PAGS

Our activities expose us to a variety of financial risks: foreign exchange risk, interest rate risk, fraud risk (losses), credit risk and liquidity risk. Our overall risk management program focuses on the unpredictability of financial markets and seeks to minimize potential adverse effects on our financial performance. For more information on risks to our activities, see Note 29 to our audited consolidated financial statements. Among the main market risk factors that may affect the PagSeguro business are the following: Foreign Exchange Risk Foreign exchange risk is the risk that the fair value or future cash flows of an exposure will fluctuate because of changes in foreign exchange rates. Foreign exchange risk arises when future commercial transactions or recognized assets or liabilities are denominated in a currency that is not the entity’s functional currency. The Company’s foreign exchange risk is mainly related to POS purchases and dividends, which are negotiated in US dollars. For further details, see Note 29 of our financial statements, where a sensitivity analysis of foreign exchange risks is presented as of December 31, 2025. Pagseguro Tecnologia, BCPS, PSGP Mexico, PBMX Mexico, Pagseguro Colombia, Pagseguro Chile and Pagseguro Peru have revenues in other currencies and cash and cash equivalents maintained in other countries, which are being hedged through a non-derivative forward. Interest Rate Risk Interest rate risk is the risk that the fair value or future cash flows of a financial instrument will fluctuate because of changes in market interest rates. Our exposure to the risk of changes in market interest rates arises primarily from financial investments and deposits both subject to variable interest rates, principally the CDI rate. For further details, see Note 29 of our financial statements, where a sensitivity analysis of the interest rate risks is presented as of December 31, 2025. In addition, margins can be affected due to interest rate fluctuation mainly for our prepayment business when we advance receivables to our merchants. Cash is our raw material for this product and if the costs spike, we need to reprice the product to reflect the new cost base. However, sometimes the repricing does not occur at the same time of the cost increase or does not achieve the same level, and consequently, the margin may decrease. Fraud Risk (Losses) Our sales transactions are susceptible to potentially fraudulent or improper sales. We use the following two main procedures to control fraud risk. The first procedure consists of monitoring, on a real-time basis, transactions carried out using credit and debit cards and boletos through an anti-fraud system. This process approves or rejects suspicious transactions at the time of the authorization, based on statistical models that are revised on an ongoing basis. The second procedure detects chargebacks and disputes not identified by the first procedure. This is a complementary procedure and increases our ability to avoid and manage chargebacks. 115 Table of Contents Credit Risk Credit risk is managed on a group basis. This risk is limited to the possibility of default by (i) card issuers, who are required to transfer the fees charged for transactions carried out by their card holders to the credit and debit card schemes, (ii) acquirers, which we use to approve transactions with card issuers, and (iii) analyses for our customers’ background to provide access to credit portfolio. In order to mitigate this risk, PagSeguro Brazil has established a Credit and Liquidity Risk Committee, whose responsibility is to assess the level of risk of each card issuer served by us, classifying them into three groups: (i) card issuers presenting a low level of risk, who have credit ratings assigned by Fitch, S&P or Moody’s and who do not require additional monitoring; (ii) card issuers presenting a medium level of risk, who are monitored in accordance with Basel requirements and property, plants and equipment ratios; and (iii) card issuers presenting a high level of risk, who are assessed by the Credit and Liquidity Risk Committee at monthly meetings. We have a rating process for loans and credit based on statistical application models (in the early stages of customer relationships) and behavior scoring (used for customers who already have a relationship history). This includes a process for designing, calibrating and implementing policies and guidelines for granting credit and calibrating collection rules. Our approach also involves a process for monitoring the portfolio’s risk profile, with a prospective view, which generates early warning alerts to the credit granting policies and risk classification models in a timely manner. No credit limits were exceeded in 2025, 2024 or 2023. Management does not expect any losses from non-performance by these counterparties in addition to the amounts already recognized as chargebacks and expected credit losses, presented as fraud risk. Liquidity Risk We manage liquidity risk by maintaining cash reserves, positive working capital and bank credit lines on receivables from issuing banks. We continuously monitor actual and projected cash flows and match the maturity profile of our financial assets and liabilities in order to ensure we have sufficient funds to honor our obligations to third parties and meet our operational needs. We invest surplus cash in interest-bearing financial investments, choosing instruments with appropriate maturity or sufficient liquidity to provide adequate margins as determined by the forecasts.

3A. [Reserved] 3C. Reasons for the offer and use of proceeds Not applicable. 3B. Capitalization and Indebtedness Not applicable. 3D. Risk Factors Summary of Risk Factors Risks Relating to Brazil • The Brazilian government has exercised, and continues to exercise, significant influence over the Brazilian economy. This influence as well as Brazil’s political and economic conditions may adversely affect us and the price of our Class A common shares. • Ongoing political instability in Brazil may adversely affect our business, results of operations and the trading price of Class A common shares. • Inflation and certain measures by the Brazilian government to curb inflation have historically affected the Brazilian economy and Brazilian capital markets, and high levels of inflation in the future could adversely affect our business and the price of our Class A common shares. • Exchange rate volatility may have adverse effects on the Brazilian economy, us and the price of our Class A common shares. • Developments and the perceptions of risks in other countries, including other emerging markets, the United States and Europe, may adversely affect the Brazilian economy and the price of Brazilian securities, including the price of our Class A common shares. • Any further downgrading of Brazil’s credit rating could reduce the trading price of our Class A common shares. Risks Relating to Our Business and Industry • If we cannot keep pace with rapid technological developments to provide new and innovative products and services, and address the rapidly evolving market for transactions on mobile devices, the use of our products and services and, consequently, our revenues could decline. • Interruption or failure of our computer and IT systems could impair our operations, which could damage our reputation and harm our results of operations. • Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches. • We may lose our competitiveness if we are unable to incorporate AI tools into our business operations and products. • AI regulation is rapidly evolving and AI regulation in Brazil remains uncertain. • We are subject to risks associated with noncompliance with Law No. 13,709/2018, as amended, the General Data Protection Law (Lei Geral de Proteção de Dados), or LGPD, and may be adversely affected by the imposition of fines and other types of penalties. 5 Table of Contents • Our services must integrate with a variety of operating systems and networks, and the hardware that enables merchants to accept payment cards must interoperate with mobile networks offered by telecom operators and third-party mobile devices utilizing those operating systems. If we are unable to ensure that our services or hardware interoperate with such networks, operating systems and devices, our business may be seriously harmed. • Our business depends on a strong and trusted brand, and any failure to maintain, protect and enhance our brand would harm our business and results of operations. • Our business is subject to extensive government regulation and oversight and our status under these regulations may change. Violation of or non-compliance with present or future regulations could be costly, expose us to substantial liability and force us to change our business practices, any of which could seriously harm our business and results of operations. • We are subject to costs and risks associated with increased or changing laws and regulations affecting our business, including those relating to the sale of consumer products. Specifically, developments in data protection and privacy laws could harm our business, financial condition, results, or operations. • Changes in tax laws, tax incentives, benefits or differing interpretations of tax laws may adversely affect our results of operations. • Failure to deal effectively with fraud, fictitious transactions, bad transactions or negative customer experiences would increase our loss rate and harm our business, and could severely diminish merchant and consumer confidence in and use of our services. • Increasingly intense competition may harm our business. • Failure to maintain sufficient working capital could limit our growth and harm our business, financial condition and results of operations. • We may offer new financial products and use new technologies that may have a negative impact on our liquidity by increasing our costs and risks associated with government regulation and investment in new technology. • We rely on third parties and UOL, our largest shareholder, and its subsidiaries in many key aspects of our business, which creates additional risk. • Our failure to manage the assets underlying our customer funds properly could harm our business. • Increases in interest rates may harm our business, financial results and results of operations. • The e-commerce market in Brazil is developing, and the expansion of our business depends on the continued growth of e-commerce, as well as increased availability, quality and usage of the internet in Brazil. • Our quarterly results of operations and operating metrics may fluctuate and are unpredictable and subject to seasonality, which could result in the price of our Class A common shares being unpredictable or declining. • Our business could be harmed if we are unable to forecast demand for our products accurately or to manage our product inventory adequately. • Some of the key components of our POS devices are sourced from a limited number of suppliers. We are therefore at risk of shortage, price increases, changes, delay or discontinuation of key components, which could disrupt and harm our business and financial results. • We are subject to anticorruption, anti-bribery and anti-money laundering laws and regulations, and any errors, failures, or delays in complying with anticorruption, anti-bribery and anti-money laundering laws and regulations could result in significant criminal, administrative and civil lawsuits, penalties, forfeiture of significant assets, or other enforcement actions, as well as reputational harm. • The loss of any member of our management team and our inability to make up for such loss with a qualified, replacement could harm our business. • We partially rely on card issuers or card schemes to process our transactions. Changes to credit card scheme fees, rules or practices may harm our business. 6 Table of Contents • We might not successfully implement strategies to increase adoption of our digital payment methods, which would limit our growth. • If we fail to establish and maintain proper and effective internal controls over financial reporting, our results of operations and our ability to operate our business may be harmed. • If we do not effectively and accurately meet our reporting obligations regarding nonfinancial information, including any climate-related information and environmental, social and governance, or ESG, reporting that we provide publicly, our results of operations and our business may be adversely affected. • We may incur financial and reputational losses as a result of environmental and social risks. • Climate change may have adverse effects on our business and financial condition. • Our operating results are affected by decreases in gross domestic product, or GDP, and consumer discretionary spending. Changes in macroeconomic conditions may reduce the volume and prices of transactions on our payments platform and harm our growth strategies and business prospects and, accordingly, adversely affect the trading price of our Class A common shares. • A failure to comply with export controls or economic sanctions laws and regulations could have a material adverse impact on our results of operations, financial condition and reputation. • Customer complaints or negative publicity about our customer service could reduce usage of our products and, as a result, our business could suffer. • We are susceptible to illegal or improper uses of our platform, which could expose us to additional liability and harm our business. • Unauthorized disclosure of sensitive or confidential customer information or our failure or the perception by our customers that we failed to comply with privacy laws or properly address privacy concerns could harm our business and standing with our customers. • We have only a limited ability to protect our intellectual property rights, which are important to our success. • If we continue to grow, we may not be able to appropriately manage the increased size of our business. • BancoSeguro S.A., or BancoSeguro, PagSeguro Brazil, and PagInvest Corretora de Títulos e Valores Mobiliários Ltda., or PagInvest, may have insufficient capital to meet the capital requirements of the National Monetary Council (Conselho Monetário Nacional), or the CMN, and the Central Bank and other regulations. • BancoSeguro’s, PagSeguro Brazil’s and PagInvest’s businesses are highly regulated and changes in regulation may affect our results and the development of our activities. • The growth of our credit portfolio of transactions through BancoSeguro could increase the default rates in our total portfolio, and the systems and methods of identification, analysis, management and control of risks related to our customer portfolio could be insufficient to prevent losses. • Our financial success is sensitive to the method consumers choose to make payments, since these methods differ in profitability. Our profitability could be harmed if there is an increase in the proportion of our business funded using less profitable methods. • We may face restrictions and penalties under the Brazilian Consumer Protection Code (Código de Defesa do Consumidor) in the future. • We are subject to regulatory activity and antitrust litigation under competition laws. • Unfavorable outcomes in litigation or our inability to post judicial collateral or provide guarantees in pending legal or administrative proceedings could have a material adverse effect on our business, financial condition and results of operations. • We may pursue strategic acquisitions or investments. The failure of an acquisition or investment to produce the anticipated results, or the inability to successfully integrate an acquired company, could harm our business. • Our developer platforms, which are open to merchants and third-party developers, subject us to additional risks. • We are a holding company and do not have any material assets other than the shares of our subsidiaries. • The outbreak of communicable diseases around the world led and could lead to higher volatility in the global capital markets, adversely affecting our business operations and the trading price of our Class A common shares. • Our historical loan losses may not be indicative of future loan losses and changes in our business may adversely affect the quality of our loan portfolio. • Default by other financial institutions may adversely affect the financial markets in general and us. • We may incur losses associated with counterparty exposure risks. • We face risks relating to liquidity of our capital resources. • Internet regulation in Brazil is recent and still limited and several legal issues related to the internet are uncertain. 7 Table of Contents Risks Relating to Our Class A Common Shares • UOL, our largest shareholder, owns 100% of our outstanding Class B common shares, which represent approximately 88.74% of the voting power of our issued share capital, and controls all matters requiring shareholder approval. This concentration of ownership and voting power limits your ability to influence corporate matters. • Class A common shares eligible for future sale may cause the market price of our Class A common shares to drop significantly. • We have not adopted a dividend policy with respect to future dividends. If we do not declare any dividends in the future, you will have to rely on price appreciation of our Class A common shares in order to achieve a return on your investment. • We may raise additional capital in the future by issuing equity securities, which may result in a potential dilution of your equity interest. • If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, the market price and trading volume of our Class A common shares could decline. • Our dual class capital structure means our shares will not be included in certain indices. We cannot predict the impact this may have on our stock price. • We are a Cayman Islands exempted company with limited liability. The rights of our shareholders may be different from the rights of shareholders governed by the laws of U.S. jurisdictions. • Our shareholders may face difficulties in protecting their interests because we are a Cayman Islands exempted company. • Our Memorandum and Articles of Association contain anti-takeover provisions that may discourage a third party from acquiring us and reduce the rights of holders of our Class A common shares. • United States civil liabilities and certain judgments obtained against us by our shareholders may not be enforceable. • Judgments of Brazilian courts to enforce our obligations with respect to our Class A common shares may be payable only in reais. • As a foreign private issuer, the disclosure requirements that we must comply with and other requirements are different from those applicable to U.S. domestic registrants. • PagSeguro Digital is a foreign private issuer and, as a result, in accordance with the listing requirements of the New York Stock Exchange, or NYSE, we rely on certain home country governance practices from the Cayman Islands, rather than the corporate governance requirements of the NYSE. • Although we do not expect to be a passive foreign investment company, or PFIC, for U.S. federal income tax purposes, there can be no assurance that we will not be a PFIC for any taxable year, which could subject United States investors in our shares to significant adverse U.S. federal income tax consequences. • Our Class A common shares may not be a suitable investment for all investors, as investment in our Class A common shares presents risks and the possibility of financial losses. Risks Relating to Brazil The Brazilian government has exercised, and continues to exercise, significant influence over the Brazilian economy. This influence as well as Brazil’s political and economic conditions may adversely affect us and the price of our Class A common shares. The Brazilian government has frequently exercised significant influence over the Brazilian economy and occasionally made drastic changes in policy and regulations. The Brazilian government’s actions to control inflation and other policies and regulations have often involved, among other measures, increases in interest rates, changes in tax policies, price controls, foreign exchange rate controls, currency devaluations, capital controls and limits on imports. We have no control over and cannot predict what measures or policies the Brazilian government may take in the future. We may be adversely affected by changes in Brazilian government policies, including, without limitation: • growth or downturn of the Brazilian economy; • interest rates; • monetary policies; • exchange rates and currency fluctuations; • inflation; • liquidity of capital and lending markets; • import and export controls; • exchange controls and restrictions on remittances abroad; • modifications to laws and regulations according to political, social and economic interests; • fiscal policy and changes in tax laws; • labor and social security regulations; • energy and water shortages and rationing, as well as other effects of climate change; and • other political, diplomatic, social and economic developments in or affecting Brazil. 8 Table of Contents We cannot predict what measures the Brazilian government may take in the face of mounting macroeconomic pressures or otherwise. Uncertainty over whether the Brazilian government will implement changes in policy or regulation affecting these or other factors in the future may affect economic performance and contribute to economic uncertainty in Brazil, which may have an adverse effect on us. Recent economic and political instability has led to a negative perception of the Brazilian economy and higher volatility in the Brazilian securities markets, which may have a material adverse effect on us and, as a consequence, on the market price of our Class A common shares. Ongoing political instability in Brazil may adversely affect our business, results of operations and the trading price of Class A common shares. The Brazilian economy has been and continues to be affected by political events in Brazil, which have also affected the confidence of investors and the public in general, adversely affecting the performance of the Brazilian economy and increasing the volatility of securities issued by Brazilian companies, including the trading price of Class A common shares. Brazilian markets have experienced heightened volatility due to uncertainties from investigations related to allegations of money laundering, corruption and misconduct by government officials and legal entities and individuals from the private sector carried out by the Brazilian Federal Police and the Office of the Brazilian Federal Prosecutor. These investigations have adversely affected the Brazilian economy and political environment. We have no control over and cannot predict developments in these investigations nor whether future investigations or allegations will result in further political and economic instability, which could adversely affect the trading price of securities issued by Brazilian companies, including ours. In the second semester of 2026, Brazil will hold elections for president, senators, federal legislators, state governors and state legislators. Political bipolarization between the left and right wings tends to enhance political instability, which could adversely affect the economy and therefore us. In addition, the president of Brazil has the power to determine policies and issue governmental acts related to the Brazilian economy that affect the operations and financial performance of companies, including us. We cannot predict which policies the new president will adopt or if these policies or changes in current policies may have an adverse effect on us or the Brazilian economy. Furthermore, changes to the Brazilian house of representatives and senate may influence legislative priorities and the regulatory environment, potentially leading to shifts in policy that could affect our business activities. Uncertainty regarding political developments and the policies the Brazilian federal government may adopt or alter may have material adverse effects on the macroeconomic environment in Brazil, as well as on the operations and financial performance of businesses operating in Brazil, including ours. These uncertainties may heighten the volatility of the Brazilian securities market, including in relation to ours. Inflation and certain measures by the Brazilian government to curb inflation have historically affected the Brazilian economy and Brazilian capital markets, and high levels of inflation in the future could adversely affect our business and the price of our Class A common shares. Historically, Brazil has experienced high inflation rates. Inflation and some of the measures taken by the Brazilian government in an attempt to curb inflation have had significant negative effects on the Brazilian economy, including economic uncertainty and heightened volatility in the Brazilian capital markets. According to the National Consumer Price Index (Índice Nacional de Preços ao Consumidor Amplo), or IPCA, Brazilian inflation rate, considering the accumulated inflation over the prior 12-month period, was 4.14%, in March 2026, and 4.26%, 4.83% and 4.62% in 2025, 2024 and 2023, respectively. Brazil may experience high levels of inflation in the future and inflationary pressures may lead to the Brazilian government’s intervening in the economy and introducing policies that could materially adversely affect our business and the price of Class A common shares. In the past, the Brazilian government’s interventions included the maintenance of a restrictive monetary policy with high interest rates that restricted credit availability and reduced economic growth, causing volatility in interest rates. For example, the SELIC rate, the Central Bank’s overnight rate, as established by the Monetary Policy Committee (Comitê de Política Monetária), or COPOM, was 14.90% p.a., 12.15% p.a. and 11.65% p.a. in 2025, 2024 and 2023, respectively. In March, 2026, the SELIC rate target was 14.75%. 9 Table of Contents The current economic environment in Brazil of rising interest rates, depreciation of the Brazilian real and the implementation of a fiscal adjustment plan that remains uncertain has led to economic uncertainty. While tight monetary policies with high interest rates may restrict Brazil’s growth and the availability of credit, more lenient government and Central Bank policies and interest rate decreases may trigger increases in inflation, and, consequently, growth volatility and the need for sudden and significant interest rate increases. Higher interest rates may increase our funding costs and affect our ability to finance operations and invest in growth opportunities. The depreciation of the Brazilian real could lead to higher operational expenses, especially if we rely on imported goods or services priced in foreign currencies. Inflation and the Brazilian government’s measures to curb it, principally the Central Bank’s monetary policy, have had and may again have significant effects on the Brazilian economy and us. Economic uncertainty and heightened volatility in the Brazilian capital markets in connection with such monetary policies could materially adversely affect our results of operations and financial condition and, consequently, the price of Class A common shares. Exchange rate volatility may have adverse effects on the Brazilian economy, us and the price of our Class A common shares. The Brazilian currency has been historically volatile and has been devalued frequently over the past three decades. Throughout this period, the Brazilian government has implemented various economic plans and used various exchange rate policies, including sudden devaluations, periodic mini-devaluations (during which the frequency of adjustments has ranged from daily to monthly), exchange controls, dual exchange rate markets and a floating exchange rate system. Although long-term depreciation of the real is generally linked to the rate of inflation in Brazil, depreciation of the real occurring over shorter periods of time has resulted in significant variations in the exchange rate between the real, the U.S. dollar and other currencies. In 2022 and 2023, the real appreciated against the U.S. dollar and, as of December 31, 2022 and 2023, the U.S. dollar selling rate was R$5.2177 per US$1.00 and R$4.8413 per US$1.00, respectively. In 2024, the real depreciated against the U.S. and, as of December 31, 2024, the U.S. dollar selling rate was R$6.1923 per US$1.00. In 2025, the real depreciated against the U.S. and, as of December 31, 2025, the U.S. dollar selling rate was R$5.5024 per US$1.00. As of March 31, 2026, the U.S. dollar selling rate was R$5.2194 per US$1.00. There can be no assurance that the real will not depreciate further against the U.S. dollar. A depreciation of the real relative to the U.S. dollar could further exacerbate already intense create inflationary pressures in Brazil and cause the Brazilian government to, among other measures, continue to increase interest rates. Any depreciation of the real may generally restrict access to the international capital markets and it would also reduce the U.S. dollar value of our results. Restrictive macroeconomic policies could reduce the stability of the Brazilian economy and harm our results of operations and profitability. In addition, domestic and international reactions to restrictive economic policies could have a negative impact on the Brazilian economy. These policies and any reactions to them may harm us by curtailing access to foreign financial markets and prompting further government intervention. A devaluation of the real relative to the U.S. dollar may also, as in the context of the current economic slowdown, decrease consumer spending, increase deflationary pressures and reduce economic growth. On the other hand, an appreciation of the real relative to the U.S. dollar and other foreign currencies may deteriorate the Brazilian foreign exchange current accounts. We and certain of our suppliers purchase goods and services from countries outside Brazil, and thus changes in the value of the U.S. dollar compared to other currencies may affect the costs of goods and services that we purchase. Depending on the circumstances, either devaluation or appreciation of the real relative to the U.S. dollar and other foreign currencies could restrict the growth of the Brazilian economy, as well as our business, results of operations and profitability. 10 Table of Contents Developments and the perceptions of risks in other countries, including other emerging markets, the United States and Europe, may adversely affect the Brazilian economy and the price of Brazilian securities, including the price of our Class A common shares. The market for securities issued by Brazilian companies is influenced by economic and market conditions in Brazil and, to varying degrees, market conditions in other Latin American and emerging markets, as well as the United States, Europe and other countries. To the extent the conditions of the global markets or economy deteriorate, the business of Brazilian companies may be harmed. The weakness in the global economy has been marked by, among other adverse factors, lower levels of consumer and corporate confidence, decreased business investment and consumer spending, the ongoing war in Ukraine along with the armed conflict in the Middle East, including the conflict involving Israel, the United States and Iran and hostilities involving the Strait of Hormuz, disagreements between Europe and the United States over Greenland, and other disputes involving major economies and their impact on the global economy and international relations, increased unemployment, reduced income and asset values in many areas, currency volatility and limited availability of credit and access to capital. Developments or economic conditions in other emerging market countries have at times significantly affected the availability of credit to Brazilian companies and resulted in considerable outflows of funds from Brazil, decreasing the amount of foreign investments in Brazil. In the United States, economic and political uncertainty and changes in interest rates may also create uncertainty in the Brazilian economy. The policies of the U.S. administration, including with respect to the increase of tariffs on imports and the ongoing U.S. Trade Representative’s investigation into Brazil’s trade practices, enhanced economic and geopolitical uncertainty globally and could result in trade disputes and cause the disruption of supply chains. In addition, sanctions, export controls and other restrictive measures administered or enforced by the United States may apply not only to foreign jurisdictions but also to persons or entities located in, or associated with, such jurisdictions, including through programs with extraterritorial reach, such as those adopted pursuant to the Global Magnitsky Human Rights Accountability Act and related executive orders involving certain Brazilian parties. Compliance with such measures may restrict or prohibit certain financial transactions, require changes to our business practices and increase regulatory, operational and compliance costs. Moreover, U.S. sanctions requirements may conflict with or differ from applicable Brazilian or other jurisdiction’s laws or governmental directives. Conflicting legal obligations between Brazilian, U.S. and other foreign laws and regulations could create significant uncertainty to the regulatory environment in which we operate and could, together with the developments of the ongoing war between Ukraine and Russia, conflicts in the Middle East and tensions with major economics, such as China, materially and adversely affect our business, results of operations, financial condition, reputation, and the price of our Class A common shares. Any further downgrading of Brazil’s credit rating could reduce the trading price of our Class A common shares. Credit ratings affect investors’ perceptions of risk and, as a result, the yields required on indebtedness issuances in the financial markets. Rating agencies regularly evaluate Brazil and its sovereign ratings, taking into account a number of factors, including macroeconomic trends, fiscal and budgetary conditions, indebtedness and the prospect of change in these factors. Downgrades in Brazil’s credit rating can lead to downgrades in our credit rating and increase the cost of our indebtedness as investors may require a higher rate of return to compensate a perception of increased risk. In June 2023, Standard & Poor’s reaffirmed its rating at BB- and adjusted its outlook to positive and, in December 2023, Standard & Poor’s upgraded Brazil’s credit rating from BB- to BB with a stable outlook. In June 2025, Standard & Poor’s reaffirmed Brazil’s credit rating to BB with a stable outlook. In June 2023, Fitch upgraded Brazil’s credit rating to BB with a stable outlook. In June 2025, Fitch affirmed Brazil’s credit rating at BB with a stable outlook. From April 2018 until October 2024, Moody’s has maintained Brazil’s credit rating at Ba2 with a stable outlook. In October 2024, Moody’s upgraded Brazil’s sovereign rating from Ba2 to Ba1 with a positive outlook. In May 2025, affirmed Brazil’s credit rating at Ba1 but changed its outlook from positive to stable. Nonetheless, any future downgrade of Brazil’s credit rating could negatively impact the trading price of our Class A common shares. Similarly, downgrades of major Brazilian companies could worsen the economic conditions in Brazil, particularly for companies reliant on foreign investment, potentially having a material adverse effect on our business, financial condition, results of operations, and the price of our Class A common shares. In addition, Brazil’s sovereign credit rating is currently rated below investment grade by the three main credit rating agencies. Consequently, the prices of securities issued by Brazilian companies have been negatively affected. A prolongation or worsening of the political uncertainty, among other factors, could lead to ratings downgrades. Any downgrade of Brazil’s sovereign credit ratings could heighten investors’ perception of risk and, as a result, cause the trading price of our Class A common shares to decline. 11 Table of Contents Risks Relating to Our Business and Industry If we cannot keep pace with rapid technological developments to provide new and innovative products and services, and address the rapidly evolving market for transactions on mobile devices, the use of our products and services and, consequently, our revenues could decline. Rapid, significant and disruptive technological changes continue to impact the industries in which we operate, including developments in payment card tokenization, mobile payments, social commerce (i.e., e-commerce through social networks), authentication, virtual currencies, distributed ledger or blockchain technologies, near field communication and other proximity or contactless payment methods, virtual reality, machine learning and AI. For instance, mobile devices are increasingly used for e-commerce transactions and payments. A significant and growing portion of our customers access our platforms through mobile devices, including for regular online shopping as well as for in-person transactions. In the year ended December 31, 2025, approximately 79% of our customers accessed our platforms through mobile devices . We may lose customers if we are not able to continue to meet our customers’ mobile and multi-screen experience expectations. Different mobile devices and platforms use a wide variety of technical and other configurations, which increase the challenges involved in providing payments in the mobile environment. In addition, a number of other companies with significant resources and a number of innovative startups have introduced products and services focusing on mobile markets. We cannot guarantee that we will be able to continue to meet customer expectations in the mobile environment or increase our volume of mobile transactions. We cannot predict the effects of technological changes on our business. In addition to our own initiatives and innovations, we rely in part on third parties for the development of and access to new technologies. We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. Developing and incorporating new technologies into our products and services may require substantial expenditures, take considerable time, and ultimately may not be successful. In addition, our ability to adopt new products and services and develop new technologies may be inhibited by industry-wide standards, payment networks, changes to laws and regulations, resistance to change from consumers or merchants, third-party intellectual property rights, or other factors. Our success will depend on our ability to develop and incorporate new technologies, address the challenges posed by the rapidly evolving market for mobile transactions through our platforms and adapt to technological changes and evolving industry standards; if we are unable to do so in a timely or cost-effective manner, our business could be harmed and our revenues could decline. Interruption or failure of our computer and IT systems could impair our operations, which could damage our reputation and harm our results of operations. Our success and ability to process payments and provide high quality customer service depend on the efficient and uninterrupted operation of our computer and IT systems. Any failure of our computer and IT systems to operate effectively or to integrate with other systems, performance inadequacy or breach in security may cause interruptions in the availability of our sites, delays in product fulfillment and reduced efficiency of our operations. Any failures, problems or security breaches may mean that fewer customers may be willing to purchase the products we offer in the future. Factors that could occur and significantly disrupt our operations include: system failures and outages caused by fire, floods, earthquakes, power loss, telecommunications failures, sabotage, vandalism, terrorist attacks and similar events, software errors, computer viruses, worms, physical or electronic break-ins and similar disruptions from unauthorized tampering with our computer systems and data centers; in addition, security breaches related to the storage and transmission of proprietary information or customer information, such as credit card numbers or other personal information. Also, if too many customers access our sites within a short period of time due to any reason, we have experienced in the past and may in the future experience system interruptions that make our sites unavailable or prevent us from efficiently completing payment transactions, which may reduce the attractiveness of our products and services. We cannot assure you that the aforementioned events will not occur. While we have backup systems and contingency plans for certain aspects of our operations and business processes, our planning does not account for all possible scenarios. Specifically, our IT infrastructure managed services and cloud computing environment are supported by solutions from Scala Data Centers S.A., or Scala, Amazon Web Services, Inc., and Oracle do Brasil Sistemas Ltda. Failure by IT services providers to adequately keep our sites operational, including any prolonged or unscheduled service disruption that affects our customers’ ability to utilize our sites, could result in the loss of sales and customers and increased costs, which could materially adversely affect our reputation and results of operations. In addition, we rely in part on external IT services providers to advise us of any security breaches. If any of those providers do not provide us with notice on a timely basis, our reputation and results of operations may be harmed. We may not be able to timely replace our external IT services providers, or find a replacement on a cost-efficient basis, in the event of disruptions, failures to provide services or other issues that may harm our business. For more information on our agreement with DigitalServices, see “Item 7B. Related Party Transactions.” Any disruptions or service interruptions that affect our sites could damage our reputation, require us to spend significant capital and other resources and expose us to a risk of loss or litigation and liability. Some of our agreements with third-party service providers do not require those providers to indemnify us for losses resulting from any disruption in service. Any of the above disruptions could seriously harm our results of operation. 12 Table of Contents Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches. Our business involves the collection, storage, processing, and transmission of customers’ personal data, including financial information and keeping other critical client information in our database, which may be the subject of cyberattacks by individuals seeking unauthorized access to such information for misuse. As such, failures to protect our clients’ personal data, as well as violation of applicable laws, may give rise to additional costs and adversely affect our image and reputation. In addition, a significant number of our customers authorize us to bill their payment card or bank accounts directly for all transactions and other fees charged by us. We have built our reputation on the premise that our platform offers customers a secure way to make payments. An increasing number of organizations, including large merchants and businesses, other large technology companies, financial institutions and government institutions have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on portions of their websites or infrastructure. Cyberattacks have become increasingly sophisticated and diffuse. As the techniques used to obtain unauthorized, improper or illegal access to our systems, our data or our customers’ data, to disable or degrade service, or to sabotage systems are constantly evolving, it may be difficult to detect them quickly and they are often not recognized until launched against a target. Unauthorized parties may attempt to gain access to our systems or facilities through various means, including, among others, hacking into our systems or those of our customers, partners or vendors, or attempting to fraudulently induce our employees, customers, partners, vendors or other users of our systems into disclosing user names, passwords, payment card information or other sensitive information, which may in turn be used to access our IT systems. Certain efforts may be supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, we expect to continue to spend significant additional resources to bolster these protections, these security measures cannot provide absolute security. Our IT and infrastructure may be vulnerable to cyberattacks or security breaches, and third parties may be able to access our customers’ personal or proprietary information and card data that are stored on or accessible through those systems. Our security measures may also be breached due to human error, malfeasance, system errors or vulnerabilities, or other irregularities. Any actual or perceived breach of our security or cybersecurity could interrupt our operations; result in our systems or services being unavailable; result in improper disclosure of data or unauthorized access to such data, including clients’ personal data for misuse; materially harm our reputation and brand; result in noncompliance with applicable legislation and, consequently, cause significant legal and financial exposure; lead to loss of customer confidence in, or decreased use of, our products and services; and adversely affect our business and results of operations. In addition, any breaches of network or data security at our customers, partners or vendors (including data center and cloud computing providers) could have similar negative effects. Actual or perceived vulnerabilities or data breaches may lead to judicial or administrative claims against us. In addition, under card rules and our contracts with our card processors, if there is a breach of card information that we store, we could be liable for the payment card issuers for their cost of issuing new cards and related expenses. We also expect to spend significant additional resources to protect against security or privacy breaches and may be required to address problems caused by breaches. Additionally, while we maintain insurance policies, we do not maintain significant insurance policies specifically for cyberattacks and our current insurance policies may not be adequate to reimburse us for losses caused by security breaches, and we may not be able to collect fully, if at all, under these insurance policies, which may materially adversely affect our business and results of operations. Since the COVID-19 pandemic, our remote work practices have expanded and, as a result, the risks related to cybersecurity failures in our internal systems have also risen. As such, interruptions or flaws in our IT systems, such as in our telework systems, accounting calculations and billing, caused by accidents, natural disasters, power outage, malfunctions or malicious acts may impact our corporate, commercial or operational activities, which could adversely affect our business and results of operations, as well as our reputation and market reliability. We believe that the risk of cyberattacks on companies like ours has increased in recent years and could increase even further as a result of the professionalization of cybercriminals, current geopolitical instability related to ongoing global conflicts and retaliatory responses to sanctions, which could adversely affect our ability to maintain or enhance our cybersecurity and data protection measures. Additionally, our operations are at risk of cyberattacks targeting Brazil’s critical infrastructure, on which our IT systems rely. Given that we do not control this infrastructure, our capacity to protect our IT systems from the fallout of such attacks is limited, potentially impairing our ability to serve our customers effectively. As data privacy and cybersecurity risks for banking organizations and the broader financial system have significantly increased in recent years, data privacy and cybersecurity issues have become the subject of increasing legislative and regulatory focus. A marked increase in scrutiny from the SEC regarding the adequacy of risk disclosures related to cybersecurity and data privacy significantly enhances the likelihood of inquiries into the Company’s cybersecurity practices and the accuracy of its related disclosures. Preparing for and addressing any such investigations could result in substantial distractions for the Company’s management and the diversion of essential resources from its core operations. For more information, see “Item 16K. Cybersecurity.” 13 Table of Contents We may lose our competitiveness if we are unable to incorporate AI tools into our business operations and products. In 2023, we began developing different initiatives involving the use of AI, which we believe will be beneficial to our business for the coming years. These AI initiatives include the development of new features to assist customers in solving issues, such as (i) allowing customers to send a picture of the problem they are having with their card machine and the AI program will make a determination on whether the machine needs to be replaced or not, and (ii) conducting an AI analysis of a customer’s service history and data available through open finance portals to offer better services to the customer. Additionally, AI may be used to help develop code, which would accelerate coding and automated testing. AI is rapidly evolving and we cannot assure that we will be able to incorporate AI tools into our business operations and products in a timely manner. Integration of AI tools into our operations presents significant intellectual property challenges. Determining intellectual property for AI-generated content remains ambiguous, which may potentially lead to infringement claims. Using third-party AI tools raises concerns about the origin of data and algorithms, which may lead to intellectual property infringements that could inadvertently implicate us. AI tools might also unintentionally access or use copyrighted materials, heightening our exposure to intellectual property disputes. As AI tools continue to evolve, ensuring protection against intellectual property infringements becomes progressively more challenging. If we are unable to successfully and timely incorporate AI into our businesses and products, we may lose our competitiveness, which may materially adversely affect our financial condition and results of operations. AI regulation is rapidly evolving and AI regulation in Brazil remains uncertain. Regulation on AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. Technologies underlying AI and the use of AI are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and information security, consumer protection, competition, which are evolving and are expected to be subject to enhanced scrutiny. In Brazil, the most noteworthy AI regulation is bill of law No. 2.338/23, which was approved in the Brazilian Senate and is now under discussion in the House of Representatives. Bill of law No. 2.338/23 seeks to establish general national standards for the development, implementation, and responsible use of AI systems in Brazil, introducing potential compliance requirements, liability standards and certain usage restrictions. If enacted, bill of law No. 2.338/23 may impose additional compliance burdens, establish liability frameworks, or mandate specific transparency and accountability measures for our use of AI systems that could directly affect our operations. Because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal or regulatory risks that may arise relating to the use of AI. If laws and regulations relating to AI are implemented, interpreted or applied in a manner inconsistent with our current practices or policies, such laws and regulations may adversely affect our use of AI and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes or result in increased compliance costs and potential increases in civil claims against us, any of which could adversely affect our operating results, financial condition and financial prospects. We are subject to risks associated with noncompliance with the LGPD and may be adversely affected by the imposition of fines and other types of penalties. In 2018, the LGPD was enacted to govern the practices related to the use of personal data in Brazil. The LGPD provides a specific legal framework to be observed in personal data processing operations by Brazilian companies. Among other provisions, it establishes the rights of data subjects, the legal bases applicable to the processing of personal data, the requirements for obtaining consent on the use of such data, when applicable, the obligations and requirements relating to security incidents and leaks and data transfers, as well as the authorization for the creation of the Brazilian Data Protection Agency (Agência Nacional de Proteção de Dados), or ANPD, which is the entity responsible for regulating and supervising the application of the LGPD and other data protection laws as well as imposing sanctions in the event of noncompliance with the legal rules and obligations. While the LGPD has been in effect since 2018, its enforcement by the ANPD is still uncertain, as the LGPD provides limited guidance on its interpretation and, in spite of interpretations issued by the ANPD on a number of matters, there remains room for courts to establish contradictory jurisprudence. If we are unable to comply with the LGPD, we may be required to indemnify users affected by violations of their rights as data subjects and be subject to administrative sanctions, warnings and penalties imposed by the ANPD. Fines under the LGPD may be equal to up to 2% of our gross sales, or the gross sales of our economic group in Brazil, in the preceding fiscal year, excluding taxes, but limited to a total of R$50.0 million per violation. In addition, we may be held liable for individual or collective material moral damages caused by our failure to meet any of the obligations set forth by the LGPD and may be required to compensate those individuals for such violations. Any failure to comply with the LGPD, regulatory requirements or orders or other applicable privacy or consumer protection-related laws and regulations, our business, reputation and results of operations could be materially adversely affected. For more information on the LGPD and applicable data protection laws, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil—Rules on E-Commerce, Data Protection, Consumer Protection, Banking Secrecy and Taxes—Data Protection.” 14 Table of Contents Our services must integrate with a variety of operating systems and networks, and the hardware that enables merchants to accept payment cards must interoperate with mobile networks offered by telecom operators and third-party mobile devices utilizing those operating systems. If we are unable to ensure that our services or hardware interoperate with such networks, operating systems and devices, our business may be seriously harmed. We are dependent on the ability of our products and services to integrate with a variety of operating systems and networks, as well as web browsers that we do not control. Any changes in these systems or networks that degrade the functionality of our products and services, impose additional costs or requirements on us, or give preferential treatment to competitive services, including their own services, could seriously harm the levels of usage of our products and services. We also rely on bank platforms to process some of our transactions. If there are any issues with or service interruptions in these bank platforms, users may be unable to have their transactions completed, which would seriously harm our business. In addition, our hardware interoperates with mobile networks offered by telecom operators and mobile devices developed by third parties. Changes in these networks or in the design of these mobile devices may limit the interoperability of our hardware with such networks and devices and require modifications to our hardware. If we are unable to ensure that our hardware continues to interoperate effectively with such networks and devices, or if doing so is costly, our business may be seriously harmed. Our business depends on a strong and trusted brand, and any failure to maintain, protect and enhance our brand would harm our business and results of operations. We have developed a strong and trusted brand, highly linked to the reputation and public image of UOL, our controlling shareholder, which has contributed significantly to the success of our business. Our brand is predicated on the idea that sellers and buyers will trust us and find value in building and growing their businesses with our products and services. Maintaining, protecting and enhancing our brand are critical to expanding our base of sellers, buyers and other third-party partners, as well as increasing engagement with our products and services. This will depend largely on our ability to maintain trust, be a technology leader, and continue to provide high-quality and secure products and services. Any negative publicity about our industry, our company or UOL, our controlling shareholder, the quality and reliability of our products and services, our risk management processes, changes to our products and services, our ability to effectively manage and resolve seller and buyer complaints, our privacy and security practices, litigation, regulatory activity, the experience of sellers and buyers with our products or services, and changes in the public opinion of UOL, could harm our reputation and the confidence in and use of our products and services. Any damage to our brand can arise from many sources, including failure by us or our partners to satisfy expectations of service and quality; inadequate protection of sensitive information; compliance failures and claims; litigation and other claims; employee misconduct; and misconduct by our partners, service providers or other counterparties. We also cannot assure you that members of our management, our employees and persons acting on their behalf will comply at all times with our internal policies and that our internal procedures will effectively monitor and identify misbehavior, which may adversely affect our reputation. If we do not successfully maintain a strong and trusted brand, our business and results of operations could be materially adversely affected. Our business is subject to extensive government regulation and oversight and our status under these regulations may change. Violation of or non-compliance with present or future regulations could be costly, expose us to substantial liability and force us to change our business practices, any of which could seriously harm our business and results of operations. PagSeguro Brazil was first licensed by the Central Bank as a payment institution on October 17, 2018 and is currently authorized to operate as: (i) an acquirer; (ii) an issuer of electronic currency; (iii) an issuer of post-paid payment instrument (credit cards); and (iv) a payment initiator within the Pix arrangement and in the context of open finance. BancoSeguro is authorized to operate as a financial institution and foreign exchange dealer and was acquired by us in January 2019. Our digital payment activities carried out by PagSeguro Brazil as payment scheme operator are currently exempt from authorization by the Central Bank. Our subsidiary Wirecard Brazil Tecnologia Ltda., or MOIP, requested the cancellation of its license in July 2025, which was approved by the Central Bank in October 2025. This subsidiary subsequently adopted the corporate name Wirecard Brazil S.A., and no longer carries out regulated activities. In March 2023, the Central Bank authorized PagInvest to operate as a securities broker-dealer (corretora de títulos e valores mobiliários). In October 2023, the Brazilian Securities Commission (Comissão de Valores Mobiliários), or the CVM, also authorized PagInvest to provide custody services. Our investment related activities in the securities market, previously conducted by BancoSeguro through our investment platform, were transferred to PagInvest during the second half of 2025, except for the third-party fund distribution and the custody of certain assets, which remain with BancoSeguro. Abroad, our activities extend over multiple jurisdictions in Latin America, such as Chile, Colombia, Mexico and Peru, which possess complex regulatory and legal frameworks. As a result of this, we are required to comply with a wide range of laws and regulations in the countries where we operate or do business, including anti-corruption, international sanctions, anti-money laundering, data protection, privacy of personal data, and related laws and regulations. Our governance and compliance processes, which include the review of internal control over financial reporting, may not timely identify or prevent breaches of legal, regulatory, accounting, governance or ethical standards required by these jurisdictions. Our failure to comply with applicable laws and other standards imposed by these jurisdictions in which we operate could subject us to investigations by authorities, litigation, fines, loss of operating licenses, disgorgement of profits, involuntary dissolution and reputational harm. 15 Table of Contents In addition, early payment of receivables is part of our activities. Law No. 12,865/2013 prohibits payment institutions such as PagSeguro Brazil from performing activities that are limited to financial institutions. There is some debate under Brazilian law as to whether providing early payment of receivables to merchants could be characterized as “lending,” which is an activity that is limited to financial institutions. Similarly, there is some debate as to whether the discount rates applicable to this early payment feature should be considered as “interest,” in which case the limits set by the Brazilian Usury Law would apply to these rates. In this context, in 2015, the Central Bank Office of Legal Counsel (Procuradoria-Geral do Banco Central), or PGBC, issued a legal opinion in which it concluded that: (i) advances of trade receivables (credit card receivables backed by executed and paid transactions) to merchants relates to the early payment of an obligation and should not be confused with activities of financial institutions; and (ii) discount rates applicable to this prepayment mechanism are subject to the limits set forth in the Brazilian Usury Law. In December 2023, this legal opinion was partially revised as the PGBC concluded that the limitations set out in the Brazilian Usury Law should not apply to receivables advances carried out by authorized payment institutions, such as PagSeguro Brazil. On June 28, 2024, the Brazilian Usury Law was amended by Law No. 14,905/2024, pursuant to which the usury limitations no longer apply to certain transactions, including, among others, advances of card receivables carried out by financial institutions and other institutions authorized to operate by the Central Bank or otherwise contracted between legal entities. However, if new laws are enacted or the courts’ interpretation of this activity change, either preventing us from providing early payments of receivables to merchants or limiting the fees we usually charge, our financial performance could be negatively affected. For further information regarding these regulatory matters, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil.” Brazilian payment institutions and financial institutions have no control over government regulations applicable to their activities. Any changes in those regulations could adversely affect the operations and financial results of BancoSeguro, PagSeguro Brazil and PagInvest. For instance, Law No. 14,690/2023 was published on October 3, 2023 which established a new limit on the interest and financial fees charged on the outstanding balances of credit card invoices in the categories of revolving credit (crédito rotativo) and installment credit (parcelamento de fatura de cartão de crédito). On December 21, 2023, the CMN and the Central Bank regulated, through Resolution No. 5,112 and Resolution No. 365, the limit provided for in Law No. 14,690/2023. Under these new rules, the total amount of interest and financial charges that may be levied on revolving credit or installment credit balances cannot exceed the original amount of the debt financed. This limit applies to all issuers of credit cards and other post-paid payment instruments. Furthermore, if we are found to be in violation of any current or future regulations, we could be (i) required to pay substantial fines (including per transaction fines) and disgorgement of our profits, (ii) required to change our business practices, or (iii) subjected to resolution regimes such as an intervention by the Central Bank and the out-of-court liquidation. We could also be subject to private lawsuits. Any of these consequences could seriously harm our business and results of operations. We are subject to costs and risks associated with increased or changing laws and regulations affecting our business, including those relating to the sale of consumer products. Specifically, developments in data protection and privacy laws could harm our business, financial condition, results, or operations. We operate in a complex regulatory and legal environment that exposes us to compliance and litigation risks and that could materially affect our results of operations. These laws may change, sometimes significantly, as a result of political, economic or social events. Some of the federal, state or local laws and regulations that affect us include: those relating to consumer products, product liability or consumer protection; those relating to the manner in which we advertise, market or sell products; labor and employment laws, including wage and hour laws; tax laws or interpretations thereof; data protection, privacy and cybersecurity laws and regulations; and securities and exchange laws and regulations. For instance, data protection and privacy laws are developing to consider the changes in cultural and consumer attitudes towards the protection of personal data. There can be no guarantee that we will have sufficient financial resources to comply with any new regulations or successfully compete in the context of a shifting regulatory environment. Any additional privacy laws or regulations could seriously harm our business, financial condition or results of operations. 16 Table of Contents Changes in tax laws, tax incentives, benefits or differing interpretations of tax laws may adversely affect our results of operations. Changes in tax laws, regulations, related interpretations and tax accounting standards in Brazil, the Cayman Islands or the United States may result in the creation of new taxes or higher tax rates on our earnings, which may significantly reduce our profits and cash flows from operations. For example, Brazilian Law No. 11,196 of 2005 grants tax benefits to companies that invest in research and development, provided that some requirements are met, which significantly reduces our annual income tax expense. On the other hand, if federal, state or municipal taxes applicable to our business increase or any tax benefits are revoked and we cannot alter our cost structure to pass our tax increases on to customers, our financial condition, results of operations and cash flows could be harmed. In this context, in December 2023, Brazilian Congress approved a broad consumption tax reform that will gradually replace the current indirect tax system with a dual value added tax, or VAT, composed of the tax on goods and services (Imposto sobre Bens e Serviços), or IBS, and the contribution on goods and services (Contribuição sobre Bens e Serviços), or CBS, and one Selective Tax (Imposto Seletivo), or IS, together with the elimination of tax benefits, which may result in an increase in the overall tax burden. The reform will be implemented over a seven-year transition period beginning in 2026, and its ultimate effects on our business, financial condition and results of operations remain uncertain. Also, in 2025, the Brazilian federal government, among other measures, (i) increased the rates applicable to certain credit, foreign exchange, insurance and securities transactions; (ii) imposed withholding income tax on dividends paid to individuals and non-resident investors, effective January 1, 2026; (iii) increased the social contribution on net income (Contribuição Social sobre o Lucro Líquido), or CSLL, rate for payment institutions and certain other entities; and (iv) reduced certain federal tax incentives, including incentives related to corporate income tax (Imposto de Renda Pessoa Jurídica), or IRPJ. These and any additional changes to tax laws, whether in the context of the tax reform or other amendments to tax laws applicable to our activities, may increase our tax burden and raise the cost of our operations, therefore adversely affecting our business and financial results. New taxes could also require us to incur substantial costs to capture data and to collect and remit taxes. If such obligations were imposed, the additional costs associated with tax collection, remittance and audit requirements could have a material adverse effect on our business and financial results. For more information on the tax reform and additional recent changes to tax laws in Brazil, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil—Rules on E-Commerce, Data Protection, Consumer Protection, Banking Secrecy and Taxes.” In addition, some tax rules related to the collection, ancillary obligations or changes in the applicable tax rates in Brazil may be amended by the authorities without prior notice or a transition period for implementation, including with respect to certain taxes that are not subject, in whole or in part, to the constitutional principles of annual and 90-day prior notice (anterioridade annual e nonagesimal). This means that Brazilian government authorities may impose taxes with effect as of the date of its publication, which may materially adversely affect taxpayers. As a result, we may not be aware at all times of all such changes that affect our business and we may therefore inadvertently fail to pay the applicable taxes or otherwise comply with tax regulations, which may result in additional tax assessments, penalties and the payment of interest on unpaid taxes. Furthermore, we are subject to tax laws and regulations that may be interpreted differently by tax authorities, judicial or administrative courts and us. The application of indirect taxes, such as sales and use tax, VAT, provincial taxes, goods and services tax, business tax and gross receipt tax, to businesses like ours is a complex and evolving issue. Significant judgment is required to evaluate applicable tax obligations. In many cases, the ultimate tax determination is uncertain because it is not clear how existing statutes apply to our business. One or more states, or municipalities, the federal government or other countries may seek to challenge the taxation or procedures applied to our transactions imposing the charge of taxes or additional reporting, record keeping or indirect tax collection obligations on businesses like ours. We are defendants in tax proceedings relating to the interpretation of tax laws and regulations by Brazilian tax authorities. For further information, see “Item 8A. Consolidated Statements and Other Financial Information—Legal Proceedings—Tax and Social Security Proceedings.” Failure to deal effectively with fraud, fictitious transactions, bad transactions or negative customer experiences would increase our loss rate and harm our business, and could severely diminish merchant and consumer confidence in and use of our services. We incur losses and expenses due to claims from consumers that merchants have not performed or that their goods or services do not match the merchant’s description. We seek to recover these losses and expenses from the merchant but may not be able to recover them in full when the merchant is unwilling or unable to pay. We also incur losses and expenses from claims that the consumer did not authorize the purchase, from consumer fraud and from erroneous transmissions. In addition, if the losses we incur related to card transactions become excessive, they could potentially result in a loss of our right to accept cards for payment. If we were unable to accept cards, the number of transactions processed through our platform would decrease substantially and our business would be harmed. We are also subject to the risk of fraudulent activity by merchants, consumers of products purchased through our platform, or third parties handling our user information. We take measures to detect and reduce the risk of fraud, but these measures need to be continually improved and may not be effective against new and continually evolving forms of fraud or in connection with new product offerings. If these measures fail, our business could be harmed. 17 Table of Contents Increasingly intense competition may harm our business. We operate in highly competitive markets characterized by rapid technological change, evolving customer needs, shifting industry standards and frequent introductions of new products and services. Our competitors include traditional and emerging merchant acquirers, financial institutions, card issuers, and well-established businesses outside our core sectors, many of which operate with significantly greater financial, technological, operational, and marketing resources than we do. We also may face competition from well-established businesses from outside our sectors and significant financial resources and experience operating in Brazil. The competitive landscape may be further reshaped by mergers and acquisitions among existing players, potentially giving rise to larger, better-resourced competitors. We also face the risk of new market entrants with innovative business models or superior technology capable of disrupting established dynamics in the Brazilian payments and digital banking industries. We expect competition to intensify as existing and new competitors continue to introduce new services, enhance existing offerings, and compete aggressively for market share. Increased competitive pressure could result in loss of existing clients, pricing compression, reduced margins, and greater difficulty in attracting new merchants and consumers, any of which could materially and adversely affect our business, growth prospects, financial condition, and results of operations. Failure to maintain sufficient working capital could limit our growth and harm our business, financial condition and results of operations. We have significant working capital requirements, primarily driven by payment terms agreed with our merchant clients and the extended payment terms that they offer to their customers. In our acquiring business, differences between the date when we pay our merchant clients and the date when we receive payments from card issuers may harm our liquidity and our cash flows. We expect our working capital needs to increase as our total transaction business increases. In order to finance our working capital needs, we have recently been entering into financing arrangements that decrease how long it takes us to collect our accounts receivable, and to increase how long we have to pay our accounts payable. In addition, we also use our full banking license to offer Certificates of Deposit (Certificados de Depósito Bancário), or CDs, through BancoSeguro primarily to fund our credit portfolio. We believe these financing arrangements and BancoSeguro’s CDs allow us to gain access to capital faster and more cheaply than we would otherwise be able to. There can be no assurance that these types of financing arrangements will continue to be available to us on acceptable terms, or at all. Additionally, we may be unable to access financing in the credit and capital markets at reasonable rates to fund our operations and, accordingly, our profitability and total transaction business could decline significantly. We may also face liquidity constraints or financial stress in connection with outstanding CDs in the face of adverse macroeconomic conditions and threats to the international financial system, such as those following the Silicon Valley Bank closure and the distressed sale of Credit Suisse to UBS in March 2023. If we do not have sufficient working capital, we may not be able to pursue our growth strategy, respond to competitive pressures or fund key strategic initiatives, such as the development of our sites, which may harm our business, financial condition and results of operations. We may offer new financial products and use new technologies that may have a negative impact on our liquidity by increasing our costs and risks associated with government regulation and investment in new technology. We may offer new financial products under BancoSeguro. The arrival of new financial products could have a variety of consequences for us. New financial products and technologies may increase our costs and risks associated with governmental regulation and investments in new technology. The costs of compliance with regulation and upgrading our infrastructure and technology to provide financial services could be significant. For example, we offer services that allow our customers to buy, hold and sell quotas for investment funds in cryptocurrencies, which are managed by third parties. Through our investment platform (the digital fund distribution platform available and used by our customers), our customers can invest in digital currencies through a new cryptocurrency investment fund. Any failure our partners in maintaining the necessary controls or managing cryptocurrency assets and funds appropriately, including maintaining compliance with applicable regulatory requirements and addressing any cybersecurity considerations, could result in potential losses of cryptocurrencies, reputational harm, regulatory enforcement actions, significant financial losses, result in customers opting to discontinue or reduce their use of our and our partners’ products, or result in significant penalties, fines or additional restrictions, which could cause an adverse impact on our business, operating results or financial condition. The significant regulatory uncertainty regarding cryptocurrency assets and cryptocurrency trading platforms, including in Brazilian markets, may restrict, limit or regulate in an excessive or burdensome manner the investments made in cryptocurrency assets or prohibit the use of such assets in the market (including any related transactions in different jurisdictions), which could adversely affect our activities, the manner in which we currently conduct some aspects of our business and, as a result, our financial condition or results of operations. Virtual asset services are governed by Resolutions No. 519, 520 and 521, enacted on November 10, 2025. For further information on these regulations, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil.” Consequently, we are subject to potential litigation from clients who may experience impacts on their investments in cryptocurrency due to market volatility or as a result of operational failures, including from the uncertain regulatory landscape. 18 Table of Contents We rely on third parties and UOL, our largest shareholder, and its subsidiaries in many key aspects of our business, which creates additional risk. We rely on third parties in many key aspects of our business, including, among others: • Networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; • Third parties that provide certain outsourced customer support and product development functions, which are critical to our operations; and • Third parties that provide facilities, infrastructure, components and services, including data center facilities and cloud computing. The third parties that we rely on to process transactions may fail or refuse to process transactions adequately. Any of the third parties we use may breach their agreements with us, refuse to renew these agreements on commercially reasonable terms, take actions that degrade the functionality of our services, impose additional costs or requirements on us, or give preferential treatment to competing services. Financial or regulatory issues, labor issues, or other problems that prevent these third parties from providing services to us or our customers could harm our business. If our service providers do not perform satisfactorily, we may not be able to timely replace these third parties, or find a replacement on a cost-efficient basis, and our operations could be disrupted, which could result in customer dissatisfaction, damage our reputation, and harm our business. We rely on UOL, our largest shareholder, and its subsidiaries for key several business services, particularly: telecommunications services, infrastructure, corporate, litigation and back-office services. UOL and its subsidiaries also provide us with advertising and media space and resell cloud services to us. For further details of these services, see “Item 7B. Related Party Transactions.” Our failure to manage the assets underlying our customer funds properly could harm our business. Our ability to manage and account accurately for the assets underlying our customer funds requires a high level of internal controls. As our business continues to grow and we expand our product offerings, we must continue to strengthen our internal controls accordingly. Our success requires significant public confidence in our ability to handle large and growing transaction volumes and amounts of customer funds. Any failure to maintain the necessary controls or to manage the assets underlying our customer funds accurately could severely diminish customer use of our products or result in penalties and fines, which could harm our business. Increases in interest rates may harm our business, financial results and results of operations. Processing consumer transactions made using credit cards, as well as providing early payment of receivables to merchants when consumers make credit card purchases in installments, both make up a significant portion of our activities. In general, when Brazilian interest rates increase, consumers may choose to make fewer purchases using credit cards; and fewer merchants may decide to use our early payment of receivables feature if our overall financing costs require us to increase the discount rate we charge for this feature. Either of these factors could cause our business activity levels to decrease. Following improved inflation rates observed in Brazil in mid-2023, after remaining steady at 13.75% p.a. between August 2022 and August 2023, the Central Bank reduced the interest rate by 0.50% in August 2023, followed by four additional reductions of the same magnitude between September 2023 and January 2024. The Central Bank ended the interest rate cut cycle with an additional 0.25% in May 2024. The SELIC rate remained at the same rate between June and July 2024. In September 2024, the interest rate cycle began to rise, starting with a 0.25% increase, followed by a 0.50% increase in November 2024, and accelerating to 1% increase in December 2024 and January 2025, in each month. The Selic rate continued to rise through June 2025 and then remained stable at 15.00% until March 2026, when it decreased to 14.75%. However, market uncertainty persists regarding inflation and interest rate dynamics in Brazil. Although the benchmark rate has remained stable in recent months, improving inflation expectations have strengthened the outlook for the beginning of a monetary easing cycle. Even so, any unexpected change in economic conditions could still require us to adjust prices further, which may adversely affect our business or financial results. 19 Table of Contents The e-commerce market in Brazil is developing, and the expansion of our business depends on the continued growth of e-commerce, as well as increased availability, quality and usage of the internet in Brazil. Our future revenues from digital payments depend substantially on consumers’ widespread acceptance and use of the internet to conduct commerce. Rapid growth in the use of the internet (particularly to provide and purchase products and services) is a relatively recent phenomenon in Brazil and we cannot assure you that this rapid growth of acceptance and usage will continue. Internet penetration in Brazil may never reach the levels seen in more developed countries for reasons that are beyond our control, including the lack of necessary network infrastructure or delayed development of enabling technologies, performance improvements and security measures. The infrastructure for the internet in Brazil may not be able to support continued growth in the number of users, their frequency of use or their bandwidth requirements. Delays in telecommunication and infrastructure development or other technology shortfalls may impede improvements in internet reliability in Brazil. If telecommunications services are not sufficiently available to support the growth of the internet in Brazil, response times could be slower, which would reduce internet usage and harm our services. In addition, even if internet penetration in Brazil increases, this may not lead to growth in e-commerce due to several factors, including lack of confidence by users in online security. Furthermore, the price of internet access and internet-connected devices, such as personal computers, tablets, mobile phones and other portable devices, may limit our growth, particularly in parts of Brazil with low levels of income. Income levels in Brazil are significantly lower than in the United States and other more developed countries, while prices of both portable devices and internet access in Brazil are higher than in those countries. Income levels in Brazil may decline and device and access prices may increase in the future. Any of these factors could limit our ability to generate revenues in future. Our quarterly results of operations and operating metrics may fluctuate and are unpredictable and subject to seasonality, which could result in the price of our Class A common shares being unpredictable or declining. Our quarterly results of operations may vary significantly and are not necessarily an indication of future performance. These fluctuations may be due to a variety of factors, some of which are outside of our control and may not fully reflect the underlying performance of our business. In addition, we operate in a somewhat seasonal industry, which tends to experience relatively fewer transactions in the first quarters of the year, increased activity as the year-end holiday shopping season initiates, and fewer transactions after the year-end holidays. In addition, businesses operating in Brazil, such as ours, tend to experience relatively fewer transactions during certain international sporting events. Factors that may cause fluctuations in our quarterly results of operations include our ability to attract and retain customers; the timing, effectiveness and costs of expansion and upgrades of our systems and infrastructure, as well as the success of those expansions and upgrades; the outcomes of legal proceedings and claims; our ability to maintain or increase revenue, gross margins and operating margins; our ability to continue introducing new services and to continue convincing customers to adopt additional offerings; increases in and timing of expenses that we may incur to grow and expand our operations and to remain competitive; period-to-period volatility related to fraud and risk losses; system failures resulting in the inaccessibility of our products and services; changes in the regulatory environment, including with respect to security, privacy or enforcement of laws and regulations by regulators, including fines, orders, or consent decrees; changes in global business or macroeconomic enforcement of laws and regulations by regulators, including fines, orders, or consent decrees; changes in global business conditions; general retail buying patterns; and the other risks described in this annual report. Future fluctuations in quarterly results may mean that our business is less predictable and may harm the trading price of our Class A common shares. Our business could be harmed if we are unable to forecast demand for our products accurately or to manage our product inventory adequately. With the goal of increasing our transaction business and POS device offerings, we invest broadly in our POS unit technology. Our products, such as the Moderninha and the Minizinha, often require investments with long lead times. An inability to forecast the success of a particular product correctly could harm our business. We must forecast inventory needs and expenses and place orders sufficiently in advance with our third-party suppliers and contract manufacturers based on our estimates of future demand for products. Our ability to forecast demand for our products could be affected by many factors, including an increase or decrease in demand for our products or for our competitors’ products, unanticipated changes in general market conditions, and the change in economic conditions. If we underestimate demand for a particular product, our contract manufacturers and suppliers may not be able to deliver enough product to meet our requirements, and we may experience a shortage of that product available for sale or distribution. The shortage of a popular product could seriously harm our brand, our seller relationships, the acquisition of additional sellers and our total transaction business. Conversely, if we overestimate demand for a particular product, we may have excess inventory for that product and the excess inventory may become obsolete or out of date. Inventory levels in excess of demand may lead us to write down or write off the inventory or sell excess inventory at further discounted prices, which could harm our profit and our business. 20 Table of Contents Some of the key components of our POS devices are sourced from a limited number of suppliers. We are therefore at risk of shortage, price increases, changes, delay or discontinuation of key components, which could disrupt and harm our business and financial results. Some of the key components used to manufacture our POS devices, such as the chip and pin reader, come from limited sources of supply. While we currently have commercial relationships with three different manufacturers that provide our POS devices. We have entered into agreements for the supply of our POS devices with PAX Brazil, Cal-Comp Indústria e Comércio de Eletrônicos e Informática Ltda., or Cal-Comp Brazil, and Gertec Brasil Ltda., or Gertec, or with their representatives in Brazil. The agreements set forth the types of POS devices to be sold by each manufacturer to us and the standard terms and conditions governing this supply of POS devices. Consideration payable to PAX Brazil, Cal-Comp and Gertec is determined by the number of POS devices ordered by us. In October 2021, media reports disclosed an investigation by U.S. authorities into the activities of PAX Technology, Inc., or Pax Technology. We currently do not have direct commercial arrangements with PAX Technology, but rather we purchase the POS device hardware – not software – from representatives of PAX Technology and its affiliates in Brazil that buy the components from PAX Technology and its affiliates and resell to us. Different from other companies in the sector, we (as an acquirer) develop and install the software on the POS devices that we source from third-party suppliers in order to provide us with greater control over related data and security features of our services using POS devices, and we do not exchange any information regarding our customers, merchants or transactions with other third-party suppliers. We understand that the PAX Technology investigation was concluded. If any of our POS devices’ suppliers, service providers or business partners are investigated, the global market for POS devices and related components could be adversely affected, which in turn could have a negative effect on our business, reputation or financial results. The agreements for the components used to manufacture our POS devices are entered into directly by the manufacturer of our POS devices and each supplier, and we do not have agreements with these suppliers. We do not engage or participate in the negotiation of these agreements and we do not enter into agreements with the suppliers of our manufacturers. As a result of our reliance on our POS device manufacturers, we are exposed to the risk of shortages and delays in the supply of the components they require to manufacture our POS devices. If our manufacturers cannot find alternative sources of supply, we could be subject to shortages or delivery delays or other issues (such as the delay in the assembly of the POS devices), and as a result our business operations or financial results could be adversely affected. A number of other supply-chain risks, including strikes or shutdowns, or loss of or damage to our POS devices while in transit or in storage, could limit the supply of our POS devices. Any interruption or delay in component supply, any increases in component costs, or the inability of our manufacturers to obtain the necessary parts or components from alternate supply sources at acceptable prices or in a timely manner (including difficulties in fulfilling obligations in connection with the warranties we provide for our POS devices) could undermine our ability to provide our POS devices or other services to our merchants. This could damage our relationships with our clients, prevent us from acquiring new clients, and adversely affect our reputation in the market, which may cause an adverse effect on our business operations or financial results. We are subject to anticorruption, anti-bribery and anti-money laundering laws and regulations, and any errors, failures, or delays in complying with anticorruption, anti-bribery and anti-money laundering laws and regulations could result in significant criminal, administrative and civil lawsuits, penalties, forfeiture of significant assets, or other enforcement actions, as well as reputational harm. We are subject to various anticorruption, anti-bribery and anti-money laundering laws and regulations that prohibit, among other things, our involvement in improper payments to certain public officials for the purpose of obtaining advantages or in transferring the proceeds of criminal activities. We have programs designed to comply with new and existing legal and regulatory requirements. However, any errors, failures, or delays in complying with anticorruption, anti-bribery and anti-money laundering laws and regulations could result in significant criminal, administrative and civil lawsuits, penalties, forfeiture of significant assets, or other enforcement actions, as well as reputational harm. Regulators may increase enforcement of these obligations, which may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our customers and to monitor our transactions. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or verify identities of customers and any change in such thresholds could result in greater costs for compliance. Costs associated with fines or enforcement actions, changes in compliance requirements, or limitations on our ability to grow could harm our business and any new requirements or changes to existing requirements could impose significant costs, result in delays to planned product improvements, make it more difficult for new customers to join our network and reduce the attractiveness of our products and services. 21 Table of Contents The loss of any member of our management team and our inability to make up for such loss with a qualified, replacement could harm our business. Our business depends upon the efforts and skill of our senior management, who has played an important role in shaping our Company culture. Our future success depends to a significant extent on the continued service of our senior management team, who are critical to the development and the execution of our business strategies. Any member of our senior management team may leave us to set up or work in businesses that compete with ours. There is no guarantee that the compensation arrangements and non-competition agreements we have entered with our senior management team are sufficiently broad or effective to prevent them from resigning in order to set up or join a competitor, or that the non-competition agreements would be upheld in a court of law. In the event that a number of our senior management members leave our company, we may have difficulty finding suitable replacements, which could seriously harm us. Our future success also depends on our ability to identify, attract, hire, train, retain, motivate and manage other highly skilled technical, managerial, IT, marketing, product, risk management and customer service personnel. Competition for these personnel is intense, and we may not be able to successfully attract, hire, train, retain, motivate and manage sufficiently qualified personnel. We partially rely on card issuers or card schemes to process our transactions. Changes to credit card scheme fees, rules or practices may harm our business. We partially rely on card issuers or card schemes to process our transactions and must pay a fee for this service. From time to time, card schemes such as MasterCard and Visa may increase the interchange fees that they charge for each transaction using one of their cards. Credit card processors have the right to pass any increases in interchange fees on to us as well as increase their own fees for processing. In addition, card schemes have imposed and may again impose special assessments for transactions that are executed through a “digital wallet,” and these fees could particularly affect us and significantly increase our costs. These increased fees increase our operating costs and reduce our profit margins. We are also required by credit card schemes to comply with their operating rules. The credit card schemes and their member banks set and interpret these rules. The bank accounts offered by those member banks compete with our digital account services. Visa, MasterCard, American Express, Elo or other credit card companies could adopt new operating rules or reinterpret existing rules that we or our processors might find difficult or even impossible to follow. As a result, we could lose our ability to provide our customers the option of using credit cards to fund their payments and our users the option to pay their fees using a credit card. If we were unable to accept credit cards, our business would be seriously harmed. In addition, we could lose the right to accept credit cards or could be required to pay fines if credit card schemes, such as MasterCard or Visa, determine that users are using our platform to engage in illegal or “high risk” activities, or if users generate a large volume of chargebacks related to fraudulent transactions. We might not successfully implement strategies to increase adoption of our digital payment methods, which would limit our growth. Our future profitability will depend, in part, on our ability to successfully implement our strategy to increase adoption of our digital payment methods. We cannot assure you that the market for digital payments will continue to grow or will remain viable. We expect to invest substantial amounts to: • drive consumer and merchant awareness of digital payments; • encourage consumers and merchants to sign up for and use our digital payment products; • enhance our infrastructure to handle seamless processing of transactions; • continue to develop state of the art, easy-to-use technology; • expand our operations; • increase the number of users who collect and pay digitally; and • grow and diversify our customer base. Despite these investments, we may fail to implement these programs successfully or to increase substantially the number of customers who pay for our digital payment methods. This would hold back any growth in our revenues and harm our business. 22 Table of Contents If we fail to establish and maintain proper and effective internal controls over financial reporting, our results of operations and our ability to operate our business may be harmed. We are subject to the Sarbanes-Oxley Act, which requires, among other things, that we establish and maintain effective internal controls over financial reporting and disclosure controls and procedures. Under the SEC’s current rules, we have been required to perform system and process evaluation and testing of our internal controls over financial reporting to allow management to assess the effectiveness of our internal controls since 2018. Our testing may reveal deficiencies in our internal controls that are deemed to be material weaknesses or significant deficiencies and render our internal controls over financial reporting ineffective. If we are not able to comply with these requirements in a timely manner, or if we or our management identifies material weaknesses or significant deficiencies in our internal controls over financial reporting that are deemed to be material weaknesses, the market price of our Class A common shares may decline and we may be subject to investigations or sanctions by the SEC, the Financial Industry Regulatory Authority, Inc., or FINRA, or other regulatory authorities. In addition, we may be required to spend significant management time and financial resources to correct any material weaknesses that may be identified or to respond to any regulatory investigations or proceedings, which could materially adversely affect our business and results of operations. If we do not effectively and accurately meet our reporting obligations regarding nonfinancial information, including any climate-related information and ESG reporting that we provide publicly, our results of operations and our business may be adversely affected. The global financial industry has seen a significant shift towards integrating ESG considerations into business operations, driven by increasing investor and regulatory focus, and we are subject to disclosure controls and procedures, particularly in areas of financial and nonfinancial reporting (including any climate-related and ESG reporting). We are subject to various regulations adopted by the Central Bank financial institutions’ products, services and activities, as well as those of their counterparties, controlled entities, suppliers and outsourced service providers. There are still uncertainties regarding the actions required to meet climate, environmental and social goals that pose a risk to our business. If we are unable to comply with applicable reporting obligation, our results of operations and reputation may be materially adversely affected. For more information on ESG regulations applicable to us, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil.” We may incur financial and reputational losses as a result of environmental and social risks. We are subject to environmental and social risks, which may potentially affect our operations, our business activities and the revenues of our clients, especially in case of serious social and/or environmental incidents which may result in regulatory penalties or sanctions. We can be indirectly liable (jointly or severally) for providing financial support to a project or company that causes environmental damage or, for example, is found to have engaged in activities that violate human rights (such as child labor, prostitution and slavery), which could also expose us to further reputational risks. In addition, we may not only face increased compliance costs due to new regulatory initiatives related to ESG but we can also face limitations to our ability to pursue certain business opportunities. In this respect, the Central Bank determines that banks must add social and environmental aspects within the scope of an integrated risk management framework, pursuant to Resolution No. 4,557/17 as amended. Accordingly, we are required to identify, measure, evaluate, monitor, control, and mitigate social, environmental and climate risks that could represent potential losses. Moreover, we are exposed to the risk that our assessment that a product or service we provide, or an investment that we have made, is socially or environmentally responsible, will be challenged by customers, regulators or third parties. There has been increased investor and regulatory focus on ESG-related practices of financial institutions. A growing interest on the part of investors and regulators in ESG factors, and increased demand for, and scrutiny of, ESG-related disclosures by financial institutions, has likewise increased the risk that we could be perceived as, or accused of, making inaccurate or misleading statements regarding the investment strategies of our self-managed investment funds, or of our and our funds’ ESG efforts or initiatives. Such perceptions or accusations could damage our reputation, result in litigation or regulatory enforcement actions, and adversely affect our business. Climate change may have adverse effects on our business and financial condition. Climate change related risks are gaining increasing social, regulatory, economic and political relevance, both in Brazil and internationally. We are subject to physical risks and transition risks relating to climate change. Physical climate risks are those that arise from changes in weather and climate that impact the economy, including rising global average temperatures, sea level rise and acute climate risks caused by natural disasters, including but not limited to floods, droughts, fires and hurricanes, such as the flood in the State of Rio Grande do Sul in Brazil in May 2024, and the series of tornadoes that impacted southern Brazil in 2025. Such disasters could adversely affect our, our clients’ and business partners’ operations. In addition, our facilities and operations may also suffer physical damages due to severe weather events which may represent increased operational costs. Transition climate risks are those that arise from the transition to a low-carbon economy. We expect that the market may face significant and rapid developments in terms of new technologies, policy, legal and regulatory demands capable of impacting our activities and the value of our assets. Effects from both physical and transitional climate risks may also represent losses for our clients and business partners, affecting their profitability as well as their ability to fulfill their obligations. Those risks could also cause market volatility and negatively affect the trading price of Class A common shares. If we do not adequately identify and address the risks associated with climate change into our risk framework to appropriately measure, manage and disclose the various financial and operational risks that may result from climate change, or if we fail to adapt our strategy and business model to a changing regulatory and market environment, we could face a material adverse impact on our business growth rates, competitiveness, profitability, capital requirements and financial condition. 23 Table of Contents Our operating results are affected by decreases in GDP and consumer discretionary spending. Changes in macroeconomic conditions may reduce the volume and prices of transactions on our payments platforms and harm our growth strategies and business prospects and, accordingly, adversely affect the trading price of our Class A common shares. Our results of operations are mainly affected by the macroeconomic conditions in Brazil and in the other countries in the region where we operate (Chile, Colombia, Mexico and Peru). Our results of operations are also affected by macroeconomic conditions globally. Our business and financial performance may be harmed by current and future economic conditions that cause a decline in business and consumer spending, including a reduction in the availability of credit, increased unemployment levels, higher energy and fuel costs, rising interest rates, financial market volatility, and recession. At the end of 2020 and especially during the beginning of 2021, government stimulus packages, credit growth, and the gradual reopening of the retail and services industries allowed the economy to recover, particularly at the end of 2021 after a successful vaccination campaign against COVID-19, leading to GDP growth of 5.0% in 2021. In 2022, the GDP increased 2.9% primarily due to the services sector. In 2023, Brazil registered a 2.9% GDP growth, mainly driven by the agricultural sector. In 2024, Brazil registered a 3.4% GDP growth, mainly driven by services and household consumption. In 2025, Brazil’s GDP grew 2.3%, reflecting a deceleration in economic activity amid tighter financial conditions and structural constraints. Growth is limited by inadequate infrastructure, including potential energy shortages and deficient transportation, logistics and telecommunication sectors, the lack of a qualified labor force, and the lack of private and public investments in these areas, which limit productivity and efficiency. Any of these factors could lead to labor market volatility and generally impact income, purchasing power and consumption levels, which could limit growth and ultimately have a material adverse effect on us. Furthermore, geopolitical instability arising from conflicts, such as the recent conflict in the Middle East and the ongoing war in Ukraine, and the resulting imposition of sanctions, taxes or tariffs against Russia and its response to such sanctions (including retaliatory acts, such as cyberattacks and sanctions against other countries) as well as recently imposed tariffs by the U.S. government on products from other countries and their reactions to the tariffs could adversely affect the global economy or specific international, regional and domestic markets, including the Brazilian market. Those events could have an adverse effect on our business and financial performance through increased worldwide inflation, greater compliance costs, higher volatility in foreign currency exchange rates, destabilized supply chains and further market disruptions, including cyberattacks targeting technologies that we rely on or the markets in which we or our customers operate. The IMF in its January 2026 World Economic Outlook projected a 3.3% GDP global growth in 2026 and 3.2% in 2027. In this recent study, the IMF indicated that, “technology investment, fiscal and monetary support, accommodative financial conditions, and private sector adaptability offset trade policy shifts. Global inflation is expected to fall, but U.S. inflation will return to target more gradually. Key downside risks are reevaluation of technology expectations and escalation of geopolitical tensions.” Policy-driven disruptions to the disinflation process could stall the shift toward monetary easing, impacting fiscal sustainability and financial stability. Addressing these risks demands a careful policy approach to balance inflation and economic activity, rebuild buffers, and enhance medium-term growth through structural reforms and stronger multilateral cooperation. Due to the inherent uncertainty in the Brazilian domestic and the international economy, and the challenges facing existing levels of globalization that connects markets globally, any of the foregoing could adversely affect the financial services sector and, consequently, our business, results of operations and financial condition, and could cause the trading price of our Class A common shares to decline. A failure to comply with export controls or economic sanctions laws and regulations could have a material adverse impact on our results of operations, financial condition and reputation. We face risks related to compliance with export controls (which can apply to software and technology) and economic sanctions laws and regulations, including those administered by the United Nations, the European Union and the United States, including the U.S. Treasury Department’s Office of Foreign Assets Control. Sanctions, export controls and other restrictive measures administered or enforced by the United States, including but not limited to the ongoing U.S. Trade Representative’s investigation into Brazil’s trade practices, may apply not only to foreign jurisdictions but also to persons or entities located in, or associated with, such jurisdictions, including through programs with extraterritorial reach, such as those adopted pursuant to the Global Magnitsky Human Rights Accountability Act and related executive orders involving certain Brazilian parties. Compliance with such measures may restrict or prohibit certain financial transactions, require changes to our business practices and increase regulatory, operational and compliance costs. Moreover, U.S. sanctions requirements may conflict with or differ from applicable Brazilian or other jurisdiction’s laws or governmental directives. Conflicting legal obligations between Brazilian, U.S. and other foreign laws and regulations could create significant uncertainty to the regulatory environment in which we operate. We may not be successful in ensuring compliance with limitations or restrictions on business with companies in any sanctioned countries and/or other sanctions targets, and we could potentially become targeted by sanctions as a result of such business even where such business was conducted in compliance with applicable laws and regulations. If we are found to be in violation of applicable sanctions or export controls laws or regulations or to have engaged in sanctionable conduct, we may face criminal or civil fines or other penalties, suffer reputational harm and our results of operations and financial condition may be adversely affected. Additionally, there can be no assurance that our employees, directors, officers, partners or any third parties that we do business with, including, among others, any distributors or suppliers, will not violate sanctions or export controls laws and regulations or engage in sanctionable conduct. We may ultimately be held responsible for any such violation of sanctions or export controls laws and regulations, or sanctionable conduct, by these persons, which could result in criminal or civil fines or other penalties, have a material adverse impact on our results of operations and financial condition and damage our reputation. 24 Table of Contents Customer complaints or negative publicity about our customer service could reduce usage of our products and, as a result, our business could suffer. Customer complaints or negative publicity about our customer service could severely diminish consumer confidence in and use of our products. Breaches of our customers’ privacy and our security measures could have the same effect. Measures we sometimes take to combat risks of fraud and breaches of privacy and security, such as freezing customer funds, can damage relations with our customers. These measures heighten the need for prompt and accurate customer service to resolve irregularities. Effective customer service requires significant expenses, which, if not managed properly, could affect our profitability significantly. Any inability by us to manage or train our customer service representatives properly could compromise our ability to handle customer complaints effectively. If we do not handle customer complaints effectively, our reputation may suffer and we may lose our customers’ confidence. We are susceptible to illegal or improper uses of our platform, which could expose us to additional liability and harm our business. We, like our platforms, are susceptible to potentially illegal or improper uses. These may include illegal online gambling, fraudulent sales of goods or services, illicit sales of prescription medications or controlled substances, software and other intellectual property piracy, money laundering, bank fraud, cyberattacks, child pornography, trafficking, terrorist financing, prohibited sales of alcoholic beverages and tobacco products and online securities fraud. The owners of intellectual property rights or government authorities may seek to bring legal action against us if our platform is used for the sale of infringing items. These claims could result in reputational harm and any resulting liabilities, loss of transaction volume or increased costs could harm our business. In addition, our services could be subject to unauthorized credit card use, identity theft, employee fraud or other internal security breaches. We may incur significant costs to protect against the threat of information security breaches or to respond to or alleviate problems caused by any breaches. Laws may require us to notify regulators, customers or employees of security breaches and we may be required to reimburse customers or banks for any funds stolen because of any breaches or to provide credit monitoring or identity theft protection in the event of a privacy breach. These requirements, as well as any additional restrictions that may be imposed by credit card companies, could raise our costs significantly and reduce our attractiveness. In addition to the direct costs of such losses, if they are related to credit card transactions and become excessive, they could result in us losing the right to accept credit cards for payment. Since credit cards are the most widely used method for our customers to pay for the products we sell, our business will be harmed if we are unable to accept credit cards. Unauthorized disclosure of sensitive or confidential customer information or our failure or the perception by our customers that we failed to comply with privacy laws or properly address privacy concerns could harm our business and standing with our customers. We collect, store, process, and use certain personal information and other user data in our business. A significant risk associated with e-commerce and communications is the secure transmission of confidential information over public networks. The perception of privacy concerns, whether or not valid, may harm our business and results of operations. We must ensure that all processing, collection, use, storage, dissemination, transfer and disposal of data for which we are responsible comply with relevant data protection and privacy laws. The protection of our customer, employee and company data is critical to us. Currently, a number of our users authorize us to bill their credit card as well as bank and payment accounts directly. We rely on commercially available systems, software, tools and monitoring to provide secure processing, transmission and storage of confidential customer information, such as credit card and other personal information. Despite the security measures we have in place, our facilities and systems, and those of our third-party service providers, may be vulnerable to security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors, or other similar events. For example, in 2021, we experienced a cyberattack that targeted our subsidiary MOIP, which was disclosed to the ANPD and considered a closed matter in February 2024. For more information about that incident, see “—Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches.” We continue to monitor and review, on an ongoing basis, our IT systems, policies and security in an effort to avoid or remedy weaknesses, vulnerabilities or deficiencies. For more information, see “Item 4B. Business Overview—Protecting Our Clients—2021 MOIP Cybersecurity Incident.” Any future security breach, or any perceived failure involving the misappropriation, loss or other unauthorized disclosure of confidential information, as well as any failure or perceived failure to comply with laws, policies, legal obligations or industry standards regarding data privacy and protection, whether by us or our vendors, could damage our reputation, expose us to litigation risk and liability, subject us to negative publicity, disrupt our operations and harm our business. Our security measures and remedial actions to address past cyberattacks may fail to prevent future security breaches, which could harm our business and financial results. We have only a limited ability to protect our intellectual property rights, which are important to our success. We believe the protection of our intellectual property, including our trademarks, patents, copyrights, domain names, trade dress, and trade secrets, is critical to our success. We seek to protect our intellectual property rights by relying on applicable laws and regulations, as well as a variety of administrative procedures. We also rely on contractual restrictions to protect our proprietary rights when offering or procuring products and services, including confidentiality agreements with parties with whom we conduct business. 25 Table of Contents However, contractual arrangements and other steps we have taken to protect our intellectual property may not prevent third parties from infringing or misappropriating our intellectual property or deter independent development of equivalent or superior intellectual property rights by others. Trademark, copyright, patent, domain name, trade dress and trade secret protection are expensive to maintain and may require litigation. Protecting our intellectual property rights and other proprietary rights is expensive and time-consuming and may not be successful in every jurisdiction. Also, we may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. We have licensed certain of our proprietary rights, such as trademarks or copyrighted material, to others in the past, and expect to do so in the future. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation. Any failure to protect or enforce our intellectual property rights adequately, or significant costs incurred in doing so, could materially harm our business. As the number of products in the software industry increases and the functionalities of these products further overlap, and as we acquire technology through acquisitions or licenses, we may become increasingly subject to infringement claims, including patent, copyright, and trademark infringement claims. We may be required to enter into litigation to determine the validity and scope of the patents or other intellectual property rights of others. The ultimate outcome of any allegation is uncertain and, regardless of the outcome, any such claim, with or without merit, may be time-consuming, result in costly litigation, divert management’s time and attention from our business, require us to stop selling, delay shipping, or redesign our products, or require us to pay substantial amounts to satisfy judgments or settle claims or lawsuits or to pay substantial royalty or licensing fees, or to satisfy indemnification obligations that we have with some of our customers. Our failure to obtain necessary license or other rights, or litigation or claims arising out of intellectual property matters, may harm our business. If we continue to grow, we may not be able to appropriately manage the increased size of our business. We are currently experiencing a period of significant expansion and anticipate that further expansion will be required to address potential growth in our customer base and market opportunities. We must constantly add new hardware, update software, enhance and improve our billing and transaction systems, and add and train new engineers and other personnel to accommodate the increased use of our platforms and the new products and features we regularly introduce. This upgrade process is expensive, and the increasing complexity and enhancement of our website and mobile app results in higher costs. Failure to upgrade our technology, features, transaction processing systems, security infrastructure, or network infrastructure and customer channels or interfaces to accommodate increased traffic or transaction volume could harm our business. Adverse consequences could include unanticipated system disruptions, slower response times, degradation in levels of customer support, impaired quality of users’ experiences of our services and delays in reporting accurate financial information. Our revenues depend on prompt and accurate transaction processes. Our failure to grow our transaction-processing capabilities to accommodate the increasing number of transactions that must be billed on our website would harm our business and our ability to collect revenue. Furthermore, we may need to enter into relationships with various strategic partners, websites and other online service providers and other third parties necessary to our business. The increased complexity of managing multiple commercial relationships could lead to execution problems that can affect current and future revenues, and operating margins. We cannot assure you that our current and planned systems, procedures and controls, personnel and third-party relationships will be adequate to support our future operations. Our failure to manage growth effectively could seriously harm our business, results of operations and financial condition. BancoSeguro, PagSeguro Brazil and PagInvest may have insufficient capital to meet the capital requirements of the CMN and the Central Bank and other regulations. Brazilian financial and payment institutions must comply with the rules of the CMN and the Central Bank on capital adequacy, including minimum capital, which generally follow the Basel III regulatory framework. We cannot guarantee that our affiliates BancoSeguro, PagSeguro Brazil and PagInvest, upon increasing their operations, will have sufficient funds or resources available for their respective capitalization in the future, which could result in their inability to meet the capital adequacy requirements of the CMN and the Central Bank. In addition, non-compliance with capital adequacy requirements may adversely affect the ability of these affiliates to distribute dividends and interest on equity to shareholders and may adversely affect their ability to operate and lend, which could cause these affiliates to sell their respective assets or take other measures that may adversely affect our operating results and financial condition. If any of BancoSeguro, PagSeguro Brazil or PagInvest were not able to comply with these capital adequacy requirements, regulators may impose sanctions, including administrative proceedings, fines, disqualification of directors and even withdrawal of authorization, which could have a material adverse effect on our operations and financial condition. Moreover, the Central Bank enacted a set of new rules applicable to payment institutions, increasing the capital and prudential requirements to which we are subject. This framework includes Central Bank Resolutions No. 198 of 2022, 199 of 2022, 200 of 2022, 201 of 2022 and 202 of 2022, all issued on March 11, 2022. and Resolution 436 of 2024, issued on November 28,2024. The new prudential requirements came into effect as of January 2025. We may be subject to stricter prudential requirements as a result of this new regulatory framework. 26 Table of Contents Under these rules, certain Brazilian operating entities in our Group structure composed of BancoSeguro, PagSeguro Brazil and PagInvest, are classified as a Type 3 conglomerate within the S3 prudential segment, which is defined as a prudential conglomerate led by a payment institution and integrated by a financial institution or other institution authorized to operate by the Central Bank subject to Law No. 4,595 of 1964. For additional information, see “Item 4B.—Business Overview—Regulation of the Payments and Banking Industries in Brazil—Developments in the Regulation of the Brazilian Banking and Payments Industries.” If any of BancoSeguro, PagSeguro Brazil, MOIP or PagInvest are not able to comply with regulatory capital requirements, the Central Bank may impose sanctions, which could have a significant adverse effect on our operations and financial condition. BancoSeguro’s, PagSeguro Brazil’s and PagInvest’s businesses are highly regulated and changes in regulation may affect our results and the development of our activities. We are subject to regulations applicable to financial institutions in Brazil, such as, but not limited to: restrictions on credit card; lending limits, earmarked lending and other credit restrictions; restrictions on remittances abroad and other exchange controls; limitations on charging of commissions and fees by financial institutions for services to retail clients and the amount of interest financial institutions can charge; and accounting and statistical requirements. The Brazilian government has historically implemented or modified regulations that affect Brazilian financial institutions and payment institutions as part of its economic policy implementation. Such regulations are continuously modified by the Brazilian government to control credit availability and to reduce or increase consumption, among other objectives. Some of these controls are temporary in nature and may be modified from time to time in accordance with Brazilian government credit policies. Other controls have been introduced and have either remained stable or were gradually reduced. Such changes may adversely affect the future operations and revenues of BancoSeguro, PagSeguro Brazil, or PagInvest, and consequently, our overall future operations and revenues. The growth of our credit portfolio of transactions through BancoSeguro could increase the default rates in our total portfolio, and the systems and methods of identification, analysis, management and control of risks related to our customer portfolio could be insufficient to prevent losses. BancoSeguro may expand its credit portfolio of transactions, increasing the origination and approval of new transactions, which could lead to an increase in late payments, default rates and expenses related to provisions, which would negatively affect our results of operations. Changes in interest rates and other variable market indexes could negatively affect our financial results. Our success depends on, among other factors, the balance between the risks and returns. We conduct credit checks on each of our customers to assess their risk profile, but we cannot assure you that our risk management systems will be sufficient to prevent losses from undetected risks in our customer portfolio, which could have a material adverse effect on our results of operations and financial condition. Our financial success is sensitive to the method consumers choose to make payments, since these methods differ in profitability. Our profitability could be harmed if there is an increase in the proportion of our business funded using less profitable methods. In connection with our acquiring business, we pay transaction fees to card schemes, banks and other intermediaries that vary according to the method chosen by consumers to fund payment transactions. These transaction fees are higher when consumers fund payments using credit cards, and lower when consumers fund payments with debit cards. Transaction fees are nominal when customers fund payment transactions by digital transfer of funds from bank accounts, and we pay no fees when customers fund payment transactions from an existing PagBank account balance. Our financial success is therefore sensitive to changes in the proportion of our business funded by consumers using credit, debit and prepaid cards, which would increase our costs if we were unable to adjust the rates we charge our customers accordingly. Consumers may resist funding payments by digital transfers from bank accounts because of the incentives offered by credit cards, for example, or general concerns about providing bank account information to a third party. In connection with our issuing business, we earn interchange revenues that vary according to the type of card that we issue to our customers (a credit, debit or prepaid card). These interchange fees are subject to the terms defined by the card schemes, and in certain cases, these fees may also be subject to terms defined by regulators. Thus, our business and financial condition may be negatively affected by the terms of interchange fees established by card schemes and regulators. As our payments ecosystem, merchant services and banking solutions include both acquiring and issuing business activities, changes in interchange rates that may negatively affect one side of our business may also positively affect the other side of our business. However, we cannot ensure that this correlation will offset a negative overall impact on our business and financial condition because of such variations in interchange rates and payment methods utilization mix. 27 Table of Contents We may face restrictions and penalties under the Brazilian Consumer Protection Code. Brazil has a series of strict consumer protection laws, referred to together as the Brazilian Consumer Protection Code. These laws apply to all companies in Brazil that supply products or services to Brazilian consumers. They include protection against misleading and deceptive advertising, protection against coercive or unfair business practices and protection in the formation and interpretation of contracts, usually in the form of civil liabilities and administrative penalties for violations. These penalties are often levied by the Brazilian Consumer Protection Agencies (Fundação de Proteção e Defesa do Consumidor), or PROCONs, which oversee consumer issues on a district-by-district basis. Companies that operate across Brazil may face penalties from multiple PROCONs, as well as from the National Secretariat for Consumers (Secretaria Nacional do Consumidor), or SENACON. Companies may settle claims made by consumers via PROCONs by paying compensation for violations directly to consumers and through a mechanism that allows them to adjust their conduct, called a conduct adjustment agreement (Termo de Ajustamento de Conduta), or TAC. Brazilian Public Prosecutors may also commence investigations of alleged violations of consumer rights, and the TAC mechanism is also available as a sanction in those proceedings. Companies that violate TACs face potential automatic fines. Brazilian Public Prosecutors may also file public civil actions against companies who violate consumer rights, seeking strict observation of the consumer protection laws and compensation for any damages to consumers. As of December 31, 2025, we had approximately 31,203 active judicial proceedings and proceedings with PROCONs and small claims courts relating to consumer rights. Most of these proceedings are related to consumer allegations of non-delivery of products by merchants and requests for withdrawal of digital account balances that were blocked by PagSeguro because they were under investigation for fraud or undergoing claim resolution. To the extent consumers file such claims against us, we may be required to pay fines for non-compliance that could have a negative impact on our results of operations. We are subject to regulatory activity and antitrust litigation under competition laws. We receive scrutiny from various governmental agencies under competition laws. Other companies or governmental agencies may allege that our actions violate antitrust or competition laws, or otherwise constitute unfair competition. Contractual agreements with buyers, sellers, or other companies could give rise to regulatory action or antitrust investigations or litigation. Also, our unilateral business practices could give rise to regulatory action or antitrust investigations or litigation. Any such claims and investigations, even if they are unfounded, are usually very expensive to defend, involve negative publicity and substantial diversion of management time and effort, and could result in significant judgments against us. Unfavorable outcomes in litigation or our inability to post judicial collateral or provide guarantees in pending legal or administrative proceedings could have a material adverse effect on our business, financial condition and results of operations. We are defendants in a significant number of judicial proceedings, including indemnity, labor and tax proceedings. As of December 31, 2025, we have recorded R$87.3 million in provisions for current civil and labor proceedings and R$121.3 million in provisions for non-current proceedings. As of December 31, 2025, we have identified civil lawsuits classified as a possible risk, as detailed in note 21 to our financial statements. These lawsuits primarily concern customer complaints involving non-delivery of products by merchants, refusals to withdraw funds from digital accounts, and reports of defects in POS terminals. Management regularly monitors these claims and understands that, while some situations have occurred that represent a possible risk, there is currently no expectation of losses. We cannot guarantee that such proceedings will have favorable outcomes for us or that the provisions made will be sufficient to pay any amounts due. Any proceedings that require us to make substantial payments, affect our reputation or otherwise interfere with our business operations could have a material adverse effect on our business, financial condition and operating results. Additionally, we may not have sufficient funds to post collateral or provide guarantees in judicial or administrative proceedings that claim substantial amounts. Even if we do not post such collateral or provide guarantees, we will be liable for paying any amounts due pursuant to any unfavorable outcomes in legal proceedings. We cannot assure you that, if we cannot make such payments, our assets, including financial assets, will not be attached, or that we will be able to obtain tax good standing certificates, all of which may have a material adverse effect on our business, financial condition and results of operations. We may pursue strategic acquisitions or investments. The failure of an acquisition or investment to produce the anticipated results, or the inability to successfully integrate an acquired company, could harm our business. We may occasionally acquire or invest in complementary companies or businesses. The success of an acquisition or investment will depend on our ability to make accurate assumptions regarding the valuation, operations, growth potential, integration and other factors related to that business. We cannot assure you that our acquisitions or investments will produce the results that we expect at the time we enter into or complete a given transaction. Furthermore, acquisitions may result in difficulties integrating the acquired companies, and may result in the diversion of our capital and our management’s attention from other business issues and opportunities. We may not be able to successfully integrate the operations that we acquire, including their personnel, financial systems, distribution or operating procedures. If we fail to integrate acquisitions successfully, our business could suffer. In addition, the expense of integrating any acquired business and their results of operations may negatively impact our operating results. 28 Table of Contents Our developer platforms, which are open to merchants and third-party developers, subject us to additional risks. We provide third-party developers with access to application programming interfaces, or APIS, software development kits and other tools designed to allow them to produce applications for use, with a particular focus on mobile applications. There can be no assurance that merchants or third-party developers will develop and maintain applications and services on our open platforms on a timely basis or at all. A number of factors could cause them to curtail or stop development for our platforms. In addition, our business is subject to many regulatory restrictions, and violations related to our developer platforms could negatively affect our operations and financial results. We are a holding company and do not have any material assets other than the shares of our subsidiaries. We are a Cayman Islands exempted company with limited liability. Our material assets are our direct and indirect equity interests in our subsidiaries, particularly PagSeguro Brazil, our Brazilian operating company. We are, therefore, dependent upon payments, dividends and distributions from our subsidiaries for funds to pay our operating and other expenses and to pay future cash dividends or distributions, if any, to holders of our Class A common shares or Class B common shares, and we may have tax costs in connection with any dividend or distribution. Furthermore, exchange rate fluctuations will affect the U.S. dollar value of any distributions our subsidiaries make with respect to our equity interests in those subsidiaries. See “—Risks Relating to Brazil—The Brazilian government has exercised, and continues to exercise, significant influence over the Brazilian economy. This influence as well as Brazil’s political and economic conditions may adversely affect us and the price of our Class A common shares,” “—Risks Relating to Our Class A Common Shares—We have not adopted a dividend policy with respect to future dividends. If we do not declare any dividends in the future, you will have to rely on price appreciation of our Class A common shares in order to achieve a return on your investment” and “Item 10B. Memorandum and Articles of Association—Dividends and Capitalization of Profits.” The outbreak of communicable diseases around the world led and could lead to higher volatility in the global capital markets, adversely affecting our business operations and the trading price of our Class A common shares. The outbreak of communicable diseases, such as the COVID-19 pandemic, and governmental responses thereto had a severe impact on global and Brazilian macro-economic and financial conditions, including the disruption of supply chains and the closures or interruptions of many businesses, leading to losses of revenues, increased unemployment and economic stagnation and contraction. The COVID-19 pandemic also resulted in materially increased volatility in both Brazilian and international financial markets and economic indicators, including exchange rates, interest rates and credit spreads. Stock markets experienced significant volatility caused by investors’ reactions to the uncertainty related to the COVID-19 pandemic in the global economy and the recessionary effect. Stock markets indices around the globe dropped sharply from January 1, 2020, to March 31, 2020, and the trading price of our shares was also adversely affected. Measures that may be taken by governmental authorities worldwide, including in Brazil, to stabilize markets and support economic growth in the event of an outbreak of an epidemic or pandemic may not be sufficient to control volatility or to prevent serious and prolonged reductions in economic activity. These measures may have adverse macroeconomic effects and negatively influence the behavior of the consumer market and the population in general. The effects of an outbreak of an epidemic or pandemic on our business will depend on, among other factors, the ultimate geographic spread of the disease, the duration of the outbreak and the extent and overall economic effects of the governmental response to it. Our net sales could be significantly reduced to the extent that an epidemic or pandemic harms the economy of Brazil or any other jurisdictions where we operate or may operate in the future. Our operations could also be severely disrupted if our customers, merchants or other participants are affected by such epidemics or pandemic. In addition, the effects of the outbreak may exacerbate the effects of the other risk factors disclosed in this section of this annual report, including potential effects on the price and performance of our Class A common shares. Our historical loan losses may not be indicative of future loan losses and changes in our business may adversely affect the quality of our loan portfolio. Our historical loan loss experience may not be indicative of our future loan losses. The quality of our loan portfolio is associated with the default risk of our clients and the sectors in which we operate. Thus, changes in our business, expansion of our loan portfolio to new sectors and clients with higher default risk may materially adversely affect the quality of our loan portfolio. In addition, changes in the Brazilian economic and political conditions, an increase in market competition, changes in regulation and in the tax regimes applicable to the sectors in which we operate and other related changes in countries in which we operate and in the international economic conditions, may also adversely affect the quality of our loan portfolio. Adverse changes affecting any large clients or the sectors to which we have significant lending exposure may have a material adverse impact on our business and our results of operations. Our results of operations and financial condition depend on our ability to evaluate losses associated with the risks to which we are exposed. We recognize an allowance for loan losses based on our current assessment and expectations regarding various factors that affect the quality of our loan portfolio. We cannot guarantee that our assessment will result in fully sufficient provisions for the risks we are exposed to. If we are unable to control or reduce the level of nonperforming or low-quality loans, we may be adversely affected. 29 Table of Contents Default by other financial institutions may adversely affect the financial markets in general and us. The safety and soundness of several financial institutions may be closely related as a result of credit, negotiation, settlement or other transactions among financial institutions. Accordingly, concerns regarding the default of a financial institution could cause significant liquidity problems, losses and/or default by other financial institutions. This systemic risk may adversely affect financial intermediaries, including clearing agencies, clearing houses, banks, securities companies and stock exchanges with which we interact daily, including us. If the Central Bank intervenes any other relevant Brazilian financial institution, we, together with other financial institutions, may be subject to deposit withdrawals and decreases in investments, which could adversely affect us. We may incur losses associated with counterparty exposure risks. We routinely conduct transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. We may incur losses if any of our counterparties fail to honor their contractual obligations, including as a result of bankruptcy, lack of liquidity, operational failure or other reasons outside our control. This risk may arise, for example, from our entering into reinsurance agreements or credit agreements pursuant to which counterparties have obligations to make payments to us and are unable to do so, or from our carrying out transactions in the foreign currency market (or other markets) that fail to be settled at the specified time due to non-delivery by the counterparty, clearing house or other financial intermediary. Any failure by a counterparty to meet its contractual obligations may adversely affect our financial performance. We face risks relating to liquidity of our capital resources. Liquidity risk, as we understand it, is the risk that we will not have sufficient financial resources to meet our obligations by the respective maturity dates or that we will honor such obligations but at an excessive cost. This risk is inherent in the activities of any financial institution. Our capacity and cost of funding, including the availability of retail deposits, may be impacted by several factors, such as changes in market conditions (e.g., in interest rates), credit supply, regulatory changes, systemic shocks in the banking sector, and changes in the market’s perception of us, among other factors. The occurrence of any of these factors could materially adversely affect our financial position and results of operations, including by increasing the amount of retail deposit withdrawals by our customers in a short period of time. In scenarios where access to funding is scarce and/or becomes too expensive, and the access to capital markets is either not possible or is limited, we may have to increase the return rate paid to deposits made to attract more clients and/or to settle assets not compromised and/or potentially devalued so that we will be able to meet our obligations. If the market liquidity is reduced, the demand pressure may have a negative impact on prices, since natural buyers may not be immediately available. Should this happen, we may have a significant decrease in the value of the assets, which will impact our results and financial position. The persistence or worsening of such adverse market conditions or rises in basic interest rates may have a material adverse impact on our capacity to access capital markets and on our cost of funding, which may adversely affect our results of operation and financial condition. Internet regulation in Brazil is recent and still limited and several legal issues related to the internet are uncertain. In 2014, Brazil enacted Law No. 12,965/2014, known as the Brazilian Civil Rights Framework for the Internet, setting forth principles, guarantees, rights and duties for the use of the internet in Brazil, including provisions about internet service provider liability, internet user privacy and internet neutrality. In May 2016, further regulations were passed in connection with the Brazilian Civil Rights Framework for the Internet. However, unlike in the United States, little case law exists around the Brazilian Civil Rights Framework for the Internet and existing jurisprudence has not been consistent. In June 2025, Brazil’s Supreme Federal Court (Supremo Tribunal Federal), or STF, held unconstitutional the rule under the Brazilian Civil Rights Framework for the Internet that requires noncompliance with a specific court order as a prerequisite for holding internet application providers civilly liable for damages caused by content published by third parties. This holding by STF increases liability risks for online platforms operating in Brazil for user-generated content in certain specific circumstances, which could materially adversely affect us. 30 Table of Contents Risks Relating to Our Class A Common Shares UOL, our largest shareholder, owns 100% of our outstanding Class B common shares, which represent approximately 88.74% of the voting power of our issued share capital, and controls all matters requiring shareholder approval. This concentration of ownership and voting power limits your ability to influence corporate matters. Our Class B common shares are entitled to 10 votes per share and our Class A common shares are entitled to one vote per share. Our Class B common shares are convertible into an equivalent number of Class A common shares and generally convert into Class A common shares upon transfer subject to limited exceptions. UOL controls our company and holds all of our outstanding Class B common shares, representing 42.72% of our issued share capital. As of March 31, 2026, UOL also held 3,718,313 of our outstanding Class A common shares. Because of the ten-to-one voting ratio between our Class B common shares and Class A common shares, these Class B common shares give UOL approximately 88.74% of the voting power of our issued share capital. UOL therefore controls the outcome of all decisions at our shareholders’ meetings, and is able to elect a majority of the members of our board of directors. It is also able to direct our actions in areas such as business strategy, financing, distributions, acquisitions and dispositions of assets or businesses. UOL’s decisions on these matters may be contrary to your expectations or preferences, and it may take actions that could be contrary to your interests. It will be able to prevent any other shareholders, including you, from blocking these actions. For further information regarding shareholdings in our company, see “Item 7A. Major Shareholders.” If UOL sells or transfers any of its Class B common shares, they will generally convert automatically into Class A common shares, subject to limited exceptions, such as transfers to affiliates, to trustees for the holder or its affiliates and certain transfers to U.S. tax-exempt organizations. The fact that any Class B common shares convert into Class A common shares if UOL sells or transfers them means that UOL will in many situations continue to control a majority of the combined voting power of our outstanding share capital, due to the voting rights of any Class B common shares that it retains. If our Class B common shares at any time represent less than 10% of the combined voting power of our Class A common shares and Class B common shares together, however, the Class B common shares then outstanding will automatically convert into Class A common shares. For a description of the dual class structure, see “Item 10B. Memorandum and Articles of Association.” Class A common shares eligible for future sale may cause the market price of our Class A common shares to drop significantly. The market price of our Class A common shares may decline because of sales of a large number of our Class A common shares in the market (including Class A common shares issuable upon conversion of Class B common shares) or the perception that these sales may occur. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate. As of Mach 31, 2026, we have outstanding 170,218,201 Class A common shares (including treasury shares) and 120,459,508 Class B common shares. All Class B common shares are beneficially owned by UOL. Our shareholders or entities controlled by them or their permitted transferees are able to sell their shares in the public market from time to time without registering them, subject to certain limitations on the timing, amount and method of those sales imposed by regulations promulgated by the SEC. If any of our shareholders, the affiliated entities controlled by them or their respective permitted transferees were to sell a large number of their Class A common shares, the market price of our Class A common shares may decline significantly. In addition, the perception in the public markets that sales by them might occur may also cause the trading price of our Class A common shares to decline. We have not adopted a dividend policy with respect to future dividends. If we do not declare any dividends in the future, you will have to rely on price appreciation of our Class A common shares in order to achieve a return on your investment. We have not adopted a dividend policy with respect to future dividends. The amount of any distributions will depend on many factors such as our results of operations, financial condition, cash requirements, prospects and other factors deemed relevant by our board of directors or, where applicable, our shareholders. Accordingly, if we do not declare dividends in the future, investors will most likely have to rely on sales of their Class A common shares, which may increase or decrease in value, as the only way to realize cash from their investment. There is no guarantee that the price of our Class A common shares will ever exceed the price that you pay. We may raise additional capital in the future by issuing equity securities, which may result in a potential dilution of your equity interest. We may issue additional equity securities to raise capital, make acquisitions, or for a variety of other purposes. Additional issuances of our shares may be made pursuant to the exercise or conversion of convertible debt securities, warrants, stock options or other equity incentive awards, which may occur pursuant to our LTIP-Goals. Any strategic partnership, issuance or placement of shares or securities convertible into or exchangeable for shares may affect the market price of our shares and could result in dilution of your equity interest. 31 Table of Contents If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, the market price and trading volume of our Class A common shares could decline. The trading market for our Class A common shares depends in part on the research and reports that securities or industry analysts publish about us or our business. If one or more of the analysts who cover us downgrade our stock or publish inaccurate or unfavorable research about our business, our stock price would likely decline. If one or more of these analysts cease coverage of our company or fail to publish reports on us regularly, demand for our Class A common shares could decline, which might cause the market price and trading volume of our Class A common shares to decline. Our dual class capital structure means our shares will not be included in certain indices. We cannot predict the impact this may have on our stock price. In 2017, certain major index providers announced changes to their eligibility criteria, excluding companies with multiple classes of common stock, such as ours, from certain indices. These changes included requirements related to voting rights and the treatment of multi-class structures. We cannot assure you that other index providers or market participants will not adopt similar policies in the future. Exclusion from key indices could reduce demand for our Class A common shares, limit liquidity, and make our shares less attractive to investors, which could adversely affect the market price of our class A common shares. We are a Cayman Islands exempted company with limited liability. The rights of our shareholders may be different from the rights of shareholders governed by the laws of U.S. jurisdictions. We are a Cayman Islands exempted company with limited liability. Our corporate affairs are governed by our Memorandum and Articles of Association of the Cayman Islands. The rights of shareholders and the responsibilities of members of our board of directors may be different from the rights of shareholders and responsibilities of directors in companies governed by the laws of U.S. jurisdictions. In the performance of its duties, the board of directors of a solvent Cayman Islands exempted company is required to consider the company’s interests, which is generally defined with reference to the interests of its shareholders (both present and future) as a whole, which may differ from the interests of one or more of its individual shareholders. See “Item 10B. Memorandum and Articles of Association—Principal Differences between Cayman Islands and U.S. Corporate Law.” The Cayman Islands, together with several other non-European Union jurisdictions, have introduced legislation aimed at addressing concerns raised by the Organisation for Economic Co-operation and Development’s (OECD) Base Erosion and Profit Shifting (BEPS) initiative as to offshore structures engaged in certain activities which attract profits without real economic activity. The Economic Substance Act contains economic substance requirements for in-scope Cayman Islands entities which are engaged in certain “relevant activities.”As we are a Cayman Islands company, our compliance obligations will include filing an annual notification, which need to state whether we are carrying out any relevant activities and if so, whether we have satisfied economic substance tests to the extent required under the Economic Substance Act. If the Cayman Islands Tax Information Authority determines that the Company or any of its Cayman Islands subsidiaries has failed to meet the requirements imposed by the Economic Substance Act the Company may face significant financial penalties, restriction on the regulation of its business activities and/or may be struck off as a registered entity in the Cayman Islands. As it is still a relatively new regime, it is anticipated that the Economic Substance Act and associated guidance will evolve and may be subject to further clarification and amendments. We may need to allocate additional resources to keep updated with these developments, and may have to make changes to our operations in order to comply with all requirements under the Economic Substance Act. Failure to satisfy these requirements may subject us to penalties under the Economic Substance Act. Our shareholders may face difficulties in protecting their interests because we are a Cayman Islands exempted company. Our corporate affairs are governed by our Memorandum and Articles of Association, and by Cayman Islands law including, without limitation, the Companies Act and the common law of the Cayman Islands. The rights of our shareholders and the fiduciary responsibilities of our directors under the laws of the Cayman Islands are not as clearly defined as under statutes or judicial precedent in existence in jurisdictions in the United States. Therefore, you may have more difficulty protecting your interests than would shareholders of a corporation incorporated in a jurisdiction in the United States, due to the comparatively less prescriptive nature of Cayman Islands law in this area. Cayman Islands statutory law in respect of schemes of arrangement does not specifically provide for shareholder appraisal rights in connection with a court sanctioned reorganization (by way of scheme of arrangement). This may make it more difficult for you to assess the value of any consideration you may receive in a merger or consolidation (which is affected by way of scheme of arrangement) or to require that the acquirer gives you additional consideration if you believe the consideration offered is insufficient. However, in respect of a merger or consolidation (which is not affected by way of scheme of arrangement), Cayman Islands statutory law, which permits a merger/consolidation without a court order, provides a mechanism for a dissenting shareholder in a merger or consolidation to require us to apply to the Grand Court of the Cayman Islands for a determination of the fair value of the dissenter’s shares if it is not possible for the company and the dissenter to agree on a fair price within the time limits prescribed. 32 Table of Contents Shareholders of Cayman Islands exempted companies (such as us) have no general rights under Cayman Islands law to inspect corporate records and accounts or to obtain copies of lists of shareholders. Our directors have discretion under our Articles of Association to determine whether, and under what conditions, our corporate records may be inspected by our shareholders, but are not obliged to make them available to our shareholders. This may make it more difficult for you to obtain information needed to establish any facts necessary for a shareholder motion or to solicit proxies from other shareholders in connection with a proxy contest. Subject to limited exceptions, under Cayman Islands law, a minority shareholder may not bring a derivative action against the board of directors. Class actions are not recognized in the Cayman Islands, but groups of shareholders with identical interests may bring representative proceedings, which are similar. Our Memorandum and Articles of Association contain anti-takeover provisions that may discourage a third party from acquiring us and reduce the rights of holders of our Class A common shares. Our Memorandum and Articles of Association contain certain provisions that could limit the ability of others to acquire our control, including a provision that grants authority to our board of directors to issue new shares in our company from time to time (including common shares and preferred shares) without action by our shareholders. These provisions could have the effect of depriving our shareholders of the opportunity to sell their Class A common shares at a premium over the prevailing market price by discouraging third parties from seeking to obtain our control in a tender offer or similar transactions. See “Item 10B. Memorandum and Articles of Association—Anti-Takeover Provisions in our Memorandum and Articles of Association.” United States civil liabilities and certain judgments obtained against us by our shareholders may not be enforceable. We are incorporated under the laws of the Cayman Islands as an exempted company. The Cayman Islands have a less prescriptive body of securities laws as compared to the United States and some U.S. states, such as Delaware, have more fulsome and judicially interpreted bodies of corporate law than the Cayman Islands. We have been advised by Conyers, Dill & Pearman LLP, our Cayman Islands legal counsel, that the courts of the Cayman Islands are unlikely (i) to recognize or enforce against us judgments of courts of the United States predicated upon the civil liability provisions of the federal securities laws of the United States or any state; and (ii) in original actions brought in the Cayman Islands, to impose liabilities against us predicated upon the civil liability provisions of the federal securities laws of the United States or any state, so far as the liabilities imposed by those provisions are penal in nature. The Cayman Islands court will not enforce criminal fines and tax judgments and judgments that are contrary to Cayman Islands public policy. However, although there is no statutory enforcement in the Cayman Islands of judgments obtained in the United States, the courts of the Cayman Islands will recognize and enforce a foreign money judgment of a foreign court of competent jurisdiction without retrial on the merits based on the principle that a judgment of a competent foreign court imposes upon the judgment debtor an obligation to pay the sum for which judgment has been given provided certain conditions are met. For a foreign judgment to be enforced in the Cayman Islands, such judgment must be final and conclusive and for a liquidated sum, and must not be in respect of taxes or a fine or penalty, inconsistent with a Cayman Islands judgment in respect of the same matter, impeachable on the grounds of fraud or obtained in a manner, and or be of a kind the enforcement of which is, contrary to natural justice or the public policy of the Cayman Islands (awards of punitive or multiple damages may well be held to be contrary to public policy). A Cayman Islands Court may stay enforcement proceedings if concurrent proceedings are being brought elsewhere. Substantially all of our assets are located outside the United States. In addition, all or a substantial portion of the assets of the members of our board of directors and of our officers are located outside the United States. As a result, it may be difficult for investors to effect service of process within the United States upon us or these persons, or to enforce against us or them judgments obtained in United States courts, including judgments predicated upon the civil liability provisions of the securities laws of the United States or any state in the United States. Judgments of Brazilian courts to enforce our obligations with respect to our Class A common shares may be payable only in reais. Most of our assets are located in Brazil. If proceedings are brought in the courts of Brazil seeking to enforce our obligations in respect of our Class A common shares, we may not be required to discharge our obligations in a currency other than the real. Under Brazilian exchange control laws, an obligation in Brazil to pay amounts denominated in a currency other than the real may only be satisfied in Brazilian currency at the exchange rate in effect on the date of the Brazilian Superior Court of Justice’s enforcement of the obligation. These amounts are then adjusted to reflect exchange rate variations through the effective payment date and, if applicable, eventual default interest. The exchange rate at that time may not afford non-Brazilian investors with full compensation for any claim arising out of or related to our obligations under the Class A common shares. The judicial recognition process for foreign judgments before the Brazilian Superior Court of Justice may be time consuming and may also give rise to difficulties in enforcing such foreign judgment in Brazil. Accordingly, we cannot assure you that judicial recognition of a foreign judgment would be successful, that the judicial recognition process would be conducted in a timely manner or that a Brazilian court would enforce a judgment of non-Brazilian courts. Furthermore, upon its recognition by the Brazilian Superior Court of Justice, the enforcement of a foreign judgment would be delegated to a lower federal court. 33 Table of Contents As a foreign private issuer, the disclosure requirements that we must comply with and other requirements are different from those applicable to U.S. domestic registrants. As a foreign private issuer, the disclosure requirements that we must comply with and other requirements are different from those applicable to U.S. domestic registrants. For example, as a foreign private issuer for U.S. purposes, we are not subject to the same disclosure requirements as a domestic U.S. registrant under the Securities Exchange Act of 1934, as amended, or the Exchange Act, including the requirements to prepare and issue quarterly reports on Form 10-Q or to file current reports on Form 8-K upon the occurrence of specified significant events, the proxy rules applicable to domestic U.S. registrants under Section 14 of the Exchange Act or the insider reporting and short-swing profit rules applicable to domestic U.S. registrants under Section 16 of the Exchange Act. In addition, we rely on exemptions from certain U.S. rules which permit us to follow Cayman Islands legal requirements rather than certain of the requirements that are applicable to U.S. domestic registrants. We follow the Cayman Islands laws and regulations that are applicable to Cayman Islands companies. However, these laws and regulations do not contain any provisions comparable to the U.S. proxy rules, the U.S. rules relating to the filing of reports on Form 10-Q or 8-K or the U.S. rules relating to liability for insiders who profit from trades made in a short period of time, as referred to above. Furthermore, foreign private issuers are required to file their annual report on Form 20-F within 120 days after the end of each fiscal year, while U.S. domestic issuers that are large accelerated filers are required to file their annual report on Form 10-K within 60 days after the end of each fiscal year. Foreign private issuers are not subject to Regulation Fair Disclosure, aimed at preventing issuers from making selective disclosures of material information. As a result of the above, even though we are required to file reports on Form 6-K disclosing the limited information that is material to us and which we make public pursuant to Cayman Islands law, or are required to distribute to shareholders generally, you may not receive information of the same type or amount that is required to be disclosed to shareholders of a U.S. company. We cannot predict if investors will find our Class A common shares less attractive because we will rely on these exemptions. If some investors find our Class A common shares less attractive as a result, there may be a less active trading market for our Class A common shares and our share price may be more volatile. PagSeguro Digital is a foreign private issuer and, as a result, in accordance with the listing requirements of the NYSE, we rely on certain home country governance practices from the Cayman Islands, rather than the corporate governance requirements of the NYSE. We report under the Exchange Act as a non-U.S. company with foreign private issuer status. The NYSE rules provide that foreign private issuers are permitted to follow home country practice in lieu of certain NYSE corporate governance standards. The standards applicable to us are considerably different from the standards applied to U.S. domestic issuers. For instance, we are not required to: • have a majority of independent members on our board of directors (other than as may result from the requirements for the audit committee member independence under the Exchange Act); • have a minimum of three members on our audit committee; • have a compensation committee and a nominating and corporate governance committee; • have regularly scheduled executive sessions of our board that consist of independent directors only; or • adopt and disclose a code of business conduct and ethics for directors, officers and employees. As a foreign private issuer, we may follow home country practice from the Cayman Islands in lieu of the above requirements. Therefore, the approach to governance adopted by our board of directors may be different from that of a board of directors consisting of a majority of independent directors, and, as a result, our management oversight may be more limited than if we were subject to all of the NYSE corporate governance standards. Accordingly, you may not have the same protections afforded to shareholders of companies that are not foreign private issuers. 34 Table of Contents Although we do not expect to be a PFIC for U.S. federal income tax purposes, there can be no assurance that we will not be a PFIC for any taxable year, which could subject United States investors in our shares to significant adverse U.S. federal income tax consequences. We do not expect to be a PFIC for the current taxable year or any future year, based on our current business plans. However, whether we are a PFIC will be determined annually based upon the composition and nature of our income, the composition, nature and valuation of our assets (including goodwill), all of which are subject to change, and which may be determined in large part by reference to the market value of our shares, which may be volatile, and our corporate structure and the classification for U.S. federal income tax purposes of our subsidiaries. The determination of whether we are a PFIC will also depend upon the application of complex U.S. federal income tax rules concerning the classification of our assets (including goodwill) and income for this purpose, and the application of these rules is uncertain in some respects. Moreover, the determination of the value of our assets (including goodwill and certain intangible assets) may depend on our market capitalization, and that market capitalization may fluctuate. Accordingly, due to the lack of directly applicable authority regarding the foregoing, there can be no assurance that the IRS will not challenge any determination by us that we are not a PFIC. If we were classified as a PFIC, special adverse U.S. federal tax rules would generally apply to a United States Holder (as defined in “Item 10E. Taxation—U.S. Federal Income Tax Considerations”) that holds our Class A common shares. United States Holders are urged to consult their own tax advisors with respect to the potential tax consequences of the PFIC rules to their particular circumstances. Our Class A common shares may not be a suitable investment for all investors, as investment in our Class A common shares presents risks and the possibility of financial losses. The investment in our Class A common shares is subject to risks. Investors who wish to invest in our Class A common shares are thus subject to asset losses, including loss of the entire value of their investment, as well as other risks, including those related to our Class A common shares, the company, the sector in which we operate, our shareholders and the general macroeconomic environment in Brazil and all other countries in the world, among other risks. Each potential investor in our Class A common shares must therefore determine the suitability of that investment in light of its own circumstances. In particular, each potential investor should: • have sufficient knowledge and experience to make a meaningful evaluation of our Class A common shares, the merits and risks of investing in our Class A common shares and the information contained in this annual report; • have access to, and knowledge of, appropriate analytical tools to evaluate, in the context of its particular financial situation, an investment in our Class A common shares and the impact our Class A common shares will have on its overall investment portfolio; • have sufficient financial resources and liquidity to bear all of the risks of an investment in our Class A common shares; • understand thoroughly the terms of our Class A common shares and be familiar with the behavior of any relevant indices and financial markets; and • be able to evaluate (either alone or with the help of a financial advisor) possible scenarios for economic, interest rate and other factors that may affect its investment and its ability to bear the applicable risks. 35 Table of Contents

4A. History and Development of the Company PagSeguro Digital is an exempted company with limited liability incorporated under the laws of the Cayman Islands and our legal name is PagSeguro Digital Ltd. The Company was created in 2006 under the brand PagSeguro, aiming to democratize the payments and access to financial services in Brazil mainly to small online sellers. We promoted innovative solutions for diverse audiences and we currently serve over 34 million clients. Our activities in Brazil began in 2006, and throughout its history, we have consolidated our role as an acquirer and card issuer, in addition to providing complete solutions for online and in person payments (through mobile devices and POS terminals) with the widest variety of payment methods, such as credit, debit and meal cards. We currently have the largest acceptance network in Brazil, with more than 6.3 million active merchants. Since our initial public offering, or IPO, in 2018, PagSeguro Digital has been a public company listed on the NYSE and regulated by the SEC with subsidiaries in Brazil and abroad, including companies regulated by the Central Bank. These companies are part of our prudential conglomerate and are licensed in Brazil as a financial institution (multiple bank and securities broker) and payment institution (issuer of electronic currency, issuer of credit cards, acquirer and payment initiation services provider), having partnerships with the principal brands of credit cards. Our principal executive office is located at Conyers Trust Company (Cayman) Limited, Cricket Square, Hutchins Drive, P.O. Box 2681, Grand Cayman, KY1-1111, Cayman Islands, and our telephone number is +55 (11) 3914-9524. Our investor relations office can be reached at +55 (11) 3914-9524. The SEC maintains a website (http://www.sec.gov) that contains reports, proxy and information statements and other information regarding registrants, such as us, that file electronically with the SEC. Our internet address is www.pagseguro.uol.com.br. On occasion, we may use our website as a channel of distribution of material company information. Financial and other material information regarding us is routinely posted on and accessible at https://investors.pagbank.com/. Information provided on our website is not part of this annual report and is not incorporated by reference herein. In 2019, the Company officially launched its digital banking operation, expanding democratization and financial inclusion beyond payments solutions, with three main objectives: (1) reduce financial expenses by diversifying funding sources through deposit growth, (2) reduce merchant churn by increasing the penetration of digital account services and (3) diversify revenue streams beyond MDR and the prepayment of credit card receivables. As of December 31, 2025, we had 8,645 employees. Even with an extremely lean corporate structure compared to other financial institutions, one of our main characteristics is our focus on innovation, creation of scalable products and widespread financial inclusion. With headquarters in the city of São Paulo and operations in all Brazilian States across more than 5,569 cities, our main mission is to develop disruptive products aimed at democratizing financial services in Brazil, offering sellers and consumers a complete digital ecosystem that is simple, mobile-first, safe and affordable. PagSeguro Digital’s clients are companies of all types and sizes — from individual entrepreneurs, micro-merchants and small businesses such as street vendors and beauty salons, to medium-sized companies in retail and other sectors –- as well as digital account clients. PagSeguro Digital also has a growing presence in the business-to-business trade segment and offers specific products for beauty care professionals, self-employed professionals, individual micro entrepreneurs, or MEI, chauffeurs and taxi drivers, lawyers, physicians and dentists, commerce and brick-and-mortar stores, restaurants, bars, and snack bars. Since its founding, PagSeguro Digital has followed initiatives for the development of an environment that is open to competition in the financial and digital means of payment sectors. That is why the Company is a member of several industry associations, such as the Brazilian Internet Association (Associação Brasileira de Internet), or ABRANET, ABECS, the Brazilian Association of Banks (Associação Brasileira de Bancos), or ABBC, and ANBIMA. Overview We are a disruptive provider of financial technology solutions focused primarily on consumers, individual entrepreneurs, micro-merchants, small companies and medium-sized companies, or SMEs, in Brazil. We have a full banking offer and the largest payments acceptance network in the country, with online solutions for in-person sales, omnichannel and self-service. Among our peers, we are the only financial technology provider in Brazil which business model covers all of the following six pillars: • multiple digital banking solutions; • in-person payments via POS devices that provide to merchants; • free digital accounts that we provide to our consumers and merchants with functionalities such as bill payments, top up prepaid mobile phone, Uber, Spotify or Google Play credits, wire transfers, peer to peer cash transfers, prepaid credit cards, cash cards, debit and credit cards, loans, investments, QR code payments, and payroll portability, among other digital banking services; • issuer of prepaid, cash, debit and credit cards; • operate as a full acquirer; and • operate as a cross-border Payment service provider (PSP). 36 Table of Contents Our end-to-end digital ecosystem enables our merchants not only to accept payments, but also to grow and manage their businesses. Before PagSeguro, many of these individual entrepreneurs and SMEs were overlooked or underserved by incumbent payment providers and large financial institutions in Brazil. We offer safe, affordable, simple, mobile-first solutions for merchants to accept payments and manage their cash through their free PagBank digital accounts, without the need for a bank account. Our digital banking ecosystem features our free PagBank digital account, under the brand PagBank, and offers 51 payment methods and 15 cash-out options including bill payments, top up prepaid mobile phone, several partnerships available in PagBank app such as Uber, iFood, Play Station, Xbox, among others, wire transfers, peer to peer cash transfers, prepaid credit cards, cash cards, loans, investments, QR code payments, and payroll portability, among other digital banking services. Our free PagBank digital account serves both consumers and merchants. Acquisitions and Changes to Our Organizational Structure In 2023, we conducted the following corporate transactions: • In July 2023, PagSeguro Brazil acquired 90% of the shares of NetPOS, in addition to the 10% it had previously acquired, and it therefore reached 100% of the share capital of NetPOS; and • In July 2023, RegistraSeguro S.A. was merged into PagSeguro Brazil. In 2024, we conducted the following corporate transaction: • In June 2024, PagSeguro set up the Fundo de Investimento em Direitos Creditórios – PagBank Multiadquirência – Responsabilidade Limitada, or FIDM. The objective of this fund is to anticipate third-party assignments in accordance with market operations. In 2025, we conducted the following corporate transactions: • In January 2025, Yamí Software & Inovação Ltda. was merged into Pag Participações; • In March 2025, Zygo Serviços de Tecnologia S.A. was merged into Pag Participações; • In August 2025, the Company contributed shares representing 100% of the issued and outstanding shares capital of PagSeguro Brazil to BS Holding, though an in-kind contribution of shares. As a result, BS Holding became the sole shareholder of PagSeguro Brazil; and • In December 2025, we completed a partial spin-off of BS Holding pursuant to which a portion of the shares of PagSeguro Brazil held by BS Holding was transferred directly to the Company as its shareholder. Following this transaction, BS Holding retained control of PagSeguro Brazil. In 2026, through the date of this annual report, we conducted the following corporate transactions: • In March 2026, CDS Serviços Financeiros Ltda., Pag Participações Ltda., and Tilix Digital Ltda. were merged into PagSeg Participações; and • In March 2026, PagSeguro Biva Serviços Financeiros Ltda. was merged into PagSeguro Tecnologia Ltda. 4B. Business Overview Our Mission, Purpose and Values Mission and Purpose Throughout its existence, PagSeguro Digital’s mission is to transform and democratize access to financial and payment solutions in Brazil by providing a simple, safe, affordable and accessible digital ecosystem to merchants and consumers. Today, the Company is also focused on the mission to make the financial lives of people and businesses easier. To pursue this mission, we have built a set of strong cultural values of customer-focused organization, protagonism, collaboration, simplicity and reliability. Values • All for the client: with focus, agility and a sparkle in our eyes, we all work for the client. • Protagonism: we act as protagonists to do things differently and without fear of challenging the status quo. • Collaboration: we embrace collaboration and diversity in order to grow. • Simplicity: we “uncomplicate” today with simplicity. • Reliability: our actions offer security to our clients. 37 Table of Contents Our Market Payments • Micro-merchants and SMEs drive the Brazilian economy According to SEBRAE (Portal do Empreendedor) and Brazil’s Internal Revenue Service (Receita Federal), there were 16.8 million micro-merchants in Brazil as of December 31, 2025. In addition, according to the most recent Annual Social Information Report (Relação Anual de Informações Sociais), or RAIS, published by the Ministry of the Economy, as of December 31, 2024, there were 4.6 million SMEs. Additionally, according to IBGE’s PNAD, as of December 31, 2025, there were 18.9 million self-employed individuals in the informal economy, usually individual customers of card acquirers. Taken together, this totals an addressable market of 40.3 million formal and informal businesses. In addition, according to SEBRAE, the number of individual micro entrepreneurs in Brazil increased significantly, from 0.8 million in 2010 to 16.2 million in January 2026. We categorize these businesses according to their TPV: • MSMB: merchants with a monthly TPV below R$3 million. • Large Retail and Online: merchants with a monthly TPV above R$ 3 million, including large retailers and online merchants. Businesses and consumers in developed economies continue to abandon cash and paper payments, shifting towards electronic payment mechanisms. This trend continues to impact the Brazilian economy, and the opportunities for the expansion of digital payments in Brazil remain significant. The migration away from checks creates efficiencies for businesses, who can reduce cost and accelerate cash flow if their accounts payable and accounts receivable functions are automated through electronic payments and reconciliation. Similar opportunities exist for consumer bill payment, direct deposit, and person-to-person payments. According to eMarketer, the mobile payments retail purchase volume in Brazil increased to US$49 billion in 2025 from US$1 billion in 2015, while in the United States, this volume was approximately US$596 billion in 2025. Regarding retail e-commerce as a whole, sales volume in Brazil increased to US$78 billion in 2025 from US$10 billion in 2015 according to eMarketer. The average growth rate of mobile e-commerce over the last 10 years has been 2.3x faster than in overall e-commerce, with m-commerce share in e-commerce growing from 11% to 63% between 2015 and 2025, according to eMarketer. This creates new options for buyers and sellers and provides business opportunities for buyers and providers of digital deliveries. • Commerce is increasingly digital and mobile worldwide According to the International Telecommunications Union (ITU), an estimated 6.0 billion people, or 74% of the total global population, used the internet in 2025, compared with 3.0 billion people, or 40% of the total global population, in 2015. The increasing number of businesses offering online shopping is fueling consumer demand for faster and more reliable payment methods. We believe these trends create an environment where merchants feel compelled to interact more closely with a broader range of customers, using online stores, mobile-friendly technologies and extensive compatibility with digital payment methods, such as cards. We believe that there is a significant market opportunity for growth in e-commerce in Brazil. • Businesses are shifting towards increasingly non-bureaucratic, friendly and all-in-one services As technology and the regulatory environment evolve, sellers of all types and sizes face a continuous need for new solutions. A significant number of businesses in Brazil remain unserved or underserved in terms of online payments, POS and mPOS services as well as value-added financial services tools for a number of reasons, including lack of access, lack of all-in-one offerings, time-consuming, limited access to conventional funds and lack of transparency. Financial Services • The structure of the Brazilian financial market creates significant opportunities for disruption The structure of the Brazilian financial market creates significant opportunities for technology-driven disruptors, who seek to break up the highly concentrated supply of services, particularly when compared to more developed markets. The banking market is relatively concentrated for global standards. Retail banking leaders are local, with no global retail banking players around the world. In September 2025, Brazil’s five largest financial institutions held 60% of financial assets, which makes it one of the world’s most concentrated markets. By comparison, banking concentration in the U.S. is significantly lower, with the five largest banks holding 42% of total assets. 38 Table of Contents The use of payment cards also remains relatively low in Brazil compared to more developed markets. According to a report by ABECS, card payments accounted for 64% of Brazilian household consumption in the third quarter of 2025. In 2024, the same indicator for Brazil was 54%, compared to 58% in the United States, 64% in the United Kingdom and 76% in Australia, according to the most recent data made available by Red Book Statistics for Payments and Financial Market Infrastructures Statistics from BIS, indicating the potential for further expansion and the growth already observed in just three years in Brazil. Credit card penetration levels are a fundamental driver for the digital payments industry. • Internet and technology pave the way for digitization of financial services Brazil is a reference in global internet adoption. According to Statista, Brazil is the fifth largest country in terms of number of internet users (183 million people in February 2025), the fourth country in terms of time spent on the internet and the fifth in terms of time spent on social media, according to the 2025 Global Digital Report from “We Are Social” and “Meltwater.” • Increasing significance of digital banking and digital banks in Brazil The adoption of technology and focus on transparency, security and simplicity has transformed the consumer habits of the Brazilian population. According to the most recent research report prepared by Deloitte on behalf of Febraban, the volume of mobile banking transactions increased 15% from 2023 to 2024, with 74% (155 billion) of all banking transactions (208.2 billion) in 2024 conducted on mobile phones or tablets. Moreover, approximately eight out of ten transactions are digital (conducted through mobile and internet banking and WhatsApp). Consequently, banks have been reducing their overall number of branches as a response to the digitization of banking, with bank managers and clerks mainly focusing on advising clients and services with greater complexity. According to the Central Bank, as of 2024, there were 16,6 thousand bank branches in Brazil, compared to 21.8 thousand bank branches in 2017. The traditional financial system has been falling short of meeting expectations of different and complementary social and economic profiles. According to the World Bank’s most recent Global Findex database published in 2024, approximately 3% of the Brazilian working age population received wages in cash only, corresponding to approximately 5.2 million Brazilian adults. Also, 26% of the Brazilian adults who paid utility bills made the utility payment using cash only, according to the World Bank’s Global Findex 2024. Clients of traditional banks also complain about high fees and spreads, limited product offerings and the level of poor customer service provided in return. According to results reported by Brazil’s four largest banks, the financial institutions’ annual revenues derived from services increased 37% from 2016 to 2025. In fact, according to a survey conducted in 2021 by the Brazilian Institute for Consumer Defense (Instituto Brasileiro de Defesa do Consumidor), the tariff packages charged by the five largest banks in Brazil have registered a significant increase. The most requested services, such as withdrawals, deposits and transfers, had increased between 9% and 25% above the inflation rates observed between 2020 and 2021. The increasing adoption of digital banks in Brazil is expected to continue as a strong trend, rendering numerous advantages such as the reduction in operational costs, maximized revenues due to increased customer attraction and retention, and new technologies and advancements in the regulatory framework. Brazilians have been responding well to this adoption as, according to the latest report “Relatório de Economia Bancária” published by the Central Bank, the evolution of active relationships between individual customers and the digital banks showed a strong growth between the second half of 2020 and December 2023. During this period, active users of digital banks grew from approximately 15 million to 100 million. • Trends shaping the banks of the future Fintechs have been splitting apart services once provided through one trusted relationship with a traditional bank in order to meet customers’ specific needs with highly specialized offerings and superior customer service. The current unbundling of financial products has created a fragmented landscape that is expected to gradually shift towards trusted, centralized and digitally-enabled financial services platforms. The following principles have an imperative role in building the banks of the future: o Best-in-class customer experience is digital and requires continuous investment in innovative technologies: mobile banking has succeeded in providing greater flexibility for customers to bank at home, at work or while socializing, in enhancing the financial awareness of its users and in retaining the client base due to user experience. o Rich data enables more personalized customer experience: customer experience is expected to overtake price and product as the key brand differentiator in the near future. In addition to being more likely to do business with a company that offers a personalized experience, consumers expect companies to anticipate their needs and make relevant suggestions before first contact and will not have issues with sharing personal data in exchange for that. o Security, exceptional customer service and transparency strengthen trustworthy relationships: trust surpasses convenience, reliability, value and time as the key attribute in the decision to adopt innovative payment and banking solutions, thus being indispensable when acquiring and retaining customers at scale. It is critical to secure the vast amounts of data and the consumer’s digital identity, and to constantly delight customers, while receiving high net promoter scores, engagement and retention in return. Equally important is companies’ ability to convincingly communicate their benefit, align the timeline of consumer costs and value received and emphasize the many steps taken, special assets used, time saved and complexity eliminated throughout the customer journey. 39 Table of Contents Our Competitive Strengths and Advantages • Our Unique Culture Through a healthy work environment that values the differences and needs of each professional, PagSeguro Digital believes that people are instrumental in the success of the business. Through communication campaigns highlighting the pillars of the Company’s mission and values, our human resources department works continuously to strengthen PagSeguro Digital’s organizational culture. Our Company has ongoing employees’ and managers’ meet up groups and development programs, encouraging greater proximity between managers and employees and continuous feedback among employees and their leadership. We also foster innovation and creativity among our employees on a daily basis and we frequently organize team meetings with the chief executive officer and other executives to ensure synergy among all teams, share our results, reinforce our values, such as collaboration, simplicity, protagonism, reliability and client satisfaction. Everyone in the Company is welcome: this has been part of the Company’s DNA since the beginning, with young and diverse teams. Diversity and inclusion, or D&I, is key to us and our D&I team promotes initiatives and activities consistently, including diversity awareness campaigns and training programs to further enhance and continuously improve its practices. In addition, our office spaces are shared environments, which contribute to greater integration among all employees and, consequently, greater productivity. • Our Business Model o Digital company with tech-DNA; o Complete digital platform with means of payment, financial services and software; o Complete multiple bank platform for individuals and companies with one or more account holders; o Acquirer with the most widely-accepted network in Brazil, offering face-to-face, online, and cross-border payments; o Issuer of debit, credit, and prepaid cards; o Investment platform offering public and private securities, investment funds and equity/REITs trading; o Insurance distribution platform: Pix, cards, health, home and life insurance; and o Super app with an extensive list of partners in telecommunications, transportation, delivery, games and entertainment. • Our Products o A Complete Banking Platform including: o PagBank account: free simple and 100% digital; o Cash-in solutions: Pix, wire transfers and deposits; and o Investments: CDs, investments funds, stocks and other. o Robust credit offerings for individuals and merchants: o Payroll loans for INSS beneficiaries and federal employees; o FGTS: enables customers to access a portion of their FGTS funds in advance of the official withdrawal date; o Credit card: fee-free credit cards offered to bank deposit certificate (Certificado de Depósito Bancário), or CDB, investors or escrow account holders; o Overdraft account: an extra limit granted to PagBank account holders; o Working capital loans for active PagBank POS sellers with sufficient TPV and receivables held as collateral; and o Receivables prepayments: early disbursement allow merchants to receive card sales funds instantly, from POS, checkout, or payment link transactions. o Robust logistics structure and service levels; and o Single interface integrating payments, financial services and software (app or internet banking). • Our Sales Channel and Client Acquisition o Online strategy in partnership with UOL, reaching 73% of the Brazilian internet audience; and o Salesforce based on HUBs covering 100% of GDP geographically distributed. • Our Financial Structure o As of December 31, 2025, cash and cash equivalents, financial investments and compulsory reserve of R$6.7 billion; and o Diversified funding sources based on deposits, with cost of funding structurally lower than industry. 40 Table of Contents Seasonality We operate in a somewhat seasonal industry. We tend to process fewer transactions in the first quarter of the year and experience increased activity as the year-end holiday shopping season initiates. As a result of quarterly fluctuations caused by these and other factors, comparisons of our operating results across different fiscal quarters may not be accurate indicators of our future performance. For additional information on risks relating to seasonality, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our quarterly results of operations and operating metrics may fluctuate and are unpredictable and subject to seasonality, which could result in the price of our Class A common shares being unpredictable or declining.” Our Products and Services Our end-to-end digital ecosystem operates as a closed loop where our clients are able to address their main day to day financial needs, including receiving and spending funds and managing and growing their businesses. Our main products and services are described in further detail below: 41 Table of Contents Digital Bank • Bill payments: We offer our clients the option to pay their bills that are in the form of invoices with bar codes (boletos). For every bill paid in this manner, PagBank receives a fee. • Deposits: Similar to bank transfers, consumers can make cash deposits at a bank branch or automated teller machine, or ATM, directly to their free PagBank digital accounts, including to a merchant’s digital account to pay for a product or service, or to the consumer’s own digital account. We generate MDR, commissions on payments made through cash deposits to a merchant’s free PagBank digital account. There is no MDR or any other commission charged by us when consumers add funds to their own free PagBank digital account. • Top-ups: Brazil still has a very large population using prepaid phones, and as a result, carriers pay brokers’ fees in order to recharge (“top-up”) these phones. At PagBank, we work as a broker offering recharges for phones to our clients and receive a fee from the carriers. • Debt management: Through certain of our services, our merchants are able to charge their customers for the services they provide or the products they sell through the use of (i) invoices with bar codes (boletos), (ii) Pix (QR code), and (iii) a hybrid format using both barcodes and QR code (Bolepix). • Direct deposits (Salary): Through our payroll portability feature, anyone working in Brazil as a registered employee can have their salary deposited directly into their free PagBank digital account at no cost. • Pix: Pix is the biggest means of bank transfers in Brazil presently. In PagBank, clients can receive and send transfers instantly, through Pix. • Tax collections: In addition to bills, we also offer our clients the ability to pay their taxes received in the form of invoices with bar codes (boletos). • Wire transfer: Other than Pix, we also offer other transfers as peer-to-peer, or P2P, transfers (internal transfer) and TED (external transfers). Some transfers cannot be done by Pix, and TED allows us to maintain a full suite of transfer options. • ATM withdrawal: Cash withdrawal from any ATM using a credit, debit, prepaid or cash card (cartão da conta) Cards • Debit card: Our PagBank Mastercard NFC debit card is linked directly to the balance of the free PagBank digital account. The card has no issuance fee, and we offer it to merchants and consumers through our PagBank Super app. Through this app, users can make purchases using any Mastercard and Visa network and withdraw cash, with a flat fee, through Cirrus ATM networks. • Credit card: Our PagBank Visa credit cards have no annual or membership fees, and they are offered to customers who invest in PagBank CDs or who reserve the balance of their PagBank free digital account in an escrow account. It is accepted in Brazil and abroad. Card information can be stored in PagBank’s free digital account to enable NFC or QR code transactions. As NFC and QR codes do not require contact between the buyer and seller’s POS device, transactions are contactless. • Cash card: Our PagBank Visa NFC enabled cash card is linked directly to the balance of the free PagBank digital account without the need to reload the card, unlike our PagBank prepaid cards. • Prepaid card: Our PagBank MasterCard prepaid cards allow merchants or consumers to use the balance from their free PagBank digital account to buy goods and services in-person and online or withdraw cash at more than one million Cirrus network ATMs in Brazil and abroad. Merchants can, therefore, receive payments from sales transactions into their free PagBank digital account, load/reload the PagBank prepaid card with its value and spend that money without needing a bank account. With a modest initial purchase cost, the card comes with no annual fees or interest rates – and we provide it free to merchants who purchase a PagBank POS or mPOS device. PagBank’s prepaid card does not require credit checks on the merchant or preapproval for issuance. Credit Products • FGTS early withdrawal: This product allows customers to advance the withdrawal of a portion of their FGTS (Brazilian Severance Pay Fund for Length of Service) funds before the official deadline. In Brazil, employees have a percentage of their monthly salary deposited into their FGTS fund to create a reserve which can be withdrawn in specific circumstances, such as an unjustified dismissal. Since 2020, employees can withdraw part of this amount in their birthday month. The FGTS early withdrawal is a secured loan product, 100% guaranteed, that enables customer to access loans using FGTS funds that already belong to them to pay for the loans. • Payroll loan: Payroll loans granted to retirees, pensioners, INSS beneficiaries, and federal public servants. The loan is directly deposited into the customer’s PagBank account and is deducted from their salary, greatly minimizing credit risks. • Working capital loan: Loans granted to active sellers with PagBank POS, certain transaction volume (TPV), and a hold on their receivables to secure the loan. • Overdraft account: Extra limit granted to PagBank account holders for emergencies and unforeseen expenses. 42 Table of Contents Insurance We developed partnerships with insurance companies in Brazil that are authorized to provide insurance products and services pursuant to a license by the Brazilian Insurance Authority (Superintendência de Seguros Privados – SUSEP). Through these partnerships, we offer insurance products in our platform, which are backed-up by our partners. We have expanded our operations in recent years and below is a list of products we offer: • PagBank Account Insurance: This is PagBank Digital Account Insurance, which guarantees compensation in the event of theft in which the customer is coerced into transferring funds from our Superapp or after withdrawing funds from an ATM. • PagBank Card Insurance: This is PagBank card insurance, which guarantees compensation in the event of loss or theft of the card resulting in improper withdrawals or purchases. • Home Insurance: Residential insurance that, in addition to guaranteeing damage to the property and all contents, extends guarantees to corporate objects, when our client acts as a businessman onsite. This Insurance also includes 24-hour emergency assistance. • Business Insurance: PagBank Business Insurance, which offers guarantees against fire, explosion, natural events, including damage caused to third parties and loss of income as a result of a covered incident. This product was launched in March 2024, with expectations of improvements to occur throughout 2024. • Health Assistance: Discount network that allows our customers access to differentiated costs for consultations, exams, telemedicine and even surgical procedures, in addition to discounts at the main pharmacies in the country. The entire scheduling experience takes place within the PagBank Super app itself. • Life Insurance: PagBank Life Insurance that guarantees compensation in the event of death or disability. This insurance has some important differences such as funeral assistance that extends to ascendants, descendants and in-laws which, in addition to payment, we take care of all procedures to support the client or family member at this difficult time. • Credit Life Insurance: This is insurance that guarantees the repayment of loans that the PagBank customer has, in the event of death, disability, unemployment or, for entrepreneurs, loss of income due to inability to generate income. Investments • Recommendation from our distribution team: Our distribution team helps customers make better investment decisions taking into account their risk profile and investment horizon. • Financial education: We provide educational resources and tools to enhance our clients’ financial literacy. Podcasts, instructional videos, daily investor calls and investment courses all connect into a comprehensive offering to our customers. This service aims to empower individuals to make informed investment decisions and understand market dynamics. • Stocks and REITs: Purchasing stocks enable investors to acquire equity in a company. It’s an opportunity to benefit from the Company’s growth and earnings, with the potential for dividends and capital appreciation. At PagBank we also offer exchange-traded funds (ETFs) and real estate funds in the mix of variable income, bringing a greater offering of products to our customers. We also provide a home broker platform embedded in our app, offering real-time market data, analytical tools, and trading capabilities. • Investment funds: Our distribution service offers access to a curated selection of around 170 investment funds managed by third parties, allowing investors to diversify across asset classes and management strategies in line with their investment objectives. • PagBank CDs: A certificate of deposit is a financial product in which investors commit their funds for a fixed period and earn interest at a predetermined rate. It’s a secure form of investment with fixed returns, ideal for risk-averse individuals. This type of investment is insured by the Credit Guarantee Fund (Fundo Garantidor de Crédito – FGC), the Brazilian version of the Federal Deposit Insurance Corporation – FDIC. • Third-party fixed income: At PagBank we act as an intermediary in the sale of third-party fixed income securities, such as corporate bonds, certificate of deposits, and asset-backed securities (ABS) offering clients a variety of options to earn regular income while diversifying their investment portfolio. • Treasury bonds: These are government-issued securities that offer investors a fixed rate of return over a predetermined period. Tesouro Direto is a government program focused on bringing individuals to invest in a safe, government-backed security. They are considered low-risk investments and are often used to preserve capital and plan for long-term financial goals. • Automatic savings: Automatic Savings is a service initially designed to offer payment terminal (POS) customers a way to automate investing their daily/weekly/monthly revenue by converting these funds into deposit certificates. It has evolved to also work the same way with customer balances. Now, with a couple of clicks, customers can set frequency and amount to save and invest in an automatic fashion. • Money boxes: An innovative service aiming to help customers save and invest in a frictionless way. With only a couple of clicks, our customers can set up how much money, and how often, they would like to save. Funds are converted into deposit certificates, thus paying interest. “Investimentos por Objetivos” as a feature of the Cofrinho investment function allows customers to save and invest in objectives defined by customers, like retirement or a car down payment. Funds can be withdrawn within one working day, making Cofrinho a safe and easy alternative for first-time investors and alike. 43 Table of Contents Marketplace • Cashback: Cashback’s main objective is to keep the customer engaged (using PagBank) and can also be used for cross selling. Currently, customers choose how they want to use their cashback: when recharging their mobile phone, when paying bills, on gift cards, on their account card or on PagBank POS. • Shopping PagBank: Shopping PagBank is a marketplace with offers from more than 50 major brands. When purchasing through Shopping PagBank, the customer always receives part of the value back, being paid directly into the PagBank account. Payments • Cross-border: Our PagSeguro Tecnologia platform provides international merchants with local payment solutions for their consumers, having a great footprint in Latin America, Spain, Portugal, Greece, Romania and Turkey. Using online merchants, PagSeguro Tecnologia can provide their end-users with more than 156 local payment methods, leveraging best conversion rates and unlocking the market potential of cross-border-commerce. All that coverage can be accessed by a transparent payment API or via branded checkout. The merchants can use our platform to perform payouts via Pix and directly to PagBank accounts. This way, their end-users become eligible for receiving any amount. PagSeguro intermediates the transaction, which collects the cash from merchants and settles the amount for the payee in Brazil, into a bank account held by the end-user. • Online checkout: Our web checkout options offer tokenization, advanced handling of shipping information, management of subscriptions and automatic billing, order tracking and split payments. PagSeguro offer two different levels of web checkout integration: Redirect and Transparent, all of which are easy to set up and customize. With Redirect checkout, upon clicking on the payment option, the consumer is redirected away from the merchant’s website to the PagSeguro secure domain, where the payment is processed. After payment, the consumer is redirected to the merchant’s website. The Transparent checkout solution allows merchants to create a fully customized payment experience. Payment is processed under the merchant’s domain while still benefiting from the features and functionalities of our ecosystem, such as anti-fraud and consumer data protection. • Pix: Pix, for instant wire transfers and payments, both online via checkout and our PagBank app and through our POS systems. • P2P and social payment: Our P2P and social payment allows merchants and consumers to transfer their balances between PagBank digital accounts free of charge. The P2P tools also allow our customers to request payments by sending a web link through e-mail, social network or messaging services such as WhatsApp to the person paying. Our customers can request payments even if they do not have a website, and the payer does not need to register with PagBank and may pay through a variety of options, including credit card, Pix, boleto and pay in up to 12 installments. • POS: PagBank’s wide range of affordable POS devices enable merchants to accept credit, pre-paid, debit and meal voucher on an in-person, chip and pin or NFC basis. PagBank’s POS devices can be set up in less than five minutes. It is designed to be easy to use and have high levels of system availability, efficient back-up solutions and value-added functionalities. For a significant amount of our POS devices, we currently rely on one manufacturer to manufacture, test and assemble, although we are expanding our range of POS devices, which would be derived from different equipment providers. The agreement for the supply of equipment, dated as of June 26, 2014, as amended from time to time, by and among PAX Brazil, Transire Fabricação de Componentes Eletrônicos Ltda., or Transire Brazil, and Net+Phone Telecomunicações Ltda., or Net+Phone, sets forth the types of POS devices to be sold by PAX Brazil, Transire Brazil and Tec Toy S.A., or Tectoy, to us and the standard terms and conditions governing this supply of POS devices. PAX Brazil, Transire Brazil and Tectoy together serve as our main supplier of POS devices. Consideration payable to PAX Brazil, Transire Brazil and Tectoy under this agreement is determined by the number of POS devices ordered by us. For more information, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Some of the key components of our POS devices are sourced from a limited number of suppliers. We are therefore at risk of shortage, price increases, changes, delay or discontinuation of key components, which could disrupt and harm our business.” We offer a comprehensive suite of POS devices such as: o For micro-merchants and SMEs, we offer 2 devices: (i) mPOS Minizinha NFC connects, through Bluetooth, from PagBank apps to the acquirer’s platform to accept payment, provides receipts via SMS and (ii) Minizinha Chip 3 is an additional POS device, with sim card communication and a larger screen; and o For businesses with greater needs, we offer three more sophisticated devices, (i) Moderninha Plus 2 provides consumer receipts via SMS and is focused on merchants that generate lower transaction volumes; while the (ii) Moderninha Pro, which provides consumer receipts via SMS or in paper form, is focused on merchants that generate higher transaction volumes. Moderninha Pro is the first single unit to offer GPRS/2G/3G (currently available 4G) chip connection, NFC, plug and play Wi-Fi and Bluetooth connections on the same device; (iii) Moderninha Smart is also a printer terminal, which has management features available such as product catalog and inventory management, in addition to allowing integration with third-party apps. • QR code: is a contactless transaction, it does not require contact between the buyer and the seller’s POS device. • TEF: launched in August 2017, is a solution that integrates EFTPOS (electronic funds transfer at point of sale) technology with merchant software, secured via PIN pad. This service allows merchants to process of large transaction volumes and issue tax receipts more easily than with traditional POS devices. • PagTotem: This self-service equipment has a 23-inch touch screen display, with ethernet connection, 2.4/5Ghz Wi-Fi bandwidths, and Bluetooth, ideal for use in stores, markets, and fast-food restaurants. • Tap On: launched in September 2023, it is a solution that transforms the cell phone into a secure device for contactless transactions, which includes larger ticket transactions authenticated with PIN, available for Android and iOS devices. 44 Table of Contents Software • PagVendas: Our sales app PagVendas is a POS software app available for smartphones and tablets running iOS or Android that integrates seamlessly with our payment processing solution but can also be used on a stand-alone basis. By using this app, merchants are able to increase productivity and manage their sales and inventory, among other items. The tablet version of the app allows merchants using POS devices to improve their business operations by registering and itemizing their services and products, selling merchandise on customizable terms, tracking business data and allowing for faster in-app checkout. • ClubPag: Our promotional engine is a marketing tool that allows merchants to advertise across our client base, available for POS devices, the merchant can expand his club by requesting the customer’s cell phone in the first purchase to register, then can offer and encourage his customers at the time of transaction, in addition to automatically sending discount coupons via SMS and/or e-mail. • PlugPag: Our wireless solution that connects the machine to the commercial automation system, via Bluetooth technology. PlugPag integration communicates the return of each sale, giving automation the possibility of processing and reconciling transactions. Integrated with Windows, Linux, Android or iOS. • Envio Fácil: PagBank’s logistics solution for online sales, the merchant can simulate, compare and choose the best price to send your products and save up on shipping. Sell via Payment Link, Checkout, PagVendas, through social networks, marketplaces, or own virtual store and deliver products with PagBank convenience and security, without additional costs, the merchant only pays for the shipping they use, without a contract, monthly fees and minimum quantity of shipments, in addition to several payment options. Sales and Marketing Our marketing strategy is designed to grow our platform by building and maintaining the recognition and trust of the PagBank brand, attracting new users and generating more frequent activity by our existing users. Our marketing initiatives aiming to recruit merchants to our ecosystem currently focus on our POS devices, tap on phone systems, web checkout solutions and other online payment solutions. We believe that introducing our digital payment solutions to merchants who are not yet our clients is the most efficient and cost-effective strategy to sustain our growth among both merchants and consumers, creating a “network growth effect.” The advantages of our digital payment solutions for merchants drive growth in their businesses, and the advantages of our digital payment solutions for consumers lead them to prefer merchants who offer these solutions, resulting in the acquisition of new clients through word-of-mouth recommendations by both merchants and consumers. Our existing clients, many of whom use PagBank as an exclusive payment method, enable us to grow our merchant base rapidly and organically. Each time a consumer who has not yet registered with PagBank visits our website or pays a merchant using one of our online or in-app checkout solutions, the consumer is invited to open a free PagBank digital account to make his or her next purchase with PagBank easy and seamless. We strive to position PagBank’s products and services on top of mind and present them as a desirable, easy and secure means to accept and make payments in Brazil, while accompanying the consumer throughout the purchasing process, from general brand awareness through to actual purchase or account registration. As a digital company, and with the support of UOL’s audience, we continue to build and maintain brand recognition and trust through a variety of marketing campaigns, including advertising through traditional media, such as television, magazines and newspapers, and online advertising such as display media, videos, search results, social media and influencer marketing, including: • Traditional offline media: television advertisements and merchandising (broadcast and cable), radio, the printed press, festivals and events, and display media such as billboards, urban digital time and weather displays, and airport and bus station displays. • Traditional online advertising: display media (including banners, rich media, interstitials, videos and native ads) on a variety of online platforms, such as premium websites, portals, video platforms such as YouTube, social media platforms such as Facebook, Instagram, Tik Tok, Kwai and X, mobile apps, e-mail marketing and affiliate programs. • Search: we have expertise in positioning our products in preferential placements on search platforms displayed on desktops, tablets and smartphones, using specific initiatives such as paid search (Search Engine Marketing, which includes bid management tools and keywords analysis) and natural or organic search (search engine optimization, or SEO, which includes website optimization). Our marketing department develops all these online and offline marketing strategies using single integrated concepts, so that our campaigns include key visual characteristics and consistent messages across all channels. In line with our growth strategy, most of our campaigns focus on micro-merchants and SMEs, with messages that highlight our easy, safe and hassle-free way of accepting payments, such as “a single online contract that allows you to accept more than 40 cash-in methods” and “free yourself from POS rental fees.” We also highlight the advantages of our products and services as a complete solution for new or growing businesses. At the same time, we also advertise value-added products and services targeted at larger merchants and consumers from higher income sectors, including our business management tools and commercial automation solutions. We believe that our association with the UOL group brings experience and competitive advantages in designing, negotiating and purchasing advertising space. The strength of our brand, products and services has been recognized in a number of awards, including and below is a list of awards we received in 2025: 45 Table of Contents • Recognized as first place in the category “Payment Methods” and one of our employees recognized as “Best Customer Service Professional – Large Operations” at the 2025 “Reclame Aqui Awards.” • Ranked seventh in the Financial Services category in the ranking of the 1,000 largest Brazilian companies, according to Exame magazine’s 2025 “Melhores & Maiores” Awards (Exame’s Best & Biggest Awards). • Recognized as one of the Most Valuable Brazilian Brands of 2025 by Interbrand. • Recognized as one of the Top 1,000 Brazilian companies of 2025 in the Valor 1000 Awards, placing PagBank among the Top 5 Brazilian companies with the highest overall scores in the financial services category. Additionally, the Company achieved, in the financial services category: o 1st place in Net Revenue, o 1st place in Interest Coverage (EBITDA over Financial Expenses), and o 2nd place in Net Revenue Growth. • Recognized as one of the “World’s Best Companies – Sustainable Growth 2025” by TIME magazine, in partnership with Statista Inc., the world’s leading provider of statistical insights and global rankings. • Recognized as one of the “Top of Mind Folha 2025” companies in the POS category. • Recognized in 2nd place in the Financial Services category in the “Top 30 Companies in Brazil Awards,” conducted by Veja magazine in partnership with Austin Rating. Further supporting the strength of our brand, PagBank has already shown strong results in brand recognition. Since May 2024, according to Google Trends, the number of internet searches for “PagBank” has been higher than the number of internet searches for PagSeguro. In addition, our PagBank app had 50 million downloads (Google Play as of February of 2026). Further evidencing the strength of our brand, 80% of our users would hire products and services offered by PagBank. In addition, as of February 25, 2026, our PagBank app was rated an average of 4.9 stars by 1.8 million reviewers in Apple’s Brazilian app store and 4.9 stars by 4.29 million reviewers in Google Play. These rankings compare favorably to those of our main competitors’ apps, which as of the same date were rated between 4.3 to 4.9 stars in Apple’s Brazilian app store and 4.4 and 4.8 stars in Google Play. We use our proprietary tools and market measurement systems developed by third parties, such as Oracle and Google, to deepen our knowledge about consumer behavior and, consequently, optimize our marketing efforts and expenditures by customizing our sales messages to make it easier for users to understand, find and buy our products and services. Our marketing strategy is customized and we manage our desktop sites, mobile websites and mobile applications differently, each optimized for the screens they fit and the way our customers use them. In addition to our online and offline advertising efforts described above, we developed a broad range of marketing and sales channels to access potential clients, including: • Our own sales team, mainly focused on offering our POS devices and online products and solutions to larger clients, as well as on providing ongoing support to those clients; • Partner companies that distribute PagBank devices and solutions to their customer base (mostly point of sale solutions’ companies); • Third-parties hired as independent sale organizations to distribute our POS devices across Brazil; • Online store platforms and web development companies, which integrate PagBank as an exclusive or preferred payment method to their clients; and • Third-party call center service provider hired to answer calls, e-mails and chat inquiries from our clients and prospects, and to offer our devices and solutions. Customer Service We believe in excellence in customer service and we continually invest in our merchant and consumer relationships by providing continuous customer service, account support and innovative solutions. By helping our clients navigate our applications and answering their questions quickly, we have been able to grow rapidly and to build trust with our clients, which has increased their loyalty and enhanced our reputation. We provide our customers with an array of digital self-service features including real-time online chat, chatbots, customer service e-mail and a customer service hotline. We maintain service quality by placing emphasis on careful selection of our customer service personnel and regular monitoring of employee performance. Our employees are trained to have in-depth product and service knowledge, professional service attitudes and communication skills to best address customer needs and inquiries. Product Development and Technology We develop most of the software technology used by our digital payments and banking platform in-house, although we also outsource certain projects to outside developers in order to expedite the delivery of software and keep our time-to-market advantage. Through this combination of technology, developed both in-house and by outsourced developers, we have developed a stable, reliable, proprietary and highly scalable platform with intuitive user interfaces, management tools, transaction processing, APIS, and database and network applications that help our customers utilize our suite of products and services, while keeping their financial information confidential. 46 Table of Contents Our payments platform allows consumers to make purchases using a broad range of payment methods, regardless of where a merchant is located. For purchases made outside Brazil, we collaborate with local payment service providers. Our banking platform offers a large number of options for making transfers, paying bills, refilling prepaid phones and other wallets. It also includes a complete set of cards, including a cash card, a prepaid card and a credit card. We manage large volumes of system access data and transactions, with more than 99.96% availability in 2025, using internet data centers provided by Scala and outsourcing multi-cloud computing and other managed IT services provided by Compasso UOL S.A., or Compass, and EDGE.UOL Tecnologia Ltda., or EDGE.UOL, both are UOL group companies. Scala, Compass and Edge provide these services to UOL, PagBank and several other large clients. Our transactions per second monthly peak increased from 79 in June 2016 to 765 in December 2025, and our average monthly deployments increased by a multiple of 20.2 from 597 average monthly deployments in 2017 to 11,436 average monthly deployments in 2025. With our hybrid infrastructure, combining local data centers and multi-cloud computing, we are able to scale up our services while retaining high availability for peak – volume occasions such as Christmas, Mother’s Day and Black Friday. This high-availability and continuously deployed platform ensures that all of our clients are able to operate with the latest features and the newest innovations without needing to patch or upgrade their software. Our scale as a UOL group company allows us to establish favorable partnerships with several suppliers, including software developers and hardware manufacturers. Technology and innovation are in the DNA of the UOL group and are at the core of our business success, with products and engineering personnel representing 34.2% of the total headcount of PagSeguro (including outsourced staff) as of December 31, 2025. With our specialized team of 3,344 people focused on developing reliable, scalable and proprietary systems and new products and features, we regularly roll out innovative and disruptive solutions that are tailored to the Brazilian market. Our expenditure on software and technology (including salaries) amounted to R$1,184.2 million in the year ended December 31, 2025, R$1,154.9 million in the year ended December 31, 2024 and R$983.0 million in the year ended December 31, 2023. We strive to offer new features and formats to improve our users’ experience on our platform. This process starts by listening to suggestions from our clients. We hold focus group meetings and conduct surveys periodically with regular and highly active customers to obtain feedback regarding our products and services, as well as suggestions and ideas for new features. We test all new products and features rigorously in-house and with pilot groups of merchants before rolling them out. Once our internal team has ensured they are working properly, we typically roll them out first to a select group of customers on a trial basis, listening to feedback and suggestions and enhancing the final details of the product or feature before rolling out to all customers. We frequently update our software products and follow a regular software release schedule with improvements deployed periodically, ensuring our merchants get immediate access to the latest features. Managing our platform’s software architecture and hardware is as important as offering new products and features. We focus on optimizing our processes and equipment to help ensure that our systems are capable of handling our rapid growth in an efficient and cost-effective way. Our technology infrastructure simplifies the storage and processing of large amounts of data, automates many administrative tasks, and enables us to deploy and operate products and services on a wide scale. Our technology infrastructure is designed to reduce downtime in the event of system outages or catastrophic events, with continuity features, system redundancy and protection against cybersecurity threats. For further information on the measures we take to protect against cybersecurity threats, see “––Protecting Our Clients.” We strive to improve our technology infrastructure and platform continuously in order to enhance the customer experience and to increase security, efficiency and scalability. PagSeguro’s research and development activities are based on years of experience in solid agile practices. These activities are distributed among small teams, known as squads, which work in parallel on complex projects. In addition to our IT professionals, the squads consist of people from different disciplines, including our products department, domain-specific business areas, information security department and customer relationship management team, among others. The exact composition of each squad is different and appropriate for each context. People on the squads apply methods like Scrum and Kanban to manage their daily activities. In order to have a global view of our projects, we use a portfolio management system which utilizes dashboards containing the scope of each development cycle, the backlog and what has been deployed thus far. Our experimentation and decisions are guided by lean practices that are heavily based on factual, data-driven information and hypothesis validation, helping us optimize our prioritization. For hypothesis tests, we heavily use practices like AB tests (testing a hypothesis involving two variants), data analysis and inferences. Our squads are encouraged to have an open mind and engage in frank communications, while maintaining responsibility and an appropriate level of autonomy. Our efficiencies of scale, relentless cost discipline, and ongoing improvements to systems and processes. As our scale has expanded, our expenses have decreased when compared to our total revenue and income: for example, in the year ended December 31, 2025, our total expenses remained stable, at 87.5% of our total revenue and income from 87.3% in the year ended December 31, 2024, while revenue from transaction activities and other services and financial income, taken together, decreased to 96.7% of our total revenue and income from 97.5% in the year ended December 31, 2024. By maintaining our spirit of innovation combined with our focus on reducing costs, we intend to continue to drive costs down to achieve further profitable growth. We anticipate that we will continue to devote considerable resources to research and development in the future as we add new features and functionality to our products and services to strengthen and extend our digital banking solutions. Our market is characterized by rapidly changing and disruptive technologies, as well as evolving industry and regulatory standards, and we seek to remain in the front line of these changes. We believe our ability to adapt to rapidly changing technologies, products and services in an evolving industry is the cornerstone of our future success. For further information on the technological challenges in our industry, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Increasingly intense competition may harm our business.” 47 Table of Contents Protecting Our Clients Trust and security are essential to ensure success in the digital payments market. Fraud is one of biggest threats to our business and clients and may involve account takeover, identity theft and malicious counterparty activities. Our ability to protect our clients from financial loss and data theft has been a key feature contributing to our success and business growth, and we believe our security expertise will continue represent a major competitive edge in the future. We’ve been consistently investing in providing comprehensive protection for our clients, focusing on three main areas: transaction security; platform security; and customer service. The efforts we focused on the matter have brought us considerable recognition from the market and our clients — PagBank was awarded with the following: one of the “Best Company for Consumers” for electronic payments in 2016, 2017, 2018, 2019, 2021, 2022 and 2023; for payments in 2019; for online payments in 2015 and 2023; for bank and digital cards in 2023, as first place in the “Banks and Digital Cards – Major Operations” and “Payment Methods – Large Operations” in the Reclame Aqui Awards by Época magazine and Reclame Aqui, a consumer protection service. In 2022 and 2023, we were recognized as the best POS by Folha Top of Mind, and we ranked as one of the “World’s Best Banks” in Brazil in 2021, 2022, 2023 and 2024 published by Forbes. In 2025, we received several awards and recognitions. For more information on the awards and recognitions we received in 2025, see “—Sales and Marketing.” The efforts we focused on the matter have brought us considerable recognition from the market and our clients — PagBank was awarded with the following: one of the “Best Company for Consumers” for electronic payments in 2016, 2017, 2018, 2019, 2021, 2022 and 2023; for payments in 2019; for online payments in 2015 and 2023; for bank and digital cards in 2023; as first place in the “Banks and Digital Cards – Major Operations” and “Payment Methods – Large Operations” in the Reclame Aqui Awards by Época magazine and Reclame Aqui, a consumer protection service. In 2022 and 2023, we were recognized as the best POS by Folha Top of Mind, and we ranked as one of the “World’s Best Banks” in Brazil in 2021, 2022, 2023 and 2024 published by Forbes. In 2025, we received several awards and recognitions. For more information on the awards and recognitions we received in 2025, see “—Sales and Marketing.” • Transaction Security We have focused and is part of our culture since our launch on ensuring the security of payment transactions carried out on our ecosystem. We believe we have been a pioneer in developing technology and expertise against online fraud and chargebacks related to fraudulent transactions in Brazil, supported by the reputation of the PagSeguro and UOL brands. Our transaction approval rate of 79% remained at the same level compared to 2024 and our net chargeback rates for transactions in 2025 averaged 0.03%, representing a decrease of 21% from 2024. These results and the enhanced transaction security was a result of a combination of anti-fraud technology, the design of our platform, and protection programs for our clients. As is the case with any digital transaction, those that take place on our digital platform are susceptible to potentially fraudulent or improper sales. We use two main processes to control this fraud risk. The first process consists of monitoring credit card, debit card and boleto transactions on a real time basis, through systems that identify potential fraud. This process approves or rejects suspicious transactions at the time of the authorization, based on statistical models that are revised on an ongoing basis. The second process, which occurs after approval of the transaction, consists of a reconciliation process in which PagSeguro Brazil follows up on all chargebacks with the card issuers and, where appropriate, opens a claim process to seek reversal of the chargeback. This is a complementary process and increases our ability to avoid and manage chargebacks. Our antifraud platform combines proprietary features, such as internal risk modeling and scoring through AI and risk assessment tools that collect public and private market information, combined by advanced fraud combat tools such as biometric engine with facial recognition with liveliness detection features, as well as front-line third party solutions such as Feedzai, Emailage, Serasa Experian and Threatmetrics. For more information, see “—Platform Security.” The design of our platform also assists in preserving data confidentiality. Consumers can make payments through PagSeguro without sharing sensitive financial information such as credit card or debit card details with the merchant. Transactions on PagSeguro are tokenized and payment authorization credentials are kept separated from account holder’s information, helping us to better detect and prevent fraud when funds enter, flow through and exit our ecosystem. In addition, the ability to make and accept digital payments increases personal security in in-person transactions by reducing the need for both consumers and merchants to carry cash. 48 Table of Contents Our protection programs guard our clients from loss through fraud and counterparty non-performance. We believe the history and critical mass of our consumer database allows us to provide quicker and more reliable transaction approval when compared with smaller or more recently established digital payments providers in Brazil. Our protection programs, which apply to online purchase transactions completed through our ecosystem, aim to reassure consumers the confidence that they will only be required to pay if they receive the product in the condition as described, and merchants the confidence that they will receive payment for the product that they are delivering to the customer. Our merchant program protects against losses for chargebacks related to fraudulent transactions and similar claims on substantially all of our online transactions. A chargeback situation may also occur if the card used was unauthorized or if there is a non-fraudulent cardholder claim. If a chargeback claim is valid, the card issuer sends the transaction back to the merchant and charges the merchant the amount of the questioned sale. If the merchant cannot remedy the chargeback, it is the merchant’s loss. If there are not sufficient funds in the merchant’s account, the chargeback amount is charged to the acquirer. For consumers, we provide protection against losses under which they can submit a claim if there is a problem with a purchase. The consumer can file a claim through our PagSeguro website, in which case the consumer and the merchant can seek to resolve the claim together. If they cannot resolve the claim within seven days after the claim is filed, the consumer has up to 20 days after filing the claim to request our assistance, in which case we act as mediator to help resolve the issue with the merchant. If a consumer does not request mediation within 20 days after filing a claim, the claim will be resolved in favor of the merchant. • Platform Security The architecture of our proprietary end-to-end payments platform coupled with third-party front-line solutions are key to our ability to provide consumers and merchants with continuity and security in their transactions. Through our numerous cash-in and cash-out options we are able to collect data from our clients, which allows us to save important information on customers for purposes of the approval of future transactions. The multiple layers of protection included in our platform help ensure continuity as well as addressing the cybersecurity risks discussed in “—Transaction Security” above. We have developed intuitive user interfaces, customer tools and transaction processing and database and network applications that help our users complete transactions reliably and securely, both on our platform and on merchant sites integrated with PagSeguro. Our technology infrastructure simplifies the storage and processing of large amounts of data, facilitates the deployment and operation of large-scale global products and services, and automates administrative tasks. This technology infrastructure has been designed around industry-standard architectures to reduce downtime in the event of outages or catastrophic occurrences. We periodically conduct risk assessments on our business processes and critical assets, identifying the need for the adoption and improvement of our continuity and contingency plans, as well as following an extensive testing program on our business continuity and disaster recovery plans. In addition, we regularly adapt our environment monitoring activities to reduce the time to identify and respond to cyberattacks and improving the resilience of the environment whenever necessary. We work hard to improve our technology infrastructure continuously in order to enhance customer experience and increase efficiency, scalability and security. We also make use of well-known security protocols and solutions to secure user data and have obtained industry-recognized certifications. The service providers’ data centers that we use to storage our equipment are also certified under the International Organization of Securitization, or ISO, standards 9001, 20000 and 27001. We also perform security penetration tests on a regular basis and apply top-most security solutions for code and application scanning (SAST/DAST). We maintain a private “Bug Bounty” program for identifying bugs and security vulnerabilities in our systems and applications exposed on the Internet. For information on new data protection regulations, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches.” Our platform’s architecture enables us to connect all parties regardless of whether the transaction is occurring at a traditional physical location (such as inside a store), a non-traditional physical location (such as in a park), or online, and whether through a mobile or fixed-line device. We believe that mobile devices, in addition to being the future of e-commerce, create opportunities to make digital payments safer. For example, we are able to use location data from mobile devices to reduce risk for our clients. 49 Table of Contents • 2021 MOIP Cybersecurity Incident Following our acquisition of our subsidiary MOIP in October 2020, which represented less than 3% of our consolidated assets as of December 31, 2021 and less than 2% and 1% of our consolidated revenue and net income, respectively, for the year ended December 31, 2021 and was shut down in December 23, 2023 with its functionalities transferred to PagBank’s online platform, we discovered that MOIP was involved in a cyberattack between September 25 and September 29, 2021. The hackers demanded that specified payments be made to prevent the public disclosure or sale of the targeted data that was compromised in the incident, which included personal profile information of MOIP customers. At the time of the incident, MOIP had a distinct and separate IT server and operating environment from the rest of our IT platform and systems, and therefore none of our databases, customer information or systems were subject or comprised, or formed part of the compromised data, beyond those independently within the MOIP IT environment. We promptly followed the requirements of applicable Brazilian law, including the filing of a formal report to the ANPD and the Central Bank on October 7, 2021. After completion of the assessment, without financial impacts, we provided further information regarding the incident to the ANPD on January 5, 2022 through a complementary form. On March 11, 2022, the ANPD requested that MOIP provide more information regarding the incident, specifically requesting a technical report detailing its scope and the measures taken by MOIP after the incident, as well as the communications MOIP sent or intended to send to its customers. MOIP provided a response to ANPD on April 8, 2022. Since then, we have not received any new requests about this incident from ANPD. On February 9, 2024 ANPD decided to archive the report, with no additional measures or information being required regarding the incident. During the review of the incident, we have not identified evidence of unauthorized access to sensitive information, such as passwords or credit card details. The cyberattack has not had a material adverse impact on our business, financial condition or customers, and our IT systems. The security and fraud prevention teams continued to monitor the incident throughout 2023, and we did not observe any relevant impact on our business. As a result of a business decision, MOIP’s operations and IT environment were deactivated, and all existing features and resources were migrated to PagSeguro’s IT server and operating environment. For more information about related risks, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—Our business is subject to cyberattacks, in addition to security (including cybersecurity) and privacy breaches.” Environmental, Social and Corporate Governance (ESG) We are committed to ESG matters and have established a dedicated ESG committee. Our ESG committee determines our ESG strategy and supervises our performance in respect of ESG matters. Our ESG Committee meets annually, and our main executive officers and board members participate in those meetings to ensure that ESG-related topics remain central in our business. As a result, we have improved our practices in recent years and received several recognitions and awards. For more information on our ESG initiatives, see our annual sustainability report available in our investor relations website at https://investors.pagbank.com/. Our annual sustainability report is not incorporated by reference in this annual report. Regulation of the Payments and Banking Industries in Brazil Our activities in Brazil are subject to Brazilian laws and regulations relating to the payments industry. Law No. 12,865/2013, dated October 9, 2013, or the Payments Industry Law, regulates the payments industry within the overall Brazilian Payment System (Sistema de Pagamentos Brasileiro), or SPB. This law created the concepts of payment schemes (arranjos de pagamento), payment scheme owners (instituidores de arranjos de pagamento) and payment institutions (instituições de pagamento). The Payments Industry Law also granted the Central Bank and the CMN the power to regulate entities that operate in the Brazilian payments industry, including those operating in digital environments, with powers to oversee the incorporation and operation of these entities, risk management, the opening and managing of payment accounts, the transfer of funds to and from payment accounts, and the rendering of acquiring services, among others. In 2013, the CMN and the Central Bank implemented a regulatory framework with respect to the operation of payment schemes and payment institutions, by means of the enactment of several resolutions. Further, from 2018 through the date of this annual report, the CMN and the Central Bank enacted additional regulation amending the previous rules and introducing, among others matters: (i) a formal definition of sub-acquirers, setting forth the conditions that require sub-acquirers to use centralized settlement through the Brazilian Interbank Payments Clearinghouse (Núclea); and (ii) a cap on interchange fees in debit and prepaid cards The rule currently applicable to interchange fees (Resolution No. 246/2022) establishes a maximum interchange rate of 0.5% for debit card issuers and 0.7% for prepaid card issuers. It also provides that debit and prepaid card transactions are subject to the same settlement deadlines (i.e., the deadline for making funds available to merchants). The regulatory framework of the Brazilian payments industry also provides that: (i) sub-acquirers are participants in open-loop payment schemes that enable merchants to accept payment instruments, without directly participating in the settlement process; (ii) the owners of those schemes (such as Visa and Mastercard), either directly or through acquirers, may impose on sub-acquirers obligations relating to compliance with applicable regulations and scheme rules; (iii) sub-acquirers that also offer prepaid payment accounts may act as settlement account institutions (i.e., holding merchants’ settlement accounts) within a payment scheme; and (iv) interoperability between open-loop and closed-loop payment schemes is permitted. For more information, see “—Payment Schemes.” 50 Table of Contents Payment Schemes A payment scheme, for Brazilian regulatory purposes, is a set of rules and procedures governing certain payment services provided to the public with direct access by its end users (i.e., payors and receivers). In addition, such payment service must be accepted by more than one receiver in order to qualify as a payment scheme. Not all payment schemes are subject to regulation, including licensing requirements and supervision by the Central Bank. The regulatory framework provides for supervision of payment schemes that are considered relevant and, thus, included in the SPB. The criteria for such classification depend on certain characteristics, as follows:  payment schemes that exceed certain thresholds on number of payment transactions or aggregate value of transactions are considered to form part of the SPB and are subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain authorization by the Central Bank;  payment schemes that operate below these thresholds are not considered to form part of the SPB and are therefore not subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain authorization from the Central Bank, although they are required to report certain operational information to the Central Bank, if so requested by the regulator. Furthermore, the Central Bank can issue an order requiring these payment schemes to apply for authorization to be part of the SPB on a case-by-case basis. In case an operational threshold is met, the payment scheme becomes part of the SPB and an application must be filed, but the payment scheme can continue to operate as usual until the authorization is granted by the Central Bank;  limited-purpose payment schemes are not considered part of the SPB and, therefore, are not subject to the legal and regulatory framework applicable to the payments industry in Brazil, including the requirement to obtain Central Bank authorization. Limited-purpose payment schemes are those whose payment instruments are: (i) accepted only at the network of merchants that clearly presents the same visual identity as the issuer, such as franchisees and other merchant licensed to use the issuer’s brand; (ii) intended for payment of specific public services, such as public transportation and public telecommunications; (iii) related to employee benefits established by law (such as meal vouchers) or (iv) issued and accepted exclusively in the scope of a closed-loop payment scheme and intended for payment of specific services as set forth by Central Bank Resolution No. 150/21; and  certain types of payment schemes have specific exemptions from the requirement to obtain authorization from the Central Bank, as, for example, payment schemes set up by governmental authorities, closed-loop payment schemes set up by certain financial institutions and closed-loop payment schemes set up by an authorized payment institution in which financial settlement of payment transactions are carried out exclusively using the book-transfer method. Moreover, there are two key types of payment schemes:  closed-loop payment scheme (arranjos de pagamento fechados), in which payment services (management of payment account, issuance and acquiring) are all carried out by the same entity that is the payment scheme owner or by an entity that controls or is controlled by or is under the same control as the payment scheme owner; and  open-loop payment schemes (arranjos de pagamento abertos): all other payment schemes that do not fall under the closed-loop category. Payment Scheme Owners Payment scheme owners, for Brazilian regulatory purposes, are the legal entities responsible for managing the rules, procedures and the use of the brand associated with a payment scheme. Central Bank regulations require payment scheme owners to (i) be incorporated in Brazil; (ii) have a corporate purpose compatible with payments activities; (iii) have the technical, operational, organizational, administrative, and financial capacity to meet their obligations; (iv) have clear and effective corporate governance mechanisms that are appropriate for the needs of payment institutions and the users of payment schemes; (v) implement rules and procedures contemplating risk management of the participants, minimum operational requirements to be observed by the participants, monitoring of fraudulent actions, settlement of transactions among participants, and interoperability mechanism, among others. Payment scheme owners that are responsible for managing open-loop payments schemes that are part of the SPB are also subject to: (i) rules that impose the creation of internal control systems and procedures; (ii) bank secrecy rules; (iii) administrative sanctioning process of the Central Bank; (iv) risk management within the payment scheme; and (v) the application of preventive measures by the Central Bank, in order to ensure the soundness, efficiency and regular functioning of payment schemes. 51 Table of Contents Recent Regulatory Developments On November 10, 2025, the Central Bank of Brazil issued Resolution No. 522/2025, which amended Resolution No. 150/2021. The new framework strengthens centralized risk management in payment schemes, expressly allocating to payment scheme owners (networks) ultimate responsibility for ensuring the settlement of all transactions to receiving users, including, if necessary, using their own funds where existing protection mechanisms are insufficient. Resolution No. 522 also enhances transparency over risk allocation and financial risk mitigation tools, and prohibits delegation of sub-acquirer oversight, such that payment scheme owners are solely responsible for monitoring participants’ risks and may not delegate sub-acquirer risk management to acquirers. It also reinforces “honor all cards” rule, prohibits the requirement of collateral among participants, limits participants’ financial liability arising from chargebacks to 180 days from transaction authorization (after which, liability shifts to the scheme owner, within the maximum timeframe provided for in the payment scheme rules), and strengthens controls on fraud prevention, anti-money laundering/combating the financing of terrorism, or AML/CFT, as well as conduct standards with payers. The rule further advances interoperability, information sharing, authorization/change/cancellation processes for arrangements, full participation of sub-acquirers in centralized clearing and settlement, and transparency of fees charged within arrangements. As a result of the structural changes to risk management, scheme owners must, by May 9, 2026, (i) submit to the Central Bank of Brazil requests for authorization to amend the rules of their payment schemes to reflect the new framework and (ii) implement the full participation of all sub-acquirers in centralized settlement, along with related operational interfaces (including information exchange between settlement infrastructures and receivables registries) and enhanced fees and penalty disclosures. The Central Bank regulations also allow payment schemes to set forth additional rules for entities that use their brands. Since we participate in these third-party payment schemes, we must comply with their rules to continue accepting payment instruments bearing their brands Payment Institutions Pursuant to Central Bank regulations, payment institutions are classified into the following types:  issuers of electronic currency (i.e., e-money, generally in the form of prepaid deposits): these payment institutions manage prepaid payment accounts for cardholders or end users, carry out payment transactions using electronic currency deposited into these pre-paid accounts, and convert the deposits into physical or book-entry currency or vice versa;  issuers of post-paid payment instruments (mainly credit cards): these payment institutions manage payment accounts where the cardholder or end-user intends to make payment on a post-paid basis, and they carry out payment transactions using these post-paid accounts;  acquirers: these payment institutions do not manage payment accounts but enable merchants to accept payment instruments issued by a payment institution or by a financial institution that participates in a payment scheme. They participate in the settlement process for payment transactions by receiving the payment from the issuer of the prepaid or post-paid instrument and settling with the merchant; and  payment initiation service providers: these payment institutions provide payment initiation services without managing payment accounts nor holding, at any time, the transferred funds, and they may not store end-users credential data used to authenticate payment transactions. Specific regulations issued by the Central Bank of Brazil have recently amended the authorization framework applicable to payment institutions. As per Resolution 80/21 (as amended by Resolution 494/25) all types of payment institution must obtain prior authorization from the Central Bank to start operating. Resolution 80/21 (as amended by Resolution 494/25) also established a transitional regime applicable to non-authorized issuers of electronic currency who started to operate before March 1, 2021 and to non-authorized issuers of post-paid payment instruments and acquirers who start operating before September 2, 2025 – those entities may continue to operate and must file an authorization request with the Central Bank between May 1, 2026, to May 31, 2026. Certain financial institutions are waived from requiring an authorization from the Central Bank to render certain payment services. In addition, certain payment institutions are not subject to the legal and regulatory framework applicable to the payments industry in Brazil. This applies, for example, to payment institutions that only participate in limited-purpose payment schemes and payment institutions that provide services in the scope of programs set up by governmental authorities and payment schemes related to employee benefits established by law. 52 Table of Contents Applicable regulations provide that payment initiation service providers must obtain Central Bank authorization prior to providing services. Any payment institution already licensed in another modality may operate as a payment initiation service provider, provided a 90-day prior notification is sent to the Central Bank. A payment institution must be incorporated in Brazil and must have a corporate purpose that is compatible with payments activities, and, once they become part of the SPB, as described above, they must comply with several requirements. CMN and Central Bank regulations applicable to payment institutions that are part of the SPB cover a wide variety of issues, including: (i) Central Bank homologation of their officers and directors; (ii) Central Bank’s prior approval of the transfer of corporate control; (iii) minimum corporate capital and net equity, which has been recently updated by Joint Resolution No. 14, dated November 3, 2025 issued by the Central Bank/CMN and Resolution No. 517, date November 3, 2025, issued by the Central Bank; (iv) implementation of internal controls and procedures; (v) establishment of an ombudsman’s office; (vi) preparation of accounting statements pursuant to the Standard Chart of Accounts of the National Financial System (Plano Contábil das Instituições do Sistema Financeiro Nacional), or COSIF; (vii) implementation of operational, liquidity, market and credit risk management structures; (viii) anti-money laundering and know-your-client requirements; (ix) banking secrecy rules; (x) settlement of payment transactions arising under open-loop payment schemes at Nuclea’s centralized settlement system; (xi) establishment of an audit committee, as the case may be; (xii) adoption of directors and officers compensation policies; and (xii) administrative penalties for non-compliance, among others. Acquires must also integrate with an authorized registration entity to register all merchants’ receivables and settle transactions in accordance with the information provided in such entities’ systems. The regulations applicable to payment institutions also cover payment accounts (contas de pagamento), which are the end-user accounts, in registered (i.e., book-entry) form, which are opened with payment institutions that are issuers of prepaid or post-paid instruments and used for carrying out each payment transaction. In order to provide protection from bankruptcy, the Payments Industry Law sets forth that funds deposited in prepaid payment accounts are considered segregate net equity (patrimônio segregado), i.e., such funds are segregated from the payment institution’s own assets. For further information, see “—Segregate Assets.” Regulation of the Banking Industry In January 2019, we acquired BBN Banco Brasileiro de Negócios S.A. (renamed to BancoSeguro S.A. in February 2019), through BS Holding, a holding company incorporated under PagSeguro Digital, whose sole purpose is to hold interest in financial institutions, as required by applicable banking regulations. BancoSeguro holds a multi-bank license to provide financial services, has commercial and investment bank portfolios, and is duly authorized by the Central Bank to perform banking operations in accordance with current regulation. In addition, on December 14, 2021, BancoSeguro was authorized by the Central Bank to operate in the foreign exchange market. Banking activities in Brazil are governed by Law No. 4,595/1964, which created the CMN, granting it powers to, among others, regulate the establishment and operation of financial entities, and empowered the Central Bank to supervise public and private financial institutions and, when needed, apply the applicable penalties. The Central Bank also controls and approves the operation, transfer of control, and corporate reorganization of financial institutions, as well as the transfer of the location of its branches (in Brazil or abroad). The CMN and the Central Bank created a vast regulatory framework regulating the National Financial System which may impact BancoSeguro’s operations and future products. In this regard, BancoSeguro must observe certain key governance, compliance, and supervision requirements applicable to all the institutions that are part of the National Financial System, such as:  complying with minimum capital requirements by the Central Bank/CMN, compulsory deposits requirements, fixed asset investment limits, limits on exposure to foreign currency, and limits to charge fees and commissions for certain financial services;  maintaining internal controls and procedures and risk management structures;  observing “know your customer,” anti-terrorist, anti-money laundering, and cybersecurity rules;  maintaining an ombudsman office;  preparing accounting statements pursuant COSIF;  complying with additional regulations from other agencies that are specific to banking activities, such as the CVM’s fundraising rules;  observing limits to acquire real estate properties not intended to be used by BancoSeguro, except when such properties are received as payment of non-performing or doubtful loans, or when expressly authorized by the Central Bank, and in accordance with rules to be issued by the CMN; and  observing legal requirements to operate with related parties. Financial institutions are also members of the SPB. Under the SPB, the Central Bank has control over the banks’ reserve accounts through the Reserve Transfer System – STR, a computerized system which enables the online transfer of funds between financial institutions and constitutes a strict control of bank balances. 53 Table of Contents In addition to regulations applicable to the financial system, BancoSeguro is also subject to laws relating to bank secrecy, consumer protection, tax, and other regulations applicable to Brazilian companies generally. Securities Regulations Multi-purpose banks with an investment banking portfolio (also known as investment banks), such as BancoSeguro and securities broker-dealer (corretora de títulos e valores mobiliários), such as PagInvest, may, among other roles, provide securities distribution, intermediation, and custody services, which are subject to Brazilian securities laws and regulations. The main laws governing the Brazilian capital markets are Law No. 4,728/1965 and Law No. 6,385/1976. Among other provisions, they regulate the distribution and issuance of securities in the market, the trading of securities and the settlement and/or clearance of securities transactions. The securities regulatory framework in Brazil is further supplemented by regulations issued by the CMN, the CVM, the Central Bank, and self-regulation policies, such as those issued by various associations, over-the-counter organized markets, and securities exchanges, that govern their members and participants (for example, the B3 and the ANBIMA). In addition to the regulatory and supervision powers of the Central Bank, all Brazilian financial institutions are subject to oversight by the CVM when they participate in the Brazilian capital markets (such as BancoSeguro and PagInvest). Multi-purpose banks with an investment banking portfolio are also regulated by CMN Resolution No. 5,046/22, which allows these entities to carry out, among others, the following activities in the capital markets: (i) participate in the processes of issuance, subscription for resale and distribution of securities; (ii) enter into securities purchase and sale transactions, for their own account or for the account of third parties; (iii) operate in commodities and futures exchanges, and in organized OTC (over the counter) markets, on its own or third-parties’ account; and (iv) coordinate reorganization and restructuring processes of companies and conglomerates, through consultancy services, equity interest and/or granting of funding or loans. Investment banks are also allowed to provide other services in the securities market, such as bookkeeping, custody, and management of third-parties’ assets, among others. Furthermore, the investment fund industry was fundamentally changed by CVM Resolution No. 175/2022, enacted in December 2022, and partially in force since October 2023, which aims to bring the local investment funds industry up to international standards. As currently BancoSeguro acts as an investment fund quotas distributor to its clients, it is only partially affected by the changes implemented by the regulation. This main change implemented by this latest CVM resolution with respect to the distribution side of the investment fund industry is related to the commercial relationship to be established between the distributor and the other members of the investment industry. With the new regulation, which is currently in effect, the distribution side will be hired by the fund manager, instead of the administrator (as established under the previous regulation). Thus, we expect to have a larger pool of counterparties in our contracts for the distribution of third-party funds, as there are more fund managers than administrators. Developments in the Regulation of the Brazilian Banking and Payments Industries We summarize below rules and regulations that have been issued or modified by law or regulation of the CMN and the Central Bank and other authorities in recent years. We believe these laws and regulations are the most relevant and impactful to our business and the industry as a whole. This summary is qualified in its entirety by the full text of the rules and regulations that are publicly available, which is not incorporated by reference into this annual report. Instant Payments (Pix) In February 2020, the Central Bank announced its 24/7 instant payments platform, which operates under the name “Pix.” It was launched in November 2020, pursuant to Central Bank Resolution No. 1/2020, as a new instant payments scheme operated by the Central Bank, which, by promoting the digitalization of payments, is intended to foster competition, reduce social costs associated with paper-based instruments and provide a better payment experience for Brazilians. Pix is based on a centralized and sole settlement infrastructure operated and maintained by the Central Bank, the Instant Payments System (Sistema de Pagamentos Instantâneos – SPI) and in a Transactional Account Identifier Directory (Diretório de Identificadores de Contas Transacionais – DICT), where all final users’ information and corresponding accounts are stored. Participation in Pix is mandatory for authorized financial institutions and payment institutions with more than 500,000 active customer accounts, considering deposit accounts, savings accounts and prepaid payment accounts. As per Central Bank Resolution No. 429/2024, only institutions authorized to operate by the Central Bank will be able to apply to join Pix. In addition to the traditional functionalities of Pix (i.e., transferring funds between individuals and/or legal entities), the Central Bank has been developing new tools that are being integrated with Pix, enabling new possibilities to use Pix in different contexts. The following features have been recently developed by the Central Bank: ▪ Pix Collection (Pix Cobrança): Pix Collection enables a receiving user to manage and receive collections related to: o immediate payments, which are those related to business models in which payment must be made at the same time of the collection, such as physical points of sale and e-commerce; o payments with maturity date, which are those related to business models in which the payment can be made at a future date, with the possibility of covering interest, fines, other additions, discounts and other rebates; and o payments related to the facilitation of cash withdrawal service, which are those related to the receipt of Pix transactions for cash withdrawal or change purposes, as requested by the withdrawing person, to enable the availability of funds to the paying user under Pix Withdrawal and Pix Change products. 54 Table of Contents  Pix Withdrawal and Pix Change (Pix Saque and Pix Troco): Pix Withdrawal consists of a transaction in which a payer user, holding a transactional account in any Pix participant, issues a Pix for the purpose of making a withdrawal from their transactional account to the transactional account of a withdrawal service facilitator or withdrawal agent, receiving funds in cash in an amount corresponding to the payment made. Pix Change consists of a transaction in which a payer user, holding a transactional account at any Pix participant, upon making a purchase at a withdrawal agent which is a merchant or a corresponding withdrawal facilitator service, issues a Pix from their transactional account to the transactional account of the withdrawal agent, for the purpose of receiving funds in cash in an amount corresponding to the difference between the Pix for the purpose of change and the purchase amount.  Scheduled Pix (Pix Agendado): Scheduled Pix consists of the possibility of a payer user to schedule a Pix on a certain future date. The request for a Scheduled Pix should be retained in the internal systems of the transactional account provider participant, not affecting the transactional account balances of the payer user, until the time the Pix is actually completed. In case of lack of sufficient funds in the payer user’s account on the scheduled date for Pix, the transaction is not authorized.  Automatic Pix (Pix Automático): In September 2024, the Central Bank released new resolutions with rules for a new feature of its Pix payment system called Pix Automático. The Automatic Pix is designed for recurring transfers, and only businesses can generate Automatic Pix charges. Automatic Pix creates new opportunities for companies that mainly serve other businesses. The Central Bank plans to fully launch Automatic Pix in June 2025.  Contactless Pix (Pix por Aproximação): Contactless Pix is a new feature of Pix, which, by using NFC (Near Field Communication) technology, allows payer users to make payments by simply holding their device near the recipient’s device. It is now to perform contactless payments with Pix through a digital wallet or app of the institution where the payer has an account. Pursuant to Central Bank Resolution No. 482/2025, the Pix Regulation was amended to formally introduce initiation by proximity (NFC). Participants offering this modality must comply with the Pix Initiation Standards Manual “Manual de Padrões para Iniciação do Pix” as of December 1, 2025. Fraud Prevention On September 23, 2021, the Central Bank issued Resolution No. 142/2021, introducing security requirements to be adopted by institutions under its regulation and supervision to prevent fraud in the provision of payment services by financial institutions, other institutions authorized to operate by the Central Bank, and payment institutions that are members of the SPB. Pursuant to the resolution, such institutions are required to limit the provision of payment services during the nighttime period to a maximum amount per deposit or prepaid payment account, as applicable, and financial and payment institutions must implement (i) procedures aimed at evaluating the customer prior to offering the same-day receivables advance feature; and (ii) daily registration of fraud or attempted fraud occurrences, including the corrective measures adopted by the institution. Based on these records, the institutions must prepare a monthly report consolidating the occurrences and the preventive and corrective measures adopted, which report must be forwarded to the institution’s audit and risk committees, internal audit unit, executive board and board of directors, as applicable. The Central Bank issued an additional resolution, which, among other matters, sets forth security mechanisms specific to Pix transactions, including the obligation of the receiving institution to perform fraud assessment of Pix transactions and precautionary blocking of funds. If necessary, in case of sufficient indications of fraud or because of operational failure in the systems of one of the participant institutions, the relevant funds may be reversed to the payer by means of the “Special Return Mechanism.” Additionally, on September 5, 2025, the Central Bank published new rules applicable to payment and financial institutions, and IT service providers (PSTIs), aimed at enhancing security in the National Financial System. In this context, Central Bank has established that PSTIs must maintain risk management policies aimed at addressing, at a minimum: (i) information and cybersecurity; (ii) business continuity; (iii) operational crisis management; (iv) fraud management; (v) internal controls and compliance; and (vi) internal audit. As an additional security measure, the Central Bank has also set forth that unauthorized IPs payment institutions or institutions linked to the National Financial System Network (RSFN) through PSTIs must observe a R$15,000.00 cap on transactions and that this limit does not apply if the institution uses accredited PSTIs and submits a reasonable assurance report, issued by an independent auditor, regarding compliance with certain security requirements. On the same date, the Central Bank issued rules establishing the PSTI accreditation process, requiring providers to apply for accreditation within eight months under the new rules. Institutions may request exemption from the transaction limit. Exemptions will be valid once approved by the Central Bank, for a period of 90 days or until the PSTI is accredited and the report is submitted, whichever occurs first. Furthermore, the CMN and the Central Bank enacted a joint resolution setting forth the requirements related to sharing data and information in the event a fraud is detected and established the necessary measures for such sharing. In addition, Central Bank’s Resolution 343/2023 establishes that financial institutions, payment institutions and other institutions authorized to operate by the Central Bank, for purposes of data retention, shall consider signs of actual or attempted fraud at least in the following activities: (i) opening deposit accounts or payment accounts; (ii) providing payment services; (iii) maintaining deposit accounts or payment accounts; and (iv) contracting credit transactions. 55 Table of Contents The new rules also set forth that records containing indications of actual or attempted fraud must contain at least (i) the identification of whoever perpetrated or attempted to perpetrate the fraud; (ii) a description of the indications of actual or attempted fraud; (iii) details of the institution responsible for recording the information; and (iv) details of the recipient account and its holder if the activity is a payment service. On July 22, 2024, the Central Bank issued Resolutions No. 402 and No. 403, which came into effect on November 1, 2024, to enhance the overall security of the Pix system. Under the new rules, transactions can still be initiated from unregistered devices for amounts of up to R$200, with a daily limit of R$1,000. However, for transactions exceeding these amounts, the device must be registered in advance by the customer. Additionally, to further secure fund transactions, the Central Bank mandates that Pix participants implement a fraud risk management solution that utilizes security information from the Central Bank to identify unusual transactions. Pix participants must also provide easily accessible information to customers about fraud prevention measures and are required to check every six months for fraud markings in the Central Bank database, which will influence how they manage clients flagged for fraud risks. In September 2025, the Central Bank issued Resolution No. 501 that provides that Brazilian financial institutions and licensed payment institutions must reject payment transactions destined to demand deposit, savings, or prepaid payment accounts where there is well-founded evidence of fraud, with the receiving institution required to notify the account holder of the measure. Institutions may determine suspicion using their own factors and data sources, including public or private databases. In addition, Resolution No. 518 of November 3rd, 2025, amends the framework for opening, maintaining, and closing payment accounts by mandating payment account closure where there are material irregularities in customer information or where the account is used by the holder to provide financial or payment services within the Brazilian Financial System or Payments System without legal basis or in noncompliance with applicable regulations. The rule provides a non-exhaustive example covering the use of payment account funds to make or receive payments, or to settle obligations, on behalf of third parties in a manner that could conceal or substitute third-party obligations and prevent their identification. Institutions must adopt and obtain approval from the management board for the internal criteria for such determinations, may rely on public or private databases, and must retain related documentation for at least ten years. Open Finance On May 4, 2020, the Central Bank and CMN published Joint Resolution No. 1/2020, amended by Joint Resolution No. 10 of July 4, 2024, setting out the framework for the implementation of open finance in Brazil. Open finance is the standardized sharing of data, products and services by financial institutions, payment institutions and other institutions licensed to operate by the Central Bank, at their customers’ discretion, through the opening and integration of their systems. Therefore, open finance is considered by the Central Bank as an important tool for innovation in the financial and payments markets, and is expected to make such sectors more efficient, inclusive and competitive. Based on the model used in the United Kingdom, open finance in Brazil operates through APIS and customers’ consent is always required before any data sharing. The CMN and the Central Bank continue to regulate open finance since its implementation, introducing new regulations aimed at enhancing payment transactions via the Pix instant payment scheme, simplifying payment initiation processes, facilitating contactless payments, providing for a new framework for governance (including the foundation of the Open Finance Association), making adjustments to mandatory participation requirements for institutions in the open finance ecosystem and including the ability for payment initiation service providers to offer services without redirecting users to other platforms, thereby streamlining contactless payments and improving user experience. As of January 2025, all institutions with over five million customers have been required to participate in data sharing within the open finance ecosystem, while smaller institutions will have the option to opt-in voluntarily. Therefore, the prudential conglomerate led by PagSeguro will also have to participate in the data sharing of Open Finance. Open finance is under gradual legal, operational and technological development and implementation in Brazil, according to certain stages defined by the Central Bank, which are still ongoing. Consequently, as of the date of this annual report, some of the applicable requirements and standards that will need to be complied with by open finance participants are still under discussion and preparation by a self-regulatory body created specifically for this purpose, as well as by the Central Bank itself. Foreign Exchange Transactions Law No. 14,286/2021, or the New Foreign Exchange Law, was published in December 2021 and became effective in December 2022. It includes provisions relating to Brazilian investment abroad and foreign capital in the country. The main goals of the New Foreign Exchange Law are to liberalize the Brazilian foreign exchange market, which faces regulatory complexity and certain inconsistencies, to modernize the system and to increase innovation and competition. 56 Table of Contents According to the Central Bank, this new legislation may have a positive impact on attracting foreign capital, for investments in the financial and capital markets and other forms of direct investment, which includes long-term investments in infrastructure and concession projects. In addition to greater international insertion, the New Foreign Exchange Law contributes to the greater international use of the real, facilitating the use of domestic currency in international financial transactions, such as allowing the entry and remittance of payment orders in Brazilian reais from accounts in Brazilian reais held by foreign financial institutions with banks in Brazil. The main aspects of the New Foreign Exchange Law are: (i) confirmation, from a legal perspective, that foreign exchange transactions of any amount may be carried out without limitation, provided they are carried out through entities authorized to operate in the Brazilian financial and payments markets and subject to applicable rules; (ii) granting of broad powers to the Central Bank to regulate the foreign exchange market and its operations; (iii) expanding the international correspondence activity of Brazilian banks; (iv) implementing the possibility of Brazilian banking institutions to invest and lend abroad funds raised in Brazil or abroad; and (v) granting powers to the Central Bank to establish situations in which the prohibition of private offsetting of credits between residents and nonresidents, as well as the payment in foreign currency in Brazil, would not apply. Foreign currency purchase and sale transactions in an amount of up to US$500, carried out between individuals on an occasional and non-professional basis are not subject to the provisions of the New Foreign Exchange Law. Recent Developments on Foreign Exchange Regulation Following the enactment of the New Foreign Exchange Law, the CMN and the Central Bank have issued new rules in order to enhance foreign exchange and international capital regulation, considering technological innovations and new business models relating to international payments and transfers. The new rules seek to promote a more competitive, inclusive and innovative environment for providing services to citizens and companies that send or receive funds from abroad. The rules enacted in 2022 and 2023 allow: (i) authorized payment institutions to operate in the foreign exchange market, operating exclusively through electronic means, as of July 1, 2023; (ii) non-banking institutions authorized to operate in the foreign exchange market (such as securities brokerage companies, foreign exchange brokerage companies and payment institutions) to directly use their foreign currency accounts held abroad to settle transactions carried out in the foreign exchange market; (iii) Brazilian exporters to also receive export revenues in a payment account held in their name with a financial institution abroad or in an account abroad of a non-banking institution authorized to operate in the foreign exchange market; (iv) the receipt or delivery of reais in foreign exchange transactions, without amount limitation, to also occur from the customers’ payment accounts held with financial institutions and other institutions authorized to operate by the Central Bank or in payment institutions participating in the Pix instant payment scheme; and (v) prepaid payment accounts in reais to be held by residents, domiciled or headquartered abroad. The regulation of international payment or transfer services in the foreign exchange market have also been consolidated and modernized, providing an equal treatment for purchases of goods and services carried out with the participation of issuers of international cards, international payment facilitators and intermediaries/representatives in cross-border transactions. Since October 2021, such services became classified in the foreign exchange regulations by the term “eFX.” Moreover, the execution of current unilateral transfers and fund transfers through the eFX system between accounts held by the customer in Brazil and abroad, of up to US$10,000.00, has also been allowed. In addition, the new regulatory framework has (i) simplified the classification codes adopted in foreign exchange transactions by reducing the number of codes; (ii) streamlined registration procedures applicable to direct foreign investments in Brazil and the respective reporting requirements to the Central Bank; (iii) established that a bank account or payment account held by foreigners shall receive equal regulatory treatment when compared to a bank account held by account holders with residence or domicile in Brazil (except in certain specific cases); and (iv) eliminated the need for simultaneous foreign exchange transactions for the conversion of debt or other forms of investment into foreign direct investments and for the granting of loans to foreign investors when there is no actual flow of funds involved in the underlying transaction. Further, on December 3, 2024, the Central Bank and the CVM issued Joint Resolution No. 13, which replaced previous regulation and introduced new rules for foreign investors in Brazil’s financial and securities markets (also known as portfolio investments). The goal of the regulations is to simplify and modernize procedures for non-resident investors, making them more efficient and in line with international standards. The key changes in the new rules, which became effective on January 1, 2025, include:  treating resident and non-resident investors equally in terms of minimum registration requirements; o eliminating the need for non-resident individual investors to appoint a representative in Brazil or register with the CVM for certain operations; o expanding the use of non-resident checking or payment accounts for financial investments; and o removing the requirement to conduct foreign exchange transactions for investment conversions and register these investments with the Central Bank. Finally, with respect to eFX providers, Public Consultation No. 124 was published on September 19, 2025, proposing that the provision of eFX services must be carried out exclusively by certain types of institutions authorized by the Central Bank of Brazil. Although the wording proposed in the public consultation is not binding, as it consists merely of a draft regulation submitted for public consultation, it already signals the Central Bank of Brazil’s intention. 57 Table of Contents Segregate Assets Law No. 14,031/2020 provides guarantee mechanisms for the financial risks associated with the transfer and settlement of funds between the participants of open-loop payment schemes, particularly issuers and acquirers, to ensure that such funds are received by the merchants, which are the final beneficiaries. Law No. 14,031/2020 was introduced to ensure that, in the event that an issuer or acquirer fails, the merchant receives the values arising from payment transactions carried out with payment cards. The concept of segregate net equity (patrimônio segregado) was introduced by the Payments Industry Law, which created a protection against bankruptcy to the funds held in or that flow through payments accounts, setting forth that funds deposited in prepaid payment accounts are segregated from the payment institution’s own assets. Law No. 14,031/2020 expanded that concept to cover all the funds flowing between participants of an open-loop payment scheme. In addition, to enforce those legal requirements, the payment institution must hold all the funds deposited in the prepaid payment account in certain specified instruments, in either (i) a specific account held with the Central Bank or (ii) federal government bonds, as provided for by Central Bank Resolution No. 300/2023. As of July 2023, balances held in this specific account held with the Central Bank started to be remunerated. Virtual Assets In December 2022, Law No. 14,478 was published, establishing a legal framework for virtual asset services in Brazil, including guidelines for the regulation of virtual asset service providers, or VASPs. Such guidelines include, among others, free competition, protection of personal data, protection of popular savings, consumer protection, and anti-money laundering actions. Under the new law, VASPs are defined as legal entities that provide, on behalf of third parties, at least one of the following services: (i) exchange between virtual assets and domestic or foreign currency; (ii) exchange between one or more virtual assets; (iii) transfer of virtual assets; (iv) safe-keeping or management of virtual assets or instruments enabling a control over virtual assets; or (v) participation in financial services and the rendering of services in connection with the issue, offering or sale of virtual assets. Subsequent legislation that came into effect in June 2023 established the Central Bank as the authority in charge of regulating and overseeing the virtual asset market within the scope of the law, with powers, among others, to authorize the operation of VASPs, and confirmed that the powers and authority of the CVM, on the subject remain unchanged. The CVM is tasked with regulating the issuance and offering of those virtual assets classified as securities under Law No. 6,385/1976. In addition, CVM Resolution No. 175 of December 23, 2022, which became effective in October 2023, defines virtual assets as financial assets, thus allowing the direct investment by investment funds in such assets, as long as they are traded on entities authorized by the Central Bank or the CVM or, for transactions carried out abroad, by a local authority with powers to supervise the relevant transactions, including with respect to market abuse practices, such as money laundering, terrorism financing and financing the proliferation of weapons of mass destruction. In 2023 and 2024, the Central Bank launched various public consultations aiming at regulating VASPs activities and proposing a regulatory framework for the provision of virtual asset services by other institutions authorized by the Central Bank. Alongside these regulatory developments, as of the date of this annual report, the Brazilian Congress is discussing new proposals for legislative bills that could further regulate the cryptocurrency market. These initiatives include potential reforms to Law No. 14,478/2022, the regulation of stablecoins, and the establishment of legal protections for funds held with VASPs. Regulatory Capital Requirements for Payment Institutions In March 2022, the Central Bank published a set of new rules defining the regulation applicable to payment institutions under which prudential conglomerates will be classified into one of the following types:  Type 1: (a) single institutions authorized to operate by the Central Bank, except for (i) payment institutions; (ii) securities’ brokerage firms; (iii) securities distribution companies; and (iv) foreign exchange brokers; and (b) prudential conglomerates led by an institution authorized to operate by the Central Bank (excluding the entities listed in item “a”);  Type 2: (a) single payment institutions; and (b) prudential conglomerates led by a payment institution and made up exclusively of: (i) payment institutions authorized to operate by the Central Bank; (ii) payment institutions not authorized to operate by the Central Bank; (iii) entities that acquire credit transactions, including real estate, or credit rights, such as commercial development companies, securitization companies and exclusive purpose companies; (iv) other legal entities whose exclusive corporate purpose is to hold shares in the entities mentioned above in this item (b); or (v) investment funds; and  Type 3: (a) securities brokerage firms, securities distribution firms and foreign exchange brokerage firms; and (b) prudential conglomerates led by the institutions referred in item (a) above; and (c) prudential conglomerates led by a payment institution not mentioned in Type 2 above. According to the Central Bank, the concept of regulatory capital applicable to payment institutions was modified in order to ensure greater capacity to absorb unexpected losses. This treatment will consist of deducting certain assets held by the institution from the calculation of regulatory capital that, in situations of financial stress, have little or no value for maintaining the institution’s operation. 58 Table of Contents Furthermore, the new rules adapt the minimum capital requirement according to the intrinsic risks of each type of activity (payment or financial activity) for a Type 3 conglomerate, recognizing the peculiarities of the payment services and their differentiated legal status, and giving specific prudential treatment to the risks arising therefrom. In this context, risk weighted assets applicable for payment services risk, or RWAsp, was created, encompassing the activities of acquiring, issuance of electronic currency and provision of payment initiation services. Regarding prudential segmentation, Type 3 conglomerates will be classified between segments S2 and S5 and will have to comply with the prudential rules of the respective segment, considering the prudential segmentation established by CMN and Central Bank regulations, which categorize financial and payment institutions into different segments based on their size, complexity, and risk profile, allowing a more proportional regulatory approach with respect to prudential requirements. Pursuant to these regulations, the prudential conglomerate made up by BancoSeguro, PagSeguro Brazil and PagInvest is classified as Type 3 conglomerate, with PagSeguro Brazil being the leader of a conglomerate in the S3 segment. Prudential Regulation Referring to Credit, Market and Operational Risk Between March 2022 and December 2024, the Central Bank issued various resolutions with respect to the prudential regulation referring to credit, market and operational risk, applicable to all institutions authorized to operate by the Central Bank, according to their segmentation, and addressing the following matters, among others:  implementation of the minimum standard of the Basel Committee for Banking Supervision, or BCBS, for calculating minimum capital requirements related to credit risk according to the standardized approach, or RWAcpad, thereby increasing the granularity of the weights applicable to exposures, bringing refinements in the differentiation in credit risk to financial institutions classified in Segment 1 (S1) to Segment 4 (S4), which currently opt for the standardized approach for credit risk;  reduction in the complexity of internal models for credit risk, or IRB, limiting their scope and increasing the comparability between institutions that adopt such framework, by means of (i) introducing new minimum standards for some parameters; (ii) reducing the set of portfolios eligible for approaches; (iii) introducing a new permanent output floor; and (iv) improving the flexibility in the application process for the use of IRB approaches, which now allows partial permanent adoption by specific portfolios;  implementation of the second phase of the Central Bank’s market risk framework (the Fundamental Review of the Trading Book – FRTB), establishing the procedures for the daily calculation, using a standardized approach, of the portion of risk-weighted assets, or RWA, related to the calculation of the capital required for exposures to the credit risk of financial instruments classified in the trading portfolio, or RWADRC, by means of (i) separating the calculation of capital requirement of exposures subject to credit risk classified in the trading book from those classified in the banking book; (ii) enabling the elimination of exposure protected by credit derivatives; and (iii) encouraging institutions to include such hedging mechanism in their portfolios, in order to lower effective exposure to risk;  softening the impact of the operation risk on the capital requirements of supervised entities by replacing the three calculation methodologies for required capital for risk-weighted assets, or RWAopad, currently in use (BIA, ASA and ASA2), with a single, more robust and risk-sensitive method, including an internal loss component that modulates the capital required;  establishment of (i) accounting procedures and criteria applicable to financial instruments, hedge accounting, the components of financial instruments which constitute payments of principal and interest on the principal value for the purposes of classification of financial assets; and (ii) parameters to measure the expected loss associated with credit risk, including for setting minimum levels of allowance for expected losses associated with credit risk; and  establishment of a transition schedule for incorporating the impacts on regulatory capital due to the new provisioning model based on IFRS 9, as per the recommendations of the BCBS, which allow jurisdictions to phase in the effects on regulatory capital resulting from increased provisions following the adoption of IFRS 9, by partially restoring regulatory capital that may have been reduced due to the shift to the new provisioning model. 59 Table of Contents On April 30, 2025, the CMN and the Central Bank of Brazil issued CMN Resolution No. 5,207 and the Central Bank Resolution No. 470, respectively, concluding the third phase of Brazil’s market risk prudential reform under Basel III’s Fundamental Review of the Trading Book. The new rules amended CMN Resolution No. 4,958 to create a standardized sensitivity-based risk-weighted assets component for market risk (RWASENS) and adjusted CMN Resolution No. 4,557 to include credit-spread movements among monitored market risk factors in internal risk management. For institutions in S1-S3, RWASENS replaces the existing exposure-based components within RWAMPAD for interest rate, equity, commodity, foreign exchange and related positions; institutions in S4 will, for now, continue using the prior components. The framework supersedes the former internal-models component (RWAMINT) for market risk capital, with any potential adoption of an Internal Models Approach contemplated in a later phase. In addition to the existing consolidated prudential requirements applicable to payment institutions in Brazil, on May 30, 2025, the Central Bank of Brazil enacted two key regulations (Resolution No. 478 and Resolution No. 477) providing significant enhancements to the regulatory capital framework applicable to payment institutions in Brazil. These new rules are specifically designed to reinforce the prudential regime for payment institutions by establishing mandatory individual capital controls. The new rules set forth the scope, methodology, and minimum requirements for the calculation of the Leverage Ratio (Razão de Alavancagem) for payment institutions. Under this regulation, payment institutions classified as Type 3 entities are now required to comply with minimum leverage ratio requirements on both a consolidated and individual basis. For those classified in S2, the minimum leverage ratio will be phased in, starting at 2% from July 1, 2026, increasing to 2.5% on January 1, 2027, and reaching 3% as of January 1, 2028, on a consolidated basis. For individual payment institutions within a prudential conglomerate, the minimum requirement will increase from 0.75% to 2.25% over the same period. The updated requirements emphasize the maintenance of an adequate funding profile, diversification of funding sources, and the timely transfer of liquidity within prudential conglomerates. Payment institutions are now explicitly required to promptly identify any statutory, contractual, legal, or regulatory restrictions that could limit liquidity transfers and to implement measures to mitigate such risks. Further, in May 2025, the CMN approved amendments to Resolution No. 4,557 and Resolution No. 4,401, under CMN Resolution No. 5,222. The new rules require conglomerate leading institutions to implement policies, strategies and processes ensuring the timely intragroup transfer of liquidity, including prompt identification and mitigation of legal, regulatory, statutory or contractual impediments, and extend the Liquidity Coverage Ratio, or LCR, to a Brazil sub-consolidated perimeter for S1 groups (excluding foreign branches) at the same 100% minimum as the consolidated LCR. The qualitative risk-management changes took effect on September 1, 2025, and the sub-consolidated LCR requirement will take effect on July 1, 2026. In parallel, the Central Bank of Brazil issued a complementary resolution updating the scope and methodology of the leverage ratio and introducing a 3% minimum RA for specified S2 broker/dealer-led groups and Type 3 payment-institution-led groups, while mandating RA measurement on a consolidated basis and, for materially relevant entities in S1-S2 groups, on an individual or (subject to conditions, including PRSO and legal opinions) a Brazil sub-consolidated basis. Finally, on November 6, 2025, the Central Bank of Brazil issued Public Consultation No. 128, proposing amendments to the recognition of credit risk mitigation instruments under the standardized approach (RWACPAD) and to the methodology for calculating counterparty credit risk under the Current Exposure Method (CEM). The proposed resolution would enhance procedures for existing credit risk mitigating instruments, recognize new instruments as credit guarantees, establish preferential risk weighting for certain payroll-linked credit operations, and introduce adjustments to the calculation of potential future gains in derivative transactions. If adopted, these changes could affect the calculation of credit risk exposures and capital requirements applicable to the prudential conglomerate led by PagSeguro. Regulation of Credit Cards and Prepaid Payment Accounts On March 1, 2022, Central Bank Resolution No. 96/2021, which amended and restated the rules relating to the opening of postpaid payment accounts (i.e., those used in products such as credit cards) and prepaid payment accounts, in addition to making the criteria for opening these accounts compatible with the rules applicable to the opening of deposit accounts (checking accounts) came into force. Among other measures, Resolution No. 96/2021:  eliminated the exhaustive list of minimum customer registration information for opening prepaid and postpaid payment accounts, determining that each payment institution will have discretion to determine what information it will require from the customer, depending on its profile;  introduced new procedures aimed at facilitating requests for prepaid and postpaid payment accounts to be closed;  classified payment accounts into two types: (i) prepaid payment accounts, which are those where the funds have been deposited into the payment account in advance of the intended payment transaction; and (ii) post-paid payment accounts, which are those where the payment transaction is intended to be performed regardless of whether or not funds have been deposited into the payment account in advance; 60 Table of Contents  revised the items that must be included in the invoices for postpaid payment accounts (i.e., credit cards), such as the need to include the total consolidated balance of contracted future obligations, such as installment purchases, credit operations and tariffs;  defined minimum provisions that must be included in the account agreements; and  required institutions to send or make available to the customer, by physical or electronic means, the credit card and the corresponding invoices, according to the form and channel chosen by the customer (among the options made available by the institution). Further, on December 21, 2023, Central Bank issued Resolution No. 365, which amended Resolution 96 and established new requirements for credit card bills and other postpaid instrument invoices, such as presenting information in an orderly form according to groups of information (i.e. highlighted area, payment alternatives and complementary information). On May 26, 2025, the Central Bank issued Resolution No. 475, establishing an electronic system that allows individuals and legal entities to register, free of charge, a request to restrict the opening of demand deposit, savings and prepaid payment accounts or changes to their holders, and enabling institutions to consult such records for contracting and supervisory purposes. On the same date, Resolution No. 476 amended Resolution No. 96/2021 to require institutions to consult this system prior to opening prepaid payment accounts or changing their holders, to document any exceptional decision to proceed despite a registered restriction, and to retain evidence of the consultation for at least ten years. Such new obligations came into force on December 1, 2025. Finally, closing of payment account rules contained in Resolution 96 /2021 were also amended by Resolution No. 518, dated November 3, 2025. Regulation on Revolving Credit (crédito rotativo) and Installment Credit (crédito parcelado) On October 3, 2023, Brazilian Federal Law No. 14,690 was published, establishing a new limitation on the interest and financial fees charged over the outstanding balance of credit card invoices that are considered revolving credit (crédito rotativo) and installment credit (parcelamento de fatura de cartão de crédito). The CMN and the Central Bank, thus, regulated the limitation provided for in Law No. 14,690/2023. Under such rules, (i) the total amount of interest and financial charges in connection with revolving credit and/or installment credit cannot exceed the original amount of the debt financed and this limitation applies to all issuers of credit cards and other post-paid payment instruments; (ii) credit card issuers and holders can renegotiate the financing as long as the total amount charged as interest and financial charges applicable to each renegotiation do not exceed the amount of the original debt; and (iii) the original amount of the debt, as well as the total amount charged as interest and financial charges applicable to each financing transaction must be detailed in the respective statements and invoices in connection with the applicable regulations in force. The new limit on interest and financial charges applies to each new revolving credit transaction or installment credit with interest. In other words, each issuer must have a control per financed transaction (revolving credit or installment credit with interest) to prevent the interest on this transaction from exceeding the interest limit imposed by Law No. 14,690/2023. Also, civil default interest and contractual fines resulting from penal clauses (imposed for late payments), as well as other fees and commissions incident to the financing transaction, are considered in the calculation of interest that will be subject to the limit mentioned therein. On December 21, 2023, the CMN and the Central Bank regulated, through Resolution No. 5,112 and Resolution No. 365, the limit provided for in Law No. 14,690/2023. Early Payment of Receivables The Payments Industry Law prohibits payment institutions such as PagSeguro Brazil from performing activities that are exclusive to financial institutions. There is some debate under Brazilian law as to whether providing advances on receivables could be characterized as “lending,” which is an activity that is limited to financial institutions. Similarly, there is some debate as to whether the discount rates applicable to this early payment feature should be considered “interest,” in which case the limits set by Brazilian Federal Decree No. 22,626 dated April 7, 1933, or the Brazilian Usury Law, would apply to these rates. In this context, on March 28, 2015, the PGBC, issued a legal opinion in which it concluded that: (i) the advance of payments of trade receivables (credit card receivables backed by executed and paid transactions) to merchants relates to the early payment of an obligation and should not be confused with activities of financial institutions; and (ii) discount rates applicable to this prepayment mechanism are subject to the limits set forth in the Brazilian Usury Law. Subsequently, in December 2023, this legal opinion was partially revised, as the PGBC concluded that the limitations set out in the Brazilian Usury Law should not apply to advance transactions carried out by authorized payment institutions. Further, on June 28, 2024, the Brazilian Usury Law was amended by Law No. 14,905/2024, which expressly states that it does not apply to certain obligations undertaken outside the National Financial System. These include, among others, transactions contracted solely between legal entities and those involving financial institutions and other institutions licensed by the Central Bank. 61 Table of Contents Operations and Registration of Receivables from Payment Schemes On December 19, 2018, the CMN and the Central Bank published Resolution No. 4,707/18 and Circular No. 3,924/18, which impose transitional rules regarding credit card receivables and credit operations guaranteed by such receivables, aimed at allowing merchants to offer their future credit card receivables as collateral to their banks for loans. These rules created information exchange obligations between financial institutions and acquirers/sub-acquirers, to facilitate the delivery of information related to merchants’ settlement schedules (agendas de recebíveis). In accordance with these rules, financial institutions must keep acquirers and sub-acquirers informed about credit transactions linked to credit card receivables. Acquirers, in turn, are required to disclose transaction data, such as settlement schedules (agendas de recebíveis), about their respective merchants to (i) financial institutions who have ongoing lending transactions secured by such receivables; and (ii) any other financial institution that is expressly authorized by such merchants to obtain this data. Subsequently, on June 7, 2021, these rules were replaced by Resolution No. 4,734/19 and Circular No. 3,952/19, as amended, which created new and definitive regulation in order to improve the rules regarding merchants’ credit transactions guaranteed by card receivables and the prepayment and discount of such receivables, increasing competition and thus reducing the cost of credit. This new regulatory framework brought several relevant changes to transactions involving credit and debit card receivables, including transactions for the early payment of such receivables by acquirers and sub-acquirers, which are subject to new procedures, as well as the assignment of these receivables to institutions that do not belong to the National Financial System. The general principle adopted by these new rules is that receivables from payment arrangements that are provided as collateral in credit transactions or assigned in discount transactions (desconto de recebíveis) must be registered in a centralized registration system operated by an entity authorized by the Central Bank. The new rules introduced the requirement of a market infrastructure convention, which created a system allowing for the registration of these receivables as financial assets, interoperability, and the exchange of information between the registration systems and market participants. Resolution No. 4,734/19 requires that the amount of receivables granted as guarantees for a certain credit transaction be reduced, whenever applicable, so that such amount is limited to the outstanding balance of the transaction or to the maximum limit available under a credit line, which is a non-dischargeable credit facility extended by a financial institution on an absolute and unilateral basis. Further, Circular No. 3,952/19 was revoked by Resolution No. 264/22, that address the procedures for registration of receivables and requires a convention between market infrastructures to guarantee the uniqueness of the receivables as financial assets that can be registered, interoperability, exchange of information between registration systems and participants in the structure. Furthermore, on August 24, 2023, the CMN issued Resolution No. 5,094 and the Central Bank issued Resolution No. 339, which address changes related to the issuance, registration, centralized deposit and negotiation of book trade acceptance bills (duplicatas escriturais), such as the establishment of a new settlement system for book trade acceptance bills and the provision to establish a contestation procedure by the bookrunner companies, which must be uniform, documented and with a response period of three days, when referring to the services of the bookrunner companies themselves. Resolutions No. 5,094 and 339 came into effect on September 1, 2023. Banking as a Service Relationship On November 28, 2025, the Central Bank of Brazil and the CMN issued Joint Resolution No. 16, which regulates the provision of Banking as a Service, or BaaS, by financial institutions, payment institutions, and other entities authorized to operate by the Central Bank of Brazil. Joint Resolution 16/25 defines BaaS as the contractual arrangement under which BaaS providers make specified financial and payment services available to clients through an integrating entity that interfaces with clients, and it clarifies the definitions of the BaaS service, the BaaS provider institution, the BaaS service-taking entity, and the client, while expressly excluding activities such as correspondent banking services, data processing/cloud services, Open Finance partnerships, and activities of sub-acquirers and network service providers from the BaaS scope. Joint Resolution No. 16/25 sets forth that BaaS agreements may cover, exclusively, one or more of the following services: (i) opening, maintenance and closing of demand deposit, savings deposit, and prepaid or postpaid payment accounts; (ii) payment services conducted through those accounts; (iii) merchant acquiring services; (iv) credit transactions (offer, contracting, administration, and collection); and (v) additional services that may be included by the Central Bank of Brazil in the future. It requires that services be provided by authorized institutions within their permitted activities and via electronic channels through system/platform/process integrations between the BaaS provider and the service-taking entity. It also sets conditions on account ownership, payment transaction flows, and debtor identity for credit operations, and clarifies that services outside the listed scope are not BaaS and cannot be offered as such. 62 Table of Contents BaaS agreements must specify the object, roles and responsibilities, remuneration, security measures, Central Bank of Brazil access rights to information, client demand handling, restrictions on fees charged in the name of the service-taking entity, representations regarding the prohibition on unauthorized financial activities, and restrictions on sub-contracting BaaS services, among other terms. They must also ensure transparency about the status of the service-taking entity (including that it is not an institution authorized by the Central Bank of Brazil, as applicable), responsibilities for client communications (including upon termination and for credit portability and post-cession rights), data sharing necessary to fulfill responsibilities, and the provision of know-your-customer, or KYC, information, fraud prevention, and AML/CFT procedures. The agreements must address resolution scenarios and termination, including access by the resolution authority, advance notice of service interruption, transparency to clients, and client options regarding relationships with the provider and the service-taking entity. The institution that provides the services bears the responsibility for the reliability, integrity, availability, security, confidentiality, and regulatory compliance of services provided under BaaS, including KYC, fraud prevention, and AML/CFT. Institutions acting as BaaS providers or service-taking entities must designate an officer responsible for compliance with such resolution (Joint Resolution No. 16/25). In Rem Collateral On October 30, 2023, Bill of Law No. 4,188/2021, known as the Legal Framework for Guarantees, was sanctioned by the President of Brazil, resulting in the publication of Law No. 14,711. The rule introduces important changes to the legal framework for collateral, and the result is expected to be greater legal security, a reduction in the spread on secured loans and greater availability of credit to borrowers. It mainly aims at tackling the current problem of dead capital in the fiduciary sale of real estate – that is, the impossibility of the same property being used as collateral more than once. Thus, Law No. 14,711 promotes the following changes to Brazilian civil law: (i) allowing a new fiduciary sale of the same property; (ii) the extension of the current guarantee to a new debt; and (iii) the introduction of the collateral agent into the Brazilian legal system. The new law also introduces several improvements related to the perfection and extrajudicial enforcement of collateral, including amendments and revocations of outdated laws, changes to collateral registration rules, and other matters. Compensation of Senior Management The CMN and Central Bank have recently published new rules dealing with the compensation of members of the senior management of financial institutions, payment institutions and other institutions authorized to operate by the Central Bank. Under the new rules, securities brokerage firms and dealerships, foreign exchange brokers and payment institutions became subject to the rules on the matter, which previously were only applicable to financial institutions in general. The new regulatory framework mainly maintained the previous guidelines, including the requirement for a compensation policy, the setup of a compensation committee and the disclosure of annual information on the compensation of senior management. Regulatory Status of PagSeguro Brazil, BancoSeguro and PagInvest BancoSeguro is a financial institution duly authorized by the Central Bank to perform banking operations in accordance with current regulations. It also holds a license from the CVM to provide securities custody services, which was obtained on February 22, 2021 and, as of the date of this annual report, has the following authorizations from the Central Bank:  authorization to operate as a payment institution, as an issuer of prepaid electronic money, related to (i) the free PagBank digital account, which relates to our rules and our brand; and (ii) to our issuance of PagSeguro electronic currency and prepaid cards, which relates to the third-party payment schemes within which the cards are issued;  authorization to operate as a payment institution, as an acquirer;  authorization to conduct activities as a payment institution issuer of post-paid payment instruments (credit cards) within third-party open-loop payment schemes; and  authorization to operate in the foreign exchange market. PagSeguro Brazil is a payment scheme owner of a closed-loop payment scheme not forming part of the SPB, which relates to P2P transfers between accounts opened by our clients within the PagBank digital account, using our rules applying to the PagBank digital account and our brand. Since this payment scheme does not form part of the SPB, it does not currently require Central Bank authorization. In addition, PagSeguro Brazil is a participant of the Pix instant payments scheme and has joined open finance on its phase 3, as an account service provider. As of November 25, 2024, PagSeguro Brazil is qualified and authorized to offer payment initiation services within the Pix instant payments scheme and in the context of open finance. For more information about the Pix instant payment scheme, see “—Developments in the Regulation of the Brazilian Banking and Payments Industries—Instant Payments (Pix).” 63 Table of Contents In March 2023, the Central Bank authorized PagInvest to operate as a securities broker-dealer (corretora de títulos e valores mobiliários) in Brazil. In October 2023, the CVM also authorized PagInvest to provide custody services as a securities broker-dealer. Our investment‑related activities in the securities market, previously conducted by BancoSeguro through our investment platform, were transferred to PagInvest during the second half of 2025, except for the third‑party fund distribution and the custody of certain assets, which remains with BancoSeguro. Anti-Money Laundering Rules We comply with all applicable anti-money laundering rules and have implemented policies and procedures to report suspicious activities to the authorities, including any suspected terrorism financing and other potentially illegal activities. Our activities in Brazil are subject to Brazilian laws and regulations relating to anti-money laundering, terrorism financing and other potentially illegal activities. These rules require us to implement policies and internal procedures to monitor and identify suspicious transactions, which must be duly reported to the relevant authorities. We have implemented all the required policies and internal procedures to ensure full compliance with these rules and regulations, including structuring a risk and fraud division led by a risk and compliance officer. Our employees are trained and informed of our policies and internal procedures and their compliance is mandatory and supervised. The Brazilian anti-money laundering law establishes the basic framework to prevent and punish money laundering as a crime. It prohibits the concealment or dissimulation of origin, location, availability, handling or ownership of assets, rights or financial resources directly or indirectly originated from crimes, subjecting the agents of these illegal practices to imprisonment, temporary disqualification from managing enterprises for up to ten years, and monetary fines. The Brazilian anti-money laundering law also created COAF, which is the Brazilian financial intelligence unit that initially operated under the jurisdiction of the Ministry of Finance but that, as of January 2020, has been transferred to the administrative structure of the Central Bank. COAF performs a key role in the Brazilian anti-money laundering and counter-terrorism financing system, and its legal responsibility is to coordinate the mechanisms for international cooperation and information exchange. On January 23, 2020, the Central Bank issued Circular No. 3,978/2020, establishing a new regulatory framework applicable to the policies, procedures and internal controls to be adopted by financial institutions and other institutions authorized to operate by the Central Bank, in order to prevent the financial system from being used to commit money laundering and terrorist financing crimes. It applies to several activities conducted by regulated entities, such as foreign exchange transactions and payments. In addition, we are subject to the anti-money laundering rules in the Cayman Islands, which set forth that any person in the Cayman Islands that knows or suspects or has reasonable grounds for knowing or suspecting that another person is engaged in criminal conduct or is involved with terrorism or terrorist financing and property, and the information for that knowledge or suspicion came to their attention in the course of their business in the regulated sector, or other trade, profession, business or employment, such person will be required to report such knowledge or suspicion to (i) the FRA, pursuant to the Proceeds of Crime Act (As Revised), if the disclosure relates to criminal conduct or money laundering or (ii) to a police officer of the rank of constable or higher, or the FRA (pursuant to the Terrorism Act (As Revised) of the Cayman Islands), if the disclosure relates to involvement with terrorism or terrorist financing and terrorist property. Rules on E-Commerce, Data Protection, Consumer Protection, Banking Secrecy and Taxes We are also subject to laws relating to internet activities and e-commerce, as well as banking secrecy laws, consumer protection laws, data protection laws and regulation, tax laws and other regulations applicable to Brazilian companies generally. E-Commerce. Internet activities in Brazil are regulated by the Brazilian Civil Rights Framework for the Internet, which embodies a substantial set of rights and obligations relating to internet service providers. This law exempts intermediary platforms such as PagSeguro from liability for activities carried out by their users. Since there are no settled court decisions in this area, however, it is still possible that we may be subject to joint civil liability for activities carried out by our users. However, such exemption is under discussion before the STF, which, as of the date of this annual report, is reviewing the constitutionality of Article 19 of the Brazilian Civil Rights Framework. Data Protection. The LGPD came into effect in September 2020 (except for its administrative sanctions, which came into effect on August 1, 2021), governing the practices related to the use of personal data, and replacing the sparse and sectoral standards that previously regulated rights to data privacy and protection in Brazil. By creating a microsystem of rules impacting all sectors of the economy, the LGPD provides a specific legal framework to be observed in personal data processing operations. Among other provisions, the LGPD establishes (i) the rights of data subjects; (ii) the legal bases applicable to the processing of personal data; (iii) the requirements for obtaining consent on the use of such data, when applicable; and (iv) the obligations and requirements relating to security incidents and leaks and data transfers. The LGPD also authorized the creation of the ANPD, which was implemented in November 2020, and is the entity responsible for regulating and supervising the application of the LGPD and other data protection laws, as well as imposing sanctions in the event of noncompliance with the legal rules and obligations. 64 Table of Contents Pursuant to the LGPD, personal data subjects are entitled to the following rights, which we must ensure: (i) to obtain confirmation of existence of personal data processing; (ii) to access their personal data; (iii) to correct all incomplete, inaccurate or outdated personal data; (iv) to carry out portability processes to transfer personal data to another service or product, in accordance with the additional regulations to be set forth by the ANPD; (v) to request the deletion of processed personal data based on consent, or the right to revoke their previously given consent; (vi) to obtain information on government and private-sector entities with whom those responsible for data processing have shared their data; (vii) to be allowed to deny consent to personal data processing and to be advised of the consequences of that denial; and (viii) to request the review of decisions made solely based on automated processing. The LGPD also establishes that the following information must be provided to data subjects, including through privacy notices: (i) the specific purpose of such processing; (ii) processing methods and duration; (iii) the identity of the data controller; (iv) the contact information of the data controller, as well as the name and contact information of the data protection officer; (v) information with regards to the sharing of personal data with third parties and its purpose; (vi) description of responsibilities, particularly the responsibilities of the processing agents involved; and (vii) expressly inform the data subjects’ rights set forth in the LGPD. Further, on February 27, 2023, the ANPD issued the dosimetry regulation, which establishes the criteria to be used when any administrative sanctions are applied. Although the regulation still includes some vague definitions (such as what entails large-scale data processing), it clarified the elements ANPD considers when analyzing a data-related incident, such as recurrence (incidents up to five years apart), good faith, cooperation, transparency, proportionality and the adoption of best practices and governance policies. According to the regulation, any administrative sanction applicable to any violation of the LGPD will depend on: (i) the classification of the infraction as “slight,” “medium” or “serious”; and (ii) ANPD’s understanding of the proportionality of the sanction in relation to the infraction committed. In addition, on August 23, 2024, the ANPD issued the Regulation on International Data Transfers, regulating Articles 33 to 36 of the LGPD, establishing rules and mechanisms for the international transfer of personal data, ensuring adequate protection in cross-border data flows. Most of the regulation is dedicated to establishing Standard Contractual Clauses (SCCs), glimpsing through regulations on binding corporate rules (BCRs), and other safeguards for lawful data transfers, in addition to introducing specific compliance requirements for organizations transferring personal data outside Brazil, including risk assessments and accountability measures. Currently the European Commission and Brazil adopted mutual adequacy decisions, confirming that their levels of data protection are comparable. As per the LGPD, we must also provide a secure environment for our users. Investing in technical and administrative maintenance for information security and personal data protection will also be necessary, including to support our corporate governance structure for personal data protection. In addition, under the LGPD, we have a legal duty to maintain a communication channel with data subjects whose data we process, including our users and partners. If our operations and business model are not in compliance with the LGPD’s rules, we may be subject to (i) formal warnings; (ii) public sanctions; (iii) the deletion of data or the suspension of data processing activities; (iv) a fine equal to up to 2% of our gross sales, or the gross sales of our economic group in Brazil, in the preceding fiscal year, excluding taxes, but limited to a total of R$50.0 million per violation; and (v) administrative sanctions by public entities and regulatory bodies that govern personal data, consumer protection and public interests, among other sanctions. In addition, we may be held liable for (i) individual or collective material moral damages caused by our failure to meet any of the obligations set forth by the LGPD; and (ii) paying damages to users harmed by violations of their rights as personal data subjects, such as their rights to transparency, in that they may obtain information regarding the processing of their personal data and other rights set forth in the LGPD. Noncompliance with any LGPD provisions may lead to the following: (i) individual or class actions being filed seeking damages due to breaches not only of the LGPD, but also of any sparse and industry-specific data protection laws still in force; and (ii) the imposition of the penalties set forth by the Consumer Protection Code and the Civil Framework for the Internet by certain consumer protection agencies, as they have been acting in this regard well before the effectiveness of the LGPD, administrative penalties levied by the ANPD, particularly in cases of violations of the LGPD. Consumer Protection. Law No. 8,078/1990, known as the Consumer Protection Code, regulates consumer relations in Brazil, including matters such as: (i) commercial practices; (ii) product and service liability; (iii) situations in which suppliers of products or services are subject to strict liability; (iv) the reversal of the burden of proof so as to benefit consumers; (v) the joint and several liability of all companies within a supply chain; (vi) unfair contract terms; (vii) advertising; and (viii) information on products and services that are offered to the public. Consumers have the right to receive clear and accurate information regarding retail products and services, with correct specification of characteristics, structure, quality, price, risks, and consumers’ rights to access and amend personal information collected about them and stored in private databases. The Consumer Protection Code also sets forth specific rules and procedures regarding the relationship between customers and users of products and services with financial and payment institutions authorized to operate by the Central Bank. In 2021, the CMN and the Central Bank enacted Resolution No. 4,949/2021 and Resolution 155/2021, respectively, aiming at ensuring a fair and equitable treatment at all stages of the relationship with the institutions providing financial and payment services, as well as a convergence of the interests of the providers with those of their consumers. Furthermore, on December 26, 2023, the CMN and the Central Bank published Joint Resolution No. 8, which came into effect on July 1, 2024 and requires the institutions authorized to operate by the Central Bank to adopt financial education measures designed for their clients and users that are natural persons, including individual entrepreneurs, by means of the publication of a financial education policy, the provision of financial education content and tools in an appropriate language, channel and timing, considering the characteristics and needs of their clients and users. 65 Table of Contents Banking Secrecy. Customer accounts on our digital platform are subject to data protection under the Brazilian Civil Rights Framework for the Internet and bank secrecy laws (Complementary Law No. 105/2001, which had its provisions extended to payment institutions through Article 17 of CMN Resolution No. 4,282/2013). Taxes. We are subject to tax laws and regulations, as well as related interpretations and tax accounting standards in Brazil, the Cayman Islands, and the United States. In Brazil, we are subject to federal and municipal taxes on our activities and services rendered. The main Brazilian taxes that are incident on our operations are the following: Corporate Income Tax (IRPJ), and Social Contribution on Net Income (CSLL). The IRPJ and CSLL are federal corporate income taxes levied on profit before income tax and social contribution. The combined nominal rate of IRPJ and CSLL varies between 34% to 45% depending on the business line of our operations. For certain regulated entities, including payment institutions, the combined nominal rate was 34% until December 31, 2025, is 37% since January 1, 2026 to December 31, 2027, and will be 40% from January 1, 2028 onwards, as a result of the increase in the CSLL rates set forth in Article 7 of Complementary Law No. 224, of December 26, 2025. For further information see item 23 of the financial statements. IRPJ on Payment of Dividends. On November 26, 2025, the Brazilian Congress enacted Law No. 15,270, which, among other changes, imposed a 10% withholding income tax on dividends paid or credited to individuals in a monthly amount equal to or exceeding R$50,000.00 and a 10% withholding income tax on dividends paid or credited to non-resident shareholders. The non-resident shareholders may be entitled to a refund on the amounts withheld in 360 days if the company’s effective tax rate exceeds the application of the statutory rate over accounting profits. However, as of the date of this annual report, Brazilian tax authorities have not yet regulated the refund procedure nor provided guidance on the particularities of the effective tax rate calculations. Federal Social Contribution (Programa de Integração Social, or PIS, and Contribuição para o Financiamento da Seguridade Social, or COFINS). PIS and COFINS are levied on gross revenue, and the combined nominal rate of these contributions varies between 4.65% and 9.25% depending on the business line of our operations. Municipal Tax on Services Rendered (Imposto sobre Serviços, or ISS). At the municipal level, we are subject to payment of ISS, which is incident on rendered services. The ISS varies between 2% and 5% according to the service rendered. Tax on Financial Transactions (Imposto sobre Operações Financeiras, or IOF). The IOF is a federal tax levied on certain financial transactions, such as loans, foreign exchange operations, insurance, and securities, as well as operations with gold (as a financial asset) and foreign exchange instruments. The IOF tax rate may vary according to the nature of the transaction. In June 2025, the Brazilian federal government enacted Decree No. 12,499, which increased the rates applicable to certain credit, foreign exchange, insurance and securities transactions, as follows:  Credit Transactions: in credit transactions carried out by legal entities, the IOF generally applies at a rate of 0.38% as a fixed charge plus 0.0082% per day, limited to 365 days, which results in a maximum aggregate rate of approximately 3.38%.  Foreign Exchange Transactions: in the foreign exchange context, the decree generally set the IOF/FX rate at 3.5% for outbound transactions and 0.38% for inbound transactions, except where specific reduced or zero rates apply to particular transactions.  Insurance Transactions: with respect to insurance transactions, the decree imposed a 5% IOF rate on the portion of contributions exceeding R$300,000 per individual in the same insurer between June 11, 2025 and December 31, 2025, in connection with certain life insurance products with survival coverage, and, beginning on January 1, 2026, on the portion exceeding R$600,000.  Securities Transactions: the decree introduced a 0.38% IOF rate on the primary subscription of quotas of Funds for Investment in Receivables (Fundos de Investimento em Direitos Creditórios), or FIDCs, i.e., upon the primary acquisition of such quotas rather than on secondary market trades. Taxation of Investment Funds. Law No. 14,754 of December 12, 2023 (Law No. 14,754/2023) imposes that from 2024 onwards, the earnings derived from any investment in closed-end FIDCs shall be subject to a semi-annual tax due on the last business day of May and November, at a rate of 15%, irrespective of actual distributions, unless those FIDCs qualify as investment entities (as defined by Law No. 14,754/2023 and CMN Resolution 5,111/2023). PagSeguro Brazil’s FIDCs administrator has indicated that FIDM and Fundo de Investimento em Direitos Creditórios – PagSeguro, or PagSeguro FIDC, qualify as investment entities according to Law No. 14,754/2023 and CMN Resolution 5,111/2023, and, based on such classification, PagSeguro FIDC is currently not subject to the periodic taxation regime introduced by Law No. 14,754/2023. Furthermore, according to Article 219, Paragraph 6, of LC 214/25 (reform on consumption), FIDCs that assign receivables from payment arrangements are considered taxpayers of the IBS and CBS, unless classified as investment entities (as defined by Law No. 14,754/2023 and CMN Resolution 5,111/2023). This legal provision has significant impacts on FIDCs, given that these investment funds were not previously considered taxpayers of consumption-related taxes. However, considering that the administrator of FIDM and PagSeguro FIDC has indicated that those entities qualify as investment entities according to Law No. 14,754/2023 and CMN Resolution 5,111/2023, FIDM and PagSeguro FIDC should not be considered a taxpayer of the IBS and CBS. 66 Table of Contents Transfer Pricing. In 2023, Brazil adopted new transfer pricing regulations through Law No. 14,596/23 and Normative Ruling No. 2,161/23. Brazilian companies are now required to comply with the arm’s length standard in transactions carried out with related parties abroad (rather they relate to commercial or financial transactions or to corporate restructurings in general) or even non-related parties when the counterpart is located in a jurisdiction classified as a tax haven under Brazilian law. Pillar 2. Law No. 15,079/24 created a CSLL Surcharge as a domestic minimum tax, or DMTT, in line with the Organization for Economic Co-Operation and Development, or OECD, and G20’s Global Anti-Base Erosion (GloBE) Rules. Following Pillar 2 Model Rules, the CSLL Surcharge targets large multinational groups to prevent tax base erosion and ensure a minimum 15% tax rate on profits. This measure supplements Brazil’s new transfer pricing rules and affects multinational groups with revenues over EUR 750 million. Key provisions of Law No 15,079/24 include: (i) CSLL Surcharge: the surcharge ensures the 15% minimum effective tax rate for multinational groups; (ii) scope: applies to large multinational groups, including domestic companies; (iii) Substance-Based Income Exclusion: reduces the tax burden on capital-intensive and labor-intensive profits; (iv) Effective Tax Rate Calculation: ensures that the 15% rate is met, with a surcharge if necessary; (v) Loss-Making Entities: specific rules for deferred tax assets (DTA) and loss-carryforwards; (vi) penalties: strict penalties for non-compliance, reinforcing the need for rigorous data submission; (vii) federal revenue regulation: Normative Instruction No. 2,228/2024 provides further guidance, including on currency conversion, profit adjustments, and the effects of corporate restructurings. Brazilian Tax Reform on Consumption. On December 20, 2023, the Brazilian Congress passed a tax reform on consumption aimed at simplifying the Brazilian tax framework, providing for, among other things, (i) the removal of five taxes (except in limited circumstances), including the existing VAT known as ICMS, the ISS, the tax on manufactured products, or IPI, PIS and COFINS, and (ii) the creation of two new VATs, namely the CBS and the IBS, and the IS, together with the elimination of tax benefits, which may result in an increase in the overall tax burden. Tax collection on the new VATs will be implemented by taxing consumption (rather than a tax on production and/or revenue, as in the prior system). The transition period began in 2026, including an initial testing and ancillary-obligations phase, and will continue through 2032. In 2027, the CBS will become fully effective and will replace PIS and COFINS, while the IPI will generally be reduced to zero, subject to limited exceptions. Beginning in 2029, ICMS and ISS will be gradually reduced, while the IBS will be gradually increased. Full implementation of the new system is expected to take place in 2033, when the CBS and IBS will fully replace the current consumption taxes. The overall tax rate after the implementation of the tax reform has not been determined but it is likely to range between 26% and 28%. Nonetheless, financial services will be subject to lower rates, starting at 10.85% in 2027 and reaching 12.50% from 2033 onwards. Taxpayers will generally be entitled to financial tax credits on all acquisitions and will levy the new taxes (IBS and CBS) in favor of the municipality where the buyer is located. The approved text of the tax reform also provides authorization for the Brazilian government to introduce a selective tax on goods and services that are harmful to health and/or the environment. Specific regimes will also be applied to sectors expressly listed in the Brazilian Constitution, with rules that will be regulated by a specific law (e.g., fuel, financial services and others). In addition, upon implementation of the tax reform, electronic payment service providers participating in a payment arrangement must, at the time of financial settlement, withhold the IBS and the CBS due on the transaction underlying the processed payment and transfer the applicable taxes to the Brazilian government. The IBS and CBS steering committee and Brazil’s Internal Revenue Service are expected to issue additional regulations to clarify how the split payment system will be implemented and operated. The overall expectation is that this mechanism will be challenging for both the Brazilian government and payment service providers. The laws and regulations applicable to the Brazilian digital payments industry are subject to ongoing interpretation and change, and our digital payments business may become subject to regulation by other authorities. For further information on the risks relating to regulation of business, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry.” Cybersecurity Regulation Financial institutions and payment institutions in Brazil are subject to specific cybersecurity and cloud outsourcing regulations to ensure the integrity and security of their internal controls. Key among these regulations is CMN Resolution No. 4,893/2021 and Central Bank Resolution No. 85/2021, mandating the establishment of a cybersecurity policy and establishing guidelines for outsourcing data processing, storage and cloud computing services. Additionally, CVM Ruling No. 35/2021 outlines the necessary cybersecurity and data protection standards for security transactions in regulated markets. By December 2021, institutions were required to be fully compliant, including having policies and response plans for cybersecurity incidents. Data processing and storage can occur both within and outside Brazil, provided the Central Bank retains access to overseas data for inspection. Any relevant agreements that are entered into providing for processing services must be reported to the Central Bank within ten days of its execution. Also, if processing, storage and cloud computing services are to be provided abroad and classified as “relevant” by the contracting regulated institution, additional regulatory requirements apply. In these scenarios, if there is no agreement to exchange information between the Central Bank and the supervisory authorities of the countries where the services will be provided, prior authorization from the Central Bank will be required for contracting the service and to implement certain changes to the terms of the agreement. 67 Table of Contents In addition, Central Bank Resolution No. 85/21 provides for the cybersecurity policy and requirements applicable to payment institutions authorized to operate by the Central Bank in contracting cloud computing, data processing and storage services. The cybersecurity policy and requirements set forth in Resolution No. 85/21 are very similar to the requirements that apply to financial institutions under CMN Resolution No. 4,893. Recently, CMN Resolution No. 5,274 and Central Bank Resolution No. 538, both dated December 18, 2025, amend CMN Resolution No. 4,893 and Central Bank Resolution No. 85/2021, respectively, in order to modify and introduce new requirements to cybersecurity policies. Regulation on Environmental, Social and Climate Risks The Central Bank has issued a series of new regulations and standards focusing on the management and governance of social, environmental and climate risks. These regulations apply to financial institutions’ products, services and activities, as well as those of their counterparties, controlled entities, suppliers and outsourced service providers. Key regulations include provisions on (i) definition and management of social, environmental and climate risks; (ii) continuous risk management; (iii) updating the Social, Environmental and Climate Responsibility Policy (Política de Responsabilidade Socioambiental e Climática), or PRSAC, every three years; (iv) regulation on the remittance of information regarding social, environmental and climate risks related to exposures in credit and securities transactions, as well as those of the respective debtors under these transactions, including information such as identification, economic sector, risk aggravating and mitigating factors; (v) regulating, for both financial institutions and payment institutions, the general criteria for the preparation and disclosure of individual and consolidated financial statements, including sustainability-related financial information, adopting the technical pronouncements of the Brazilian Sustainability Pronouncements Committee (Comitê Brasileiro de Pronunciamentos de Sustentabilidade), or CBPS, which follow the same parameters as IFRS S1 and S2, among others. Additionally, in line with the “Sustainability” pillar of the “Agenda BC#” and following certain Central Bank public consultations, new rules were published to improve disclosure and governance related to social, environmental and climate risks. These rules aim to align national regulations with international ESG standards, including the recommendations of the Task Force on Climate-related Financial Disclosures. Notably, Resolution No. 139 mandates the annual publication of the Report on Social, Environmental and Climate Risks and Opportunities (Relatório de Riscos e Oportunidades Sociais, Ambientais e Climáticas), or the GRSAC Report, by financial institutions classified in S1, S2, S3 or S4, detailing social, environmental, and climate risks and opportunities, which must be published annually with the base date of December 31, within a maximum period of 90 days from December 31, and made available on their websites for a period of five years. On March 6, 2024, the SEC adopted final rules requiring significant climate-related disclosures by public companies, including evaluation and disclosure of material climate-related risks and opportunities, GHG emissions inventory, climate-related targets and goals, and financial impacts of physical and transition risks, or the SEC Climate Rules. A large number of petitions that seek judicial review of the SEC Climate Rules have been filed. On April 4, 2024, the SEC voluntarily stayed implementation of these new rules pending completion of judicial review of consolidated legal challenges by the Court of Appeals for the Eight Circuit. On November 4, 2025, the Central Bank of Brazil launched Public Consultation No. 127, proposing amendments to Resolution No. 139 to expand and standardize the GRSAC Report. The proposal introduces a second phase of requirements focused on quantitative metrics and targets, while refining the qualitative tables adopted in 2021, and aligns disclosures with international standards, including IFRS S1 and S2 and the Basel Committee’s Pillar 3 framework for voluntary climate risk disclosures. The new framework structures the GRSAC Report into standardized qualitative and quantitative tables covering governance, strategy, risk management and climate risk (transition and physical), as well as sectoral exposures and emissions, agriculture by biome, power generation by source, physical risk metrics for drought and heavy rain, transition plans, and social and environmental risk exposures. Disclosure of business opportunities remains voluntary; disclosure of national and international voluntary commitments follows new standardized tables (COMP1 and COMP2). The consultation also clarifies the use of climate scenario analysis, with parameters for narratives, time horizons and scientific bases. Implementation is phased. For S1 and S2 institutions, the new GRSAC Report format would take effect in January 2027, with the first publication in 2028 using a December 2027 reference date. S3 institutions become subject to all tables with the first required publication based on December 31, 2028; S4 institutions, previously limited to a qualitative governance table, must disclose standardized information on social, environmental or climate commitments via COMP1 and COMP2 on the same timeline as S3. S5 institutions remain exempt. The proposed rules preserve flexibility to add granularity or justify omissions where immaterial and allow complementing tables to meet the sustainability financial reporting requirements aligned with IFRS, subject to consolidation scope differences. Naming Regulations for Authorized Institutions in Brazil On November 28, 2025, the Central Bank of Brazil and the CMN issued Joint Resolution No. 17, which governs the nomenclature and public presentation of institutions authorized to operate by the Central Bank of Brazil. The rule applies to the institution’s full nomenclature (comprising its corporate name, trade name, brand, and internet domain) and to any means used for communication or public presentation to clients and users. 68 Table of Contents Joint Resolution No. 17/25 requires institutions to include, in their corporate names, terms that clearly reference the scope of their authorization to operate granted by the Central Bank of Brazil. It prohibits use, in any nomenclature, of terms – whether literally or by morphological or phonetic similarity – that suggest activities or an institutional type for which the entity does not have specific authorization. Cooperatives may reference their cooperative system in their nomenclature. Institutions that are part of a prudential conglomerate may incorporate the conglomerate’s name, provided it is clear to clients which type of institution within the conglomerate they are interacting with and the conglomerate’s name does not include terms identifying a type of institution not included in the conglomerate. FGTS-Backed Loans On December 11, 2019, Brazil enacted Law No. 13,932, which introduced the annual withdrawal option (saque-aniversário) under the FGTS regime. This modality permits workers to withdraw, each year in the month of their birthday, a portion of their FGTS balance regardless of whether their employment has been terminated. By electing the saque-aniversário, the worker relinquishes the right to withdraw the entire FGTS balance upon termination without cause (the saque-rescisão), but remains entitled to receive the 40% severance penalty payable by the employer. The annual withdrawal amount is determined by a progressive schedule that applies higher percentages to smaller account balances and includes a fixed top-up amount per tier. A worker who wishes to revert to the traditional saque-rescisão must observe a 25-month waiting period from the date of the reversion request. Law No. 13,932/19 also authorized workers to assign or pledge their future saque-aniversário withdrawals to financial institutions by way of fiduciary assignment or lien. This framework gave rise to FGTS-backed loans, a consumer credit product in which the borrower’s future annual FGTS withdrawal amounts are automatically directed to the lender as collateral, enabling faster access to credit. For lenders, these loans offer a lower-risk profile due to the statutory repayment channel through the FGTS system. On October 7, 2025, pursuant to Resolution CCFGTS No. 1,130/25, the FGTS approved amendments to the saque-aniversário rules, effective November 1, 2025, that, among other measures: (i) impose a 90-day cooling-off period after opt-in before a worker may enter into a fiduciary assignment or lien over future withdrawals; (ii) limit workers to one concurrent loan transaction per year; (iii) restrict the number of future annual withdrawals that may be pledged as collateral to up to five (one per year) within any 12-month period, with the possibility to contract up to three additional loan transactions in each subsequent three-year period; and (iv) cap the advanceable amount per annual withdrawal to a minimum of R$100 and a maximum of R$500, implying a maximum aggregate loan size of R$2,500. As a result, FGTS-backed loan origination volumes and ticket sizes are now subject to new constraints (including waiting periods, limits on concurrent and aggregate advances, and per-withdrawal caps), which may narrow the addressable market and affect unit economics, although the repayment mechanics via the FGTS system remain unchanged. Private Payroll Deduction Loans Rules Law No. 15,179 was published on July 24, 2025, amending Law No. 10,820 of December 17, 2003, and aiming to modernize the framework for private payroll-deduction loans by facilitating the use of digital platforms for both the solicitation and management of these credit arrangements. The reform is intended to enhance efficiency, strengthen security, and improve accessibility for workers. Under the updated rules, formal employees – including rural workers, domestic workers, and registered MEIs – may apply for loans on more favorable terms directly through Brazil’s official Digital Work Card application. Loan repayments are capped at 35% of the borrower’s gross salary, with the option to pledge up to 10% of the FGTS (Severance Indemnity Fund) balance or up to 100% of the termination indemnity payable upon dismissal without cause as collateral, and installments are deducted automatically from payroll via the national eSocial system. The measure is expected to deliver tangible benefits to workers by expanding access to lower interest credit facilities and reducing administrative costs. For the first 120 days following the launch of the systems or platform, funds from new payroll-deducted loan transactions with authorized institutions must be used exclusively to repay either (i) non-payroll-deducted loans with outstanding installments without collateral, or (ii) payroll-deducted loans with outstanding installments, provided the borrower has such active obligations on the date the new loan is granted. These new credit operations may be offered by any duly authorized and accredited payroll-deducting institution and must carry an interest rate lower than that of the original loan being refinanced. In such cases, lending institutions are required to report the relevant loan data to the designated public operating agents. This priority repayment structure is intended to encourage the replacement of higher-cost debt with cheaper, payroll-deducted alternatives, thereby contributing to broader economic stimulus. 69 Table of Contents 4C. Organizational Structure We are a subsidiary of UOL, a Brazilian privately held Corporation founded in 1996 and Brazil’s largest internet content, digital products and services company. The chart below shows our corporate structure, including our wholly-owned subsidiaries and our other direct and indirect subsidiaries, as of the date of this annual report. For more information on our subsidiaries, see Exhibit 8.1 to this annual report and Note 4 to our audited consolidated financial statements. (*) Shares delivered under the LTIP and LTIP-Goals, which also compose PagSeguro Digital’s float. (**) Refers to total capital; UOL directly holds 88.74% of our voting capital. (***) For more details on our subsidiaries, please refer to “Item 4. Information on the Company”, subtopic “History and development of the company”. 4D. Property, Plant and Equipment Our Facilities We do not own any real estate. We lease our head office directly from a third-party and we directly rent a number of other smaller offices in Brazil directly from third parties. For our other office space and the operations center in São Paulo, we either lease the space on market terms on an arm’s-length basis from UOL or its affiliates, or we use the space provided by UOL or its affiliates on a cost-sharing basis through an expense apportionment agreement entered into between us and UOL or the relevant affiliate. For more information on this agreement, see “Item 7B. Related Party Transactions—Agreements with UOL and UOL Subsidiaries—Cost-Sharing Agreements.” We also lease other office for our subsidiaries. Other Equipment The majority of our equipment consists of POS devices. The rest of our equipment consists of data processing equipment, machinery, building leasing, facilities and furniture and fittings. 70 Table of Contents Intellectual Property The protection of our trademarks, copyrights, logos, service marks, trade dress, domain names, patents and trade secrets is critical to our future success. We rely on a combination of trademark, copyright, service mark, patent and trade secret laws, administrative procedures and contractual restrictions to establish and protect our proprietary rights in our products and services. We have entered into confidentiality and invention assignment agreements with our employees and certain outside contractors as well as have entered into non-disclosure agreements with our employees, strategic partners and some suppliers in order to limit access to and disclosure of our proprietary information and technology. We actively pursue registration of our trademarks, copyrights, logos, service marks and domain names. We have registered or applied for registration of trademarks with the Brazilian National Institute of Industrial Property (Instituto Nacional da Propriedade Industrial), or INPI, including, among others, the trademarks and logos of “PagSeguro,” “PagBank,” “Moderninha,” “Minizinha,” “PlugPag,” “PagInvest” and “PagVendas.” We have also registered several domain names with NIC.br, Brazil’s internet domain name registry, and domain registrars in the United States and elsewhere, including “pagseguro.com.br,” “pagseguro.com,” “moderninha.com.br,” “moderninhapro.com.br,” “moderninhax.com.br,” “moderninhaplus.com.br,” “moderninhapro2.com.br,” “moderninhasmart.com.br,” “minizinha.com.br,” “minizinhachip.com.br,” “minizinhanfc.com.br,” “boacompra.com.br,” “pagbank. com.br,” “pagbank.com,” “paginvest.net” and “paginvest.com.br.” We own or have the right to use all of the material intellectual property that we use. For information about risks affecting our intellectual property, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—We have only a limited ability to protect our intellectual property rights, which are important to our success.” Licenses and Contracts Visa and MasterCard We have material contracts with Visa and MasterCard in connection with our activities as an acquirer for these card schemes. Our Visa Payment Arrangements Participation and Trademark License Agreement, dated as of August 24, 2015 and amended on July 3, 2017, between Visa do Brasil Empreendimentos Ltda. and PagSeguro Brazil, sets forth the general terms and conditions under which PagSeguro Brazil acts as a merchant acquiring principal participant for Visa in Brazil and provides PagSeguro Brazil with a non-exclusive and non-transferable license to use certain trademarks owned by Visa in connection with its activities as an acquirer in Brazil. Under this agreement, PagSeguro Brazil is exclusively responsible for all the costs and risks associated with its participation as a merchant acquiring principal, and fees payable to Visa under this agreement is determined by the standard payment terms set forth in the Visa Core Rules and Visa Product and Service Rules, available on Visa’s website. Our License Agreement, dated as of June 18, 2015 and as amended from time to time, between MasterCard International Incorporated and PagSeguro Brazil sets forth the general terms and conditions under which MasterCard grants PagSeguro Brazil a non-exclusive license to use certain trade names, trademarks, service marks and logotypes (including MasterCard, Cirrus and Maestro branded marks) in Brazil in connection with PagSeguro Brazil’s issuing and acquiring activities. No consideration is due to MasterCard under this agreement. Other Licenses We operate software products under licenses, including certain open-source licenses, from our vendors, including, among others, Verifone, Oracle, Feedzai and Cisco. Even if any such third-party technology did not continue to be available to us on commercially reasonable terms, we believe that alternative technologies would be available as needed in every case. License of our Proprietary Rights to Our Clients The standard online contract entered into between us and our merchants when they open a free PagBank digital account provides a limited, non-transferable license to certain of our proprietary rights, such as our name and logo, for use by our merchants for commercial purposes. We expect to continue this practice in the future as part of our marketing strategy. While we attempt to ensure that our licensees maintain the quality of the PagSeguro brand, they may take actions that could materially adversely affect the value of our proprietary rights or reputation.

The following discussion should be read in conjunction with our audited consolidated financial statements and the notes thereto included elsewhere in this annual report. The following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this annual report, particularly in “Item 3D. Risk Factors.” 5A. Operating Results Principal Factors Affecting Our Financial Condition and Results of Operations We believe our operating and business performance is driven by various factors that affect the global and Brazilian economy, the Brazilian digital payments market, trends affecting the broader Brazilian financial technology solutions industry and trends affecting the specific markets and customer base that we target, particularly micro-merchants and SMEs in Brazil. The following key factors may affect our future performance. Adoption of Our Digital Payment Services and POS Devices, and Usage of Our Early Payment of Receivables Feature We believe our digital platform, digital payment services and POS devices are the foundation of our relationship with our clients. We generate revenue through the commissions and other fees that we charge for electronic payment intermediation, as well as fees for other services and revenues from the provision of POS devices and related items. In addition, we generate financial income through the early payment of receivables feature that we offer our merchant clients. We intend to continue to drive growth in our digital payment services, POS devices and early payment of receivables feature by scaling our solutions to meet the needs of our clients. Our digital payment solutions and POS devices are the principal way in which our clients become familiar with our full range of products and services. We seek to leverage the familiarity generated by these services, features and devices to encourage merchants to sign up for our other services, which can help them increase their sales and, in turn, generate incremental revenue for us. As a result, the number of new merchants who adopt our digital payment services and purchase our POS devices will affect our growth. Furthermore, our customer base consists primarily of micro-merchants and SMEs, who tend to generate relatively high levels of early payment of receivables from installment transactions in order to fulfill their working capital needs. These micro-merchants and SMEs are at the core of our strategy. Increased Use of Credit and Debit Cards and Expanded Digital Payments Network The results of our operations depend significantly on the use of credit and debit cards to make digital payments in Brazil. According to ABECS, credit, debit and prepaid cards transactions accounted for 56% of household consumption in 2025 in Brazil, totaling more than R$3 trillion. Credit, debit and prepaid card transaction volume in Brazil has increased at a compound annual growth rate, or CAGR, of 17% from 2018 to 2025 according to ABECS, in which 69% of the transactions volume corresponds to credit card transactions and 22% corresponds to debit card transactions. According to ABECS estimates, 2026 is expected to have between R$5.0 trillion and R$5.01 trillion in card volume, representing an increase of 9.5% to 11.5%. According to ABECS, online purchases made up 35% of the total number of credit card transactions in Brazil and 25% of the total transactions value in 2025, illustrating the potential for expansion of online payments in Brazil. Our results of operations depend in part on consumers’ widespread acceptance and use of the internet as a way to conduct commerce and financial transactions. E-commerce is also underpenetrated compared to e-commerce levels in more developed economies. According to eMarketer, Brazil’s e-commerce totaled approximately US$78 billion in 2025 and accounted for 12.2% (an increase from 6.7% in 2019) of the US$668 billion in retail sales for the year, compared to 20.9% worldwide in 2025. Purchases made through mobile devices (m-commerce) reached approximately US$49 billion and accounted for 63% (from 39% in 2019) of all online (e-commerce) retail sales in Brazil in 2025. Since we view commerce via mobile devices as a key driver of growth going forward, we focus on maintaining a mobile-first digital platform, and we design our solutions on a mobile-first basis so that our merchants can be always self-sufficient. 72 Table of Contents Further, Latin America’s retail industry proved resilient amid two years of market volatility caused by the pandemic. By the end of 2021, retail sales were well on their way to a full recovery from 2020. In 2025, considering the worldwide economy, total retail sales increased 3.7%, retail e-commerce sales grew 7.9% and retail e-commerce sales grew 9.3%. In its turn, in Latin America, total retail sales increased 4.9%, retail e-commerce sales grew 12.2% and retail m-commerce sales grew 14.9%. In addition, according to eMarketer’s Latin America Mobile Payment Users report, proximity payment penetration in Brazil reached 50% of smartphone users in 2025. This is higher than the penetration rate in Mexico (18%). According to ABECS, proximity payments in Brazil account for 73.6% of all in-person transactions, with 72% of the population using this payment method daily. Furthermore, according to the most recent data included in The Global Payments Report 2025 by Worldpay, consumer use of credit cards remains strong, while sources of credit are diversifying and they are increasingly paying via credit card funded digital wallets, buy now, pay later, or BNPL, and POS financing offered by banks, fintechs and merchants. For Latin American countries, they expect that digital wallets will increase from 22% to 29% of e-commerce payment volumes by 2030, surpassing the share cards (which will decrease from 46% to 31%). Globally, digital wallets are extending their omnichannel dominance, being already the leading payment method and remaining among the fastest growing methods. The projections are that digital wallets will increase from 53% to 65% of global e-commerce payment volumes by 2030 with decline in credit cards (from 20% to 13%) and debit cards and prepaid (from 12% to 7%). Nevertheless, digital wallets and credit and debit cards will still account for over 80% of e-commerce global spend by 2030. BNPL is expected to grow in transaction value at a 9% CAGR, while its market share is expected to remain stable at 5% from 2024 to 2030. Launch of New Products and Services and Cross-selling to Our Clients We strive to stay on the cutting edge of the financial technology solutions industry by developing and launching new products and services to offer to both new and existing clients and intend to continue to invest in product development to build new products and services and to bring them to market. This allows us to continue to meet the needs of our clients, as these needs grow and change over time. While we expect our total expenses to increase in the short term as we plan for growth, we expect our expenses to decline as a percentage of our total revenue and income over the medium term as these investments benefit our business and our business grows. Our existing clients represent a sizable opportunity to cross-sell products and services with relatively low incremental marketing and advertising expenses for us. We believe that our range of services, many of which can be used for both business and personal needs, represents an opportunity to further increase engagement with our existing clients. We plan to continually invest in product development so as to maintain and increase the attractiveness of our products and services. To the extent that we are able to cross-sell these products and services and develop and introduce new products and services to our existing clients and attract new clients, we expect our revenues and financial income to continue to grow and our margins to increase. Marketing and Advertising For information regarding our marketing and advertising, see “Item 4B. Business Overview—Sales and Marketing.” Merchant Size We benefit from our primary focus on micro-merchants and SMEs, who we believe were overlooked or underserved by incumbent payment providers and large financial institutions in Brazil before PagSeguro. In addition to payments solutions, we are serving our micro merchants and SMEs with evolving day-to-day banking solutions, that should increase the revenue and profitability of our client base. Serving an increasing number of larger merchants also presents an opportunity to cross-sell value-added services and features such as accounting reconciliation, which generate incremental revenues and margin with low or no customer acquisition costs. Consumer Adoption of Our Products and Services Many of our products and services reach consumers directly. Our complete and free of charge digital banking solutions are an attractive alternative not only for unbanked consumers, but also for those who, despite already being served by traditional financial institutions, seek a more efficient, accessible, and integrated banking experience. Most of our customers (representing 84% of the PagBank active customer base) already maintained a banking relationship prior to opening their PagBank account, underscoring our ability to attract consumers within a competitive and well‑served market. We have made significant investments in the development of our complete and free of charge digital banking solutions, and our ability to grow our consumer network going forward will be important for strengthening our ecosystem and driving our growth. 73 Table of Contents According to data from the World Bank, published in 2025 with reference to the closed year of 2024, 86% of the Brazilian population aged 15 and over held an account at a bank or similar financial institution, indicating a high level of financial inclusion in the country. However, access remains uneven across income groups. Among the wealthiest 60% of the population, the share of individuals with a financial account reached 92%, while among the poorest 40%, this figure was significantly lower, at 76%. These disparities highlight that, despite meaningful progress in the bankarization of the Brazilian population, important gaps in financial inclusion persist, particularly among lower-income groups. The unequal access to formal financial services reinforces the existence of a substantial segment of individuals with limited or inadequate access to the financial system, supporting the potential for further expansion of financial inclusion solutions and for the entrance and growth of innovative digital financial institutions capable of more effectively serving these partially underserved segments. Currency Fluctuations We do not generate material revenues in foreign currencies that could substantially affect our results of operations. Certain of our expenses and capital expenditure are subject to currency fluctuation, as the prices of the POS devices we purchase are set in U.S. dollars. Inflation Inflation, government policies adopted to curb inflationary pressures and uncertainties regarding possible future governmental intervention have contributed to economic uncertainty in Brazil. Brazilian inflation rate pursuant to the IPCA index was 4.26%, 4.83% and 4.62% in 2025, 2024 and 2023, respectively. The SELIC rate, the Central Bank’s overnight rate, was 15%, 12.25% and 11.75% for the twelve months ended in 2025, 2024 and 2023, respectively. The interest rates have been volatile in the past years in Brazil, with periods of increase, decrease and stability of the SELIC rate. From January 2022 until August 2022, the SELIC rate increased, reaching 13.75%, and remained stable until July 2023. From August 2023 until May 2024, the SELIC rate decreased, reaching 10.5%, and remained stable until September 2024. Following such period of stability in 2023, the SELIC rate has been increasing sand, as of the date of this annual report, it is 15% following the last meeting of COPOM on January 29, 2026. For more information, see “Item 3D. Risk Factors—Risks Relating to Brazil—Ongoing political instability in Brazil may adversely affect our business, results of operations and the trading price of Class A common shares” and “Item 3D. Risk Factors—Risks Relating to Brazil—Inflation and certain measures by the Brazilian government to curb inflation have historically affected the Brazilian economy and Brazilian capital markets, and high levels of inflation in the future could adversely affect our business and the price of our Class A common shares.” Inflation has a direct effect on our contracts with certain suppliers, such as telecommunications operators, which costs are indexed to the IPCA, and data processors, whose labor costs are adjusted according to inflation. While inflation may cause our suppliers to increase their prices, we are generally able to offset this effect by increasing the prices we charge for our products and services. Inflation also impacts on our revenues from merchants. When merchants adjust their prices for inflation, the purchasing power of consumers may be reduced, which may adversely affect our revenue if it results in a reduction in the number and volume of transactions. However, if our merchants raise their prices due to inflation, the amount we receive on each transaction also increases. 74 Table of Contents Pricing and Revenue Mix in Our Payment Processing Services We generate revenue in the form of commissions and fees on the capture, transmission, processing and settlement of transactions carried out using credit, debit, Pix and meal voucher cards, as well as fees for other services. Credit and debit cards generate commissions in the form of the merchant discount rate, or MDR, which is a commission withheld by us from the transaction value paid to the merchant. The MDR we charge may vary over time and we may make different commercial offers for different services or for larger clients. However, overall, the MDR for Pix is lower than for debit cards, which, in turn, is lower than that for credit cards Payments made using meal voucher cards and other payment methods generate per-transaction or percentage commissions at various rates. Our revenues are therefore impacted by the mix of these types of services that we sell, as well as any changes in the pricing for each service. Financing of Our Early Payment of Merchants’ Receivables Feature We receive significant financial income from offering our merchants the option to obtain early payment of their receivables from credit card installments. We incur significant financial expenses in order to maintain this optional feature and we fund this feature (i) principally by obtaining early payment of note receivables due to us from the card issuers and acquirers, enabling us to provide the related early payment to merchants, as well as (ii) through our general third-party borrowings, issuing CD’s or other financial options through BancoSeguro or PagSeguro and own capital. Our ability to maintain adequate funding for the early payment feature is important for our operations and future income generation. For further information, see “—Principal Components of Our Results of Operations—Financial Expenses.” Interchange Fees We rely on card issuers and card schemes to process our transactions, and we are required to pay fees for this service. In addition, although we are accredited as an acquirer. From time to time, card schemes such as MasterCard and Visa may increase the interchange fees that they charge for each transaction using one of their cards. Credit card schemes have the right to pass any increases in interchange fees on to us as well as to increase their own fees for processing. In addition, card schemes have imposed and may again impose special assessments for transactions that are executed through a “digital wallet,” and these fees could particularly affect us and significantly increase our costs. Although our standard contract with our merchant clients allows us to adjust our rates and tariffs at our discretion by notice to the merchant, our ability to vary our pricing remains subject to a variety of factors, including competition from other payment providers, market conditions and, in certain cases, direct price negotiations with the merchant. As a result, we may not necessarily be able to pass through all interchange and processing fees to our merchant clients and increases in these fees may therefore increase our cost of sales and services and reduce our margins. In connection with our acquiring business operations, the interchange fee, which we record as Transaction costs within Cost of sales and services, has the potential to affect our margins. An increase in interchange fees will result in an increase in our Cost of sales and services and if we cannot pass the interchange fees onto customers via a corresponding increase in MDR, our margin will also be affected. Currently, the difference between interchange fees and the MDR we charge is less for debit card transactions than for credit card transactions, so our margins on credit card transactions are greater. We cannot predict if or when the card schemes will increase their interchange fees, or what the amount of any such increases may be. For further information, see “Item 3D. Risk Factors—Risks Relating to Our Business and Industry—We partially rely on card issuers or card schemes to process our transactions. Changes to credit card scheme fees, rules or practices may harm our business.” In connection with our issuing business operations, we earn interchange revenues that vary according to the type of card that we issue to our customers (a credit, debit or prepaid card). These interchange fees are subject to the terms defined by the card schemes, and in certain cases, these fees may also be subject to terms defined by the established card schemes and in certain cases, these fees may also be subject to terms defined by regulator. Thus, our business and financial condition may be negatively affected by the terms of interchange fees established by card schemes and regulator. 75 Table of Contents As our payments ecosystem, merchant services and banking solutions include both acquiring and issuing business operations, the variations to interchange rates that may negatively affect one side of the business, may also positively affect the other side of the business. However, this correlation does not guarantee that we will not experience a negative impact on our overall financial condition as a result of variations in the interchange rates and payment methods utilization mix. Brazilian Political Environment and Macroeconomic Conditions, Interest Rates, Consumer Credit and Consumer Spending Substantially all of our operations are located in Brazil. As a result, our revenues, financial income and profitability are influenced by political and economic conditions in Brazil, including their impact on credit availability, disposable income, employment rates and average wages. Our business, as well as the financial technology solutions industry more broadly, is particularly sensitive to changes in economic conditions. Our total revenue and income depend on consumer spending levels, prevailing interest rates and the expansion or contraction of consumer credit in Brazil, each of which affect both the volume and value of payment transactions. Interest rates on consumer credit transactions have an indirect effect on us, as Lower rates tend to stimulate private consumption, increasing credit and debit card transactions or reducing the number of installments chosen by consumers. Conversely, higher interest rates may reduce private consumption or increase the number of installments selected. Rising interest rates may also discourage merchants from using our early payment of receivables feature if higher financing costs require us to raise the discount rate applied to this service. Recent economic instability in Brazil, combined with a deteriorating political environment, has weakened market confidence in the Brazilian economy. For further information, see “Item 3D. Risk Factors—Risks Relating to Brazil—Ongoing political instability in Brazil may adversely affect our business, results of operations and the trading price of Class A common shares.” The following table shows data for real GDP, inflation and interest rates in Brazil and the U.S. dollar/real exchange rate at the dates and for the periods indicated. For the Years Ended December 31, 2025 2025 2024 2023 Real growth (contraction) in GDP ( 2.3% 3.4% 3.2% Inflation (IGP-M) (1) -1.1% 6.5% -3.2% Inflation (IPCA) (2) 4.3% 4.8% 4.6% Long-term interest rates – TJLP (average) (3) 8.7% 6.9% 7.1% CDI interest rate (average) (4) 14.3% 10.8% 13.2% Period-end exchange rate—reais per US$1.00 R$5.50 R$6.19 R$4.84 Average exchange rate—reais per US$1.00 (5) R$ 5.59 R$5.39 R$5.00 Average unemployment rate (6) 5.9% 6.9% 8.0% Source: FGV, IBGE, Central Bank and Bloomberg (1) Inflation (IGP-M) is the general market price index (Índice Geral de Preços – Mercado) measured by FGV. (2) Inflation (IPCA) is a broad consumer price index measured by the IBGE. (3) TJLP is the Brazilian long-term interest rate (Taxa de Juros de Longo Prazo) (average of monthly rates for the period). (4) The CDI interest rate is an average of interbank overnight rates in Brazil (daily average for the period). (5) Average of the exchange rate on each business day of the period. (6) Average unemployment rate for year as measured by the IBGE. Our business has grown rapidly, driven by new clients and increased TPV, with our total revenue and income increasing to R$20,410.5 million in 2025 from R$18,809.6 million in 2024 and R$15,948.4 million in 2023. In addition to continuing to grow our client base, we believe that our business model will allow us to benefit from Brazil’s economic growth potential, particularly among micro-merchants, SMEs and individuals without bank accounts or underserved by traditional banking institutions. Seasonality For information regarding our seasonality, see “Item 4B. Business Overview—Seasonality.” 76 Table of Contents Principal Components of Our Results of Operations The following is a summary of the items comprising our statements of income: Total Revenue and Income Our total revenue and income consist of the total of our revenue from transaction activities and other services, financial income and other financial income. Revenues We generate revenues from transaction activities and other services. In each case, our revenues consist of gross revenues less deductions from those revenues. Revenue from Transaction Activities and Other Services Our revenue from transaction activities and other services consists of gross revenue from transaction activities and other services, less deductions from those gross revenues. Our main source of gross revenue from transaction activities and other services is commissions and fees on the capture, transmission, processing and settlement of transactions carried out using credit, debit and meal voucher cards and fees for other services. We have the primary responsibility of providing the services to our clients and we also directly set the prices for such services, independently from the related transaction costs agreed between us and the card schemes or card issuers. Since we have primary responsibility for providing our merchant clients with the intermediation service, and we have price discretion to adjust the rates and tariffs we charge merchants, we are the principal in the intermediation transaction. We therefore recognize our transaction fees as revenue on a gross basis, and we recognize the transaction costs separately as discussed below. This line item also includes the fees we charge for other services, such as revenues received from the one-time and non-refundable membership fee in order to simplify inventory control and the acquisition of POS devices by our clients and revenues from credit operations. We also recognize revenue earned on a daily pro-rata basis. Revenue from credit operations due and overdue before entering in stop accrual is recorded in revenue from transaction activities and services. After stop accrual, income will only be recognized when actually received. We recognize revenues from these commissions and fees when the purchase is approved by the card issuer, in the case of cash-in payments made via payment cards; when the transaction is carried out, in the case of payments made via other cash-in payment methods; or in the case of services, when the service, is rendered. The amounts deducted from our gross revenue from transaction activities and other services consist principally of the applicable Brazilian sales taxes and social security contributions: ISS; contributions to the Brazilian government’s PIS; and contributions to the Brazilian government’s COFINS. We are required to collect each of these on our transaction activities and other services. Financial Income As described under “Item 4B. Business Overview—Our Products and Services—Cards,” our early payment of receivables feature consists of paying our merchants their installment receivables upfront when consumers paying by credit card choose to pay the merchant in installments. We account for the remuneration from this feature as financial income. This financial income makes up a significant portion of our overall total revenue and income. Our remuneration from the early payment of receivables feature consists of a discount that we withhold from the transaction value of the receivables that we pay to merchants in advance. We recognize the discount amount as financial income at the time a sale transaction is approved involving a merchant who has opted to receive early payments of the receivables from their credit card installment sales. The discount that generates our financial income relates to any early payment for the purchases. 77 Table of Contents Our financial income relates to early payments to merchants of amounts related to receivables from purchase transactions that have been approved by the card issuer and the card scheme. The financial expenses we incur in funding this early payment of receivables feature are accounted for in our financial expenses, discussed below. Other Financial Income Our other financial income consists principally of interest generated by bank savings accounts and by deposits, we make with Brazilian courts, known as judicial deposits, which guarantee any compensation we may be required to pay in litigation matters. Our other financial income also includes our gain of foreign exchange variations, i.e., the gain on our assets and liabilities related to the appreciation or depreciation of the real against foreign currencies, which has limited impact on our cash position. Cost of Sales and Services Our cost of sales and services represents the amounts that make up the cost of the services and devices we offer. These amounts are divided into transaction costs, marketing and advertising, personnel expenses and depreciation and amortization and other costs. For further information on these costs, see Note 27 to our audited consolidated financial statements.  Our transaction costs consist of interchange fees set by card schemes that are owed to the issuer of the card; assessment fees owed to card schemes; fees paid to third-party payment processors; fees paid to acquirers; and bank settlement fees. All of our transaction costs are accounted for within our cost of sales and services. Since we are the principal in the intermediation transaction, we recognize the transaction costs that we pay to third parties, such as card schemes and card issuers who process these transactions, within our cost of sales and services separately from the transaction fees we receive, which we recognize on a gross basis. The transaction costs are agreed between the card schemes or card issuers and us, independently of the fees we charge our merchant clients.  Our marketing and advertising expenses are divided between our cost of sales and services as well as our selling expenses. Of this total, the portion of marketing and advertising that is accounted for within our cost of sales and services relates to customer support.  Our personnel expenses consist of wages, overtime, benefits (such as meal vouchers, transportation vouchers and medical insurance, among others), profit sharing, and social contribution and payroll taxes. In Brazil, social contribution and payroll taxes consist of the INSS contribution and FGTS contribution. Our personnel expenses are divided between our cost of sales and services as well as our selling expenses and our administrative expenses. Of this total, the portion of our personnel expenses that is accounted for within our cost of sales and services refers to employees engaged in activities related to the cost of services that we offer, such as technology, customer support, logistics, anti-fraud activities and mediation services.  Our depreciation and amortization expenses are allocated to our cost of sales and services as well as our selling expenses and our administrative expenses. The portion of our depreciation and amortization expenses that is included in our cost of sales and services consists mainly of: (i) the depreciation of equipment, furniture, technology and installations that form part of the cost of services that we offer; and (ii) the amortization of software that we develop internally for use in our operations.  Our other expenses are allocated to our cost of sales and services as well as our selling expenses and our administrative expenses. Of this total, the portion of our other expenses that is included in our cost of sales and services consists mainly of items such as travel expenses and office supplies that form part of the cost of services that we offer. 78 Table of Contents Selling Expenses Our selling expenses represent the amounts that we spend on publicity, marketing, quality control and direct or indirect relations with our clients. These amounts are divided into marketing and advertising, personnel expenses, chargeback and credit loss allowance expenses, depreciation and amortization expenses and other expenses. For further information on these expenses, see Note 27 to our audited consolidated financial statements.  The portion of marketing and advertising expenses included in our selling expenses relates to the production and distribution of our marketing and advertising campaigns on traditional offline media, traditional online advertising, the positioning of our products in search platforms, telemarketing related to offering our POS devices, commissions to our third party sales force and partners such as platforms, bloggers and developers, expenses incurred in relation to trade marketing at events, and amounts that we spend on consulting services and call centers for our telemarketing campaigns.  The portion of our personnel expenses included in our selling expenses relates to employees engaged in marketing and advertising of our services, POS devices, hubs and features.  Chargeback and credit loss allowance expenses consist of transaction losses arising from chargebacks related to fraudulent transactions, which occurs when a consumer makes a purchase via credit card and then requests a chargeback from the issuing bank after receiving the goods or services purchased and expected credit losses related to our credit products. All of our losses expenses are accounted for within our selling expenses.  The portion of our depreciation and amortization expense included in our selling expenses consists of the depreciation of equipment used for client relationships.  The portion of our other costs included in our selling expenses consist of expenses related to travel, lodging and insurance, facilities, rent, consultancy fees and office supplies relating to marketing and advertising of our services, POS devices and features. Administrative Expenses Our administrative expenses represent the amounts that we spend on back office and overhead expenses. These amounts are divided into Personnel expenses, depreciation and amortization expenses and other costs. While we expect our administrative expenses to increase in the short term as we plan for growth and as we incur costs of compliance associated with being a public company, we expect these expenses to decline as a percentage of our total revenue and income over the medium term as our business grows.  The portion of our personnel expenses that form part of our administrative expenses relates to our finance, legal, human resources, and administrative personnel, as well as fees paid for professional services, including legal, tax and accounting services.  The portion of our depreciation and amortization expenses that form part of our administrative expenses relates to: (i) the depreciation of the equipment, furniture, tools and technology used in our head office and back-office operations; and (ii) the amortization of software developed internally to support our head office and back-office needs and leasing needs, which is shown in Note 14 to our audited consolidated financial statements.  The portion of our other costs that form part of our administrative expenses includes items such as bank charges, travel, reimbursement of staff expenses and office supplies. Financial Expenses Our financial expenses include the charges we incur to obtain early payment of note receivables owed to us by card issuers and acquirers in order to finance the early payment of receivables feature that we offer merchants and interest related to deposits and bank accounts of our clients. Variations in our financial expenses are driven by Brazilian interest rates, which determine the cost of most of our financing, together with changes in the mix of the financing we use for our early payment of receivables feature. We incur significant financial expenses in order to maintain the early payment of receivables feature. We fund this feature (i) principally by obtaining early payment of receivables owed to us by card issuers and acquirers, enabling us to provide the related early payment to merchants, as well as (ii) through our general third-party borrowings and own capital, issuing CDs or other financial options through BancoSeguro or PagSeguro and own capital. In addition, we use FIDCs to finance the early payment of receivables of our merchants. Our remuneration from the early payment of receivables feature continues to be reflected as financial income in our consolidated financial statements. For further information regarding our FIDCs, see “Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil—Rules on E-Commerce, Data Protection, Consumer Protection, Banking Secrecy and Taxes—Taxation of Investment Funds.” 79 Table of Contents Other Income (Expenses), Net Our other income (expenses), net line item consists mainly of contingencies, impairment of assets mainly related to POS, software, cloud and consulting expenses and miscellaneous income or expense items. Current Income Tax and Social Contribution Current income tax and social contribution consist of tax assets and liabilities for the current year. Our liability to income tax principally reflects the level of our profit before income taxes; this line item also varies, however, to the extent that we are entitled to defer tax on certain investments in technological innovation, in which case our tax base for income tax for the year is reduced and the related deferred tax liability is accounted for in the deferred income tax and social contribution line item below. Our tax assets for the current year are calculated based on the expected recoverable amount, and tax liabilities for the current year are calculated based on the amount payable to the applicable tax authorities. The tax rates and tax laws used to calculate this amount are those enacted or substantially enacted at the balance sheet date. Current income tax and social contribution related to items recognized directly in equity is also recognized in equity. We periodically evaluate our tax positions with respect to interpreting tax regulations and, when appropriate, establish provisions. Deferred Income Tax and Social Contribution Deferred income tax and social contribution consist of temporary differences between the tax basis of assets and liabilities and their carrying amounts at the balance sheet date. This line item refers principally to deferrals of tax liability that we are entitled to take on capital investments that we make in technological innovation under Brazilian Law No. 11,196/2005, known as the Technological Innovation Law or “Lei do Bem.” We are able to use this tax deferral law principally for the investments we make in developing software internally, where we capitalize the labor and other costs involved as an intangible asset rather than accounting for these amounts as expenses, and we depreciate the accounting value of the intangible asset over its useful life. The Lei do Bem allows us to defer our tax liability on these investments. Other Brazilian tax rules also allow us to defer tax on certain items, for example on unpaid amounts due from creditors. Deferred taxes also include some entities and investment funds that adopt different taxation regimes according to the applicable rules in their jurisdictions, the main different tax regime refers to gain on the ownership of FIDC equity interests, that will be realized only in the redemption of such equity interests. The deferred income tax and social contribution line item consists of our liability to future tax under the Lei do Bem and these other tax laws, less the depreciation and amortization that we take during the year on the respective capitalized assets, and less the tax losses carried forward from prior years that we are able to offset against our tax liability during the year. For further information on this line item, see Note 23 to our audited consolidated financial statements. Deferred tax liabilities are recognized for all taxable temporary differences, except in certain situations explained in Note 2.19 of our audited consolidated financial statements. The carrying amount of deferred tax assets is reviewed at each balance sheet date and derecognized to the extent that it is no longer probable that sufficient taxable profit will be available to allow all or part of the deferred tax assets to be utilized. Unrecognized deferred tax assets are reviewed, at each balance sheet date, and recognized to the extent that it is probable that future taxable profit will be available to allow for their utilization. As of the date of this annual report, there is no Cayman Islands income tax, corporation tax, capital gains tax or other taxes payable by the PagSeguro Digital or its shareholders. PagSeguro Digital is an exempted company under Cayman Islands law and as such has received an undertaking as to tax concessions pursuant to Section 6 of the Tax Concessions Act (2018 Revision). This undertaking provides that, for a period of 20 years from the date of issue of the undertaking, no law thereafter enacted in the Cayman Islands imposing any taxes to be levied on profits, income, gains or appreciation will apply to the Company or its operations. No capital or stamp duties are levied in the Cayman Islands on the issue, transfer or redemption of our Class A common shares. An annual registration fee will be payable by PagSeguro Digital to the Cayman Islands government which will be calculated by reference to the nominal amount of its authorized capital. 80 Table of Contents Results of Operations The following discussion of our results of operations is based on the financial information derived from our audited consolidated financial statements included elsewhere in this annual report. For a discussion of our results of operations for the year ended December 31, 2024, see “Item 5A. Operating Results in 2024 and 2023” of our annual report on Form 20-F for the fiscal year ended December 31, 2024, filed with the SEC on April 29, 2025. Results of Operations in 2025 and 2024 For the Years Ended December 31, 2025 PercentChange 2024 (in millions of reais, with the exception ofpercentages and per-share amounts) Revenue from transaction activities and other services 8,158.7 (11.2)% 9,183.3 Financial income 11,584.6 26.6% 9,150.4 Other financial income 667.3 40.2% 475.9 Total revenue and income 20,410.5 8.5% 18,809.6 Cost of services (9,696.1) 1.6% (9,543.3) Selling expenses (1,644.9) (6.0)% (1,749.3) Credit loss allowance expenses (129.3) 17.2% (110.3) Administrative expenses (861.0) (11.4)% (972.3) Financial costs (5,228.8) 39.6% (3,746.7) Other income (expenses), net (301.1) (2.2)% (307.9) Profit before income taxes 2,549.4 7.2% 2,379.9 Current income tax and social contribution (354.3) 35.6% (261.2) Deferred income tax and social contribution (76.8) 3168.1% (2.4) Income Tax and Social Contribution (431.1) 63.6% (263.6) Net Income for the Year 2,118.4 0.1% 2,116.4 Attributable to: Equity holders of the parent 2,118.4 0.1% 2,116.4 Non-controlling interests — — — Basic earnings per common share – R$ 7.1761 7.2% 6.6953 Diluted earnings per common share – R$ 7.1118 7.4% 6.6238 Total Revenue and Income Our total revenue and income amounted to R$20,410.5 million in 2025, an increase of 8.5% from R$18,809.6 million in 2024. This increase was primarily due to an increase in our TPV and will be detailed in each revenue and income lines described below. Revenue from Transaction Activities and Other Services Our revenue from transaction activities and other services in 2025 amounted to R$8,158.7 million, a decrease of R$1,024.6 million, or 11.2%, from R$9,183.3 million in 2024, as a result of the factors described below. Our gross revenue from transaction activities and other services in 2025 amounted to R$9,419.1 million, a decrease of R$933.1 million, or 9.0%, from R$10,352.2 million in 2024. This decrease was mainly related to changes in our business pricing structure, pursuant to which a greater portion of the consideration associated with early payment arrangements within our FIDC structures is recognized as financial income. This change commenced in 2Q24 and was partially reflected in 2024, with the full-year impact reflected in 2025. Our deductions from gross revenue from transaction activities and other services, which consist principally of sales taxes, amounted to R$1,260.5 million in 2025, or 13.4% of our gross revenue from transaction activities and other services for the year. In 2024, deductions from gross revenue from transaction activities and other services totaled R$1,168.9 million, or 11.3% of our gross revenue from transaction activities and other services for the year. The R$91.6 million, or 7.8%, increase in deductions in 2025, was primarily driven by taxes incurred on intercompany transactions in 2025, for which the corresponding revenues are eliminated in consolidation. Financial Income Our financial income, which represents the volume of the discount fees we withhold from TPV in the early payment of receivables feature that we offer merchants and the MDR fee for the payment processing transaction, amounted to R$11,584.6 million in 2025, an increase of R$2,434.2 million, or 26.6%, from R$9,150.4 million in 2024. The increase in this activity in 2025 compared to 2024 was driven by higher TPV and mix of processed debit and credit card payments containing a higher percentage of credit card transactions made in installments in 2025 compared to 2024 as well as by the recognition of the early payment arrangements within our FIDC. For more information on recognition of early payment arrangements within our FIDC structures, see “––Revenue from Transaction Activities and Other Services.” 81 Table of Contents Other Financial Income Our other financial income amounted to R$667.3 million in 2025, an increase of R$191.4 million, or 40.2%, from R$475.9 million in 2024. The increase of R$191.4 million in our other financial income in 2025 was due to the increased income interest on cash and cash equivalents and financial investments as a result of the higher volume of financial investments and compulsory reserves deposited in the Central Bank and higher SELIC rate as compared to 2024. Expenses Our total expenses amounted to R$17,861.1 million in 2025, an increase of R$1,431.4 million, or 8.7%, from R$16,429.7 million in 2024. As a percentage of our total revenue and income, our total expenses in 2025 remained stable at 87.5% compared to 87.3% in 2024 each expense will be detailed in lines described below. Cost of Services Our cost of services amounted to R$9,696.1 million in 2025, an increase of R$152.8 million, or 1.6%, from R$9,543.3 million in 2024. As a percentage of our total revenue income, our cost of services decreased by 3.2 percentage points, to 47.5% in 2025 from 50.7% in 2024. The percentage of costs relative to revenue decreased due to the efficiency achieved in negotiations related to operating costs, which allowed costs to stay controlled even as revenue increased. Selling Expenses Our selling expenses amounted to R$1,644.9 million in 2025, a decrease of R$104.4 million, or 6.0%, from R$1,749.3 million in 2024. As a percentage of our total revenue and income, our selling expenses decreased to 8.1% in 2025, compared to 9.3% in 2024 This performance was mainly driven by lower chargeback due the improvement of our client analysis. Credit loss allowance expenses Our credit loss allowance expenses amounted to R$129.3 million in 2025, an increase of R$19.0 million, or 17.2%, from R$110.3 million in 2024. As a percentage of our total revenue and income, our credit loss allowance expenses remained stable at 0.6% in 2025, compared to 0.6% in 2024. Administrative Expenses Our administrative expenses amounted to R$861.0 million in 2025, a decrease of R$111.3 million, or 11.4%, from R$972.3 million in 2024. This decrease was primarily driven by lower profit sharing provisions. As a percentage of our total revenue and income, administrative expenses decreased to 4.2%, compared to 5.2% in 2024. Financial Expenses Our financial expenses amounted to R$5,228.8 million in 2025, an increase of R$1,482.1 million, or 39.6%, from R$3,746.7 million in 2024. The increase in our financial expenses was primarily driven by the rapid growth of our banking segment and TPV, which raised our working capital needs related to advances of merchants’ receivables. Expenses related to time deposits (CDBs) and bank accounts also increased compared to 2024, mainly due to the rise in the SELIC, as well as the greater amounts deposited by our clients. Other Income (Expenses), Net Our other income (expenses), net, recorded expenses of R$301.1 million in 2025, a decrease of R$6.8 million, or 2.2%, from expenses of R$307.9 million in 2024. This decrease is mainly related to provisions established in the amount of R$156.1 million in POS devices made in 2025 as compared to R$163.9 million in the year 2024. Profit before Income Taxes Our profit before income taxes amounted to R$2,549.4 million in 2025, an increase of R$169.5 million, or 7.1%, from R$2,379.9 million in 2024 as a result of the factors described above. Income Tax and Social Contribution Income tax and social contribution amounted to expenses of R$431.1 million in 2025, an increase of R$167.5 million, or 63.6%, from expenses of R$263.6 million in 2024. This total item consists of current income tax and social contribution and deferred income tax and social contribution. Our total effective tax rate was 16.9% in 2025, compared to 11.1% in 2024. In both periods, the difference between the effective income tax and social contribution rate and the rate computed by applying the Brazilian federal statutory rate was mainly related to the tax benefit under the Lei do Bem, which reduces income tax charges based on investments made in innovation and technology, such as those made by PagSeguro Brazil, our Brazilian operating subsidiary and income tax abroad due to certain entities or investment funds adopting different taxation regimes in accordance with the applicable rules in their respective jurisdictions. In 2025, we also recognized the increase in the CSLL rate, as provided under Law 224/2025, in the amount of R$142.3 million, which was the main driver of the year over year increase in tax expenses. Under Brazilian income tax law, income taxes are paid by each entity on a stand-alone basis. 82 Table of Contents Net Income for the Year As a result of the foregoing, our net income for the year amounted to R$2,118.4 million in 2025, an increase of R$2.0 million, or 0.1%, from R$2,116.4 million in 2024. As a percentage of our total revenue and income, our net income for the year decreased 0.9 percentage points, to 10.4% in 2025 from 11.3% in 2024. 5B. Liquidity and Capital Resources The following discussion of our liquidity and capital resources is based on the financial information derived from our audited consolidated financial statements included elsewhere in this annual report. For a discussion of our liquidity and capital resources for the year ended December 31, 2024, see “—Cash Flows—Year Ended December 31, 2024 Compared to Year Ended December 31, 2023” of our annual report on Form 20-F for the fiscal year ended December 31, 2024, filed with the SEC on April 29, 2025. General Our principal liquidity requirements relate to the early payment of receivables feature that we offer merchants, obligations with deposits, checking accounts and borrowings. We believe our current working capital is sufficient for present requirements. Through the date of this annual report, we have satisfied our funding and working capital requirements (i) through the cash generated by our businesses, (ii) by obtaining early payment of note receivables due to us from the card issuers and acquirers and (iii) by the deposits. The table below presents our cash position at the beginning of each period, and our net cash provided by operating activities, net cash used in investing activities and net cash provided by financing activities during the periods indicated: At and for the Year Ended December 31, (in millions of reais) 2025 2024 2023 Liquidity and Capital Resources Cash and cash equivalents 1,857.5 927.7 2,899.1 Net cash provided (used in) by operating activities 7,562.4 (3,416.3) 3,999.8 Net cash used in investing activities (2,299.8) (1,830.1) (2,703.8) Net cash provided (used in) by financing activities (4,332.8) 3,275.0 (226.0) Our cash and cash equivalents, which are held in reais, include cash on hand, deposits with banks and other short-term highly liquid investments with original maturities of three months or less, and with immaterial risk of change in value. For more information, see Note 6 to our audited consolidated financial statements. Cash Flows Our net cash provided by (used in) operating activities consists of: (i) our profit before income taxes for the year; (ii) amounts that are recorded as expenses or revenues in our statement of income but which do not affect cash; (iii) amounts representing changes in our operating assets and liabilities; (iv) the cash amounts of income taxes and social contributions that we pay during the period; and (v) the cash amounts of interest income received (paid). Our cash flows used in investing activities consist of amounts paid on acquisitions, our purchases of property and equipment, our purchases of intangible assets, and our new financial investments less the payments we make to redeem existing financial investments. Our cash flows from financing activities consist of borrowings, leases, distribution of dividends and repurchased shares in accordance with our share repurchase programs. For more information on our share repurchases, see “Item 16E. Purchases of Equity Securities by the Issuer and Affiliated Purchasers.” 83 Table of Contents Year Ended December 31, 2025 Compared to Year Ended December 31, 2024 Our cash and cash equivalents at the year ended December 31, 2025 amounted to R$1,857.5 million. Our profit before income taxes for the year ended December 31, 2025 amounted to R$2,549.4 million. The amounts for revenue, income and expenses recorded in our statement of income in the year ended December 31, 2025 but which did not affect our cash flows totaled the positive amount of R$4,762.3 million, mainly due to R$112.1 million of share-based LTIP-Goals expenses, R$251.6 million in chargeback, R$129.3 million in credit loss allowance expenses, R$1,807.5 million of depreciation and amortization recorded in our statement of income, R$182.7 million in loss on disposal of property, equipment, intangible, inventories and investments assets and R$2,158.9 million of interest in income and expenses accrued. LTIP-Goals expenses relate to equity awards under our LTIP-Goals, chargeback relate to amounts that we initially recorded as revenues but for which we did not receive the related cash payment due primarily to fraud and credit loss allowance is related to delinquency on unsecured loans and expected credit losses related to our credit products. Changes in our operating assets and liabilities in the year ended December 31, 2025 amounted to a negative cash flow of R$2,933.5 million:  Our accounts receivable item, mainly related to receivables derived from transactions where we act as the financial intermediary in operations with the issuing banks, which is presented net of transaction costs and financial expenses we incur when we elect to receive early payment of the accounts receivable owed to us by card issuers, consists of the difference between the opening and closing balances of the accounts receivable item of current assets and non-current assets on our balance sheet (R$56,061.4 million on December 31, 2025, compared to R$56,650.5 million on December 31, 2024) excluding interest income received in cash and total losses, which are presented separately in the statement of cash flows. Accounts receivable represented a negative cash flow of R$5,054.6 million in the year ended December 31, 2025.  Our credit portfolio item, mainly related to amounts receivable arising from credit card operations, payroll loans and other loans operations, presented net of provision for losses, consists of the difference between the opening and closing balances of the loan portfolio item recorded in current and non-current assets on our balance sheet (R$4,206.4 million on December 31, 2025, compared to R$3,152.8 million on December 31, 2024), excluding expected credit losses, which are presented separately in the statement of cash flows. The credit portfolios represented a negative cash flow of R$1,159.7 million for the year ended December 31, 2025.  Our payables to third parties item, which is presented net of revenue from transaction activities and financial income we receive when merchants elect to receive early payments, consists of the difference between the opening and closing balances of the payables to third parties item of current and non-current liabilities on our balance sheet (R$10,893.7 million on December 31, 2025, compared to R$11,642.2 million on December 31, 2024). Payables to third parties represented a negative cash flow of R$711.2 million in the year ended December 31, 2025.  Our checking accounts item, which refers to amounts due to merchants that use PagSeguro Brazil platform and balance from clients, consists of the difference between the opening and closing balances of the checking accounts item of our balance sheet (R$12,243.7 million on December 31, 2025, compared to R$12,030.6 million on December 31, 2024), excluding interest income paid. Checking accounts represented a negative cash flow of R$630.6 million in the year ended December 31, 2025.  Our obligations to FIDC quota holders, which refers to amounts of senior quotas of the FIDC that were issued to third parties investors, consists of the difference between the opening and closing balances of the obligations to FIDC quota holders item of current and non-current liabilities on our balance sheet (R$1.171,5 million on December 31, 2025, compared to R$1,151.4 million on December 31, 2024), excluding interest income paid. Obligations to FIDC quota holders represented a negative cash flow of R$50.6 million in the year ended December 31, 2025.  Our receivables from (payables to) related parties item consists of the difference between the opening and closing balances of the payables to related parties item excluding interest paid, which are presented separately in the statement of cash flows (receivables R$25.9 million on December 31, 2025, compared to R$31.8 million on December 31, 2024, payables R$780.4 million compared to R$1,131.2 million on December 31, 2024). Receivables from (payables to) related parties represented a negative cash flow of R$344.9 million in the year ended December 31, 2025.  Our salaries and social charges item represent amounts that were recorded on our statement of income, but which remained unpaid at the end of the period. This item represented a negative cash flow of R$19.1 million in the year ended December 31, 2025.  Our trade payables item consists of the difference between the opening and closing balances of the trade payables (R$606.7 million on December 31, 2025, compared to R$663.2 million on December 31, 2024). Trade payables represented a negative cash flow of R$53.9 million in the year ended December 31, 2025.  Taxes and contributions item consists of sales taxes (ISS, ICMS, PIS and COFINS). This item represented negative cash flow of R$165.6 million in the year ended December 31, 2025 due to increased TPV in the year ended December 31, 2025. 84 Table of Contents  Our compulsory reserve item consists in the minimum amount that we need to maintain available as requested by the Central Bank. This item represented a positive cash flow of R$1,056.3 million in the year ended December 31, 2025, due to the reduction in our deposits amounts that requires a compulsory reserve.  Our recoverable taxes item consists of withholding taxes and recoverable taxes on transaction activities and other services and purchase of POS devices. This item represented a negative cash flow of R$81.2 million in the year ended December 31, 2025, mainly related to withholding taxes from FIDC quotas redeemed in 2025.  Our banking issuances item consists of issued certificates of deposit, excluding paid interest income paid to, which are presented separately in the statement of cash flows. This item represented a positive cash flow of R$4,561.8 million in the year ended December 31, 2025. We paid income tax and social contribution in cash totaling R$187.9 million and recorded a positive cash flow of R$3,372.1 million related to interest income received (paid) in cash in 2025. As a result of the above, our net cash provided by operating activities in the year ended December 31, 2025 totaled R$7,562.4 million. Our cash flows used in investing activities in the year ended December 31, 2025 totaled R$2,299.8 million. This amount consisted of R$1,236.8 million in purchases and development of intangible assets, which represent purchases of third-party software and salaries and other amounts that we paid to develop internally software and technology, which we capitalize as intangible assets, R$1,040.0 million in purchases of property and equipment, mainly related to POS device purchases and negative cash flow of R$22.9 million related to the acquisition of financial investments. Our cash flows used in financing activities in the year ended December 31, 2025 totaled R$4,332.8 million, principally related to our contracted borrowings less the payments of principal and interest in the negative amount of R$2,305.4 million along with R$1,330.2 million that we spent on the repurchase of shares to be held in treasury and dividend distributions totaling R$617.1 million. After considering the total increase in cash and cash equivalents of R$929.8 million in 2025, as discussed above, our cash and cash equivalents at December 31, 2025 amounted to R$1,857.5 million Year Ended December 31, 2024 Compared to Year Ended December 31, 2023 For this discussion, see our annual report on Form 20-F for the fiscal year ended December 31, 2024, filed with the SEC on April 29, 2025. Loans and Financings The composition of our borrowings is as follows: Origination date Due date Interest rate December 31, 2025 December 31, 2024 March, 2024 March, 2025 110.2% of the CDI — 252,287 March, 2024 March, 2025 109.9% of the CDI — 762,078 December, 2024 January, 2025 106.6% of the CDI — 2,513,021 December, 2024 February, 2025 105.5% of the CDI — 350,168 December, 2024 December, 2025 105.0% of the CDI — 643,949 January, 2025 January, 2026 107.0% of the CDI 989,076 — December, 2025 March, 2026 102.9% of the CDI 800,454 — December, 2025 December, 2026 104.5% of the CDI 647,316 — 2,436.846 4,521,503 The borrowings balance refers to funds for working capital related to the merchant’s prepayment operation and credit underwriting. These borrowings have attractive interest rates and consist substantially of borrowings with very short maturity, therefore, the decision to raise funds through borrowings is based on market opportunities and financial efficiency regardless of the instrument used. For more information on our borrowings, see note 22 to our audited consolidated financial statements. 85 Table of Contents Commitments and Contractual Obligations Our contractual obligations at December 31, 2025 consisted of obligations to purchase POS devices and deposits obligations as follows: At December 31, 2025 Less than1 year 1 to 3years Total (R$ millions) POS device purchases 823.3 — 823.3 Banking issuances obligations 18,947.9 9,480.1 28,428.0 Borrowings 2,436.8 — 2,436.8 Total 22,208.0 9,480.1 31,688.1 Off-Balance Sheet Arrangements Other than the POS contractual obligations shown above, we do not have any off-balance sheet arrangements. For a discussion of off-balance sheet arrangements for the year ended December 31, 2024, see “Item 5A. Operating Results—Off-Balance Sheet Arrangements” of our annual report on Form 20-F for the fiscal year ended December 31, 2024, filed with the SEC on April 29, 2025. New Accounting Pronouncements Effective for Periods Beginning on or After January 1, 2025 Certain IFRS accounting pronouncements became effective for periods beginning on or after January 1, 2025. The nature and effect of these changes did not have material impacts on our audited consolidated financial statements. For further information, see Note 2.24 to our audited consolidated financial statements. Accounting Pronouncements Issued but Not yet Effective There are new and amended standards and interpretations in respect of presentation and preparation of consolidated financial statements that are issued, but not yet effective, up to the date of issuance of the consolidated financial statements are disclosed below. The Company intends to adopt these new and amended standards and interpretations, if applicable, when they become effective. For more information on accounting pronouncement issued but not yet effective, see Note 2.25 to our audited consolidated financial statements. 5C. Research and Development, Patent and Licenses, etc. For more information on our research and development and intellectual property, see “Item 4B. Business Overview—Product Development and Technology,” and “Item 4D. Property, Plant and Equipment—Intellectual Property.” 5D. Trend Information We believe that increasing levels of penetration and usage of credit cards among the Brazilian population and the introduction of new products and services will continue to fuel volume growth in our business. However, we expect many factors to affect our future business, financial condition, results of operations, liquidity, capital resources, and the trading price of our Class A common shares, including:  the Brazilian economic, fiscal, political and financial environment (for further information, see “Item 5A. Operating Results,” “Item 3D. Risk Factors—Risks Relating to Brazil,” and “Item 3D. Risk Factors—Risks Relating to Our Business and Industry”);  the legal and regulatory developments affecting our operations (for further information, see Item 4B. Business Overview—Regulation of the Payments and Banking Industries in Brazil” and “Item 3D. Risk Factors—Risks Relating to Our Business and Industry”);  the global effects of U.S. policies involving four main factors: increase in tariffs, deregulation, decreases in national taxes and deportation of immigrants, which may affect the labor market and its impacts on global trade;  the ongoing geopolitical tensions and armed conflicts, particularly the escalation of conflicts in the Middle East, may affect global economic activity depending on the duration of the conflict and the extent of damage to energy infrastructure, especially through higher and more volatile oil and energy prices (for further information, see “Item 3D. Risk Factors—Risks Relating to Brazil—Developments and the perceptions of risks in other countries, including other emerging markets, the United States and Europe, may adversely affect the Brazilian economy and the price of Brazilian securities, including the price of our Class A common shares”);  interest rates, inflation, exchange rates and other factors affecting our financial condition and results of operations (for further information, see “Item 5A. Operating Results,” ‘‘Item 5B. Liquidity and Capital Resources,” and “Item 3D. Risk Factors—Risks Relating to Brazil”); and  risks we face in our operations and that could affect our business, results of operations and financial conditions (for further information, see “Item 3D. Risk Factors”). 5E. Critical Accounting Estimates For a discussion on critical accounting estimates, see Note 3 to our audited consolidated financial statements. 86 Table of Contents