Credit Risk Overview 184 Table of Contents Credit risk is the risk of loss arising from changes in the creditworthiness of borrowers, issuers, and counterparties. We are exposed to credit risk in circumstances where (i) a borrower, issuer, or counterparty fails to meet its contractual financial obligations, and/or (ii) the value of a financial instrument is adversely affected by credit spread widening, credit migration, credit rating downgrades, or default events. Credit risk may result in, among other effects: (i) losses from non-performance of contractual obligations; (ii) reductions in the fair value of credit exposures due to deterioration in credit quality; (iii) lower profitability or income due to increased credit costs and risk premium; and (iv) concessions granted in restructuring or renegotiation processes, as well as costs associated with collection and recovery activities. Our credit risk management framework is governed by our internal credit risk and control policies and is designed to: i.Follow the guidelines established by our board of directors and provide timely information to enable oversight of credit risk strategies, policies and risk tolerance in relation to expected returns. ii.Maintain well established defined credit risk policies and strategies, including operating limits, risk mitigation mechanisms and procedures intended to keep exposures within our risk appetite. iii.Maintain processes and tools to measure, monitor and control credit risk across products and sectors, managing portfolios and concentrations, taking into account their sensitivity to changes in the economic environment. iv.Continuously monitor portfolio performance and the effectiveness of policies and strategies, escalating to senior management indications of deterioration in credit quality and exceptions to established procedures. v.Support compliance of credit operations and controls with applicable laws and regulations in the jurisdictions in which we operate. Our credit risk management framework and institutional policy are approved by our board of directors and apply to our companies and subsidiaries in Brazil and abroad, in compliance with applicable regulatory requirements. Procedures and Key Indicators Business units overseeing credit portfolios conduct continuous monitoring of their respective exposures and originate credit within established approval authorities, considering market conditions and the broader macroeconomic environment. Our credit risk management practices consider internal factors (including borrower rating, portfolio performance and trends, default behavior, expected returns and allocated economic capital) as well as external factors (including interest rates, market indicators of default, inflation and consumption trends). Credit assessments vary by customer segment: 1.Individuals and small and medium-sized enterprises: credit decisions are supported by statistical scoring models, which typically include application/initial scores for the early stages of the relationship and behavioral scores for customers with an established history. 2.Large corporate customers: assessments are primarily based on counterparty-specific information, including financial condition, cash-generating capacity, corporate group considerations, and the current and prospective outlook of the sectors in which the counterparty operates. Credit proposals are assessed on a case-by-case basis. We monitor credit exposure to customers and counterparties against established limits and address limit exceptions through defined governance processes. Where appropriate, we may use contractual protections and risk mitigants, including covenants and rights to require early repayment or additional collateral, in accordance with the terms of the relevant agreements. Credit risk measurement considers, among other components, (i) probability of default, (ii) exposure at default, (iii) historical loss experience, and (iv) concentration of exposures. These components support the lending process, portfolio management and the establishment of limits. We use models and methodologies subject to governance processes to support the estimation of credit risk parameters, with the objective of maintaining data and methods that are sufficiently complete and accurate to reflect the risk profile of the exposures. Loan Approval Process Credit approvals are conducted in accordance with our credit risk management policies and approval authorities established at the business unit and risk levels, considering applicable criteria and our risk appetite. Credit decisions may be made through (i) a pre-approval process for eligible products and customers, or (ii) a traditional approval process conducted on a 185 Table of Contents case-by-case basis. In both cases, decisions are guided by credit quality considerations, which may include internal ratings supported by models, affordability and income commitment (as applicable), and credit restrictions defined by us and, where relevant, market practices. Our risk appetite framework sets forth the principles governing credit exposure, while the Risk function and the business units are responsible for developing and maintaining the policies and procedures that govern the credit cycle. As part of the credit granting process, we perform credit history checks using credit protection services and public registries, as applicable, to identify information that could represent impediments or heightened risk for granting credit (for example, court-ordered asset restrictions, invalid taxpayer identification, prior or pending restructuring/renegotiation processes, or payment incidents). Our assessment framework seeks to ensure that credit decisions are consistent with our risk appetite and aligned with the governance standards established in our credit risk management framework. For further information about our credit risk and credit risk mitigation practices, see “Note 32 – Risk and Capital Management” in our consolidated financial statements. Liquidity Risk Overview Liquidity risk is defined as the likelihood that a financial institution will not be able to effectively honor its expected and unexpected obligations, either current or future, including those from guaranteed commitments, without affecting its daily operations or incurring significant losses. Liquidity risk management processes and funding programs should take into account the financial institution’s lending, investment, and other activities and should ensure that adequate liquidity is maintained at the level of the parent company and of each of its subsidiaries. Governance Our liquidity risk control is managed by an independent area which is responsible for determining the composition of our reserve, estimating cash flow and exposure to liquidity risk over several time horizons, and monitoring the minimum limits of the risk appetite in countries in which we operate. All activities are subject to assessment by independent validation, internal controls and audit departments. Procedures and Key Indicators In accordance with the requirements under Central Bank regulations, we report our Liquidity Risk Statements on a monthly basis to the Central Bank. In addition, the following items are periodically prepared and submitted to the senior management for monitoring and decision support: •Different scenarios for liquidity projections to decision support, also using stressed macroeconomics scenarios and reversed stress according to risk appetite; •Contingency plans for potential crisis, which contain procedures ordered by levels of execution, considering each country's characteristics; •Reports of risk indicators; and •Tracking and monitoring our funding sources taking into account counterparty´s type, maturity and other aspects, considering the risk appetite. Market Risk Overview Market risk is the possibility of losses resulting from fluctuations in the market value of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, price indices, equity and commodity prices. 186 Table of Contents Governance Our policies and general market risk management framework are in line with the principles of CMN Resolution No. 4,557, and its subsequent amendments. These principles guide our approach to market risk control across our Itaú Unibanco Group. Our market risk management strategy is aimed at balancing corporate business goals, taking into account, among other factors: •Political, economic and market conditions; •The profile of our portfolio; and •Capacity to act in specific markets. The key principles underlying our market risk management strategy are as follows: •Provide visibility and comfort for all senior management levels that market risks assumed must be in line with our risk-return objectives; •Provide disciplined and informed dialogue on the overall market risk profile and its evolution over time; •Increase transparency as to how the business works to optimize results; •Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and •Monitor and avoid risk concentration. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk; (ii) monitoring stress scenarios, limits and alerts; (iii) applying, analyzing and stress testing scenarios; (iv) reporting risk to the individuals responsible in the business units, in compliance with our governance procedures; (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable; and (vi) supporting the secure launch of new financial products. The CMN has regulations establishing the segregation of market risk exposure into minimum risk factors, such as: interest rates, exchange rates, stocks and commodities. Brazilian inflation indices are also treated as a group of risk factors and follow the same structure. Our structure of limits and alerts follows the board of directors guidelines, which are reviewed and approved by our board of directors on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders’ equity, liquidity, complexity and market volatility, as well as our risk appetite. Procedures and Key Indicators In an attempt to fit the transactions into the defined limits, we hedge transactions with clients and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, which can be characterized as either accounting or economic hedge, both of which are governed by our institutional regulations. Our market risk framework categorizes transactions as “Trading Book” or “Banking Book,” in accordance with general criteria established by specific regulation. Our Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Our Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, and intended to be either held to maturity, or sold in the medium or long term. Market risk management is based on the following key metrics: •Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, taking into account a defined holding period and confidence interval; 187 Table of Contents •Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market; •Stop Loss / Max Drawdown: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; •Concentration: cumulative exposure of certain financial instruments or risk factors calculated at market value (mark to market); and •Stressed VaR: a statistical metric derived from VaR calculation, aimed at capturing the most significant risk in simulations of the current portfolio, taking into account the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, we also analyze sensitivity and loss control measures. They include: •Gap Analysis: accumulated exposure of cash flows by risk factor, which are marked-to-market and positioned by settlement dates; •Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a one basis point change is applied to current interest rates or on the index rates; and •Sensitivities to Various Risk Factors (Greek): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. For further information on market risk see “Note 32 – Risk and Capital Management” to our audited consolidated financial statements. VaR – Consolidated Itaú Unibanco Holding Our consolidated VaR is calculated through the historical simulation. The assumption underlying historical simulation is that the expected distribution for the possible gains and losses (P&L) for a portfolio over a desired time horizon can be estimated based on the historical behavior of the returns of the market risk factors to which this portfolio is exposed. For the VaR calculation of non-linear instruments, we carry out a full re-pricing (full valuation), without any potential simplifications in the calculation. The VaR is calculated with a confidence interval of 99%, a historical period of four years (1,000 working days) and a holding period that varies in accordance with the portfolio’s market liquidity, considering a minimum horizon of ten working days. Also, under a conservative approach, the VaR is calculated on a daily basis with and without volatility weighting, with the final VaR being the most restrictive value between the two methodologies. We calculate VaR for the regulatory portfolio (exposure of the trading portfolio and exposure to foreign currency and commodities of the banking portfolio) according to internal models approved by the Central Bank. The Consolidated Total VaR table provides an analysis of our portfolio exposure to market risk. Consolidated VaR (Historical Simulation approach) (1) Average Minimum Maximum December 31, 2025 Average Minimum Maximum December 31, 2024 (In millions of R$) Group of Risk Factor Interest rate 1,303 1,028 1,974 1,376 1,179 988 2,120 2,009 Currencies 40 22 97 51 36 18 64 50 Equities 45 36 89 46 51 35 86 46 Commodities 30 10 67 40 17 8 41 19 Diversification effect (2) — — — (385) — — — (381) Total 1,085 777 1,744 1,128 939 756 1,902 1,743 1)Determined in local currency and converted into Brazilian reais at the closing price on the reporting date.2)Reduction of risk due to the combination of all risk factors. 188 Table of Contents As of December 31, 2025, our average global VaR (Historical Simulation) was R$1,085 million, or 0.5% of our consolidated stockholders’ equity as of December 31, 2025, compared to our average global VaR (historical simulation) of R$939 million as of December 31, 2024 or 0.4% of our consolidated stockholders’ equity as of December 31, 2024. VaR – Trading Book The table below presents risks arising from all positions with the intention of trading, following the criteria defined above for our Trading Book. Our total average Trading Book VaR was R$122.1 million as of December 31, 2025, compared to R$71.4 million as of December 31, 2024. Trading Book VaR (1) Average Minimum Maximum December 31, 2025 Average Minimum Maximum December 31, 2024 (In millions of R$) Group of Risk Factor Interest rate 111.6 75.6 195.0 127.0 70.0 22.8 276.4 118.4 Currencies 52.9 36.6 117.8 55.0 29.8 2.4 122.4 52.7 Equities 41.4 30.7 86.4 33.1 49.8 33.6 107.1 47.4 Commodities 32.2 10.4 104.6 40.0 18.0 3.0 57.3 15.4 Diversification effect (2) (139.8) (129.3) Total 122.1 92.2 176.0 115.3 71.4 46.1 131.3 104.5 1)Determined in local currency and converted into Brazilian reais at the closing price on the reporting date.2)Reduction of risk due to the combination of all risk factors. Backtesting The effectiveness of the VaR model is validated by the use of backtesting techniques that compare hypothetical and effective daily results with the estimated daily VaR. The number of exceptions to the VaR pre-established limits should be consistent, within an acceptable margin, with the hypothesis of 99% confidence level considering a period of 250 business days. Confidence levels of 97.5% and 95%, and periods of 500 and 750 business days are also considered. The backtesting analysis presented below considers the ranges suggested by the BCBS. The ranges are divided into: •Green (0 to 4 exceptions): corresponds to backtesting results that do not suggest any problems with the quality or accuracy of the adopted models; •Yellow (5 to 9 exceptions): refers to an intermediate range group, which indicates an early warning and/or monitoring and may indicate the need to review the model; and; •Red (10 or more exceptions): demonstrates the need for improvement action. According to Central Bank Circular No. 3,646, hypothetical testing consists of applying market price variations for a specific day to the portfolio balance at the end of the preceding business day. The effective test is the variation in the portfolio value up to the end of the day, including intraday transactions and excluding amounts not related to market price variations, such as fees, brokerage fees and commissions. The actual and hypothetical P&L had no exceptions over the preceding 250 business days ended December 31, 2025. We conduct daily backtesting on the VaR results used for regulatory capital calculations as well as the VaR results by trading units and risk factors. These results are reported to senior market risk management. Senior management regularly reviews and evaluates the results of these tests.