← Back to PAGS filing summaryThis is the extracted source text from the SEC filing. Formatting may differ from the original document.
4A. History and Development of the Company
PagSeguro Digital is an exempted company with limited liability incorporated under the laws of the Cayman Islands and our legal name is PagSeguro Digital Ltd. The Company was created in 2006 under the brand PagSeguro, aiming to democratize the payments and access to financial services in Brazil mainly to small online sellers. We promoted innovative solutions for diverse audiences and we currently serve over 34 million clients. Our activities in Brazil began in 2006, and throughout its history, we have consolidated our role as an acquirer and card issuer, in addition to providing complete solutions for online and in person payments (through mobile devices and POS terminals) with the widest variety of payment methods, such as credit, debit and meal cards. We currently have the largest acceptance network in Brazil, with more than 6.3 million active merchants. Since our initial public offering, or IPO, in 2018, PagSeguro Digital has been a public company listed on the NYSE and regulated by the SEC with subsidiaries in Brazil and abroad, including companies regulated by the Central Bank. These companies are part of our prudential conglomerate and are licensed in Brazil as a financial institution (multiple bank and securities broker) and payment institution (issuer of electronic currency, issuer of credit cards, acquirer and payment initiation services provider), having partnerships with the principal brands of credit cards.
Our principal executive office is located at Conyers Trust Company (Cayman) Limited, Cricket Square, Hutchins Drive, P.O. Box 2681, Grand Cayman, KY1-1111, Cayman Islands, and our telephone number is +55 (11) 3914-9524. Our investor relations office can be reached at +55 (11) 3914-9524. The SEC maintains a website (http://www.sec.gov) that contains reports, proxy and information statements and other information regarding registrants, such as us, that file electronically with the SEC. Our internet address is www.pagseguro.uol.com.br. On occasion, we may use our website as a channel of distribution of material company information. Financial and other material information regarding us is routinely posted on and accessible at https://investors.pagbank.com/. Information provided on our website is not part of this annual report and is not incorporated by reference herein.
In 2019, the Company officially launched its digital banking operation, expanding democratization and financial inclusion beyond payments solutions, with three main objectives: (1) reduce financial expenses by diversifying funding sources through deposit growth, (2) reduce merchant churn by increasing the penetration of digital account services and (3) diversify revenue streams beyond MDR and the prepayment of credit card receivables. As of December 31, 2025, we had 8,645 employees. Even with an extremely lean corporate structure compared to other financial institutions, one of our main characteristics is our focus on innovation, creation of scalable products and widespread financial inclusion. With headquarters in the city of São Paulo and operations in all Brazilian States across more than 5,569 cities, our main mission is to develop disruptive products aimed at democratizing financial services in Brazil, offering sellers and consumers a complete digital ecosystem that is simple, mobile-first, safe and affordable.
PagSeguro Digital’s clients are companies of all types and sizes — from individual entrepreneurs, micro-merchants and small businesses such as street vendors and beauty salons, to medium-sized companies in retail and other sectors –- as well as digital account clients. PagSeguro Digital also has a growing presence in the business-to-business trade segment and offers specific products for beauty care professionals, self-employed professionals, individual micro entrepreneurs, or MEI, chauffeurs and taxi drivers, lawyers, physicians and dentists, commerce and brick-and-mortar stores, restaurants, bars, and snack bars.
Since its founding, PagSeguro Digital has followed initiatives for the development of an environment that is open to competition in the financial and digital means of payment sectors. That is why the Company is a member of several industry associations, such as the Brazilian Internet Association (Associação Brasileira de Internet), or ABRANET, ABECS, the Brazilian Association of Banks (Associação Brasileira de Bancos), or ABBC, and ANBIMA.
Overview
We are a disruptive provider of financial technology solutions focused primarily on consumers, individual entrepreneurs, micro-merchants, small companies and medium-sized companies, or SMEs, in Brazil. We have a full banking offer and the largest payments acceptance network in the country, with online solutions for in-person sales, omnichannel and self-service.
Among our peers, we are the only financial technology provider in Brazil which business model covers all of the following six pillars:
• multiple digital banking solutions;
• in-person payments via POS devices that provide to merchants;
• free digital accounts that we provide to our consumers and merchants with functionalities such as bill payments, top up prepaid mobile phone, Uber, Spotify or Google Play credits, wire transfers, peer to peer cash transfers, prepaid credit cards, cash cards, debit and credit cards, loans, investments, QR code payments, and payroll portability, among other digital banking services;
• issuer of prepaid, cash, debit and credit cards;
• operate as a full acquirer; and
• operate as a cross-border Payment service provider (PSP).
36
Table of Contents
Our end-to-end digital ecosystem enables our merchants not only to accept payments, but also to grow and manage their businesses. Before PagSeguro, many of these individual entrepreneurs and SMEs were overlooked or underserved by incumbent payment providers and large financial institutions in Brazil. We offer safe, affordable, simple, mobile-first solutions for merchants to accept payments and manage their cash through their free PagBank digital accounts, without the need for a bank account. Our digital banking ecosystem features our free PagBank digital account, under the brand PagBank, and offers 51 payment methods and 15 cash-out options including bill payments, top up prepaid mobile phone, several partnerships available in PagBank app such as Uber, iFood, Play Station, Xbox, among others, wire transfers, peer to peer cash transfers, prepaid credit cards, cash cards, loans, investments, QR code payments, and payroll portability, among other digital banking services. Our free PagBank digital account serves both consumers and merchants.
Acquisitions and Changes to Our Organizational Structure
In 2023, we conducted the following corporate transactions:
• In July 2023, PagSeguro Brazil acquired 90% of the shares of NetPOS, in addition to the 10% it had previously acquired, and it therefore reached 100% of the share capital of NetPOS; and
• In July 2023, RegistraSeguro S.A. was merged into PagSeguro Brazil.
In 2024, we conducted the following corporate transaction:
• In June 2024, PagSeguro set up the Fundo de Investimento em Direitos Creditórios – PagBank Multiadquirência – Responsabilidade Limitada, or FIDM. The objective of this fund is to anticipate third-party assignments in accordance with market operations.
In 2025, we conducted the following corporate transactions:
• In January 2025, Yamí Software & Inovação Ltda. was merged into Pag Participações;
• In March 2025, Zygo Serviços de Tecnologia S.A. was merged into Pag Participações;
• In August 2025, the Company contributed shares representing 100% of the issued and outstanding shares capital of PagSeguro Brazil to BS Holding, though an in-kind contribution of shares. As a result, BS Holding became the sole shareholder of PagSeguro Brazil; and
• In December 2025, we completed a partial spin-off of BS Holding pursuant to which a portion of the shares of PagSeguro Brazil held by BS Holding was transferred directly to the Company as its shareholder. Following this transaction, BS Holding retained control of PagSeguro Brazil.
In 2026, through the date of this annual report, we conducted the following corporate transactions:
• In March 2026, CDS Serviços Financeiros Ltda., Pag Participações Ltda., and Tilix Digital Ltda. were merged into PagSeg Participações; and
• In March 2026, PagSeguro Biva Serviços Financeiros Ltda. was merged into PagSeguro Tecnologia Ltda.
4B. Business Overview
Our Mission, Purpose and Values
Mission and Purpose
Throughout its existence, PagSeguro Digital’s mission is to transform and democratize access to financial and payment solutions in Brazil by providing a simple, safe, affordable and accessible digital ecosystem to merchants and consumers. Today, the Company is also focused on the mission to make the financial lives of people and businesses easier. To pursue this mission, we have built a set of strong cultural values of customer-focused organization, protagonism, collaboration, simplicity and reliability.
Values
• All for the client: with focus, agility and a sparkle in our eyes, we all work for the client.
• Protagonism: we act as protagonists to do things differently and without fear of challenging the status quo.
• Collaboration: we embrace collaboration and diversity in order to grow.
• Simplicity: we “uncomplicate” today with simplicity.
• Reliability: our actions offer security to our clients.
37
Table of Contents
Our Market
Payments
• Micro-merchants and SMEs drive the Brazilian economy
According to SEBRAE (Portal do Empreendedor) and Brazil’s Internal Revenue Service (Receita Federal), there were 16.8 million micro-merchants in Brazil as of December 31, 2025. In addition, according to the most recent Annual Social Information Report (Relação Anual de Informações Sociais), or RAIS, published by the Ministry of the Economy, as of December 31, 2024, there were 4.6 million SMEs. Additionally, according to IBGE’s PNAD, as of December 31, 2025, there were 18.9 million self-employed individuals in the informal economy, usually individual customers of card acquirers. Taken together, this totals an addressable market of 40.3 million formal and informal businesses. In addition, according to SEBRAE, the number of individual micro entrepreneurs in Brazil increased significantly, from 0.8 million in 2010 to 16.2 million in January 2026.
We categorize these businesses according to their TPV:
• MSMB: merchants with a monthly TPV below R$3 million.
• Large Retail and Online: merchants with a monthly TPV above R$ 3 million, including large retailers and online merchants.
Businesses and consumers in developed economies continue to abandon cash and paper payments, shifting towards electronic payment mechanisms. This trend continues to impact the Brazilian economy, and the opportunities for the expansion of digital payments in Brazil remain significant. The migration away from checks creates efficiencies for businesses, who can reduce cost and accelerate cash flow if their accounts payable and accounts receivable functions are automated through electronic payments and reconciliation. Similar opportunities exist for consumer bill payment, direct deposit, and person-to-person payments.
According to eMarketer, the mobile payments retail purchase volume in Brazil increased to US$49 billion in 2025 from US$1 billion in 2015, while in the United States, this volume was approximately US$596 billion in 2025.
Regarding retail e-commerce as a whole, sales volume in Brazil increased to US$78 billion in 2025 from US$10 billion in 2015 according to eMarketer. The average growth rate of mobile e-commerce over the last 10 years has been 2.3x faster than in overall e-commerce, with m-commerce share in e-commerce growing from 11% to 63% between 2015 and 2025, according to eMarketer. This creates new options for buyers and sellers and provides business opportunities for buyers and providers of digital deliveries.
• Commerce is increasingly digital and mobile worldwide
According to the International Telecommunications Union (ITU), an estimated 6.0 billion people, or 74% of the total global population, used the internet in 2025, compared with 3.0 billion people, or 40% of the total global population, in 2015.
The increasing number of businesses offering online shopping is fueling consumer demand for faster and more reliable payment methods. We believe these trends create an environment where merchants feel compelled to interact more closely with a broader range of customers, using online stores, mobile-friendly technologies and extensive compatibility with digital payment methods, such as cards. We believe that there is a significant market opportunity for growth in e-commerce in Brazil.
• Businesses are shifting towards increasingly non-bureaucratic, friendly and all-in-one services
As technology and the regulatory environment evolve, sellers of all types and sizes face a continuous need for new solutions. A significant number of businesses in Brazil remain unserved or underserved in terms of online payments, POS and mPOS services as well as value-added financial services tools for a number of reasons, including lack of access, lack of all-in-one offerings, time-consuming, limited access to conventional funds and lack of transparency.
Financial Services
• The structure of the Brazilian financial market creates significant opportunities for disruption
The structure of the Brazilian financial market creates significant opportunities for technology-driven disruptors, who seek to break up the highly concentrated supply of services, particularly when compared to more developed markets. The banking market is relatively concentrated for global standards. Retail banking leaders are local, with no global retail banking players around the world. In September 2025, Brazil’s five largest financial institutions held 60% of financial assets, which makes it one of the world’s most concentrated markets. By comparison, banking concentration in the U.S. is significantly lower, with the five largest banks holding 42% of total assets.
38
Table of Contents
The use of payment cards also remains relatively low in Brazil compared to more developed markets. According to a report by ABECS, card payments accounted for 64% of Brazilian household consumption in the third quarter of 2025. In 2024, the same indicator for Brazil was 54%, compared to 58% in the United States, 64% in the United Kingdom and 76% in Australia, according to the most recent data made available by Red Book Statistics for Payments and Financial Market Infrastructures Statistics from BIS, indicating the potential for further expansion and the growth already observed in just three years in Brazil. Credit card penetration levels are a fundamental driver for the digital payments industry.
• Internet and technology pave the way for digitization of financial services
Brazil is a reference in global internet adoption. According to Statista, Brazil is the fifth largest country in terms of number of internet users (183 million people in February 2025), the fourth country in terms of time spent on the internet and the fifth in terms of time spent on social media, according to the 2025 Global Digital Report from “We Are Social” and “Meltwater.”
• Increasing significance of digital banking and digital banks in Brazil
The adoption of technology and focus on transparency, security and simplicity has transformed the consumer habits of the Brazilian population. According to the most recent research report prepared by Deloitte on behalf of Febraban, the volume of mobile banking transactions increased 15% from 2023 to 2024, with 74% (155 billion) of all banking transactions (208.2 billion) in 2024 conducted on mobile phones or tablets.
Moreover, approximately eight out of ten transactions are digital (conducted through mobile and internet banking and WhatsApp). Consequently, banks have been reducing their overall number of branches as a response to the digitization of banking, with bank managers and clerks mainly focusing on advising clients and services with greater complexity. According to the Central Bank, as of 2024, there were 16,6 thousand bank branches in Brazil, compared to 21.8 thousand bank branches in 2017.
The traditional financial system has been falling short of meeting expectations of different and complementary social and economic profiles. According to the World Bank’s most recent Global Findex database published in 2024, approximately 3% of the Brazilian working age population received wages in cash only, corresponding to approximately 5.2 million Brazilian adults. Also, 26% of the Brazilian adults who paid utility bills made the utility payment using cash only, according to the World Bank’s Global Findex 2024.
Clients of traditional banks also complain about high fees and spreads, limited product offerings and the level of poor customer service provided in return. According to results reported by Brazil’s four largest banks, the financial institutions’ annual revenues derived from services increased 37% from 2016 to 2025.
In fact, according to a survey conducted in 2021 by the Brazilian Institute for Consumer Defense (Instituto Brasileiro de Defesa do Consumidor), the tariff packages charged by the five largest banks in Brazil have registered a significant increase. The most requested services, such as withdrawals, deposits and transfers, had increased between 9% and 25% above the inflation rates observed between 2020 and 2021. The increasing adoption of digital banks in Brazil is expected to continue as a strong trend, rendering numerous advantages such as the reduction in operational costs, maximized revenues due to increased customer attraction and retention, and new technologies and advancements in the regulatory framework. Brazilians have been responding well to this adoption as, according to the latest report “Relatório de Economia Bancária” published by the Central Bank, the evolution of active relationships between individual customers and the digital banks showed a strong growth between the second half of 2020 and December 2023. During this period, active users of digital banks grew from approximately 15 million to 100 million.
• Trends shaping the banks of the future
Fintechs have been splitting apart services once provided through one trusted relationship with a traditional bank in order to meet customers’ specific needs with highly specialized offerings and superior customer service. The current unbundling of financial products has created a fragmented landscape that is expected to gradually shift towards trusted, centralized and digitally-enabled financial services platforms. The following principles have an imperative role in building the banks of the future:
o Best-in-class customer experience is digital and requires continuous investment in innovative technologies: mobile banking has succeeded in providing greater flexibility for customers to bank at home, at work or while socializing, in enhancing the financial awareness of its users and in retaining the client base due to user experience.
o Rich data enables more personalized customer experience: customer experience is expected to overtake price and product as the key brand differentiator in the near future. In addition to being more likely to do business with a company that offers a personalized experience, consumers expect companies to anticipate their needs and make relevant suggestions before first contact and will not have issues with sharing personal data in exchange for that.
o Security, exceptional customer service and transparency strengthen trustworthy relationships: trust surpasses convenience, reliability, value and time as the key attribute in the decision to adopt innovative payment and banking solutions, thus being indispensable when acquiring and retaining customers at scale. It is critical to secure the vast amounts of data and the consumer’s digital identity, and to constantly delight customers, while receiving high net promoter scores, engagement and retention in return. Equally important is companies’ ability to convincingly communicate their benefit, align the timeline of consumer costs and value received and emphasize the many steps taken, special assets used, time saved and complexity eliminated throughout the customer journey.
39
Table of Contents
Our Competitive Strengths and Advantages
• Our Unique Culture
Through a healthy work environment that values the differences and needs of each professional, PagSeguro Digital believes that people are instrumental in the success of the business. Through communication campaigns highlighting the pillars of the Company’s mission and values, our human resources department works continuously to strengthen PagSeguro Digital’s organizational culture.
Our Company has ongoing employees’ and managers’ meet up groups and development programs, encouraging greater proximity between managers and employees and continuous feedback among employees and their leadership. We also foster innovation and creativity among our employees on a daily basis and we frequently organize team meetings with the chief executive officer and other executives to ensure synergy among all teams, share our results, reinforce our values, such as collaboration, simplicity, protagonism, reliability and client satisfaction.
Everyone in the Company is welcome: this has been part of the Company’s DNA since the beginning, with young and diverse teams. Diversity and inclusion, or D&I, is key to us and our D&I team promotes initiatives and activities consistently, including diversity awareness campaigns and training programs to further enhance and continuously improve its practices. In addition, our office spaces are shared environments, which contribute to greater integration among all employees and, consequently, greater productivity.
• Our Business Model
o Digital company with tech-DNA;
o Complete digital platform with means of payment, financial services and software;
o Complete multiple bank platform for individuals and companies with one or more account holders;
o Acquirer with the most widely-accepted network in Brazil, offering face-to-face, online, and cross-border payments;
o Issuer of debit, credit, and prepaid cards;
o Investment platform offering public and private securities, investment funds and equity/REITs trading;
o Insurance distribution platform: Pix, cards, health, home and life insurance; and
o Super app with an extensive list of partners in telecommunications, transportation, delivery, games and entertainment.
• Our Products
o A Complete Banking Platform including:
o PagBank account: free simple and 100% digital;
o Cash-in solutions: Pix, wire transfers and deposits; and
o Investments: CDs, investments funds, stocks and other.
o Robust credit offerings for individuals and merchants:
o Payroll loans for INSS beneficiaries and federal employees;
o FGTS: enables customers to access a portion of their FGTS funds in advance of the official withdrawal date;
o Credit card: fee-free credit cards offered to bank deposit certificate (Certificado de Depósito Bancário), or CDB, investors or escrow account holders;
o Overdraft account: an extra limit granted to PagBank account holders;
o Working capital loans for active PagBank POS sellers with sufficient TPV and receivables held as collateral; and
o Receivables prepayments: early disbursement allow merchants to receive card sales funds instantly, from POS, checkout, or payment link transactions.
o Robust logistics structure and service levels; and
o Single interface integrating payments, financial services and software (app or internet banking).
• Our Sales Channel and Client Acquisition
o Online strategy in partnership with UOL, reaching 73% of the Brazilian internet audience; and
o Salesforce based on HUBs covering 100% of GDP geographically distributed.
• Our Financial Structure
o As of December 31, 2025, cash and cash equivalents, financial investments and compulsory reserve of R$6.7 billion; and
o Diversified funding sources based on deposits, with cost of funding structurally lower than industry.
40
Table of Contents
Seasonality
We operate in a somewhat seasonal industry. We tend to process fewer transactions in the first quarter of the year and experience increased activity as the year-end holiday shopping season initiates. As a result of quarterly fluctuations caused by these and other factors, comparisons of our operating results across different fiscal quarters may not be accurate indicators of our future performance. For additional information on risks relating to seasonality, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our quarterly results of operations and operating metrics may fluctuate and are unpredictable and subject to seasonality, which could result in the price of our Class A common shares being unpredictable or declining.”
Our Products and Services
Our end-to-end digital ecosystem operates as a closed loop where our clients are able to address their main day to day financial needs, including receiving and spending funds and managing and growing their businesses. Our main products and services are described in further detail below:
41
Table of Contents
Digital Bank
• Bill payments: We offer our clients the option to pay their bills that are in the form of invoices with bar codes (boletos). For every bill paid in this manner, PagBank receives a fee.
• Deposits: Similar to bank transfers, consumers can make cash deposits at a bank branch or automated teller machine, or ATM, directly to their free PagBank digital accounts, including to a merchant’s digital account to pay for a product or service, or to the consumer’s own digital account. We generate MDR, commissions on payments made through cash deposits to a merchant’s free PagBank digital account. There is no MDR or any other commission charged by us when consumers add funds to their own free PagBank digital account.
• Top-ups: Brazil still has a very large population using prepaid phones, and as a result, carriers pay brokers’ fees in order to recharge (“top-up”) these phones. At PagBank, we work as a broker offering recharges for phones to our clients and receive a fee from the carriers.
• Debt management: Through certain of our services, our merchants are able to charge their customers for the services they provide or the products they sell through the use of (i) invoices with bar codes (boletos), (ii) Pix (QR code), and (iii) a hybrid format using both barcodes and QR code (Bolepix).
• Direct deposits (Salary): Through our payroll portability feature, anyone working in Brazil as a registered employee can have their salary deposited directly into their free PagBank digital account at no cost.
• Pix: Pix is the biggest means of bank transfers in Brazil presently. In PagBank, clients can receive and send transfers instantly, through Pix.
• Tax collections: In addition to bills, we also offer our clients the ability to pay their taxes received in the form of invoices with bar codes (boletos).
• Wire transfer: Other than Pix, we also offer other transfers as peer-to-peer, or P2P, transfers (internal transfer) and TED (external transfers). Some transfers cannot be done by Pix, and TED allows us to maintain a full suite of transfer options.
• ATM withdrawal: Cash withdrawal from any ATM using a credit, debit, prepaid or cash card (cartão da conta)
Cards
• Debit card: Our PagBank Mastercard NFC debit card is linked directly to the balance of the free PagBank digital account. The card has no issuance fee, and we offer it to merchants and consumers through our PagBank Super app. Through this app, users can make purchases using any Mastercard and Visa network and withdraw cash, with a flat fee, through Cirrus ATM networks.
• Credit card: Our PagBank Visa credit cards have no annual or membership fees, and they are offered to customers who invest in PagBank CDs or who reserve the balance of their PagBank free digital account in an escrow account. It is accepted in Brazil and abroad. Card information can be stored in PagBank’s free digital account to enable NFC or QR code transactions. As NFC and QR codes do not require contact between the buyer and seller’s POS device, transactions are contactless.
• Cash card: Our PagBank Visa NFC enabled cash card is linked directly to the balance of the free PagBank digital account without the need to reload the card, unlike our PagBank prepaid cards.
• Prepaid card: Our PagBank MasterCard prepaid cards allow merchants or consumers to use the balance from their free PagBank digital account to buy goods and services in-person and online or withdraw cash at more than one million Cirrus network ATMs in Brazil and abroad. Merchants can, therefore, receive payments from sales transactions into their free PagBank digital account, load/reload the PagBank prepaid card with its value and spend that money without needing a bank account. With a modest initial purchase cost, the card comes with no annual fees or interest rates – and we provide it free to merchants who purchase a PagBank POS or mPOS device. PagBank’s prepaid card does not require credit checks on the merchant or preapproval for issuance.
Credit Products
• FGTS early withdrawal: This product allows customers to advance the withdrawal of a portion of their FGTS (Brazilian Severance Pay Fund for Length of Service) funds before the official deadline. In Brazil, employees have a percentage of their monthly salary deposited into their FGTS fund to create a reserve which can be withdrawn in specific circumstances, such as an unjustified dismissal. Since 2020, employees can withdraw part of this amount in their birthday month. The FGTS early withdrawal is a secured loan product, 100% guaranteed, that enables customer to access loans using FGTS funds that already belong to them to pay for the loans.
• Payroll loan: Payroll loans granted to retirees, pensioners, INSS beneficiaries, and federal public servants. The loan is directly deposited into the customer’s PagBank account and is deducted from their salary, greatly minimizing credit risks.
• Working capital loan: Loans granted to active sellers with PagBank POS, certain transaction volume (TPV), and a hold on their receivables to secure the loan.
• Overdraft account: Extra limit granted to PagBank account holders for emergencies and unforeseen expenses.
42
Table of Contents
Insurance
We developed partnerships with insurance companies in Brazil that are authorized to provide insurance products and services pursuant to a license by the Brazilian Insurance Authority (Superintendência de Seguros Privados – SUSEP). Through these partnerships, we offer insurance products in our platform, which are backed-up by our partners. We have expanded our operations in recent years and below is a list of products we offer:
• PagBank Account Insurance: This is PagBank Digital Account Insurance, which guarantees compensation in the event of theft in which the customer is coerced into transferring funds from our Superapp or after withdrawing funds from an ATM.
• PagBank Card Insurance: This is PagBank card insurance, which guarantees compensation in the event of loss or theft of the card resulting in improper withdrawals or purchases.
• Home Insurance: Residential insurance that, in addition to guaranteeing damage to the property and all contents, extends guarantees to corporate objects, when our client acts as a businessman onsite. This Insurance also includes 24-hour emergency assistance.
• Business Insurance: PagBank Business Insurance, which offers guarantees against fire, explosion, natural events, including damage caused to third parties and loss of income as a result of a covered incident. This product was launched in March 2024, with expectations of improvements to occur throughout 2024.
• Health Assistance: Discount network that allows our customers access to differentiated costs for consultations, exams, telemedicine and even surgical procedures, in addition to discounts at the main pharmacies in the country. The entire scheduling experience takes place within the PagBank Super app itself.
• Life Insurance: PagBank Life Insurance that guarantees compensation in the event of death or disability. This insurance has some important differences such as funeral assistance that extends to ascendants, descendants and in-laws which, in addition to payment, we take care of all procedures to support the client or family member at this difficult time.
• Credit Life Insurance: This is insurance that guarantees the repayment of loans that the PagBank customer has, in the event of death, disability, unemployment or, for entrepreneurs, loss of income due to inability to generate income.
Investments
• Recommendation from our distribution team: Our distribution team helps customers make better investment decisions taking into account their risk profile and investment horizon.
• Financial education: We provide educational resources and tools to enhance our clients’ financial literacy. Podcasts, instructional videos, daily investor calls and investment courses all connect into a comprehensive offering to our customers. This service aims to empower individuals to make informed investment decisions and understand market dynamics.
• Stocks and REITs: Purchasing stocks enable investors to acquire equity in a company. It’s an opportunity to benefit from the Company’s growth and earnings, with the potential for dividends and capital appreciation. At PagBank we also offer exchange-traded funds (ETFs) and real estate funds in the mix of variable income, bringing a greater offering of products to our customers. We also provide a home broker platform embedded in our app, offering real-time market data, analytical tools, and trading capabilities.
• Investment funds: Our distribution service offers access to a curated selection of around 170 investment funds managed by third parties, allowing investors to diversify across asset classes and management strategies in line with their investment objectives.
• PagBank CDs: A certificate of deposit is a financial product in which investors commit their funds for a fixed period and earn interest at a predetermined rate. It’s a secure form of investment with fixed returns, ideal for risk-averse individuals. This type of investment is insured by the Credit Guarantee Fund (Fundo Garantidor de Crédito – FGC), the Brazilian version of the Federal Deposit Insurance Corporation – FDIC.
• Third-party fixed income: At PagBank we act as an intermediary in the sale of third-party fixed income securities, such as corporate bonds, certificate of deposits, and asset-backed securities (ABS) offering clients a variety of options to earn regular income while diversifying their investment portfolio.
• Treasury bonds: These are government-issued securities that offer investors a fixed rate of return over a predetermined period. Tesouro Direto is a government program focused on bringing individuals to invest in a safe, government-backed security. They are considered low-risk investments and are often used to preserve capital and plan for long-term financial goals.
• Automatic savings: Automatic Savings is a service initially designed to offer payment terminal (POS) customers a way to automate investing their daily/weekly/monthly revenue by converting these funds into deposit certificates. It has evolved to also work the same way with customer balances. Now, with a couple of clicks, customers can set frequency and amount to save and invest in an automatic fashion.
• Money boxes: An innovative service aiming to help customers save and invest in a frictionless way. With only a couple of clicks, our customers can set up how much money, and how often, they would like to save. Funds are converted into deposit certificates, thus paying interest. “Investimentos por Objetivos” as a feature of the Cofrinho investment function allows customers to save and invest in objectives defined by customers, like retirement or a car down payment. Funds can be withdrawn within one working day, making Cofrinho a safe and easy alternative for first-time investors and alike.
43
Table of Contents
Marketplace
• Cashback: Cashback’s main objective is to keep the customer engaged (using PagBank) and can also be used for cross selling. Currently, customers choose how they want to use their cashback: when recharging their mobile phone, when paying bills, on gift cards, on their account card or on PagBank POS.
• Shopping PagBank: Shopping PagBank is a marketplace with offers from more than 50 major brands. When purchasing through Shopping PagBank, the customer always receives part of the value back, being paid directly into the PagBank account.
Payments
• Cross-border: Our PagSeguro Tecnologia platform provides international merchants with local payment solutions for their consumers, having a great footprint in Latin America, Spain, Portugal, Greece, Romania and Turkey. Using online merchants, PagSeguro Tecnologia can provide their end-users with more than 156 local payment methods, leveraging best conversion rates and unlocking the market potential of cross-border-commerce. All that coverage can be accessed by a transparent payment API or via branded checkout. The merchants can use our platform to perform payouts via Pix and directly to PagBank accounts. This way, their end-users become eligible for receiving any amount. PagSeguro intermediates the transaction, which collects the cash from merchants and settles the amount for the payee in Brazil, into a bank account held by the end-user.
• Online checkout: Our web checkout options offer tokenization, advanced handling of shipping information, management of subscriptions and automatic billing, order tracking and split payments. PagSeguro offer two different levels of web checkout integration: Redirect and Transparent, all of which are easy to set up and customize. With Redirect checkout, upon clicking on the payment option, the consumer is redirected away from the merchant’s website to the PagSeguro secure domain, where the payment is processed. After payment, the consumer is redirected to the merchant’s website. The Transparent checkout solution allows merchants to create a fully customized payment experience. Payment is processed under the merchant’s domain while still benefiting from the features and functionalities of our ecosystem, such as anti-fraud and consumer data protection.
• Pix: Pix, for instant wire transfers and payments, both online via checkout and our PagBank app and through our POS systems.
• P2P and social payment: Our P2P and social payment allows merchants and consumers to transfer their balances between PagBank digital accounts free of charge. The P2P tools also allow our customers to request payments by sending a web link through e-mail, social network or messaging services such as WhatsApp to the person paying. Our customers can request payments even if they do not have a website, and the payer does not need to register with PagBank and may pay through a variety of options, including credit card, Pix, boleto and pay in up to 12 installments.
• POS: PagBank’s wide range of affordable POS devices enable merchants to accept credit, pre-paid, debit and meal voucher on an in-person, chip and pin or NFC basis. PagBank’s POS devices can be set up in less than five minutes. It is designed to be easy to use and have high levels of system availability, efficient back-up solutions and value-added functionalities. For a significant amount of our POS devices, we currently rely on one manufacturer to manufacture, test and assemble, although we are expanding our range of POS devices, which would be derived from different equipment providers. The agreement for the supply of equipment, dated as of June 26, 2014, as amended from time to time, by and among PAX Brazil, Transire Fabricação de Componentes Eletrônicos Ltda., or Transire Brazil, and Net+Phone Telecomunicações Ltda., or Net+Phone, sets forth the types of POS devices to be sold by PAX Brazil, Transire Brazil and Tec Toy S.A., or Tectoy, to us and the standard terms and conditions governing this supply of POS devices. PAX Brazil, Transire Brazil and Tectoy together serve as our main supplier of POS devices. Consideration payable to PAX Brazil, Transire Brazil and Tectoy under this agreement is determined by the number of POS devices ordered by us. For more information, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Some of the key components of our POS devices are sourced from a limited number of suppliers. We are therefore at risk of shortage, price increases, changes, delay or discontinuation of key components, which could disrupt and harm our business.” We offer a comprehensive suite of POS devices such as:
o For micro-merchants and SMEs, we offer 2 devices: (i) mPOS Minizinha NFC connects, through Bluetooth, from PagBank apps to the acquirer’s platform to accept payment, provides receipts via SMS and (ii) Minizinha Chip 3 is an additional POS device, with sim card communication and a larger screen; and
o For businesses with greater needs, we offer three more sophisticated devices, (i) Moderninha Plus 2 provides consumer receipts via SMS and is focused on merchants that generate lower transaction volumes; while the (ii) Moderninha Pro, which provides consumer receipts via SMS or in paper form, is focused on merchants that generate higher transaction volumes. Moderninha Pro is the first single unit to offer GPRS/2G/3G (currently available 4G) chip connection, NFC, plug and play Wi-Fi and Bluetooth connections on the same device; (iii) Moderninha Smart is also a printer terminal, which has management features available such as product catalog and inventory management, in addition to allowing integration with third-party apps.
• QR code: is a contactless transaction, it does not require contact between the buyer and the seller’s POS device.
• TEF: launched in August 2017, is a solution that integrates EFTPOS (electronic funds transfer at point of sale) technology with merchant software, secured via PIN pad. This service allows merchants to process of large transaction volumes and issue tax receipts more easily than with traditional POS devices.
• PagTotem: This self-service equipment has a 23-inch touch screen display, with ethernet connection, 2.4/5Ghz Wi-Fi bandwidths, and Bluetooth, ideal for use in stores, markets, and fast-food restaurants.
• Tap On: launched in September 2023, it is a solution that transforms the cell phone into a secure device for contactless transactions, which includes larger ticket transactions authenticated with PIN, available for Android and iOS devices.
44
Table of Contents
Software
• PagVendas: Our sales app PagVendas is a POS software app available for smartphones and tablets running iOS or Android that integrates seamlessly with our payment processing solution but can also be used on a stand-alone basis. By using this app, merchants are able to increase productivity and manage their sales and inventory, among other items. The tablet version of the app allows merchants using POS devices to improve their business operations by registering and itemizing their services and products, selling merchandise on customizable terms, tracking business data and allowing for faster in-app checkout.
• ClubPag: Our promotional engine is a marketing tool that allows merchants to advertise across our client base, available for POS devices, the merchant can expand his club by requesting the customer’s cell phone in the first purchase to register, then can offer and encourage his customers at the time of transaction, in addition to automatically sending discount coupons via SMS and/or e-mail.
• PlugPag: Our wireless solution that connects the machine to the commercial automation system, via Bluetooth technology. PlugPag integration communicates the return of each sale, giving automation the possibility of processing and reconciling transactions. Integrated with Windows, Linux, Android or iOS.
• Envio Fácil: PagBank’s logistics solution for online sales, the merchant can simulate, compare and choose the best price to send your products and save up on shipping. Sell via Payment Link, Checkout, PagVendas, through social networks, marketplaces, or own virtual store and deliver products with PagBank convenience and security, without additional costs, the merchant only pays for the shipping they use, without a contract, monthly fees and minimum quantity of shipments, in addition to several payment options.
Sales and Marketing
Our marketing strategy is designed to grow our platform by building and maintaining the recognition and trust of the PagBank brand, attracting new users and generating more frequent activity by our existing users. Our marketing initiatives aiming to recruit merchants to our ecosystem currently focus on our POS devices, tap on phone systems, web checkout solutions and other online payment solutions. We believe that introducing our digital payment solutions to merchants who are not yet our clients is the most efficient and cost-effective strategy to sustain our growth among both merchants and consumers, creating a “network growth effect.” The advantages of our digital payment solutions for merchants drive growth in their businesses, and the advantages of our digital payment solutions for consumers lead them to prefer merchants who offer these solutions, resulting in the acquisition of new clients through word-of-mouth recommendations by both merchants and consumers.
Our existing clients, many of whom use PagBank as an exclusive payment method, enable us to grow our merchant base rapidly and organically. Each time a consumer who has not yet registered with PagBank visits our website or pays a merchant using one of our online or in-app checkout solutions, the consumer is invited to open a free PagBank digital account to make his or her next purchase with PagBank easy and seamless.
We strive to position PagBank’s products and services on top of mind and present them as a desirable, easy and secure means to accept and make payments in Brazil, while accompanying the consumer throughout the purchasing process, from general brand awareness through to actual purchase or account registration. As a digital company, and with the support of UOL’s audience, we continue to build and maintain brand recognition and trust through a variety of marketing campaigns, including advertising through traditional media, such as television, magazines and newspapers, and online advertising such as display media, videos, search results, social media and influencer marketing, including:
• Traditional offline media: television advertisements and merchandising (broadcast and cable), radio, the printed press, festivals and events, and display media such as billboards, urban digital time and weather displays, and airport and bus station displays.
• Traditional online advertising: display media (including banners, rich media, interstitials, videos and native ads) on a variety of online platforms, such as premium websites, portals, video platforms such as YouTube, social media platforms such as Facebook, Instagram, Tik Tok, Kwai and X, mobile apps, e-mail marketing and affiliate programs.
• Search: we have expertise in positioning our products in preferential placements on search platforms displayed on desktops, tablets and smartphones, using specific initiatives such as paid search (Search Engine Marketing, which includes bid management tools and keywords analysis) and natural or organic search (search engine optimization, or SEO, which includes website optimization).
Our marketing department develops all these online and offline marketing strategies using single integrated concepts, so that our campaigns include key visual characteristics and consistent messages across all channels. In line with our growth strategy, most of our campaigns focus on micro-merchants and SMEs, with messages that highlight our easy, safe and hassle-free way of accepting payments, such as “a single online contract that allows you to accept more than 40 cash-in methods” and “free yourself from POS rental fees.” We also highlight the advantages of our products and services as a complete solution for new or growing businesses. At the same time, we also advertise value-added products and services targeted at larger merchants and consumers from higher income sectors, including our business management tools and commercial automation solutions. We believe that our association with the UOL group brings experience and competitive advantages in designing, negotiating and purchasing advertising space. The strength of our brand, products and services has been recognized in a number of awards, including and below is a list of awards we received in 2025:
45
Table of Contents
• Recognized as first place in the category “Payment Methods” and one of our employees recognized as “Best Customer Service Professional – Large Operations” at the 2025 “Reclame Aqui Awards.”
• Ranked seventh in the Financial Services category in the ranking of the 1,000 largest Brazilian companies, according to Exame magazine’s 2025 “Melhores & Maiores” Awards (Exame’s Best & Biggest Awards).
• Recognized as one of the Most Valuable Brazilian Brands of 2025 by Interbrand.
• Recognized as one of the Top 1,000 Brazilian companies of 2025 in the Valor 1000 Awards, placing PagBank among the Top 5 Brazilian companies with the highest overall scores in the financial services category. Additionally, the Company achieved, in the financial services category:
o 1st place in Net Revenue,
o 1st place in Interest Coverage (EBITDA over Financial Expenses), and
o 2nd place in Net Revenue Growth.
• Recognized as one of the “World’s Best Companies – Sustainable Growth 2025” by TIME magazine, in partnership with Statista Inc., the world’s leading provider of statistical insights and global rankings.
• Recognized as one of the “Top of Mind Folha 2025” companies in the POS category.
• Recognized in 2nd place in the Financial Services category in the “Top 30 Companies in Brazil Awards,” conducted by Veja magazine in partnership with Austin Rating.
Further supporting the strength of our brand, PagBank has already shown strong results in brand recognition. Since May 2024, according to Google Trends, the number of internet searches for “PagBank” has been higher than the number of internet searches for PagSeguro. In addition, our PagBank app had 50 million downloads (Google Play as of February of 2026). Further evidencing the strength of our brand, 80% of our users would hire products and services offered by PagBank. In addition, as of February 25, 2026, our PagBank app was rated an average of 4.9 stars by 1.8 million reviewers in Apple’s Brazilian app store and 4.9 stars by 4.29 million reviewers in Google Play. These rankings compare favorably to those of our main competitors’ apps, which as of the same date were rated between 4.3 to 4.9 stars in Apple’s Brazilian app store and 4.4 and 4.8 stars in Google Play.
We use our proprietary tools and market measurement systems developed by third parties, such as Oracle and Google, to deepen our knowledge about consumer behavior and, consequently, optimize our marketing efforts and expenditures by customizing our sales messages to make it easier for users to understand, find and buy our products and services. Our marketing strategy is customized and we manage our desktop sites, mobile websites and mobile applications differently, each optimized for the screens they fit and the way our customers use them. In addition to our online and offline advertising efforts described above, we developed a broad range of marketing and sales channels to access potential clients, including:
• Our own sales team, mainly focused on offering our POS devices and online products and solutions to larger clients, as well as on providing ongoing support to those clients;
• Partner companies that distribute PagBank devices and solutions to their customer base (mostly point of sale solutions’ companies);
• Third-parties hired as independent sale organizations to distribute our POS devices across Brazil;
• Online store platforms and web development companies, which integrate PagBank as an exclusive or preferred payment method to their clients; and
• Third-party call center service provider hired to answer calls, e-mails and chat inquiries from our clients and prospects, and to offer our devices and solutions.
Customer Service
We believe in excellence in customer service and we continually invest in our merchant and consumer relationships by providing continuous customer service, account support and innovative solutions. By helping our clients navigate our applications and answering their questions quickly, we have been able to grow rapidly and to build trust with our clients, which has increased their loyalty and enhanced our reputation. We provide our customers with an array of digital self-service features including real-time online chat, chatbots, customer service e-mail and a customer service hotline. We maintain service quality by placing emphasis on careful selection of our customer service personnel and regular monitoring of employee performance. Our employees are trained to have in-depth product and service knowledge, professional service attitudes and communication skills to best address customer needs and inquiries.
Product Development and Technology
We develop most of the software technology used by our digital payments and banking platform in-house, although we also outsource certain projects to outside developers in order to expedite the delivery of software and keep our time-to-market advantage. Through this combination of technology, developed both in-house and by outsourced developers, we have developed a stable, reliable, proprietary and highly scalable platform with intuitive user interfaces, management tools, transaction processing, APIS, and database and network applications that help our customers utilize our suite of products and services, while keeping their financial information confidential.
46
Table of Contents
Our payments platform allows consumers to make purchases using a broad range of payment methods, regardless of where a merchant is located. For purchases made outside Brazil, we collaborate with local payment service providers. Our banking platform offers a large number of options for making transfers, paying bills, refilling prepaid phones and other wallets. It also includes a complete set of cards, including a cash card, a prepaid card and a credit card.
We manage large volumes of system access data and transactions, with more than 99.96% availability in 2025, using internet data centers provided by Scala and outsourcing multi-cloud computing and other managed IT services provided by Compasso UOL S.A., or Compass, and EDGE.UOL Tecnologia Ltda., or EDGE.UOL, both are UOL group companies. Scala, Compass and Edge provide these services to UOL, PagBank and several other large clients. Our transactions per second monthly peak increased from 79 in June 2016 to 765 in December 2025, and our average monthly deployments increased by a multiple of 20.2 from 597 average monthly deployments in 2017 to 11,436 average monthly deployments in 2025. With our hybrid infrastructure, combining local data centers and multi-cloud computing, we are able to scale up our services while retaining high availability for peak – volume occasions such as Christmas, Mother’s Day and Black Friday. This high-availability and continuously deployed platform ensures that all of our clients are able to operate with the latest features and the newest innovations without needing to patch or upgrade their software. Our scale as a UOL group company allows us to establish favorable partnerships with several suppliers, including software developers and hardware manufacturers.
Technology and innovation are in the DNA of the UOL group and are at the core of our business success, with products and engineering personnel representing 34.2% of the total headcount of PagSeguro (including outsourced staff) as of December 31, 2025. With our specialized team of 3,344 people focused on developing reliable, scalable and proprietary systems and new products and features, we regularly roll out innovative and disruptive solutions that are tailored to the Brazilian market. Our expenditure on software and technology (including salaries) amounted to R$1,184.2 million in the year ended December 31, 2025, R$1,154.9 million in the year ended December 31, 2024 and R$983.0 million in the year ended December 31, 2023.
We strive to offer new features and formats to improve our users’ experience on our platform. This process starts by listening to suggestions from our clients. We hold focus group meetings and conduct surveys periodically with regular and highly active customers to obtain feedback regarding our products and services, as well as suggestions and ideas for new features. We test all new products and features rigorously in-house and with pilot groups of merchants before rolling them out. Once our internal team has ensured they are working properly, we typically roll them out first to a select group of customers on a trial basis, listening to feedback and suggestions and enhancing the final details of the product or feature before rolling out to all customers. We frequently update our software products and follow a regular software release schedule with improvements deployed periodically, ensuring our merchants get immediate access to the latest features. Managing our platform’s software architecture and hardware is as important as offering new products and features. We focus on optimizing our processes and equipment to help ensure that our systems are capable of handling our rapid growth in an efficient and cost-effective way.
Our technology infrastructure simplifies the storage and processing of large amounts of data, automates many administrative tasks, and enables us to deploy and operate products and services on a wide scale. Our technology infrastructure is designed to reduce downtime in the event of system outages or catastrophic events, with continuity features, system redundancy and protection against cybersecurity threats. For further information on the measures we take to protect against cybersecurity threats, see “––Protecting Our Clients.” We strive to improve our technology infrastructure and platform continuously in order to enhance the customer experience and to increase security, efficiency and scalability.
PagSeguro’s research and development activities are based on years of experience in solid agile practices. These activities are distributed among small teams, known as squads, which work in parallel on complex projects. In addition to our IT professionals, the squads consist of people from different disciplines, including our products department, domain-specific business areas, information security department and customer relationship management team, among others. The exact composition of each squad is different and appropriate for each context. People on the squads apply methods like Scrum and Kanban to manage their daily activities. In order to have a global view of our projects, we use a portfolio management system which utilizes dashboards containing the scope of each development cycle, the backlog and what has been deployed thus far. Our experimentation and decisions are guided by lean practices that are heavily based on factual, data-driven information and hypothesis validation, helping us optimize our prioritization. For hypothesis tests, we heavily use practices like AB tests (testing a hypothesis involving two variants), data analysis and inferences. Our squads are encouraged to have an open mind and engage in frank communications, while maintaining responsibility and an appropriate level of autonomy.
Our efficiencies of scale, relentless cost discipline, and ongoing improvements to systems and processes. As our scale has expanded, our expenses have decreased when compared to our total revenue and income: for example, in the year ended December 31, 2025, our total expenses remained stable, at 87.5% of our total revenue and income from 87.3% in the year ended December 31, 2024, while revenue from transaction activities and other services and financial income, taken together, decreased to 96.7% of our total revenue and income from 97.5% in the year ended December 31, 2024. By maintaining our spirit of innovation combined with our focus on reducing costs, we intend to continue to drive costs down to achieve further profitable growth. We anticipate that we will continue to devote considerable resources to research and development in the future as we add new features and functionality to our products and services to strengthen and extend our digital banking solutions. Our market is characterized by rapidly changing and disruptive technologies, as well as evolving industry and regulatory standards, and we seek to remain in the front line of these changes. We believe our ability to adapt to rapidly changing technologies, products and services in an evolving industry is the cornerstone of our future success. For further information on the technological challenges in our industry, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Increasingly intense competition may harm our business.”
47
Table of Contents
Protecting Our Clients
Trust and security are essential to ensure success in the digital payments market. Fraud is one of biggest threats to our business and clients and may involve account takeover, identity theft and malicious counterparty activities. Our ability to protect our clients from financial loss and data theft has been a key feature contributing to our success and business growth, and we believe our security expertise will continue represent a major competitive edge in the future. We’ve been consistently investing in providing comprehensive protection for our clients, focusing on three main areas: transaction security; platform security; and customer service. The efforts we focused on the matter have brought us considerable recognition from the market and our clients — PagBank was awarded with the following: one of the “Best Company for Consumers” for electronic payments in 2016, 2017, 2018, 2019, 2021, 2022 and 2023; for payments in 2019; for online payments in 2015 and 2023; for bank and digital cards in 2023, as first place in the “Banks and Digital Cards – Major Operations” and “Payment Methods – Large Operations” in the Reclame Aqui Awards by Época magazine and Reclame Aqui, a consumer protection service. In 2022 and 2023, we were recognized as the best POS by Folha Top of Mind, and we ranked as one of the “World’s Best Banks” in Brazil in 2021, 2022, 2023 and 2024 published by Forbes. In 2025, we received several awards and recognitions. For more information on the awards and recognitions we received in 2025, see “—Sales and Marketing.”
The efforts we focused on the matter have brought us considerable recognition from the market and our clients — PagBank was awarded with the following: one of the “Best Company for Consumers” for electronic payments in 2016, 2017, 2018, 2019, 2021, 2022 and 2023; for payments in 2019; for online payments in 2015 and 2023; for bank and digital cards in 2023; as first place in the “Banks and Digital Cards – Major Operations” and “Payment Methods – Large Operations” in the Reclame Aqui Awards by Época magazine and Reclame Aqui, a consumer protection service. In 2022 and 2023, we were recognized as the best POS by Folha Top of Mind, and we ranked as one of the “World’s Best Banks” in Brazil in 2021, 2022, 2023 and 2024 published by Forbes. In 2025, we received several awards and recognitions. For more information on the awards and recognitions we received in 2025, see “—Sales and Marketing.”
• Transaction Security
We have focused and is part of our culture since our launch on ensuring the security of payment transactions carried out on our ecosystem. We believe we have been a pioneer in developing technology and expertise against online fraud and chargebacks related to fraudulent transactions in Brazil, supported by the reputation of the PagSeguro and UOL brands. Our transaction approval rate of 79% remained at the same level compared to 2024 and our net chargeback rates for transactions in 2025 averaged 0.03%, representing a decrease of 21% from 2024. These results and the enhanced transaction security was a result of a combination of anti-fraud technology, the design of our platform, and protection programs for our clients.
As is the case with any digital transaction, those that take place on our digital platform are susceptible to potentially fraudulent or improper sales. We use two main processes to control this fraud risk. The first process consists of monitoring credit card, debit card and boleto transactions on a real time basis, through systems that identify potential fraud. This process approves or rejects suspicious transactions at the time of the authorization, based on statistical models that are revised on an ongoing basis. The second process, which occurs after approval of the transaction, consists of a reconciliation process in which PagSeguro Brazil follows up on all chargebacks with the card issuers and, where appropriate, opens a claim process to seek reversal of the chargeback. This is a complementary process and increases our ability to avoid and manage chargebacks.
Our antifraud platform combines proprietary features, such as internal risk modeling and scoring through AI and risk assessment tools that collect public and private market information, combined by advanced fraud combat tools such as biometric engine with facial recognition with liveliness detection features, as well as front-line third party solutions such as Feedzai, Emailage, Serasa Experian and Threatmetrics. For more information, see “—Platform Security.”
The design of our platform also assists in preserving data confidentiality. Consumers can make payments through PagSeguro without sharing sensitive financial information such as credit card or debit card details with the merchant. Transactions on PagSeguro are tokenized and payment authorization credentials are kept separated from account holder’s information, helping us to better detect and prevent fraud when funds enter, flow through and exit our ecosystem. In addition, the ability to make and accept digital payments increases personal security in in-person transactions by reducing the need for both consumers and merchants to carry cash.
48
Table of Contents
Our protection programs guard our clients from loss through fraud and counterparty non-performance. We believe the history and critical mass of our consumer database allows us to provide quicker and more reliable transaction approval when compared with smaller or more recently established digital payments providers in Brazil. Our protection programs, which apply to online purchase transactions completed through our ecosystem, aim to reassure consumers the confidence that they will only be required to pay if they receive the product in the condition as described, and merchants the confidence that they will receive payment for the product that they are delivering to the customer.
Our merchant program protects against losses for chargebacks related to fraudulent transactions and similar claims on substantially all of our online transactions. A chargeback situation may also occur if the card used was unauthorized or if there is a non-fraudulent cardholder claim. If a chargeback claim is valid, the card issuer sends the transaction back to the merchant and charges the merchant the amount of the questioned sale. If the merchant cannot remedy the chargeback, it is the merchant’s loss. If there are not sufficient funds in the merchant’s account, the chargeback amount is charged to the acquirer.
For consumers, we provide protection against losses under which they can submit a claim if there is a problem with a purchase. The consumer can file a claim through our PagSeguro website, in which case the consumer and the merchant can seek to resolve the claim together. If they cannot resolve the claim within seven days after the claim is filed, the consumer has up to 20 days after filing the claim to request our assistance, in which case we act as mediator to help resolve the issue with the merchant. If a consumer does not request mediation within 20 days after filing a claim, the claim will be resolved in favor of the merchant.
• Platform Security
The architecture of our proprietary end-to-end payments platform coupled with third-party front-line solutions are key to our ability to provide consumers and merchants with continuity and security in their transactions. Through our numerous cash-in and cash-out options we are able to collect data from our clients, which allows us to save important information on customers for purposes of the approval of future transactions. The multiple layers of protection included in our platform help ensure continuity as well as addressing the cybersecurity risks discussed in “—Transaction Security” above.
We have developed intuitive user interfaces, customer tools and transaction processing and database and network applications that help our users complete transactions reliably and securely, both on our platform and on merchant sites integrated with PagSeguro. Our technology infrastructure simplifies the storage and processing of large amounts of data, facilitates the deployment and operation of large-scale global products and services, and automates administrative tasks. This technology infrastructure has been designed around industry-standard architectures to reduce downtime in the event of outages or catastrophic occurrences. We periodically conduct risk assessments on our business processes and critical assets, identifying the need for the adoption and improvement of our continuity and contingency plans, as well as following an extensive testing program on our business continuity and disaster recovery plans. In addition, we regularly adapt our environment monitoring activities to reduce the time to identify and respond to cyberattacks and improving the resilience of the environment whenever necessary. We work hard to improve our technology infrastructure continuously in order to enhance customer experience and increase efficiency, scalability and security. We also make use of well-known security protocols and solutions to secure user data and have obtained industry-recognized certifications. The service providers’ data centers that we use to storage our equipment are also certified under the International Organization of Securitization, or ISO, standards 9001, 20000 and 27001. We also perform security penetration tests on a regular basis and apply top-most security solutions for code and application scanning (SAST/DAST). We maintain a private “Bug Bounty” program for identifying bugs and security vulnerabilities in our systems and applications exposed on the Internet. For information on new data protection regulations, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches.”
Our platform’s architecture enables us to connect all parties regardless of whether the transaction is occurring at a traditional physical location (such as inside a store), a non-traditional physical location (such as in a park), or online, and whether through a mobile or fixed-line device. We believe that mobile devices, in addition to being the future of e-commerce, create opportunities to make digital payments safer. For example, we are able to use location data from mobile devices to reduce risk for our clients.
49
Table of Contents
• 2021 MOIP Cybersecurity Incident
Following our acquisition of our subsidiary MOIP in October 2020, which represented less than 3% of our consolidated assets as of December 31, 2021 and less than 2% and 1% of our consolidated revenue and net income, respectively, for the year ended December 31, 2021 and was shut down in December 23, 2023 with its functionalities transferred to PagBank’s online platform, we discovered that MOIP was involved in a cyberattack between September 25 and September 29, 2021. The hackers demanded that specified payments be made to prevent the public disclosure or sale of the targeted data that was compromised in the incident, which included personal profile information of MOIP customers. At the time of the incident, MOIP had a distinct and separate IT server and operating environment from the rest of our IT platform and systems, and therefore none of our databases, customer information or systems were subject or comprised, or formed part of the compromised data, beyond those independently within the MOIP IT environment. We promptly followed the requirements of applicable Brazilian law, including the filing of a formal report to the ANPD and the Central Bank on October 7, 2021. After completion of the assessment, without financial impacts, we provided further information regarding the incident to the ANPD on January 5, 2022 through a complementary form. On March 11, 2022, the ANPD requested that MOIP provide more information regarding the incident, specifically requesting a technical report detailing its scope and the measures taken by MOIP after the incident, as well as the communications MOIP sent or intended to send to its customers. MOIP provided a response to ANPD on April 8, 2022. Since then, we have not received any new requests about this incident from ANPD. On February 9, 2024 ANPD decided to archive the report, with no additional measures or information being required regarding the incident. During the review of the incident, we have not identified evidence of unauthorized access to sensitive information, such as passwords or credit card details. The cyberattack has not had a material adverse impact on our business, financial condition or customers, and our IT systems. The security and fraud prevention teams continued to monitor the incident throughout 2023, and we did not observe any relevant impact on our business. As a result of a business decision, MOIP’s operations and IT environment were deactivated, and all existing features and resources were migrated to PagSeguro’s IT server and operating environment. For more information about related risks, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches.”
Environmental, Social and Corporate Governance (ESG)
We are committed to ESG matters and have established a dedicated ESG committee. Our ESG committee determines our ESG strategy and supervises our performance in respect of ESG matters. Our ESG Committee meets annually, and our main executive officers and board members participate in those meetings to ensure that ESG-related topics remain central in our business. As a result, we have improved our practices in recent years and received several recognitions and awards. For more information on our ESG initiatives, see our annual sustainability report available in our investor relations website at https://investors.pagbank.com/. Our annual sustainability report is not incorporated by reference in this annual report.
Regulation of the Payments and Banking Industries in Brazil
Our activities in Brazil are subject to Brazilian laws and regulations relating to the payments industry. Law No. 12,865/2013, dated October 9, 2013, or the Payments Industry Law, regulates the payments industry within the overall Brazilian Payment System (Sistema de Pagamentos Brasileiro), or SPB. This law created the concepts of payment schemes (arranjos de pagamento), payment scheme owners (instituidores de arranjos de pagamento) and payment institutions (instituições de pagamento).
The Payments Industry Law also granted the Central Bank and the CMN the power to regulate entities that operate in the Brazilian payments industry, including those operating in digital environments, with powers to oversee the incorporation and operation of these entities, risk management, the opening and managing of payment accounts, the transfer of funds to and from payment accounts, and the rendering of acquiring services, among others.
In 2013, the CMN and the Central Bank implemented a regulatory framework with respect to the operation of payment schemes and payment institutions, by means of the enactment of several resolutions. Further, from 2018 through the date of this annual report, the CMN and the Central Bank enacted additional regulation amending the previous rules and introducing, among others matters: (i) a formal definition of sub-acquirers, setting forth the conditions that require sub-acquirers to use centralized settlement through the Brazilian Interbank Payments Clearinghouse (Núclea); and (ii) a cap on interchange fees in debit and prepaid cards
The rule currently applicable to interchange fees (Resolution No. 246/2022) establishes a maximum interchange rate of 0.5% for debit card issuers and 0.7% for prepaid card issuers. It also provides that debit and prepaid card transactions are subject to the same settlement deadlines (i.e., the deadline for making funds available to merchants).
The regulatory framework of the Brazilian payments industry also provides that: (i) sub-acquirers are participants in open-loop payment schemes that enable merchants to accept payment instruments, without directly participating in the settlement process; (ii) the owners of those schemes (such as Visa and Mastercard), either directly or through acquirers, may impose on sub-acquirers obligations relating to compliance with applicable regulations and scheme rules; (iii) sub-acquirers that also offer prepaid payment accounts may act as settlement account institutions (i.e., holding merchants’ settlement accounts) within a payment scheme; and (iv) interoperability between open-loop and closed-loop payment schemes is permitted. For more information, see “—Payment Schemes.”
50
Table of Contents
Payment Schemes
A payment scheme, for Brazilian regulatory purposes, is a set of rules and procedures governing certain payment services provided to the public with direct access by its end users (i.e., payors and receivers). In addition, such payment service must be accepted by more than one receiver in order to qualify as a payment scheme.
Not all payment schemes are subject to regulation, including licensing requirements and supervision by the Central Bank. The regulatory framework provides for supervision of payment schemes that are considered relevant and, thus, included in the SPB. The criteria for such classification depend on certain characteristics, as follows:
payment schemes that exceed certain thresholds on number of payment transactions or aggregate value of transactions are considered to form part of the SPB and are subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain authorization by the Central Bank;
payment schemes that operate below these thresholds are not considered to form part of the SPB and are therefore not subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain authorization from the Central Bank, although they are required to report certain operational information to the Central Bank, if so requested by the regulator. Furthermore, the Central Bank can issue an order requiring these payment schemes to apply for authorization to be part of the SPB on a case-by-case basis. In case an operational threshold is met, the payment scheme becomes part of the SPB and an application must be filed, but the payment scheme can continue to operate as usual until the authorization is granted by the Central Bank;
limited-purpose payment schemes are not considered part of the SPB and, therefore, are not subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain Central Bank authorization. Limited-purpose payment schemes are those whose payment instruments are: (i) accepted only at the network of merchants that clearly presents the same visual identity as the issuer, such as franchisees and other merchant licensed to use the issuer’s brand; (ii) intended for payment of specific public services, such as public transportation and public telecommunications; (iii) related to employee benefits established by law (such as meal vouchers) or (iv) issued and accepted exclusively in the scope of a closed-loop payment scheme and intended for payment of specific services as set forth by Central Bank Resolution No. 150/21; and
certain types of payment schemes have specific exemptions from the requirement to obtain authorization from the Central Bank, as, for example, payment schemes set up by governmental authorities, closed-loop payment schemes set up by certain financial institutions and closed-loop payment schemes set up by an authorized payment institution in which financial settlement of payment transactions are carried out exclusively using the book-transfer method.
Moreover, there are two key types of payment schemes:
closed-loop payment scheme (arranjos de pagamento fechados), in which payment services (management of payment account, issuance and acquiring) are all carried out by the same entity that is the payment scheme owner or by an entity that controls or is controlled by or is under the same control as the payment scheme owner; and
open-loop payment schemes (arranjos de pagamento abertos): all other payment schemes that do not fall under the closed-loop category.
Payment Scheme Owners
Payment scheme owners, for Brazilian regulatory purposes, are the legal entities responsible for managing the rules, procedures and the use of the brand associated with a payment scheme. Central Bank regulations require payment scheme owners to (i) be incorporated in Brazil; (ii) have a corporate purpose compatible with payments activities; (iii) have the technical, operational, organizational, administrative, and financial capacity to meet their obligations; (iv) have clear and effective corporate governance mechanisms that are appropriate for the needs of payment institutions and the users of payment schemes; (v) implement rules and procedures contemplating risk management of the participants, minimum operational requirements to be observed by the participants, monitoring of fraudulent actions, settlement of transactions among participants, and interoperability mechanism, among others.
Payment scheme owners that are responsible for managing open-loop payments schemes that are part of the SPB are also subject to: (i) rules that impose the creation of internal control systems and procedures; (ii) bank secrecy rules; (iii) administrative sanctioning process of the Central Bank; (iv) risk management within the payment scheme; and (v) the application of preventive measures by the Central Bank, in order to ensure the soundness, efficiency and regular functioning of payment schemes.
51
Table of Contents
Recent Regulatory Developments
On November 10, 2025, the Central Bank of Brazil issued Resolution No. 522/2025, which amended Resolution No. 150/2021. The new framework strengthens centralized risk management in payment schemes, expressly allocating to payment scheme owners (networks) ultimate responsibility for ensuring the settlement of all transactions to receiving users, including, if necessary, using their own funds where existing protection mechanisms are insufficient.
Resolution No. 522 also enhances transparency over risk allocation and financial risk mitigation tools, and prohibits delegation of sub-acquirer oversight, such that payment scheme owners are solely responsible for monitoring participants’ risks and may not delegate sub-acquirer risk management to acquirers. It also reinforces “honor all cards” rule, prohibits the requirement of collateral among participants, limits participants’ financial liability arising from chargebacks to 180 days from transaction authorization (after which, liability shifts to the scheme owner, within the maximum timeframe provided for in the payment scheme rules), and strengthens controls on fraud prevention, anti-money laundering/combating the financing of terrorism, or AML/CFT, as well as conduct standards with payers. The rule further advances interoperability, information sharing, authorization/change/cancellation processes for arrangements, full participation of sub-acquirers in centralized clearing and settlement, and transparency of fees charged within arrangements.
As a result of the structural changes to risk management, scheme owners must, by May 9, 2026, (i) submit to the Central Bank of Brazil requests for authorization to amend the rules of their payment schemes to reflect the new framework and (ii) implement the full participation of all sub-acquirers in centralized settlement, along with related operational interfaces (including information exchange between settlement infrastructures and receivables registries) and enhanced fees and penalty disclosures.
The Central Bank regulations also allow payment schemes to set forth additional rules for entities that use their brands. Since we participate in these third-party payment schemes, we must comply with their rules to continue accepting payment instruments bearing their brands
Payment Institutions
Pursuant to Central Bank regulations, payment institutions are classified into the following types:
issuers of electronic currency (i.e., e-money, generally in the form of prepaid deposits): these payment institutions manage prepaid payment accounts for cardholders or end users, carry out payment transactions using electronic currency deposited into these pre-paid accounts, and convert the deposits into physical or book-entry currency or vice versa;
issuers of post-paid payment instruments (mainly credit cards): these payment institutions manage payment accounts where the cardholder or end-user intends to make payment on a post-paid basis, and they carry out payment transactions using these post-paid accounts;
acquirers: these payment institutions do not manage payment accounts but enable merchants to accept payment instruments issued by a payment institution or by a financial institution that participates in a payment scheme. They participate in the settlement process for payment transactions by receiving the payment from the issuer of the prepaid or post-paid instrument and settling with the merchant; and
payment initiation service providers: these payment institutions provide payment initiation services without managing payment accounts nor holding, at any time, the transferred funds, and they may not store end-users credential data used to authenticate payment transactions.
Specific regulations issued by the Central Bank of Brazil have recently amended the authorization framework applicable to payment institutions. As per Resolution 80/21 (as amended by Resolution 494/25) all types of payment institution must obtain prior authorization from the Central Bank to start operating. Resolution 80/21 (as amended by Resolution 494/25) also established a transitional regime applicable to non-authorized issuers of electronic currency who started to operate before March 1, 2021 and to non-authorized issuers of post-paid payment instruments and acquirers who start operating before September 2, 2025 – those entities may continue to operate and must file an authorization request with the Central Bank between May 1, 2026, to May 31, 2026.
Certain financial institutions are waived from requiring an authorization from the Central Bank to render certain payment services. In addition, certain payment institutions are not subject to the legal and regulatory framework applicable to the payments industry in Brazil. This applies, for example, to payment institutions that only participate in limited-purpose payment schemes and payment institutions that provide services in the scope of programs set up by governmental authorities and payment schemes related to employee benefits established by law.
52
Table of Contents
Applicable regulations provide that payment initiation service providers must obtain Central Bank authorization prior to providing services. Any payment institution already licensed in another modality may operate as a payment initiation service provider, provided a 90-day prior notification is sent to the Central Bank.
A payment institution must be incorporated in Brazil and must have a corporate purpose that is compatible with payments activities, and, once they become part of the SPB, as described above, they must comply with several requirements. CMN and Central Bank regulations applicable to payment institutions that are part of the SPB cover a wide variety of issues, including: (i) Central Bank homologation of their officers and directors; (ii) Central Bank’s prior approval of the transfer of corporate control; (iii) minimum corporate capital and net equity, which has been recently updated by Joint Resolution No. 14, dated November 3, 2025 issued by the Central Bank/CMN and Resolution No. 517, date November 3, 2025, issued by the Central Bank; (iv) implementation of internal controls and procedures; (v) establishment of an ombudsman’s office; (vi) preparation of accounting statements pursuant to the Standard Chart of Accounts of the National Financial System (Plano Contábil das Instituições do Sistema Financeiro Nacional), or COSIF; (vii) implementation of operational, liquidity, market and credit risk management structures; (viii) anti-money laundering and know-your-client requirements; (ix) banking secrecy rules; (x) settlement of payment transactions arising under open-loop payment schemes at Nuclea’s centralized settlement system; (xi) establishment of an audit committee, as the case may be; (xii) adoption of directors and officers compensation policies; and (xii) administrative penalties for non-compliance, among others. Acquires must also integrate with an authorized registration entity to register all merchants’ receivables and settle transactions in accordance with the information provided in such entities’ systems.
The regulations applicable to payment institutions also cover payment accounts (contas de pagamento), which are the end-user accounts, in registered (i.e., book-entry) form, which are opened with payment institutions that are issuers of prepaid or post-paid instruments and used for carrying out each payment transaction.
In order to provide protection from bankruptcy, the Payments Industry Law sets forth that funds deposited in prepaid payment accounts are considered segregate net equity (patrimônio segregado), i.e., such funds are segregated from the payment institution’s own assets. For further information, see “—Segregate Assets.”
Regulation of the Banking Industry
In January 2019, we acquired BBN Banco Brasileiro de Negócios S.A. (renamed to BancoSeguro S.A. in February 2019), through BS Holding, a holding company incorporated under PagSeguro Digital, whose sole purpose is to hold interest in financial institutions, as required by applicable banking regulations. BancoSeguro holds a multi-bank license to provide financial services, has commercial and investment bank portfolios, and is duly authorized by the Central Bank to perform banking operations in accordance with current regulation. In addition, on December 14, 2021, BancoSeguro was authorized by the Central Bank to operate in the foreign exchange market.
Banking activities in Brazil are governed by Law No. 4,595/1964, which created the CMN, granting it powers to, among others, regulate the establishment and operation of financial entities, and empowered the Central Bank to supervise public and private financial institutions and, when needed, apply the applicable penalties. The Central Bank also controls and approves the operation, transfer of control, and corporate reorganization of financial institutions, as well as the transfer of the location of its branches (in Brazil or abroad). The CMN and the Central Bank created a vast regulatory framework regulating the National Financial System which may impact BancoSeguro’s operations and future products.
In this regard, BancoSeguro must observe certain key governance, compliance, and supervision requirements applicable to all the institutions that are part of the National Financial System, such as:
complying with minimum capital requirements by the Central Bank/CMN, compulsory deposits requirements, fixed asset investment limits, limits on exposure to foreign currency, and limits to charge fees and commissions for certain financial services;
maintaining internal controls and procedures and risk management structures;
observing “know your customer,” anti-terrorist, anti-money laundering, and cybersecurity rules;
maintaining an ombudsman office;
preparing accounting statements pursuant COSIF;
complying with additional regulations from other agencies that are specific to banking activities, such as the CVM’s fundraising rules;
observing limits to acquire real estate properties not intended to be used by BancoSeguro, except when such properties are received as payment of non-performing or doubtful loans, or when expressly authorized by the Central Bank, and in accordance with rules to be issued by the CMN; and
observing legal requirements to operate with related parties.
Financial institutions are also members of the SPB. Under the SPB, the Central Bank has control over the banks’ reserve accounts through the Reserve Transfer System – STR, a computerized system which enables the online transfer of funds between financial institutions and constitutes a strict control of bank balances.
53
Table of Contents
In addition to regulations applicable to the financial system, BancoSeguro is also subject to laws relating to bank secrecy, consumer protection, tax, and other regulations applicable to Brazilian companies generally.
Securities Regulations
Multi-purpose banks with an investment banking portfolio (also known as investment banks), such as BancoSeguro and securities broker-dealer (corretora de títulos e valores mobiliários), such as PagInvest, may, among other roles, provide securities distribution, intermediation, and custody services, which are subject to Brazilian securities laws and regulations.
The main laws governing the Brazilian capital markets are Law No. 4,728/1965 and Law No. 6,385/1976. Among other provisions, they regulate the distribution and issuance of securities in the market, the trading of securities and the settlement and/or clearance of securities transactions. The securities regulatory framework in Brazil is further supplemented by regulations issued by the CMN, the CVM, the Central Bank, and self-regulation policies, such as those issued by various associations, over-the-counter organized markets, and securities exchanges, that govern their members and participants (for example, the B3 and the ANBIMA). In addition to the regulatory and supervision powers of the Central Bank, all Brazilian financial institutions are subject to oversight by the CVM when they participate in the Brazilian capital markets (such as BancoSeguro and PagInvest).
Multi-purpose banks with an investment banking portfolio are also regulated by CMN Resolution No. 5,046/22, which allows these entities to carry out, among others, the following activities in the capital markets: (i) participate in the processes of issuance, subscription for resale and distribution of securities; (ii) enter into securities purchase and sale transactions, for their own account or for the account of third parties; (iii) operate in commodities and futures exchanges, and in organized OTC (over the counter) markets, on its own or third-parties’ account; and (iv) coordinate reorganization and restructuring processes of companies and conglomerates, through consultancy services, equity interest and/or granting of funding or loans. Investment banks are also allowed to provide other services in the securities market, such as bookkeeping, custody, and management of third-parties’ assets, among others.
Furthermore, the investment fund industry was fundamentally changed by CVM Resolution No. 175/2022, enacted in December 2022, and partially in force since October 2023, which aims to bring the local investment funds industry up to international standards. As currently BancoSeguro acts as an investment fund quotas distributor to its clients, it is only partially affected by the changes implemented by the regulation. This main change implemented by this latest CVM resolution with respect to the distribution side of the investment fund industry is related to the commercial relationship to be established between the distributor and the other members of the investment industry. With the new regulation, which is currently in effect, the distribution side will be hired by the fund manager, instead of the administrator (as established under the previous regulation). Thus, we expect to have a larger pool of counterparties in our contracts for the distribution of third-party funds, as there are more fund managers than administrators.
Developments in the Regulation of the Brazilian Banking and Payments Industries
We summarize below rules and regulations that have been issued or modified by law or regulation of the CMN and the Central Bank and other authorities in recent years. We believe these laws and regulations are the most relevant and impactful to our business and the industry as a whole. This summary is qualified in its entirety by the full text of the rules and regulations that are publicly available, which is not incorporated by reference into this annual report.
Instant Payments (Pix)
In February 2020, the Central Bank announced its 24/7 instant payments platform, which operates under the name “Pix.” It was launched in November 2020, pursuant to Central Bank Resolution No. 1/2020, as a new instant payments scheme operated by the Central Bank, which, by promoting the digitalization of payments, is intended to foster competition, reduce social costs associated with paper-based instruments and provide a better payment experience for Brazilians. Pix is based on a centralized and sole settlement infrastructure operated and maintained by the Central Bank, the Instant Payments System (Sistema de Pagamentos Instantâneos – SPI) and in a Transactional Account Identifier Directory (Diretório de Identificadores de Contas Transacionais – DICT), where all final users’ information and corresponding accounts are stored.
Participation in Pix is mandatory for authorized financial institutions and payment institutions with more than 500,000 active customer accounts, considering deposit accounts, savings accounts and prepaid payment accounts. As per Central Bank Resolution No. 429/2024, only institutions authorized to operate by the Central Bank will be able to apply to join Pix.
In addition to the traditional functionalities of Pix (i.e., transferring funds between individuals and/or legal entities), the Central Bank has been developing new tools that are being integrated with Pix, enabling new possibilities to use Pix in different contexts. The following features have been recently developed by the Central Bank:
▪ Pix Collection (Pix Cobrança): Pix Collection enables a receiving user to manage and receive collections related to:
o immediate payments, which are those related to business models in which payment must be made at the same time of the collection, such as physical points of sale and e-commerce;
o payments with maturity date, which are those related to business models in which the payment can be made at a future date, with the possibility of covering interest, fines, other additions, discounts and other rebates; and
o payments related to the facilitation of cash withdrawal service, which are those related to the receipt of Pix transactions for cash withdrawal or change purposes, as requested by the withdrawing person, to enable the availability of funds to the paying user under Pix Withdrawal and Pix Change products.
54
Table of Contents
Pix Withdrawal and Pix Change (Pix Saque and Pix Troco): Pix Withdrawal consists of a transaction in which a payer user, holding a transactional account in any Pix participant, issues a Pix for the purpose of making a withdrawal from their transactional account to the transactional account of a withdrawal service facilitator or withdrawal agent, receiving funds in cash in an amount corresponding to the payment made. Pix Change consists of a transaction in which a payer user, holding a transactional account at any Pix participant, upon making a purchase at a withdrawal agent which is a merchant or a corresponding withdrawal facilitator service, issues a Pix from their transactional account to the transactional account of the withdrawal agent, for the purpose of receiving funds in cash in an amount corresponding to the difference between the Pix for the purpose of change and the purchase amount.
Scheduled Pix (Pix Agendado): Scheduled Pix consists of the possibility of a payer user to schedule a Pix on a certain future date. The request for a Scheduled Pix should be retained in the internal systems of the transactional account provider participant, not affecting the transactional account balances of the payer user, until the time the Pix is actually completed. In case of lack of sufficient funds in the payer user’s account on the scheduled date for Pix, the transaction is not authorized.
Automatic Pix (Pix Automático): In September 2024, the Central Bank released new resolutions with rules for a new feature of its Pix payment system called Pix Automático. The Automatic Pix is designed for recurring transfers, and only businesses can generate Automatic Pix charges. Automatic Pix creates new opportunities for companies that mainly serve other businesses. The Central Bank plans to fully launch Automatic Pix in June 2025.
Contactless Pix (Pix por Aproximação): Contactless Pix is a new feature of Pix, which, by using NFC (Near Field Communication) technology, allows payer users to make payments by simply holding their device near the recipient’s device. It is now to perform contactless payments with Pix through a digital wallet or app of the institution where the payer has an account. Pursuant to Central Bank Resolution No. 482/2025, the Pix Regulation was amended to formally introduce initiation by proximity (NFC). Participants offering this modality must comply with the Pix Initiation Standards Manual “Manual de Padrões para Iniciação do Pix” as of December 1, 2025.
Fraud Prevention
On September 23, 2021, the Central Bank issued Resolution No. 142/2021, introducing security requirements to be adopted by institutions under its regulation and supervision to prevent fraud in the provision of payment services by financial institutions, other institutions authorized to operate by the Central Bank, and payment institutions that are members of the SPB. Pursuant to the resolution, such institutions are required to limit the provision of payment services during the nighttime period to a maximum amount per deposit or prepaid payment account, as applicable, and financial and payment institutions must implement (i) procedures aimed at evaluating the customer prior to offering the same-day receivables advance feature; and (ii) daily registration of fraud or attempted fraud occurrences, including the corrective measures adopted by the institution. Based on these records, the institutions must prepare a monthly report consolidating the occurrences and the preventive and corrective measures adopted, which report must be forwarded to the institution’s audit and risk committees, internal audit unit, executive board and board of directors, as applicable.
The Central Bank issued an additional resolution, which, among other matters, sets forth security mechanisms specific to Pix transactions, including the obligation of the receiving institution to perform fraud assessment of Pix transactions and precautionary blocking of funds. If necessary, in case of sufficient indications of fraud or because of operational failure in the systems of one of the participant institutions, the relevant funds may be reversed to the payer by means of the “Special Return Mechanism.”
Additionally, on September 5, 2025, the Central Bank published new rules applicable to payment and financial institutions, and IT service providers (PSTIs), aimed at enhancing security in the National Financial System. In this context, Central Bank has established that PSTIs must maintain risk management policies aimed at addressing, at a minimum: (i) information and cybersecurity; (ii) business continuity; (iii) operational crisis management; (iv) fraud management; (v) internal controls and compliance; and (vi) internal audit. As an additional security measure, the Central Bank has also set forth that unauthorized IPs payment institutions or institutions linked to the National Financial System Network (RSFN) through PSTIs must observe a R$15,000.00 cap on transactions and that this limit does not apply if the institution uses accredited PSTIs and submits a reasonable assurance report, issued by an independent auditor, regarding compliance with certain security requirements. On the same date, the Central Bank issued rules establishing the PSTI accreditation process, requiring providers to apply for accreditation within eight months under the new rules.
Institutions may request exemption from the transaction limit. Exemptions will be valid once approved by the Central Bank, for a period of 90 days or until the PSTI is accredited and the report is submitted, whichever occurs first.
Furthermore, the CMN and the Central Bank enacted a joint resolution setting forth the requirements related to sharing data and information in the event a fraud is detected and established the necessary measures for such sharing.
In addition, Central Bank’s Resolution 343/2023 establishes that financial institutions, payment institutions and other institutions authorized to operate by the Central Bank, for purposes of data retention, shall consider signs of actual or attempted fraud at least in the following activities: (i) opening deposit accounts or payment accounts; (ii) providing payment services; (iii) maintaining deposit accounts or payment accounts; and (iv) contracting credit transactions.
55
Table of Contents
The new rules also set forth that records containing indications of actual or attempted fraud must contain at least (i) the identification of whoever perpetrated or attempted to perpetrate the fraud; (ii) a description of the indications of actual or attempted fraud; (iii) details of the institution responsible for recording the information; and (iv) details of the recipient account and its holder if the activity is a payment service.
On July 22, 2024, the Central Bank issued Resolutions No. 402 and No. 403, which came into effect on November 1, 2024, to enhance the overall security of the Pix system. Under the new rules, transactions can still be initiated from unregistered devices for amounts of up to R$200, with a daily limit of R$1,000. However, for transactions exceeding these amounts, the device must be registered in advance by the customer. Additionally, to further secure fund transactions, the Central Bank mandates that Pix participants implement a fraud risk management solution that utilizes security information from the Central Bank to identify unusual transactions. Pix participants must also provide easily accessible information to customers about fraud prevention measures and are required to check every six months for fraud markings in the Central Bank database, which will influence how they manage clients flagged for fraud risks.
In September 2025, the Central Bank issued Resolution No. 501 that provides that Brazilian financial institutions and licensed payment institutions must reject payment transactions destined to demand deposit, savings, or prepaid payment accounts where there is well-founded evidence of fraud, with the receiving institution required to notify the account holder of the measure. Institutions may determine suspicion using their own factors and data sources, including public or private databases.
In addition, Resolution No. 518 of November 3rd, 2025, amends the framework for opening, maintaining, and closing payment accounts by mandating payment account closure where there are material irregularities in customer information or where the account is used by the holder to provide financial or payment services within the Brazilian Financial System or Payments System without legal basis or in noncompliance with applicable regulations. The rule provides a non-exhaustive example covering the use of payment account funds to make or receive payments, or to settle obligations, on behalf of third parties in a manner that could conceal or substitute third-party obligations and prevent their identification. Institutions must adopt and obtain approval from the management board for the internal criteria for such determinations, may rely on public or private databases, and must retain related documentation for at least ten years.
Open Finance
On May 4, 2020, the Central Bank and CMN published Joint Resolution No. 1/2020, amended by Joint Resolution No. 10 of July 4, 2024, setting out the framework for the implementation of open finance in Brazil. Open finance is the standardized sharing of data, products and services by financial institutions, payment institutions and other institutions licensed to operate by the Central Bank, at their customers’ discretion, through the opening and integration of their systems. Therefore, open finance is considered by the Central Bank as an important tool for innovation in the financial and payments markets, and is expected to make such sectors more efficient, inclusive and competitive. Based on the model used in the United Kingdom, open finance in Brazil operates through APIS and customers’ consent is always required before any data sharing.
The CMN and the Central Bank continue to regulate open finance since its implementation, introducing new regulations aimed at enhancing payment transactions via the Pix instant payment scheme, simplifying payment initiation processes, facilitating contactless payments, providing for a new framework for governance (including the foundation of the Open Finance Association), making adjustments to mandatory participation requirements for institutions in the open finance ecosystem and including the ability for payment initiation service providers to offer services without redirecting users to other platforms, thereby streamlining contactless payments and improving user experience.
As of January 2025, all institutions with over five million customers have been required to participate in data sharing within the open finance ecosystem, while smaller institutions will have the option to opt-in voluntarily. Therefore, the prudential conglomerate led by PagSeguro will also have to participate in the data sharing of Open Finance.
Open finance is under gradual legal, operational and technological development and implementation in Brazil, according to certain stages defined by the Central Bank, which are still ongoing. Consequently, as of the date of this annual report, some of the applicable requirements and standards that will need to be complied with by open finance participants are still under discussion and preparation by a self-regulatory body created specifically for this purpose, as well as by the Central Bank itself.
Foreign Exchange Transactions
Law No. 14,286/2021, or the New Foreign Exchange Law, was published in December 2021 and became effective in December 2022. It includes provisions relating to Brazilian investment abroad and foreign capital in the country. The main goals of the New Foreign Exchange Law are to liberalize the Brazilian foreign exchange market, which faces regulatory complexity and certain inconsistencies, to modernize the system and to increase innovation and competition.
56
Table of Contents
According to the Central Bank, this new legislation may have a positive impact on attracting foreign capital, for investments in the financial and capital markets and other forms of direct investment, which includes long-term investments in infrastructure and concession projects. In addition to greater international insertion, the New Foreign Exchange Law contributes to the greater international use of the real, facilitating the use of domestic currency in international financial transactions, such as allowing the entry and remittance of payment orders in Brazilian reais from accounts in Brazilian reais held by foreign financial institutions with banks in Brazil.
The main aspects of the New Foreign Exchange Law are: (i) confirmation, from a legal perspective, that foreign exchange transactions of any amount may be carried out without limitation, provided they are carried out through entities authorized to operate in the Brazilian financial and payments markets and subject to applicable rules; (ii) granting of broad powers to the Central Bank to regulate the foreign exchange market and its operations; (iii) expanding the international correspondence activity of Brazilian banks; (iv) implementing the possibility of Brazilian banking institutions to invest and lend abroad funds raised in Brazil or abroad; and (v) granting powers to the Central Bank to establish situations in which the prohibition of private offsetting of credits between residents and nonresidents, as well as the payment in foreign currency in Brazil, would not apply. Foreign currency purchase and sale transactions in an amount of up to US$500, carried out between individuals on an occasional and non-professional basis are not subject to the provisions of the New Foreign Exchange Law.
Recent Developments on Foreign Exchange Regulation
Following the enactment of the New Foreign Exchange Law, the CMN and the Central Bank have issued new rules in order to enhance foreign exchange and international capital regulation, considering technological innovations and new business models relating to international payments and transfers. The new rules seek to promote a more competitive, inclusive and innovative environment for providing services to citizens and companies that send or receive funds from abroad.
The rules enacted in 2022 and 2023 allow: (i) authorized payment institutions to operate in the foreign exchange market, operating exclusively through electronic means, as of July 1, 2023; (ii) non-banking institutions authorized to operate in the foreign exchange market (such as securities brokerage companies, foreign exchange brokerage companies and payment institutions) to directly use their foreign currency accounts held abroad to settle transactions carried out in the foreign exchange market; (iii) Brazilian exporters to also receive export revenues in a payment account held in their name with a financial institution abroad or in an account abroad of a non-banking institution authorized to operate in the foreign exchange market; (iv) the receipt or delivery of reais in foreign exchange transactions, without amount limitation, to also occur from the customers’ payment accounts held with financial institutions and other institutions authorized to operate by the Central Bank or in payment institutions participating in the Pix instant payment scheme; and (v) prepaid payment accounts in reais to be held by residents, domiciled or headquartered abroad.
The regulation of international payment or transfer services in the foreign exchange market have also been consolidated and modernized, providing an equal treatment for purchases of goods and services carried out with the participation of issuers of international cards, international payment facilitators and intermediaries/representatives in cross-border transactions. Since October 2021, such services became classified in the foreign exchange regulations by the term “eFX.” Moreover, the execution of current unilateral transfers and fund transfers through the eFX system between accounts held by the customer in Brazil and abroad, of up to US$10,000.00, has also been allowed.
In addition, the new regulatory framework has (i) simplified the classification codes adopted in foreign exchange transactions by reducing the number of codes; (ii) streamlined registration procedures applicable to direct foreign investments in Brazil and the respective reporting requirements to the Central Bank; (iii) established that a bank account or payment account held by foreigners shall receive equal regulatory treatment when compared to a bank account held by account holders with residence or domicile in Brazil (except in certain specific cases); and (iv) eliminated the need for simultaneous foreign exchange transactions for the conversion of debt or other forms of investment into foreign direct investments and for the granting of loans to foreign investors when there is no actual flow of funds involved in the underlying transaction.
Further, on December 3, 2024, the Central Bank and the CVM issued Joint Resolution No. 13, which replaced previous regulation and introduced new rules for foreign investors in Brazil’s financial and securities markets (also known as portfolio investments). The goal of the regulations is to simplify and modernize procedures for non-resident investors, making them more efficient and in line with international standards. The key changes in the new rules, which became effective on January 1, 2025, include:
treating resident and non-resident investors equally in terms of minimum registration requirements;
o eliminating the need for non-resident individual investors to appoint a representative in Brazil or register with the CVM for certain operations;
o expanding the use of non-resident checking or payment accounts for financial investments; and
o removing the requirement to conduct foreign exchange transactions for investment conversions and register these investments with the Central Bank.
Finally, with respect to eFX providers, Public Consultation No. 124 was published on September 19, 2025, proposing that the provision of eFX services must be carried out exclusively by certain types of institutions authorized by the Central Bank of Brazil. Although the wording proposed in the public consultation is not binding, as it consists merely of a draft regulation submitted for public consultation, it already signals the Central Bank of Brazil’s intention.
57
Table of Contents
Segregate Assets
Law No. 14,031/2020 provides guarantee mechanisms for the financial risks associated with the transfer and settlement of funds between the participants of open-loop payment schemes, particularly issuers and acquirers, to ensure that such funds are received by the merchants, which are the final beneficiaries. Law No. 14,031/2020 was introduced to ensure that, in the event that an issuer or acquirer fails, the merchant receives the values arising from payment transactions carried out with payment cards. The concept of segregate net equity (patrimônio segregado) was introduced by the Payments Industry Law, which created a protection against bankruptcy to the funds held in or that flow through payments accounts, setting forth that funds deposited in prepaid payment accounts are segregated from the payment institution’s own assets. Law No. 14,031/2020 expanded that concept to cover all the funds flowing between participants of an open-loop payment scheme. In addition, to enforce those legal requirements, the payment institution must hold all the funds deposited in the prepaid payment account in certain specified instruments, in either (i) a specific account held with the Central Bank or (ii) federal government bonds, as provided for by Central Bank Resolution No. 300/2023. As of July 2023, balances held in this specific account held with the Central Bank started to be remunerated.
Virtual Assets
In December 2022, Law No. 14,478 was published, establishing a legal framework for virtual asset services in Brazil, including guidelines for the regulation of virtual asset service providers, or VASPs. Such guidelines include, among others, free competition, protection of personal data, protection of popular savings, consumer protection, and anti-money laundering actions.
Under the new law, VASPs are defined as legal entities that provide, on behalf of third parties, at least one of the following services: (i) exchange between virtual assets and domestic or foreign currency; (ii) exchange between one or more virtual assets; (iii) transfer of virtual assets; (iv) safe-keeping or management of virtual assets or instruments enabling a control over virtual assets; or (v) participation in financial services and the rendering of services in connection with the issue, offering or sale of virtual assets.
Subsequent legislation that came into effect in June 2023 established the Central Bank as the authority in charge of regulating and overseeing the virtual asset market within the scope of the law, with powers, among others, to authorize the operation of VASPs, and confirmed that the powers and authority of the CVM, on the subject remain unchanged. The CVM is tasked with regulating the issuance and offering of those virtual assets classified as securities under Law No. 6,385/1976.
In addition, CVM Resolution No. 175 of December 23, 2022, which became effective in October 2023, defines virtual assets as financial assets, thus allowing the direct investment by investment funds in such assets, as long as they are traded on entities authorized by the Central Bank or the CVM or, for transactions carried out abroad, by a local authority with powers to supervise the relevant transactions, including with respect to market abuse practices, such as money laundering, terrorism financing and financing the proliferation of weapons of mass destruction.
In 2023 and 2024, the Central Bank launched various public consultations aiming at regulating VASPs activities and proposing a regulatory framework for the provision of virtual asset services by other institutions authorized by the Central Bank.
Alongside these regulatory developments, as of the date of this annual report, the Brazilian Congress is discussing new proposals for legislative bills that could further regulate the cryptocurrency market. These initiatives include potential reforms to Law No. 14,478/2022, the regulation of stablecoins, and the establishment of legal protections for funds held with VASPs.
Regulatory Capital Requirements for Payment Institutions
In March 2022, the Central Bank published a set of new rules defining the regulation applicable to payment institutions under which prudential conglomerates will be classified into one of the following types:
Type 1: (a) single institutions authorized to operate by the Central Bank, except for (i) payment institutions; (ii) securities’ brokerage firms; (iii) securities distribution companies; and (iv) foreign exchange brokers; and (b) prudential conglomerates led by an institution authorized to operate by the Central Bank (excluding the entities listed in item “a”);
Type 2: (a) single payment institutions; and (b) prudential conglomerates led by a payment institution and made up exclusively of: (i) payment institutions authorized to operate by the Central Bank; (ii) payment institutions not authorized to operate by the Central Bank; (iii) entities that acquire credit transactions, including real estate, or credit rights, such as commercial development companies, securitization companies and exclusive purpose companies; (iv) other legal entities whose exclusive corporate purpose is to hold shares in the entities mentioned above in this item (b); or (v) investment funds; and
Type 3: (a) securities brokerage firms, securities distribution firms and foreign exchange brokerage firms; and (b) prudential conglomerates led by the institutions referred in item (a) above; and (c) prudential conglomerates led by a payment institution not mentioned in Type 2 above.
According to the Central Bank, the concept of regulatory capital applicable to payment institutions was modified in order to ensure greater capacity to absorb unexpected losses. This treatment will consist of deducting certain assets held by the institution from the calculation of regulatory capital that, in situations of financial stress, have little or no value for maintaining the institution’s operation.
58
Table of Contents
Furthermore, the new rules adapt the minimum capital requirement according to the intrinsic risks of each type of activity (payment or financial activity) for a Type 3 conglomerate, recognizing the peculiarities of the payment services and their differentiated legal status, and giving specific prudential treatment to the risks arising therefrom. In this context, risk weighted assets applicable for payment services risk, or RWAsp, was created, encompassing the activities of acquiring, issuance of electronic currency and provision of payment initiation services.
Regarding prudential segmentation, Type 3 conglomerates will be classified between segments S2 and S5 and will have to comply with the prudential rules of the respective segment, considering the prudential segmentation established by CMN and Central Bank regulations, which categorize financial and payment institutions into different segments based on their size, complexity, and risk profile, allowing a more proportional regulatory approach with respect to prudential requirements. Pursuant to these regulations, the prudential conglomerate made up by BancoSeguro, PagSeguro Brazil and PagInvest is classified as Type 3 conglomerate, with PagSeguro Brazil being the leader of a conglomerate in the S3 segment.
Prudential Regulation Referring to Credit, Market and Operational Risk
Between March 2022 and December 2024, the Central Bank issued various resolutions with respect to the prudential regulation referring to credit, market and operational risk, applicable to all institutions authorized to operate by the Central Bank, according to their segmentation, and addressing the following matters, among others:
implementation of the minimum standard of the Basel Committee for Banking Supervision, or BCBS, for calculating minimum capital requirements related to credit risk according to the standardized approach, or RWAcpad, thereby increasing the granularity of the weights applicable to exposures, bringing refinements in the differentiation in credit risk to financial institutions classified in Segment 1 (S1) to Segment 4 (S4), which currently opt for the standardized approach for credit risk;
reduction in the complexity of internal models for credit risk, or IRB, limiting their scope and increasing the comparability between institutions that adopt such framework, by means of (i) introducing new minimum standards for some parameters; (ii) reducing the set of portfolios eligible for approaches; (iii) introducing a new permanent output floor; and (iv) improving the flexibility in the application process for the use of IRB approaches, which now allows partial permanent adoption by specific portfolios;
implementation of the second phase of the Central Bank’s market risk framework (the Fundamental Review of the Trading Book – FRTB), establishing the procedures for the daily calculation, using a standardized approach, of the portion of risk-weighted assets, or RWA, related to the calculation of the capital required for exposures to the credit risk of financial instruments classified in the trading portfolio, or RWADRC, by means of (i) separating the calculation of capital requirement of exposures subject to credit risk classified in the trading book from those classified in the banking book; (ii) enabling the elimination of exposure protected by credit derivatives; and (iii) encouraging institutions to include such hedging mechanism in their portfolios, in order to lower effective exposure to risk;
softening the impact of the operation risk on the capital requirements of supervised entities by replacing the three calculation methodologies for required capital for risk-weighted assets, or RWAopad, currently in use (BIA, ASA and ASA2), with a single, more robust and risk-sensitive method, including an internal loss component that modulates the capital required;
establishment of (i) accounting procedures and criteria applicable to financial instruments, hedge accounting, the components of financial instruments which constitute payments of principal and interest on the principal value for the purposes of classification of financial assets; and (ii) parameters to measure the expected loss associated with credit risk, including for setting minimum levels of allowance for expected losses associated with credit risk; and
establishment of a transition schedule for incorporating the impacts on regulatory capital due to the new provisioning model based on IFRS 9, as per the recommendations of the BCBS, which allow jurisdictions to phase in the effects on regulatory capital resulting from increased provisions following the adoption of IFRS 9, by partially restoring regulatory capital that may have been reduced due to the shift to the new provisioning model.
59
Table of Contents
On April 30, 2025, the CMN and the Central Bank of Brazil issued CMN Resolution No. 5,207 and the Central Bank Resolution No. 470, respectively, concluding the third phase of Brazil’s market risk prudential reform under Basel III’s Fundamental Review of the Trading Book. The new rules amended CMN Resolution No. 4,958 to create a standardized sensitivity-based risk-weighted assets component for market risk (RWASENS) and adjusted CMN Resolution No. 4,557 to include credit-spread movements among monitored market risk factors in internal risk management. For institutions in S1-S3, RWASENS replaces the existing exposure-based components within RWAMPAD for interest rate, equity, commodity, foreign exchange and related positions; institutions in S4 will, for now, continue using the prior components. The framework supersedes the former internal-models component (RWAMINT) for market risk capital, with any potential adoption of an Internal Models Approach contemplated in a later phase.
In addition to the existing consolidated prudential requirements applicable to payment institutions in Brazil, on May 30, 2025, the Central Bank of Brazil enacted two key regulations (Resolution No. 478 and Resolution No. 477) providing significant enhancements to the regulatory capital framework applicable to payment institutions in Brazil. These new rules are specifically designed to reinforce the prudential regime for payment institutions by establishing mandatory individual capital controls.
The new rules set forth the scope, methodology, and minimum requirements for the calculation of the Leverage Ratio (Razão de Alavancagem) for payment institutions. Under this regulation, payment institutions classified as Type 3 entities are now required to comply with minimum leverage ratio requirements on both a consolidated and individual basis. For those classified in S2, the minimum leverage ratio will be phased in, starting at 2% from July 1, 2026, increasing to 2.5% on January 1, 2027, and reaching 3% as of January 1, 2028, on a consolidated basis. For individual payment institutions within a prudential conglomerate, the minimum requirement will increase from 0.75% to 2.25% over the same period.
The updated requirements emphasize the maintenance of an adequate funding profile, diversification of funding sources, and the timely transfer of liquidity within prudential conglomerates. Payment institutions are now explicitly required to promptly identify any statutory, contractual, legal, or regulatory restrictions that could limit liquidity transfers and to implement measures to mitigate such risks.
Further, in May 2025, the CMN approved amendments to Resolution No. 4,557 and Resolution No. 4,401, under CMN Resolution No. 5,222. The new rules require conglomerate leading institutions to implement policies, strategies and processes ensuring the timely intragroup transfer of liquidity, including prompt identification and mitigation of legal, regulatory, statutory or contractual impediments, and extend the Liquidity Coverage Ratio, or LCR, to a Brazil sub-consolidated perimeter for S1 groups (excluding foreign branches) at the same 100% minimum as the consolidated LCR. The qualitative risk-management changes took effect on September 1, 2025, and the sub-consolidated LCR requirement will take effect on July 1, 2026. In parallel, the Central Bank of Brazil issued a complementary resolution updating the scope and methodology of the leverage ratio and introducing a 3% minimum RA for specified S2 broker/dealer-led groups and Type 3 payment-institution-led groups, while mandating RA measurement on a consolidated basis and, for materially relevant entities in S1-S2 groups, on an individual or (subject to conditions, including PRSO and legal opinions) a Brazil sub-consolidated basis.
Finally, on November 6, 2025, the Central Bank of Brazil issued Public Consultation No. 128, proposing amendments to the recognition of credit risk mitigation instruments under the standardized approach (RWACPAD) and to the methodology for calculating counterparty credit risk under the Current Exposure Method (CEM). The proposed resolution would enhance procedures for existing credit risk mitigating instruments, recognize new instruments as credit guarantees, establish preferential risk weighting for certain payroll-linked credit operations, and introduce adjustments to the calculation of potential future gains in derivative transactions. If adopted, these changes could affect the calculation of credit risk exposures and capital requirements applicable to the prudential conglomerate led by PagSeguro.
Regulation of Credit Cards and Prepaid Payment Accounts
On March 1, 2022, Central Bank Resolution No. 96/2021, which amended and restated the rules relating to the opening of postpaid payment accounts (i.e., those used in products such as credit cards) and prepaid payment accounts, in addition to making the criteria for opening these accounts compatible with the rules applicable to the opening of deposit accounts (checking accounts) came into force. Among other measures, Resolution No. 96/2021:
eliminated the exhaustive list of minimum customer registration information for opening prepaid and postpaid payment accounts, determining that each payment institution will have discretion to determine what information it will require from the customer, depending on its profile;
introduced new procedures aimed at facilitating requests for prepaid and postpaid payment accounts to be closed;
classified payment accounts into two types: (i) prepaid payment accounts, which are those where the funds have been deposited into the payment account in advance of the intended payment transaction; and (ii) post-paid payment accounts, which are those where the payment transaction is intended to be performed regardless of whether or not funds have been deposited into the payment account in advance;
60
Table of Contents
revised the items that must be included in the invoices for postpaid payment accounts (i.e., credit cards), such as the need to include the total consolidated balance of contracted future obligations, such as installment purchases, credit operations and tariffs;
defined minimum provisions that must be included in the account agreements; and
required institutions to send or make available to the customer, by physical or electronic means, the credit card and the corresponding invoices, according to the form and channel chosen by the customer (among the options made available by the institution).
Further, on December 21, 2023, Central Bank issued Resolution No. 365, which amended Resolution 96 and established new requirements for credit card bills and other postpaid instrument invoices, such as presenting information in an orderly form according to groups of information (i.e. highlighted area, payment alternatives and complementary information).
On May 26, 2025, the Central Bank issued Resolution No. 475, establishing an electronic system that allows individuals and legal entities to register, free of charge, a request to restrict the opening of demand deposit, savings and prepaid payment accounts or changes to their holders, and enabling institutions to consult such records for contracting and supervisory purposes. On the same date, Resolution No. 476 amended Resolution No. 96/2021 to require institutions to consult this system prior to opening prepaid payment accounts or changing their holders, to document any exceptional decision to proceed despite a registered restriction, and to retain evidence of the consultation for at least ten years. Such new obligations came into force on December 1, 2025. Finally, closing of payment account rules contained in Resolution 96 /2021 were also amended by Resolution No. 518, dated November 3, 2025.
Regulation on Revolving Credit (crédito rotativo) and Installment Credit (crédito parcelado)
On October 3, 2023, Brazilian Federal Law No. 14,690 was published, establishing a new limitation on the interest and financial fees charged over the outstanding balance of credit card invoices that are considered revolving credit (crédito rotativo) and installment credit (parcelamento de fatura de cartão de crédito). The CMN and the Central Bank, thus, regulated the limitation provided for in Law No. 14,690/2023.
Under such rules, (i) the total amount of interest and financial charges in connection with revolving credit and/or installment credit cannot exceed the original amount of the debt financed and this limitation applies to all issuers of credit cards and other post-paid payment instruments; (ii) credit card issuers and holders can renegotiate the financing as long as the total amount charged as interest and financial charges applicable to each renegotiation do not exceed the amount of the original debt; and (iii) the original amount of the debt, as well as the total amount charged as interest and financial charges applicable to each financing transaction must be detailed in the respective statements and invoices in connection with the applicable regulations in force.
The new limit on interest and financial charges applies to each new revolving credit transaction or installment credit with interest. In other words, each issuer must have a control per financed transaction (revolving credit or installment credit with interest) to prevent the interest on this transaction from exceeding the interest limit imposed by Law No. 14,690/2023. Also, civil default interest and contractual fines resulting from penal clauses (imposed for late payments), as well as other fees and commissions incident to the financing transaction, are considered in the calculation of interest that will be subject to the limit mentioned therein.
On December 21, 2023, the CMN and the Central Bank regulated, through Resolution No. 5,112 and Resolution No. 365, the limit provided for in Law No. 14,690/2023.
Early Payment of Receivables
The Payments Industry Law prohibits payment institutions such as PagSeguro Brazil from performing activities that are exclusive to financial institutions. There is some debate under Brazilian law as to whether providing advances on receivables could be characterized as “lending,” which is an activity that is limited to financial institutions. Similarly, there is some debate as to whether the discount rates applicable to this early payment feature should be considered “interest,” in which case the limits set by Brazilian Federal Decree No. 22,626 dated April 7, 1933, or the Brazilian Usury Law, would apply to these rates.
In this context, on March 28, 2015, the PGBC, issued a legal opinion in which it concluded that: (i) the advance of payments of trade receivables (credit card receivables backed by executed and paid transactions) to merchants relates to the early payment of an obligation and should not be confused with activities of financial institutions; and (ii) discount rates applicable to this prepayment mechanism are subject to the limits set forth in the Brazilian Usury Law. Subsequently, in December 2023, this legal opinion was partially revised, as the PGBC concluded that the limitations set out in the Brazilian Usury Law should not apply to advance transactions carried out by authorized payment institutions.
Further, on June 28, 2024, the Brazilian Usury Law was amended by Law No. 14,905/2024, which expressly states that it does not apply to certain obligations undertaken outside the National Financial System. These include, among others, transactions contracted solely between legal entities and those involving financial institutions and other institutions licensed by the Central Bank.
61
Table of Contents
Operations and Registration of Receivables from Payment Schemes
On December 19, 2018, the CMN and the Central Bank published Resolution No. 4,707/18 and Circular No. 3,924/18, which impose transitional rules regarding credit card receivables and credit operations guaranteed by such receivables, aimed at allowing merchants to offer their future credit card receivables as collateral to their banks for loans. These rules created information exchange obligations between financial institutions and acquirers/sub-acquirers, to facilitate the delivery of information related to merchants’ settlement schedules (agendas de recebíveis). In accordance with these rules, financial institutions must keep acquirers and sub-acquirers informed about credit transactions linked to credit card receivables. Acquirers, in turn, are required to disclose transaction data, such as settlement schedules (agendas de recebíveis), about their respective merchants to (i) financial institutions who have ongoing lending transactions secured by such receivables; and (ii) any other financial institution that is expressly authorized by such merchants to obtain this data.
Subsequently, on June 7, 2021, these rules were replaced by Resolution No. 4,734/19 and Circular No. 3,952/19, as amended, which created new and definitive regulation in order to improve the rules regarding merchants’ credit transactions guaranteed by card receivables and the prepayment and discount of such receivables, increasing competition and thus reducing the cost of credit.
This new regulatory framework brought several relevant changes to transactions involving credit and debit card receivables, including transactions for the early payment of such receivables by acquirers and sub-acquirers, which are subject to new procedures, as well as the assignment of these receivables to institutions that do not belong to the National Financial System.
The general principle adopted by these new rules is that receivables from payment arrangements that are provided as collateral in credit transactions or assigned in discount transactions (desconto de recebíveis) must be registered in a centralized registration system operated by an entity authorized by the Central Bank. The new rules introduced the requirement of a market infrastructure convention, which created a system allowing for the registration of these receivables as financial assets, interoperability, and the exchange of information between the registration systems and market participants.
Resolution No. 4,734/19 requires that the amount of receivables granted as guarantees for a certain credit transaction be reduced, whenever applicable, so that such amount is limited to the outstanding balance of the transaction or to the maximum limit available under a credit line, which is a non-dischargeable credit facility extended by a financial institution on an absolute and unilateral basis.
Further, Circular No. 3,952/19 was revoked by Resolution No. 264/22, that address the procedures for registration of receivables and requires a convention between market infrastructures to guarantee the uniqueness of the receivables as financial assets that can be registered, interoperability, exchange of information between registration systems and participants in the structure.
Furthermore, on August 24, 2023, the CMN issued Resolution No. 5,094 and the Central Bank issued Resolution No. 339, which address changes related to the issuance, registration, centralized deposit and negotiation of book trade acceptance bills (duplicatas escriturais), such as the establishment of a new settlement system for book trade acceptance bills and the provision to establish a contestation procedure by the bookrunner companies, which must be uniform, documented and with a response period of three days, when referring to the services of the bookrunner companies themselves. Resolutions No. 5,094 and 339 came into effect on September 1, 2023.
Banking as a Service Relationship
On November 28, 2025, the Central Bank of Brazil and the CMN issued Joint Resolution No. 16, which regulates the provision of Banking as a Service, or BaaS, by financial institutions, payment institutions, and other entities authorized to operate by the Central Bank of Brazil. Joint Resolution 16/25 defines BaaS as the contractual arrangement under which BaaS providers make specified financial and payment services available to clients through an integrating entity that interfaces with clients, and it clarifies the definitions of the BaaS service, the BaaS provider institution, the BaaS service-taking entity, and the client, while expressly excluding activities such as correspondent banking services, data processing/cloud services, Open Finance partnerships, and activities of sub-acquirers and network service providers from the BaaS scope.
Joint Resolution No. 16/25 sets forth that BaaS agreements may cover, exclusively, one or more of the following services: (i) opening, maintenance and closing of demand deposit, savings deposit, and prepaid or postpaid payment accounts; (ii) payment services conducted through those accounts; (iii) merchant acquiring services; (iv) credit transactions (offer, contracting, administration, and collection); and (v) additional services that may be included by the Central Bank of Brazil in the future. It requires that services be provided by authorized institutions within their permitted activities and via electronic channels through system/platform/process integrations between the BaaS provider and the service-taking entity. It also sets conditions on account ownership, payment transaction flows, and debtor identity for credit operations, and clarifies that services outside the listed scope are not BaaS and cannot be offered as such.
62
Table of Contents
BaaS agreements must specify the object, roles and responsibilities, remuneration, security measures, Central Bank of Brazil access rights to information, client demand handling, restrictions on fees charged in the name of the service-taking entity, representations regarding the prohibition on unauthorized financial activities, and restrictions on sub-contracting BaaS services, among other terms. They must also ensure transparency about the status of the service-taking entity (including that it is not an institution authorized by the Central Bank of Brazil, as applicable), responsibilities for client communications (including upon termination and for credit portability and post-cession rights), data sharing necessary to fulfill responsibilities, and the provision of know-your-customer, or KYC, information, fraud prevention, and AML/CFT procedures. The agreements must address resolution scenarios and termination, including access by the resolution authority, advance notice of service interruption, transparency to clients, and client options regarding relationships with the provider and the service-taking entity.
The institution that provides the services bears the responsibility for the reliability, integrity, availability, security, confidentiality, and regulatory compliance of services provided under BaaS, including KYC, fraud prevention, and AML/CFT. Institutions acting as BaaS providers or service-taking entities must designate an officer responsible for compliance with such resolution (Joint Resolution No. 16/25).
In Rem Collateral
On October 30, 2023, Bill of Law No. 4,188/2021, known as the Legal Framework for Guarantees, was sanctioned by the President of Brazil, resulting in the publication of Law No. 14,711. The rule introduces important changes to the legal framework for collateral, and the result is expected to be greater legal security, a reduction in the spread on secured loans and greater availability of credit to borrowers. It mainly aims at tackling the current problem of dead capital in the fiduciary sale of real estate – that is, the impossibility of the same property being used as collateral more than once. Thus, Law No. 14,711 promotes the following changes to Brazilian civil law: (i) allowing a new fiduciary sale of the same property; (ii) the extension of the current guarantee to a new debt; and (iii) the introduction of the collateral agent into the Brazilian legal system. The new law also introduces several improvements related to the perfection and extrajudicial enforcement of collateral, including amendments and revocations of outdated laws, changes to collateral registration rules, and other matters.
Compensation of Senior Management
The CMN and Central Bank have recently published new rules dealing with the compensation of members of the senior management of financial institutions, payment institutions and other institutions authorized to operate by the Central Bank. Under the new rules, securities brokerage firms and dealerships, foreign exchange brokers and payment institutions became subject to the rules on the matter, which previously were only applicable to financial institutions in general. The new regulatory framework mainly maintained the previous guidelines, including the requirement for a compensation policy, the setup of a compensation committee and the disclosure of annual information on the compensation of senior management.
Regulatory Status of PagSeguro Brazil, BancoSeguro and PagInvest
BancoSeguro is a financial institution duly authorized by the Central Bank to perform banking operations in accordance with current regulations. It also holds a license from the CVM to provide securities custody services, which was obtained on February 22, 2021 and, as of the date of this annual report, has the following authorizations from the Central Bank:
authorization to operate as a payment institution, as an issuer of prepaid electronic money, related to (i) the free PagBank digital account, which relates to our rules and our brand; and (ii) to our issuance of PagSeguro electronic currency and prepaid cards, which relates to the third-party payment schemes within which the cards are issued;
authorization to operate as a payment institution, as an acquirer;
authorization to conduct activities as a payment institution issuer of post-paid payment instruments (credit cards) within third-party open-loop payment schemes; and
authorization to operate in the foreign exchange market.
PagSeguro Brazil is a payment scheme owner of a closed-loop payment scheme not forming part of the SPB, which relates to P2P transfers between accounts opened by our clients within the PagBank digital account, using our rules applying to the PagBank digital account and our brand. Since this payment scheme does not form part of the SPB, it does not currently require Central Bank authorization.
In addition, PagSeguro Brazil is a participant of the Pix instant payments scheme and has joined open finance on its phase 3, as an account service provider. As of November 25, 2024, PagSeguro Brazil is qualified and authorized to offer payment initiation services within the Pix instant payments scheme and in the context of open finance. For more information about the Pix instant payment scheme, see “—Developments in the Regulation of the Brazilian Banking and Payments Industries—Instant Payments (Pix).”
63
Table of Contents
In March 2023, the Central Bank authorized PagInvest to operate as a securities broker-dealer (corretora de títulos e valores mobiliários) in Brazil. In October 2023, the CVM also authorized PagInvest to provide custody services as a securities broker-dealer. Our investment‑related activities in the securities market, previously conducted by BancoSeguro through our investment platform, were transferred to PagInvest during the second half of 2025, except for the third‑party fund distribution and the custody of certain assets, which remains with BancoSeguro.
Anti-Money Laundering Rules
We comply with all applicable anti-money laundering rules and have implemented policies and procedures to report suspicious activities to the authorities, including any suspected terrorism financing and other potentially illegal activities.
Our activities in Brazil are subject to Brazilian laws and regulations relating to anti-money laundering, terrorism financing and other potentially illegal activities. These rules require us to implement policies and internal procedures to monitor and identify suspicious transactions, which must be duly reported to the relevant authorities. We have implemented all the required policies and internal procedures to ensure full compliance with these rules and regulations, including structuring a risk and fraud division led by a risk and compliance officer. Our employees are trained and informed of our policies and internal procedures and their compliance is mandatory and supervised.
The Brazilian anti-money laundering law establishes the basic framework to prevent and punish money laundering as a crime. It prohibits the concealment or dissimulation of origin, location, availability, handling or ownership of assets, rights or financial resources directly or indirectly originated from crimes, subjecting the agents of these illegal practices to imprisonment, temporary disqualification from managing enterprises for up to ten years, and monetary fines.
The Brazilian anti-money laundering law also created COAF, which is the Brazilian financial intelligence unit that initially operated under the jurisdiction of the Ministry of Finance but that, as of January 2020, has been transferred to the administrative structure of the Central Bank. COAF performs a key role in the Brazilian anti-money laundering and counter-terrorism financing system, and its legal responsibility is to coordinate the mechanisms for international cooperation and information exchange.
On January 23, 2020, the Central Bank issued Circular No. 3,978/2020, establishing a new regulatory framework applicable to the policies, procedures and internal controls to be adopted by financial institutions and other institutions authorized to operate by the Central Bank, in order to prevent the financial system from being used to commit money laundering and terrorist financing crimes. It applies to several activities conducted by regulated entities, such as foreign exchange transactions and payments.
In addition, we are subject to the anti-money laundering rules in the Cayman Islands, which set forth that any person in the Cayman Islands that knows or suspects or has reasonable grounds for knowing or suspecting that another person is engaged in criminal conduct or is involved with terrorism or terrorist financing and property, and the information for that knowledge or suspicion came to their attention in the course of their business in the regulated sector, or other trade, profession, business or employment, such person will be required to report such knowledge or suspicion to (i) the FRA, pursuant to the Proceeds of Crime Act (As Revised), if the disclosure relates to criminal conduct or money laundering or (ii) to a police officer of the rank of constable or higher, or the FRA (pursuant to the Terrorism Act (As Revised) of the Cayman Islands), if the disclosure relates to involvement with terrorism or terrorist financing and terrorist property.
Rules on E-Commerce, Data Protection, Consumer Protection, Banking Secrecy and Taxes
We are also subject to laws relating to internet activities and e-commerce, as well as banking secrecy laws, consumer protection laws, data protection laws and regulation, tax laws and other regulations applicable to Brazilian companies generally.
E-Commerce. Internet activities in Brazil are regulated by the Brazilian Civil Rights Framework for the Internet, which embodies a substantial set of rights and obligations relating to internet service providers. This law exempts intermediary platforms such as PagSeguro from liability for activities carried out by their users. Since there are no settled court decisions in this area, however, it is still possible that we may be subject to joint civil liability for activities carried out by our users. However, such exemption is under discussion before the STF, which, as of the date of this annual report, is reviewing the constitutionality of Article 19 of the Brazilian Civil Rights Framework.
Data Protection. The LGPD came into effect in September 2020 (except for its administrative sanctions, which came into effect on August 1, 2021), governing the practices related to the use of personal data, and replacing the sparse and sectoral standards that previously regulated rights to data privacy and protection in Brazil. By creating a microsystem of rules impacting all sectors of the economy, the LGPD provides a specific legal framework to be observed in personal data processing operations. Among other provisions, the LGPD establishes (i) the rights of data subjects; (ii) the legal bases applicable to the processing of personal data; (iii) the requirements for obtaining consent on the use of such data, when applicable; and (iv) the obligations and requirements relating to security incidents and leaks and data transfers. The LGPD also authorized the creation of the ANPD, which was implemented in November 2020, and is the entity responsible for regulating and supervising the application of the LGPD and other data protection laws, as well as imposing sanctions in the event of noncompliance with the legal rules and obligations.
64
Table of Contents
Pursuant to the LGPD, personal data subjects are entitled to the following rights, which we must ensure: (i) to obtain confirmation of existence of personal data processing; (ii) to access their personal data; (iii) to correct all incomplete, inaccurate or outdated personal data; (iv) to carry out portability processes to transfer personal data to another service or product, in accordance with the additional regulations to be set forth by the ANPD; (v) to request the deletion of processed personal data based on consent, or the right to revoke their previously given consent; (vi) to obtain information on government and private-sector entities with whom those responsible for data processing have shared their data; (vii) to be allowed to deny consent to personal data processing and to be advised of the consequences of that denial; and (viii) to request the review of decisions made solely based on automated processing. The LGPD also establishes that the following information must be provided to data subjects, including through privacy notices: (i) the specific purpose of such processing; (ii) processing methods and duration; (iii) the identity of the data controller; (iv) the contact information of the data controller, as well as the name and contact information of the data protection officer; (v) information with regards to the sharing of personal data with third parties and its purpose; (vi) description of responsibilities, particularly the responsibilities of the processing agents involved; and (vii) expressly inform the data subjects’ rights set forth in the LGPD.
Further, on February 27, 2023, the ANPD issued the dosimetry regulation, which establishes the criteria to be used when any administrative sanctions are applied. Although the regulation still includes some vague definitions (such as what entails large-scale data processing), it clarified the elements ANPD considers when analyzing a data-related incident, such as recurrence (incidents up to five years apart), good faith, cooperation, transparency, proportionality and the adoption of best practices and governance policies. According to the regulation, any administrative sanction applicable to any violation of the LGPD will depend on: (i) the classification of the infraction as “slight,” “medium” or “serious”; and (ii) ANPD’s understanding of the proportionality of the sanction in relation to the infraction committed.
In addition, on August 23, 2024, the ANPD issued the Regulation on International Data Transfers, regulating Articles 33 to 36 of the LGPD, establishing rules and mechanisms for the international transfer of personal data, ensuring adequate protection in cross-border data flows. Most of the regulation is dedicated to establishing Standard Contractual Clauses (SCCs), glimpsing through regulations on binding corporate rules (BCRs), and other safeguards for lawful data transfers, in addition to introducing specific compliance requirements for organizations transferring personal data outside Brazil, including risk assessments and accountability measures. Currently the European Commission and Brazil adopted mutual adequacy decisions, confirming that their levels of data protection are comparable.
As per the LGPD, we must also provide a secure environment for our users. Investing in technical and administrative maintenance for information security and personal data protection will also be necessary, including to support our corporate governance structure for personal data protection. In addition, under the LGPD, we have a legal duty to maintain a communication channel with data subjects whose data we process, including our users and partners.
If our operations and business model are not in compliance with the LGPD’s rules, we may be subject to (i) formal warnings; (ii) public sanctions; (iii) the deletion of data or the suspension of data processing activities; (iv) a fine equal to up to 2% of our gross sales, or the gross sales of our economic group in Brazil, in the preceding fiscal year, excluding taxes, but limited to a total of R$50.0 million per violation; and (v) administrative sanctions by public entities and regulatory bodies that govern personal data, consumer protection and public interests, among other sanctions. In addition, we may be held liable for (i) individual or collective material moral damages caused by our failure to meet any of the obligations set forth by the LGPD; and (ii) paying damages to users harmed by violations of their rights as personal data subjects, such as their rights to transparency, in that they may obtain information regarding the processing of their personal data and other rights set forth in the LGPD.
Noncompliance with any LGPD provisions may lead to the following: (i) individual or class actions being filed seeking damages due to breaches not only of the LGPD, but also of any sparse and industry-specific data protection laws still in force; and (ii) the imposition of the penalties set forth by the Consumer Protection Code and the Civil Framework for the Internet by certain consumer protection agencies, as they have been acting in this regard well before the effectiveness of the LGPD, administrative penalties levied by the ANPD, particularly in cases of violations of the LGPD.
Consumer Protection. Law No. 8,078/1990, known as the Consumer Protection Code, regulates consumer relations in Brazil, including matters such as: (i) commercial practices; (ii) product and service liability; (iii) situations in which suppliers of products or services are subject to strict liability; (iv) the reversal of the burden of proof so as to benefit consumers; (v) the joint and several liability of all companies within a supply chain; (vi) unfair contract terms; (vii) advertising; and (viii) information on products and services that are offered to the public. Consumers have the right to receive clear and accurate information regarding retail products and services, with correct specification of characteristics, structure, quality, price, risks, and consumers’ rights to access and amend personal information collected about them and stored in private databases.
The Consumer Protection Code also sets forth specific rules and procedures regarding the relationship between customers and users of products and services with financial and payment institutions authorized to operate by the Central Bank. In 2021, the CMN and the Central Bank enacted Resolution No. 4,949/2021 and Resolution 155/2021, respectively, aiming at ensuring a fair and equitable treatment at all stages of the relationship with the institutions providing financial and payment services, as well as a convergence of the interests of the providers with those of their consumers. Furthermore, on December 26, 2023, the CMN and the Central Bank published Joint Resolution No. 8, which came into effect on July 1, 2024 and requires the institutions authorized to operate by the Central Bank to adopt financial education measures designed for their clients and users that are natural persons, including individual entrepreneurs, by means of the publication of a financial education policy, the provision of financial education content and tools in an appropriate language, channel and timing, considering the characteristics and needs of their clients and users.
65
Table of Contents
Banking Secrecy. Customer accounts on our digital platform are subject to data protection under the Brazilian Civil Rights Framework for the Internet and bank secrecy laws (Complementary Law No. 105/2001, which had its provisions extended to payment institutions through Article 17 of CMN Resolution No. 4,282/2013).
Taxes. We are subject to tax laws and regulations, as well as related interpretations and tax accounting standards in Brazil, the Cayman Islands, and the United States. In Brazil, we are subject to federal and municipal taxes on our activities and services rendered. The main Brazilian taxes that are incident on our operations are the following:
Corporate Income Tax (IRPJ), and Social Contribution on Net Income (CSLL). The IRPJ and CSLL are federal corporate income taxes levied on profit before income tax and social contribution. The combined nominal rate of IRPJ and CSLL varies between 34% to 45% depending on the business line of our operations. For certain regulated entities, including payment institutions, the combined nominal rate was 34% until December 31, 2025, is 37% since January 1, 2026 to December 31, 2027, and will be 40% from January 1, 2028 onwards, as a result of the increase in the CSLL rates set forth in Article 7 of Complementary Law No. 224, of December 26, 2025. For further information see item 23 of the financial statements.
IRPJ on Payment of Dividends. On November 26, 2025, the Brazilian Congress enacted Law No. 15,270, which, among other changes, imposed a 10% withholding income tax on dividends paid or credited to individuals in a monthly amount equal to or exceeding R$50,000.00 and a 10% withholding income tax on dividends paid or credited to non-resident shareholders. The non-resident shareholders may be entitled to a refund on the amounts withheld in 360 days if the company’s effective tax rate exceeds the application of the statutory rate over accounting profits. However, as of the date of this annual report, Brazilian tax authorities have not yet regulated the refund procedure nor provided guidance on the particularities of the effective tax rate calculations.
Federal Social Contribution (Programa de Integração Social, or PIS, and Contribuição para o Financiamento da Seguridade Social, or COFINS). PIS and COFINS are levied on gross revenue, and the combined nominal rate of these contributions varies between 4.65% and 9.25% depending on the business line of our operations.
Municipal Tax on Services Rendered (Imposto sobre Serviços, or ISS). At the municipal level, we are subject to payment of ISS, which is incident on rendered services. The ISS varies between 2% and 5% according to the service rendered.
Tax on Financial Transactions (Imposto sobre Operações Financeiras, or IOF). The IOF is a federal tax levied on certain financial transactions, such as loans, foreign exchange operations, insurance, and securities, as well as operations with gold (as a financial asset) and foreign exchange instruments. The IOF tax rate may vary according to the nature of the transaction. In June 2025, the Brazilian federal government enacted Decree No. 12,499, which increased the rates applicable to certain credit, foreign exchange, insurance and securities transactions, as follows:
Credit Transactions: in credit transactions carried out by legal entities, the IOF generally applies at a rate of 0.38% as a fixed charge plus 0.0082% per day, limited to 365 days, which results in a maximum aggregate rate of approximately 3.38%.
Foreign Exchange Transactions: in the foreign exchange context, the decree generally set the IOF/FX rate at 3.5% for outbound transactions and 0.38% for inbound transactions, except where specific reduced or zero rates apply to particular transactions.
Insurance Transactions: with respect to insurance transactions, the decree imposed a 5% IOF rate on the portion of contributions exceeding R$300,000 per individual in the same insurer between June 11, 2025 and December 31, 2025, in connection with certain life insurance products with survival coverage, and, beginning on January 1, 2026, on the portion exceeding R$600,000.
Securities Transactions: the decree introduced a 0.38% IOF rate on the primary subscription of quotas of Funds for Investment in Receivables (Fundos de Investimento em Direitos Creditórios), or FIDCs, i.e., upon the primary acquisition of such quotas rather than on secondary market trades.
Taxation of Investment Funds. Law No. 14,754 of December 12, 2023 (Law No. 14,754/2023) imposes that from 2024 onwards, the earnings derived from any investment in closed-end FIDCs shall be subject to a semi-annual tax due on the last business day of May and November, at a rate of 15%, irrespective of actual distributions, unless those FIDCs qualify as investment entities (as defined by Law No. 14,754/2023 and CMN Resolution 5,111/2023). PagSeguro Brazil’s FIDCs administrator has indicated that FIDM and Fundo de Investimento em Direitos Creditórios – PagSeguro, or PagSeguro FIDC, qualify as investment entities according to Law No. 14,754/2023 and CMN Resolution 5,111/2023, and, based on such classification, PagSeguro FIDC is currently not subject to the periodic taxation regime introduced by Law No. 14,754/2023.
Furthermore, according to Article 219, Paragraph 6, of LC 214/25 (reform on consumption), FIDCs that assign receivables from payment arrangements are considered taxpayers of the IBS and CBS, unless classified as investment entities (as defined by Law No. 14,754/2023 and CMN Resolution 5,111/2023). This legal provision has significant impacts on FIDCs, given that these investment funds were not previously considered taxpayers of consumption-related taxes. However, considering that the administrator of FIDM and PagSeguro FIDC has indicated that those entities qualify as investment entities according to Law No. 14,754/2023 and CMN Resolution 5,111/2023, FIDM and PagSeguro FIDC should not be considered a taxpayer of the IBS and CBS.
66
Table of Contents
Transfer Pricing. In 2023, Brazil adopted new transfer pricing regulations through Law No. 14,596/23 and Normative Ruling No. 2,161/23. Brazilian companies are now required to comply with the arm’s length standard in transactions carried out with related parties abroad (rather they relate to commercial or financial transactions or to corporate restructurings in general) or even non-related parties when the counterpart is located in a jurisdiction classified as a tax haven under Brazilian law.
Pillar 2. Law No. 15,079/24 created a CSLL Surcharge as a domestic minimum tax, or DMTT, in line with the Organization for Economic Co-Operation and Development, or OECD, and G20’s Global Anti-Base Erosion (GloBE) Rules. Following Pillar 2 Model Rules, the CSLL Surcharge targets large multinational groups to prevent tax base erosion and ensure a minimum 15% tax rate on profits. This measure supplements Brazil’s new transfer pricing rules and affects multinational groups with revenues over EUR 750 million. Key provisions of Law No 15,079/24 include: (i) CSLL Surcharge: the surcharge ensures the 15% minimum effective tax rate for multinational groups; (ii) scope: applies to large multinational groups, including domestic companies; (iii) Substance-Based Income Exclusion: reduces the tax burden on capital-intensive and labor-intensive profits; (iv) Effective Tax Rate Calculation: ensures that the 15% rate is met, with a surcharge if necessary; (v) Loss-Making Entities: specific rules for deferred tax assets (DTA) and loss-carryforwards; (vi) penalties: strict penalties for non-compliance, reinforcing the need for rigorous data submission; (vii) federal revenue regulation: Normative Instruction No. 2,228/2024 provides further guidance, including on currency conversion, profit adjustments, and the effects of corporate restructurings.
Brazilian Tax Reform on Consumption. On December 20, 2023, the Brazilian Congress passed a tax reform on consumption aimed at simplifying the Brazilian tax framework, providing for, among other things, (i) the removal of five taxes (except in limited circumstances), including the existing VAT known as ICMS, the ISS, the tax on manufactured products, or IPI, PIS and COFINS, and (ii) the creation of two new VATs, namely the CBS and the IBS, and the IS, together with the elimination of tax benefits, which may result in an increase in the overall tax burden. Tax collection on the new VATs will be implemented by taxing consumption (rather than a tax on production and/or revenue, as in the prior system). The transition period began in 2026, including an initial testing and ancillary-obligations phase, and will continue through 2032. In 2027, the CBS will become fully effective and will replace PIS and COFINS, while the IPI will generally be reduced to zero, subject to limited exceptions. Beginning in 2029, ICMS and ISS will be gradually reduced, while the IBS will be gradually increased. Full implementation of the new system is expected to take place in 2033, when the CBS and IBS will fully replace the current consumption taxes.
The overall tax rate after the implementation of the tax reform has not been determined but it is likely to range between 26% and 28%. Nonetheless, financial services will be subject to lower rates, starting at 10.85% in 2027 and reaching 12.50% from 2033 onwards. Taxpayers will generally be entitled to financial tax credits on all acquisitions and will levy the new taxes (IBS and CBS) in favor of the municipality where the buyer is located. The approved text of the tax reform also provides authorization for the Brazilian government to introduce a selective tax on goods and services that are harmful to health and/or the environment. Specific regimes will also be applied to sectors expressly listed in the Brazilian Constitution, with rules that will be regulated by a specific law (e.g., fuel, financial services and others).
In addition, upon implementation of the tax reform, electronic payment service providers participating in a payment arrangement must, at the time of financial settlement, withhold the IBS and the CBS due on the transaction underlying the processed payment and transfer the applicable taxes to the Brazilian government. The IBS and CBS steering committee and Brazil’s Internal Revenue Service are expected to issue additional regulations to clarify how the split payment system will be implemented and operated. The overall expectation is that this mechanism will be challenging for both the Brazilian government and payment service providers.
The laws and regulations applicable to the Brazilian digital payments industry are subject to ongoing interpretation and change, and our digital payments business may become subject to regulation by other authorities. For further information on the risks relating to regulation of business, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry.”
Cybersecurity Regulation
Financial institutions and payment institutions in Brazil are subject to specific cybersecurity and cloud outsourcing regulations to ensure the integrity and security of their internal controls. Key among these regulations is CMN Resolution No. 4,893/2021 and Central Bank Resolution No. 85/2021, mandating the establishment of a cybersecurity policy and establishing guidelines for outsourcing data processing, storage and cloud computing services. Additionally, CVM Ruling No. 35/2021 outlines the necessary cybersecurity and data protection standards for security transactions in regulated markets. By December 2021, institutions were required to be fully compliant, including having policies and response plans for cybersecurity incidents. Data processing and storage can occur both within and outside Brazil, provided the Central Bank retains access to overseas data for inspection. Any relevant agreements that are entered into providing for processing services must be reported to the Central Bank within ten days of its execution. Also, if processing, storage and cloud computing services are to be provided abroad and classified as “relevant” by the contracting regulated institution, additional regulatory requirements apply. In these scenarios, if there is no agreement to exchange information between the Central Bank and the supervisory authorities of the countries where the services will be provided, prior authorization from the Central Bank will be required for contracting the service and to implement certain changes to the terms of the agreement.
67
Table of Contents
In addition, Central Bank Resolution No. 85/21 provides for the cybersecurity policy and requirements applicable to payment institutions authorized to operate by the Central Bank in contracting cloud computing, data processing and storage services. The cybersecurity policy and requirements set forth in Resolution No. 85/21 are very similar to the requirements that apply to financial institutions under CMN Resolution No. 4,893.
Recently, CMN Resolution No. 5,274 and Central Bank Resolution No. 538, both dated December 18, 2025, amend CMN Resolution No. 4,893 and Central Bank Resolution No. 85/2021, respectively, in order to modify and introduce new requirements to cybersecurity policies.
Regulation on Environmental, Social and Climate Risks
The Central Bank has issued a series of new regulations and standards focusing on the management and governance of social, environmental and climate risks. These regulations apply to financial institutions’ products, services and activities, as well as those of their counterparties, controlled entities, suppliers and outsourced service providers. Key regulations include provisions on (i) definition and management of social, environmental and climate risks; (ii) continuous risk management; (iii) updating the Social, Environmental and Climate Responsibility Policy (Política de Responsabilidade Socioambiental e Climática), or PRSAC, every three years; (iv) regulation on the remittance of information regarding social, environmental and climate risks related to exposures in credit and securities transactions, as well as those of the respective debtors under these transactions, including information such as identification, economic sector, risk aggravating and mitigating factors; (v) regulating, for both financial institutions and payment institutions, the general criteria for the preparation and disclosure of individual and consolidated financial statements, including sustainability-related financial information, adopting the technical pronouncements of the Brazilian Sustainability Pronouncements Committee (Comitê Brasileiro de Pronunciamentos de Sustentabilidade), or CBPS, which follow the same parameters as IFRS S1 and S2, among others.
Additionally, in line with the “Sustainability” pillar of the “Agenda BC#” and following certain Central Bank public consultations, new rules were published to improve disclosure and governance related to social, environmental and climate risks. These rules aim to align national regulations with international ESG standards, including the recommendations of the Task Force on Climate-related Financial Disclosures. Notably, Resolution No. 139 mandates the annual publication of the Report on Social, Environmental and Climate Risks and Opportunities (Relatório de Riscos e Oportunidades Sociais, Ambientais e Climáticas), or the GRSAC Report, by financial institutions classified in S1, S2, S3 or S4, detailing social, environmental, and climate risks and opportunities, which must be published annually with the base date of December 31, within a maximum period of 90 days from December 31, and made available on their websites for a period of five years.
On March 6, 2024, the SEC adopted final rules requiring significant climate-related disclosures by public companies, including evaluation and disclosure of material climate-related risks and opportunities, GHG emissions inventory, climate-related targets and goals, and financial impacts of physical and transition risks, or the SEC Climate Rules. A large number of petitions that seek judicial review of the SEC Climate Rules have been filed. On April 4, 2024, the SEC voluntarily stayed implementation of these new rules pending completion of judicial review of consolidated legal challenges by the Court of Appeals for the Eight Circuit.
On November 4, 2025, the Central Bank of Brazil launched Public Consultation No. 127, proposing amendments to Resolution No. 139 to expand and standardize the GRSAC Report. The proposal introduces a second phase of requirements focused on quantitative metrics and targets, while refining the qualitative tables adopted in 2021, and aligns disclosures with international standards, including IFRS S1 and S2 and the Basel Committee’s Pillar 3 framework for voluntary climate risk disclosures. The new framework structures the GRSAC Report into standardized qualitative and quantitative tables covering governance, strategy, risk management and climate risk (transition and physical), as well as sectoral exposures and emissions, agriculture by biome, power generation by source, physical risk metrics for drought and heavy rain, transition plans, and social and environmental risk exposures. Disclosure of business opportunities remains voluntary; disclosure of national and international voluntary commitments follows new standardized tables (COMP1 and COMP2). The consultation also clarifies the use of climate scenario analysis, with parameters for narratives, time horizons and scientific bases.
Implementation is phased. For S1 and S2 institutions, the new GRSAC Report format would take effect in January 2027, with the first publication in 2028 using a December 2027 reference date. S3 institutions become subject to all tables with the first required publication based on December 31, 2028; S4 institutions, previously limited to a qualitative governance table, must disclose standardized information on social, environmental or climate commitments via COMP1 and COMP2 on the same timeline as S3. S5 institutions remain exempt. The proposed rules preserve flexibility to add granularity or justify omissions where immaterial and allow complementing tables to meet the sustainability financial reporting requirements aligned with IFRS, subject to consolidation scope differences.
Naming Regulations for Authorized Institutions in Brazil
On November 28, 2025, the Central Bank of Brazil and the CMN issued Joint Resolution No. 17, which governs the nomenclature and public presentation of institutions authorized to operate by the Central Bank of Brazil. The rule applies to the institution’s full nomenclature (comprising its corporate name, trade name, brand, and internet domain) and to any means used for communication or public presentation to clients and users.
68
Table of Contents
Joint Resolution No. 17/25 requires institutions to include, in their corporate names, terms that clearly reference the scope of their authorization to operate granted by the Central Bank of Brazil. It prohibits use, in any nomenclature, of terms – whether literally or by morphological or phonetic similarity – that suggest activities or an institutional type for which the entity does not have specific authorization. Cooperatives may reference their cooperative system in their nomenclature. Institutions that are part of a prudential conglomerate may incorporate the conglomerate’s name, provided it is clear to clients which type of institution within the conglomerate they are interacting with and the conglomerate’s name does not include terms identifying a type of institution not included in the conglomerate.
FGTS-Backed Loans
On December 11, 2019, Brazil enacted Law No. 13,932, which introduced the annual withdrawal option (saque-aniversário) under the FGTS regime. This modality permits workers to withdraw, each year in the month of their birthday, a portion of their FGTS balance regardless of whether their employment has been terminated. By electing the saque-aniversário, the worker relinquishes the right to withdraw the entire FGTS balance upon termination without cause (the saque-rescisão), but remains entitled to receive the 40% severance penalty payable by the employer. The annual withdrawal amount is determined by a progressive schedule that applies higher percentages to smaller account balances and includes a fixed top-up amount per tier. A worker who wishes to revert to the traditional saque-rescisão must observe a 25-month waiting period from the date of the reversion request.
Law No. 13,932/19 also authorized workers to assign or pledge their future saque-aniversário withdrawals to financial institutions by way of fiduciary assignment or lien. This framework gave rise to FGTS-backed loans, a consumer credit product in which the borrower’s future annual FGTS withdrawal amounts are automatically directed to the lender as collateral, enabling faster access to credit. For lenders, these loans offer a lower-risk profile due to the statutory repayment channel through the FGTS system.
On October 7, 2025, pursuant to Resolution CCFGTS No. 1,130/25, the FGTS approved amendments to the saque-aniversário rules, effective November 1, 2025, that, among other measures: (i) impose a 90-day cooling-off period after opt-in before a worker may enter into a fiduciary assignment or lien over future withdrawals; (ii) limit workers to one concurrent loan transaction per year; (iii) restrict the number of future annual withdrawals that may be pledged as collateral to up to five (one per year) within any 12-month period, with the possibility to contract up to three additional loan transactions in each subsequent three-year period; and (iv) cap the advanceable amount per annual withdrawal to a minimum of R$100 and a maximum of R$500, implying a maximum aggregate loan size of R$2,500. As a result, FGTS-backed loan origination volumes and ticket sizes are now subject to new constraints (including waiting periods, limits on concurrent and aggregate advances, and per-withdrawal caps), which may narrow the addressable market and affect unit economics, although the repayment mechanics via the FGTS system remain unchanged.
Private Payroll Deduction Loans Rules
Law No. 15,179 was published on July 24, 2025, amending Law No. 10,820 of December 17, 2003, and aiming to modernize the framework for private payroll-deduction loans by facilitating the use of digital platforms for both the solicitation and management of these credit arrangements.
The reform is intended to enhance efficiency, strengthen security, and improve accessibility for workers. Under the updated rules, formal employees – including rural workers, domestic workers, and registered MEIs – may apply for loans on more favorable terms directly through Brazil’s official Digital Work Card application. Loan repayments are capped at 35% of the borrower’s gross salary, with the option to pledge up to 10% of the FGTS (Severance Indemnity Fund) balance or up to 100% of the termination indemnity payable upon dismissal without cause as collateral, and installments are deducted automatically from payroll via the national eSocial system.
The measure is expected to deliver tangible benefits to workers by expanding access to lower interest credit facilities and reducing administrative costs. For the first 120 days following the launch of the systems or platform, funds from new payroll-deducted loan transactions with authorized institutions must be used exclusively to repay either (i) non-payroll-deducted loans with outstanding installments without collateral, or (ii) payroll-deducted loans with outstanding installments, provided the borrower has such active obligations on the date the new loan is granted.
These new credit operations may be offered by any duly authorized and accredited payroll-deducting institution and must carry an interest rate lower than that of the original loan being refinanced. In such cases, lending institutions are required to report the relevant loan data to the designated public operating agents. This priority repayment structure is intended to encourage the replacement of higher-cost debt with cheaper, payroll-deducted alternatives, thereby contributing to broader economic stimulus.
69
Table of Contents
4C. Organizational Structure
We are a subsidiary of UOL, a Brazilian privately held Corporation founded in 1996 and Brazil’s largest internet content, digital products and services company. The chart below shows our corporate structure, including our wholly-owned subsidiaries and our other direct and indirect subsidiaries, as of the date of this annual report. For more information on our subsidiaries, see Exhibit 8.1 to this annual report and Note 4 to our audited consolidated financial statements.
(*) Shares delivered under the LTIP and LTIP-Goals, which also compose PagSeguro Digital’s float.
(**) Refers to total capital; UOL directly holds 88.74% of our voting capital.
(***) For more details on our subsidiaries, please refer to “Item 4. Information on the Company”, subtopic “History and development of the company”.
4D. Property, Plant and Equipment
Our Facilities
We do not own any real estate. We lease our head office directly from a third-party and we directly rent a number of other smaller offices in Brazil directly from third parties. For our other office space and the operations center in São Paulo, we either lease the space on market terms on an arm’s-length basis from UOL or its affiliates, or we use the space provided by UOL or its affiliates on a cost-sharing basis through an expense apportionment agreement entered into between us and UOL or the relevant affiliate. For more information on this agreement, see “Item 7B. Related Party Transactions—Agreements with UOL and UOL Subsidiaries—Cost-Sharing Agreements.” We also lease other office for our subsidiaries.
Other Equipment
The majority of our equipment consists of POS devices. The rest of our equipment consists of data processing equipment, machinery, building leasing, facilities and furniture and fittings.
70
Table of Contents
Intellectual Property
The protection of our trademarks, copyrights, logos, service marks, trade dress, domain names, patents and trade secrets is critical to our future success. We rely on a combination of trademark, copyright, service mark, patent and trade secret laws, administrative procedures and contractual restrictions to establish and protect our proprietary rights in our products and services. We have entered into confidentiality and invention assignment agreements with our employees and certain outside contractors as well as have entered into non-disclosure agreements with our employees, strategic partners and some suppliers in order to limit access to and disclosure of our proprietary information and technology.
We actively pursue registration of our trademarks, copyrights, logos, service marks and domain names. We have registered or applied for registration of trademarks with the Brazilian National Institute of Industrial Property (Instituto Nacional da Propriedade Industrial), or INPI, including, among others, the trademarks and logos of “PagSeguro,” “PagBank,” “Moderninha,” “Minizinha,” “PlugPag,” “PagInvest” and “PagVendas.” We have also registered several domain names with NIC.br, Brazil’s internet domain name registry, and domain registrars in the United States and elsewhere, including “pagseguro.com.br,” “pagseguro.com,” “moderninha.com.br,” “moderninhapro.com.br,” “moderninhax.com.br,” “moderninhaplus.com.br,” “moderninhapro2.com.br,” “moderninhasmart.com.br,” “minizinha.com.br,” “minizinhachip.com.br,” “minizinhanfc.com.br,” “boacompra.com.br,” “pagbank. com.br,” “pagbank.com,” “paginvest.net” and “paginvest.com.br.” We own or have the right to use all of the material intellectual property that we use.
For information about risks affecting our intellectual property, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—We have only a limited ability to protect our intellectual property rights, which are important to our success.”
Licenses and Contracts
Visa and MasterCard
We have material contracts with Visa and MasterCard in connection with our activities as an acquirer for these card schemes. Our Visa Payment Arrangements Participation and Trademark License Agreement, dated as of August 24, 2015 and amended on July 3, 2017, between Visa do Brasil Empreendimentos Ltda. and PagSeguro Brazil, sets forth the general terms and conditions under which PagSeguro Brazil acts as a merchant acquiring principal participant for Visa in Brazil and provides PagSeguro Brazil with a non-exclusive and non-transferable license to use certain trademarks owned by Visa in connection with its activities as an acquirer in Brazil. Under this agreement, PagSeguro Brazil is exclusively responsible for all the costs and risks associated with its participation as a merchant acquiring principal, and fees payable to Visa under this agreement is determined by the standard payment terms set forth in the Visa Core Rules and Visa Product and Service Rules, available on Visa’s website.
Our License Agreement, dated as of June 18, 2015 and as amended from time to time, between MasterCard International Incorporated and PagSeguro Brazil sets forth the general terms and conditions under which MasterCard grants PagSeguro Brazil a non-exclusive license to use certain trade names, trademarks, service marks and logotypes (including MasterCard, Cirrus and Maestro branded marks) in Brazil in connection with PagSeguro Brazil’s issuing and acquiring activities. No consideration is due to MasterCard under this agreement.
Other Licenses
We operate software products under licenses, including certain open-source licenses, from our vendors, including, among others, Verifone, Oracle, Feedzai and Cisco. Even if any such third-party technology did not continue to be available to us on commercially reasonable terms, we believe that alternative technologies would be available as needed in every case.
License of our Proprietary Rights to Our Clients
The standard online contract entered into between us and our merchants when they open a free PagBank digital account provides a limited, non-transferable license to certain of our proprietary rights, such as our name and logo, for use by our merchants for commercial purposes. We expect to continue this practice in the future as part of our marketing strategy. While we attempt to ensure that our licensees maintain the quality of the PagSeguro brand, they may take actions that could materially adversely affect the value of our proprietary rights or reputation.