,035 595,861 558,932 - 36,471 200,265 458 Derivatives 93,624 93,714 - 91,240 - 6,826 2,474 Operations with credit granting characteristics 1,219,313 1,221,457 1,183,457 - - 182,037 38,000 Interbank and interbranch accounts 296,771 296,770 296,770 - - 75 - Current and deferred tax assets 93,261 89,613 87,252 - - - 2,361 Others assets 94,401 83,100 83,100 - - 77,581 - Permanent assets 37,430 64,915 47,834 - - - 17,081 Investments 8,948 38,891 38,560 - - - 331 Real estate 9,765 9,274 9,274 - - - - Real estate by lease - - - - - Goodwill and Intangible assets 18,717 16,750 - - - - 16,750 Total assets 3,199,692 2,834,356 2,354,547 382,964 36,471 498,059 60,374 Liabilities Current and Non-current liabilities 2,990,324 2,601,904 - 578,487 - 311,919 2,023,417 Deposits 1,099,998 1,110,902 - - - 79,882 1,110,902 Deposits received under securities repurchase agreements 528,406 528,583 - 516,293 - 79,096 12,290 Debt instruments 419,894 421,485 - - - 2,907 421,485 Borrowings and onlending 136,916 136,915 - - - 2,379 136,915 Derivatives 88,588 88,541 - 62,194 - 6,883 26,347 Interbank and interbranch accounts 109,359 109,027 - - - 2,087 109,027 Provisions for financial guarantees, credit commitments and credits to be released 2,314 2,314 - - - - 2,314 Technical provision for insurance, pension plan and premium bonds 371,959 - - - - - - Other provisions 16,795 16,594 - - - - 16,594 Current and deferred tax liabilities 19,259 16,403 - - - - 16,403 Other liabilities 196,836 171,140 - - - 138,685 171,140 Total liabilities 2,990,324 2,601,904 - 578,487 - 311,919 2,023,417

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 20 CC1 - Composition of regulatory capital 1 03/31/2026 Value (R$ Thousand) Balance Sheet Reference Common Equity Tier I: instruments and reserves 1 Instruments Eligible for the Common Equity Tier I 136,909,898 (k) 2 Revenue reserves 65,015,812 (l) 3 Other revenue and other reserve (1,576,796) (m) 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 5,909,651 (j) 6 Common Equity Tier I before regulatory adjustments 206,258,565 Common Equity Tier I: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 84,061 8 Goodwill (net of related tax liability) 1,558,674 (e) 9 Intangible assets 15,522,176 (h) / (i) 10 Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution related to determination periods ended until December 31, 1998 2,353,108 (b) 11 Adjustments related to the market value of derivative financial instruments used to hedge the cash flows of protected items whose mark- to-market adjustments are not recorded in the books. (271,367) 12 Shortfall of provisions to expected losses - 15 Actuarial assets related to defined benefit pension funds - (d) 16 Shares or other instruments issued by the bank authorized to compose the Core Capital, acquired directly, indirectly or synthetically 264,828 (n) 17 Reciprocal cross-holdings in common equity - 18 Total value of adjustments related to net non-significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities - 19 Total value of adjustments related to net significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific adjustments - 21 Total value of adjustments related to tax credits arising from temporary differences that depend on the generation of income or future taxable income for their realization, above the limit of 10% of the Common Equity Tier I, disregarding specific deductions - 22 Amount that exceeds 15% of the Common Equity Tier I - 23 Of which: arising from net investments in the Common Equity Tier I of companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities - 25 Of which: arising from tax credits resulting from temporary differences that depend on the generation of income or future taxable income for their realization - 26 National specific regulatory adjustments (23,734) 26.a Deferred permanent assets - (g) 26.b Investment in dependence, financial institution abroad or non-financial entity that is part of the conglomerate, with respect to which the Central Bank of Brazil does not have access to information, data and documents - 26.d Increase of unauthorized capital - 26.e Excess of the amount adjusted of Common Equity Tier I - 26.f Deposit to cover capital deficiency - 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect - (i) 26.h Excess of resources invested on permanent assets - 26.i Total capital detached - 26.j Other residual differences concerning the Common Equity Tier I calculation methodology for regulatory purposes (23,734) 27 Other residual differences related to the calculation of the Common Equity Tier I for regulatory purposes - 28 Total regulatory deductions from the Common Equity Tier I 19,487,746 29 Common Equity Tier I 186,770,818 Additional Tier I Capital: instruments 30 Instruments eligible for the Additional Tier I Capital 21,455,898 31 Of which: classified as equity under applicable accounting standards - 32 Of which: classified as liabilities under applicable accounting standards 21,455,898 33 Instruments authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 34 Additional Tier 1 instruments issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 956,098 35 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 36 Additional Tier I Capital before regulatory adjustments 22,411,996

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 21 Additional Tier I Capital: regulatory adjustments 37 Shares or other instruments issued by the bank authorized to compose the Additional Tier I Capital, acquired directly, indirectly or synthetically - 38 Reciprocal cross-holdings in additional Tier 1 instruments - 39 Total value of adjustments related to net non-significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 40 Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 41 National specific regulatory adjustments - 41.b Non-controlling interest in Additional Tier I Capital - 41.c Other residual differences concerning the Additional Tier I Capital calculation methodology for regulatory purposes - 42 Regulatory adjustments applied to the Additional Tier I Capital due to the insufficient Tier II Capital to cover deductions - 43 Total regulatory deductions from the Additional Tier I Capital - 44 Additional Tier I Capital (AT1) 22,411,996 45 Tier I 209,182,814 Tier II: instruments and provisions 46 Instruments eligible for Tier II 20,072,282 47 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 48 Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 1,271,958 49 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 50 Provisions 308 51 Tier II before regulatory adjustments 21,344,548 Tier II: regulatory adjustments 52 Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, indirectly or synthetically - 53 Reciprocal cross-holdings in Tier 2 instruments - 54 Total value of adjustments related to net non-significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 55 Total value of adjustments related to net significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 56 National specific regulatory adjustments - 56.b Non-controlling interest in Tier II - 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes - 57 Total regulatory deductions from Tier II Capital - 58 Tier II 21,344,548 59 Referential Equity (Tier I + Tier II) 230,527,362 60 Total risk-weighted assets 1,560,810,228 BIS Ratios and Additional Capital Buffers 61 Common Equity Tier I Ratio 12.0% 62 Tier I Ratio 13.4% 63 BIS Ratio 14.8% 64 Additional Capital Buffers (% of RWA) 3.6% 65 Of which: capital conservation buffer requirement 2.5% 66 Of which: bank-specific countercyclical buffer requirement 0.1% 67 Of which: capital buffer for institutions that are systemically important at global level (G-SIB) 1.0% 68 Common Equity Tier 1 capital available after meeting the bank's minimum capital requirements (% of RWA) 3.2% Amounts below the limit for deduction (non-weighted by risk) 72 Total value, subject to risk weighting, of non-significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as well as non-significant investments in the Additional Tier I, Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 2,290,860 73 Total value, subject to risk weighting, of significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 16,783,376 (f) / (a) 75 Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 9,960,379 (c) Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) 82 Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 83 Amount excluded from the Additional Tier I Capital due to the line 82 limit - 84 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 85 Amount excluded from Tier II due to the line 84 limit - 1) The adjustment to equity arising from the adoption of the criteria for setting aside provisions for expected losses set out in CMN Resolution No. 4,966 impacted capital in phases, as defined in CMN Resolution No. 5,199.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 27 The table shows that the average LCR in the quarter is 195.1%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. LIQ2: Net Stable Funding Ratio (NSFR) a b c d e Value per residual effective maturity term (R$ thousand) 03/31/2026 No Maturity (1) Lower than six months (1) Greater than or equal to six months, and lower than 1 year (1) Greater than or equal to 1 year (1) Weighted Value (In thousand R$) (2) Available Stable Funding (ASF) (3) Capital - - - 250,187,723 250,187,723 Reference Equity, gross of regulatory deductions - - - 208,659,543 208,659,543 Other capital instruments not included in line 2 - - - 41,528,180 41,528,180 Retail Funding: 185,517,747 643,389,629 5,103,938 1,736,259 784,856,480 Stable Funding 104,298,327 543,920,794 1,981,655 121,692 617,812,429 Less Stable Funding 81,219,421 99,468,835 3,122,283 1,614,567 167,044,051 Wholesale Funding: 62,753,168 923,676,583 73,170,018 145,861,000 374,383,394 Operational deposits and deposits of member cooperatives 28,774,876 - - - 14,387,438 Other Wholesale Funding 33,978,292 923,676,583 73,170,018 145,861,000 359,995,956 Opertions in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 170,275,264 13,930,292 1,297,090 - Other liabilities, in which: 93,976,157 163,666,960 13,883,101 75,207,588 82,149,139 Derivatives whose replacement values are lower than zero 36,200,295 - - Other liability or equity elements not included above 93,976,157 127,466,665 13,883,101 75,207,588 82,149,139 Total Available Stable Funding (ASF) 1,491,576,736 Required Stable Funding (RSF) (3) Total NSFR high quality liquid assets (HQLA) 47,448,140 Operational deposits held at other financial institutions - - - - - Performing loans and securities (financial institutions, corporates and central banks) 1,233,724 637,174,693 155,651,356 763,555,428 890,796,945 Performing loans to financial institutions secured by Level 1 HQLA - 19,946,376 - 658,895 2,653,533 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions 944,615 31,783,208 8,066,457 18,567,012 27,757,302 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks, of which: 289,109 514,120,727 100,740,550 327,266,831 484,335,360 With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644. - - - 9,981,803 6,488,172 Performing residential mortgages, of which: - 15,325,855 13,755,651 175,605,348 124,832,989 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 124,619,051 102,402,375 Securities that are not in default and do not qualify as HQLA, including exchange-traded equities - 55,998,528 33,088,699 241,457,341 251,217,761 Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 171,984,346 15,741,599 1,627,941 - Other assets, in which: 94,230,147 172,394,872 7,393,987 126,606,786 268,557,089 Transactions with gold and commodities, including those with expected physical settlement - - Assets posted as initial margin for derivatives contracts and participation in mutual guarantee funds of clearinghouses or providers of clearing and settlement services which acts as central counterparty. - - 20,011,243 17,009,556 Derivatives whose replacement values are higher than or equal to zero 40,085,637 - 7,304,103 5,487,470 Derivatives whose replacement values are less than zero, gross of the deduction of any collateral provided as a result of deposit of variation margin - - 1,820,740 1,820,740 All other assets not included in the above categories 94,230,147 132,309,235 7,393,987 97,470,700 244,239,323 Off-balance sheet transactions 789,812,585 7,924,441 - 21,346,939 15,865,371 Total Required Stable Funding (RSF) 1,222,667,546 NSFR (%) 122.0% 1) Corresponds to the total amount of Available Stable Funding (ASF) or Required Stable funding (RSF). 2) Corresponds to the amount after application of weighting factors. 3) Corresponds to the Available Stable Funding (ASF) or Required Stable Funding (RSF). R$ thousand Total Adjusted Value (1) 03/31/2026 12/31/2025 Total Available Stable Funding (ASF) 1,491,576,736 1,499,680,491 Total Required Stable Funding (RSF) 1,222,667,546 1,202,059,545 NSFR (%) 122.0% 124.8% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 49 Institution Model considered for Market Risk Acácia FIDC Direito Creditório Responsabilidade LTDA VaR and Stressed VaR Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR Angico FIDC Segmento Infraestrutura e Agronegócio de Responsabilidade Limitada VaR and Stressed VaR Banco Investcred Unibanco S.A. VaR and Stressed VaR Banco Itaú Chile VaR and Stressed VaR Banco Itaú Consignado S.A. VaR and Stressed VaR Banco Itaú Veículos S.A. VaR and Stressed VaR Banco ItauBank S.A. VaR and Stressed VaR Banco Itaucard S.A. VaR and Stressed VaR Dibens Leasing S.A. - Arrendamento Mercantil VaR and Stressed VaR Erythrina FIDC Segm Infra e Agro Responsabilidade VaR and Stressed VaR FIDC B2cycle NPL VaR and Stressed VaR FIDC Cloudw Akira I VaR and Stressed VaR FIDC Kiwify VaR and Stressed VaR FIDC Mobilitas VaR and Stressed VaR FIDC Sumup Solo VaR and Stressed VaR Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento VaR and Stressed VaR Fundo De Invest Dir Creditórios Não Padron NPL II VaR and Stressed VaR FUNDO DE INVESTIMENTO EM DIREITOS CREDITÓRIOS ECO INVEST BRASIL VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios IA VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios Soul VaR and Stressed VaR Fundo Fortaleza de Investimento Imobiliário VaR and Stressed VaR Fundo Kinea Ventures VaR and Stressed VaR IA II - Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada VaR and Stressed VaR Ideal Corretora de Titulos e Valores Mobiliarios S.A. VaR and Stressed VaR Ideal Holding Financeira S.A. VaR and Stressed VaR Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. VaR and Stressed VaR Iresolve Companhia Securitizadora de Créditos Financeiros S.A. VaR and Stressed VaR Itaú Administradora de Consórcios Ltda. VaR and Stressed VaR Itaú Administradora de Fondos de Inversión S.A VaR and Stressed VaR Itaú Bank & Trust Bahamas Ltd. VaR and Stressed VaR Itaú Bank & Trust Cayman Ltd. VaR and Stressed VaR Itaú Bank, Ltd. VaR and Stressed VaR Itaú BBA Trading S.A. VaR and Stressed VaR Itaú BBA USA Securities Inc. VaR and Stressed VaR Itaú Chile New York Branch. VaR and Stressed VaR Itaú Companhia Securitizadora de Créditos Financeiros VaR and Stressed VaR Itaú Corredores de Bolsa Limitada VaR and Stressed VaR Itaú Corretora de Valores S.A. VaR and Stressed VaR Itau Isento Julho 28 FIC de Fundos Infra RF Incentivo Resp Limitada VaR and Stressed VaR Itau Isento Marco 28 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada VaR and Stressed VaR Itau Isento Marco 29 Fundo de Investimento em Cotas de FIIF em Infra RF - Resp Limitada VaR and Stressed VaR Itau Isento Setembro 28 Fundo de Investimento em Cotas de FIIF em Infra RF Resp Limitada VaR and Stressed VaR Itau Isento Setembro 29 FIC de Fundos Incentivados VaR and Stressed VaR Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado VaR and Stressed VaR Itaú Unibanco Holding S.A. VaR and Stressed VaR Itaú Unibanco Holding S.A., Grand Cayman Branch VaR and Stressed VaR Itaú Unibanco S.A. VaR and Stressed VaR Itaú Unibanco S.A., Nassau Branch VaR and Stressed VaR Itaú Unibanco Veículos Administradora de Consórcios Ltda. VaR and Stressed VaR ITB Holding Ltd. VaR and Stressed VaR Kinea CDI Absoluto Fundo De Investimento Financeiro Renda Fixa LP Resp Limitada VaR and Stressed VaR Kinea CO-investimento Fundo de Investimento Imobiliario VaR and Stressed VaR Kinea Equity Infra I Warehouse Feeder MM Ficfi CP VaR and Stressed VaR Kinea FOF Imobiliário FIF Multimercado - Responsabilidade Limitada VaR and Stressed VaR Kinea I Private Equity FIP Multiestrategia VaR and Stressed VaR

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 50 Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On March 31, 2026, VaR represented 57% of the capital requirement, while the stressed VaR represented 43%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco's portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions Kinea IMA- B5 Absoluto Fundo De Investimento Financeiro Renda Fixa LP Resp Limitada VaR and Stresse VaR Kinea KP Fundo de Investimento Multimercado Crédito Privado VaR and Stresse VaR Licania Fund Limited VaR and Stresse VaR Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento VaR and Stresse VaR Microinvest S.A. Soc. de Crédito a Microempreendedor VaR and Stresse VaR NC 2025 Fundo de Investimento em Direitos Creditórios VaR and Stresse VaR NC 2025 I Fundo de Investimento em Direitos Creditórios VaR and Stresse VaR Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior VaR and Stresse VaR Redecard Instituição de Pagamento S.A. VaR and Stresse VaR Redecard Sociedade de Crédito Direto S.A VaR and Stresse VaR RT Itaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stresse VaR RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stresse VaR Tangerina Fundo de Investimento em Direitos Creditórios - Responsabilidade Limitada VaR and Stresse VaR Tarumã 2 FIF Fundo Incentivado em Investimento em Deb de Infra RF Cred Priv Resp Limitada VaR and Stresse VaR Tarumã Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado VaR and Stresse VaR Théros Fundo de Investimento nas Cadeias Produtivas VaR and Stresse VaR Vitex FIF Fundo Incentivado em Investimento em Debêntures de Infra RF Cred Priv Resp Limitada VaR and Stresse VaR

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 54 • ∆NII (Delta Net Interest Income) is defined as the difference between the result of financial intermediation of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The institution uses an internal model to measure ∆EVE and ∆NII. ∆EVE results do not represent immediate impact in the stockholders’ equity. Meanwhile, ∆NII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank’s results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank’s risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for ∆EVE and ∆NII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The ∆EVE and ∆NII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the ∆EVE and ∆NII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 59 addresses the risks most relevant to the institution’s operations through specific procedures, in alignment with applicable corporate policies. To mitigate Social, Environmental and Climate Risks, ITAÚ UNIBANCO HOLDING CONSOLIDADO carries out process, risk and control mapping activities, monitors new regulations related to the topic and records identified occurrences in internal systems. In addition to risk identification, the stages of prioritization, risk response, mitigation, monitoring and reporting complement the management of the risks assessed. Risk management follows the three lines of defense model. First-line areas, represented by the business units, are responsible for managing risks in their day-to-day activities, in accordance with the guidelines of the ESC Risk Policy and specific procedures, supported by specialized technical assessments carried out by dedicated teams, such as those in the Credit area. Business support areas, including Sustainability and Institutional Legal, also rely on specialized teams that work in an integrated manner to manage all dimensions of Social, Environmental and Climate Risks associated with the conglomerate’s activities. Second-line areas, such as Social, Environmental and Climate Risk and Internal Controls, provide oversight, methodological support and ensure the appropriate governance of business and credit activities. In the third line, Internal Audit operates independently, performing assessments of risk management, controls and governance. The institution has specific procedures in place for the management of Social, Environmental and Climate risks in its own operations — including assets, branch infrastructure, technology and suppliers — as well as within traditional risk categories such as credit, investments and key subsidiaries. These procedures are designed in accordance with the principles of relevance and proportionality and range from the verification of information in applicable public databases for clients and suppliers to in-depth individual analyses for selected clients, depending on the segment or type of product. The governance structure also includes the Social, Environmental and Climate Risk Committee, whose primary responsibility is to assess and deliberate on institutional and strategic matters, as well as on products, operations and services that involve Social, Environmental and Climate Risks. Given the relevance of climate risk, ITAÚ UNIBANCO HOLDING CONSOLIDADO supports the Task Force on Climate-related Financial Disclosures (TCFD) and is committed to maintaining a process of continuous improvement aligned with its recommendations. In addition, the institution measures the sensitivity of its loan portfolio to climate risks through the application of the Climate Risk Sensitivity Scale, which categorizes clients and sectors by considering both physical risks — arising from changes in climate patterns, such as increased rainfall, rising temperatures and extreme weather events — and transition risks, resulting from economic changes driven by climate-related actions, including carbon pricing, climate regulation, market risks and reputational risks. Operational and Compliance Risk Compliance and operational risks are defined as the possibility of losses resulting from external events or failures in internal processes, people, or systems, or from non-compliance with legal and regulatory requirements. The methodology supporting the management of these risks adheres to market best practices, trends, and applicable regulations, with emphasis on the principles of Basel, COSO (Committee of Sponsoring Organizations of the Treadway Commission), COBIT (Control Objectives for Information and Related Technologies), and IIA (The Institute of Internal Auditors), as well as the intensive use of artificial intelligence to challenge the status quo. Model Risk

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 61 Itaú Unibanco understands reputational risk as the risk arising from internal practices and/or external factors that may generate a negative perception of Itaú Unibanco by customers, employees, shareholders, investors, regulatory bodies, government, suppliers, the press and the society in general. It can impact the bank's reputation, the value of its brand and/or result in financial losses. Besides, this can affect the maintenance of existing business relationships, access to sources of fundraising, the attraction of new business and talent to compose the company's staff or even the license to operate. The institution believes that its reputation is extremely important for achieving its long-term goals, which is why it seeks the alignment of the speech, the action and the ethical and transparent practice, essential to raise the confidence of Itaú Unibanco’s stakeholders. Itaú Unibanco’s reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institution, Itaú Unibanco’s governance is structured in a way to ensure that potential risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products, including the use of new technologies. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations, including BACEN Circular 3,978/20 among others, and cooperation with police and judicial authorities. It also seeks a continuously alignment with local and international best practices for preventing and fighting against illegal acts, through investing and training eligible employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Policies and Procedures; • Client Identification Process; • Know Your Customer (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; • Compliance with Sanctions; • Monitoring, Selection and Analysis of Suspicious Operations or Situations;