We are exposed to market risks in the ordinary course of our business, including the effects of interest rate changes and foreign currency fluctuations. Information relating to quantitative and qualitative disclosures about these market risks is described below and in note 34 to our audited consolidated financial statements included elsewhere in this annual report. We conducted a sensitivity analysis for market risks we considered relevant as of December 31, 2025, 2024 and 2023. For this analysis, we adopted the following three scenarios: •Scenario I, which contemplates an increase in fixed interest rate yields, exchange coupon rates and inflation of one basis point, and an increase in the prices of shares and currencies of one percentage point; •Scenario II, which contemplates 25% increases and decreases in fixed interest rate yields, exchange coupon rates and inflation, assuming the largest possible losses per scenario; and •Scenario III, which contemplates 50% increases and decreases in pre-fixed interest rate yields, exchange coupon rates, inflation and interest rates, assuming the largest possible losses per scenario. The below table sets forth the impact of each scenario on each market risk. It does not account for the risk protocols of our risk and treasury areas, which trigger risk mitigation measures as soon as losses are detected, minimizing the risk of significant losses: As of December 31, 2025 Trading Portfolio Exposures Scenarios Risk Factors: Risk of Variation in: I II III (R$ millions) Pre-fixed Pre-fixed interest rate in reais — (224) (408) Exchange coupons Foreign currencies coupon rate — (15) (40) Foreign currencies Exchange rates — 82 49 Price indexes Inflation coupon rates — (49) (81) Shares Shares prices — 59 150 Seed Money Seed Money — (21) (60) (1) (167) (390) 132 FORM 20-F «Table of Contents As of December 31, 2024 Trading Portfolio Exposures Scenarios Risk Factors: Risk of Variation in: I II III (R$ millions) Pre-fixed Pre-fixed interest rate in reais — 8 50 Exchange coupons Foreign currencies coupon rate — 7 (15) Foreign currencies Exchange rates — 65 148 Price indexes Inflation coupon rates — (12) (25) Shares Shares prices (6) (162) (459) Seed Money Seed Money — (4) 18 (7) (129) (283) As of December 31, 2023 Trading Portfolio Exposures Scenarios Risk Factors: Risk of Variation in: I II III (R$ millions) Pre-fixed Pre-fixed interest rate in reais — 21 23 Exchange coupons Foreign currencies coupon rate — (18) (37) Foreign currencies Exchange rates — 343 907 Price indexes Inflation coupon rates — (13) (25) Shares Shares prices (3) (252) (290) Seed Money Seed Money (3) (71) (141) (7) 11 438 Currency Risk We are subject to foreign currency risk as we hold interests in XP Holding International LLC, one of our international financial holding companies in the United States, XP Advisors Inc., our finance services consulting company in the United States, and XP Holding UK Ltd, one of our international financial holding companies in the United Kingdom, whose equity as of December 31, 2025 was US$114.2 million (US$96.8 million as of December 31, 2024), US$15.3 million (US$12.3 million as of December 31, 2024) and GBP 6.4 million (GBP 16.5 million as of December 31, 2024) respectively. The foreign currency exposure risk of XP Holding International and XP Advisors Inc. is hedged with the objective of minimizing the volatility of our functional currency (the real) against the U.S. dollar arising from foreign investments offshore. The foreign currency exposure risk of XP Holding UK Ltd has not been hedged. For more information on our outstanding agreements, see “Item 5. Operating and Financial Review and Prospects—B. Liquidity and Capital Resources—Indebtedness." Interest Rate Risk Interest rate risk arises from the possibility that we incur in gains or losses arising from fluctuations in interest rates on our financial assets and liabilities. The following are the risk rates that we are exposed to: (1) SELIC rate; (2) IGP-M, the Brazilian general market price index (Índice Geral de Preços do Mercado); (3) IPCA, the Brazilian national consumer price index (Índice Nacional de Preços ao Consumidor Amplo); (4) PRE, the Brazilian required reference equity index (Patrimônio de Referência Exigido); and (5) foreign exchange coupon. We have floating interest rate indebtedness, so we are exposed to interest rate risk as a result of changes in the level of interest rates, and any increase in interest rates could negatively affect our results of operations and would increase the costs associated with financing our operations. As of December 31, 2025 and 2024, substantially all of our total indebtedness consisted of floating rate debt and was principally indexed to the CDI. Furthermore, our exposure to interest rate risk also applies to our cash and cash equivalents deposited in interest-bearing accounts which are indexed to the CDI, which can affect our results of operations and cash flows. 133 FORM 20-F «Table of Contents Price Risk Price risk is the risk arising from price changes in investment fund portfolios and shares listed on the stock exchange held in our portfolio, which may affect profit or loss. Price risk is mitigated by our management through the diversification of our portfolio and/or through the use of derivatives contracts, such as options or futures. We believe we adopt conservative price risk limits in our risk budget. Liquidity Risk Liquidity risk relates to maintaining sufficient cash and securities through an adequate amount of committed credit facilities to meet obligations when due and to close out market positions. We have a liquidity risk management policy, which aims to ensure a minimum level of liquidity considered adequate by our management. This policy establishes actions to be taken in the event of liquidity contingencies, which are designed to reframe cash within required minimum liquidity limits. Our risk department is responsible for the structure and management of risks, and is under the supervision of the board of directors, for the avoidance of any conflicts of interest with departments requiring liquidity. Liquidity risk control is based on forecasts of cash and assets with credit risk. The cash forecast relies on the free funds deposited by customers, while fund allocations can be classified according to their settlement or zero settlement periods. The stressed scenario models for delays in private credit assets and the extent to which possible stress would affect our liquidity conditions. Credit Risk Credit risk is the risk of suffering financial losses related to noncompliance by any of our clients and market counterparties with financial obligations, agreement devaluations as a result of the deterioration in the risk rating of borrowers, reduced gains or remuneration, and concessions granted in the renegotiation of financial arrangements and recovery costs, among others. Credit risk includes, among other risks: (1) non-compliance by counterparties with obligations related to the settlement of transactions in financial assets, including derivative financial instruments; (2) losses related to non-compliance with financial obligations by borrowers located abroad, as a result of the actions taken by the government of the country in which they reside; (3) cash disbursements to honor warranties, co-obligations, credit commitments or other transactions of a similar nature; and (4) losses associated with non-compliance by intermediaries or borrowers with financial obligations pursuant to financing agreements. In our credit operations, we use client investments as collateral to reduce potential losses and mitigate credit risk exposure by managing collateral so that they are always sufficient, legally enforceable (effective) and viable. We also monitor the value of the collateral. The credit risk management provides recommendations to set risk appetite strategies, to set limits, including exposure analysis and trends as well as the effectiveness of the credit policy. We believe our credit operations have high credit quality and we often use risk mitigation measures, primarily through client investments as collateral. Our risk department is responsible for managing credit risk, ensuring compliance with our credit risk policy and established operating limits. Our credit policy is based on our internal scenario, including portfolio composition by security, issuer, rating, economic activity and duration of the portfolio, and on the external economic scenario, including interest rates and inflation, among others. The credit analysis department is also actively involved in this process and is responsible for assessing the credit risk of issues and issuers with which we maintain or intend to maintain credit relations. It also recommends limiting the credit risk positions of customers. We use both National Scale ratings from internationally recognized Credit Rating Risk Agencies and our internal rating scales to subdivide portfolios into High, Medium and Low Risk. Management undertakes credit quality analysis of all assets, including those that are not past due or reduced to recoverable value. For credit operations, we often use the relevant client’s investments under custody with us as collateral to reduce potential losses and protect against credit risk exposure, and we manage and monitor this collateral to ensure it remains sufficient, legally enforceable (effective) and viable. Our credit risk management operations allow us to formulate risk appetite strategies and establish limits, including exposure analysis and trends as well as the effectiveness of our credit policy. As of December 31, 2025, such assets were substantially represented by credit operations and securities purchased under agreements to resell the counterparties, which include Brazilian banks with low credit risk, securities issued by the Brazilian government, as well as derivative financial instruments transactions, which are mostly traded on the B3. 134 FORM 20-F «Table of Contents Market Risk Market risk is the risk that the fair value or future cash flows of a financial instrument will fluctuate because of changes in market prices. Market risk comprises three main types of risk: foreign exchange variation, interest rates and share prices. The aim of market risk management is to control exposure to market risks, within acceptable parameters, while optimizing returns. Market risk management for operations is carried out through policies, control procedures and prior identification of risks in new products and activities, with the purpose of maintaining market risk exposure at levels considered acceptable by us and to meet the business strategy and limits defined by the risk committee of XP Brazil. The main tool used to measure and control our exposure risk to the market, mainly in relation to the trading assets portfolio, is the Maps Luna program, which calculates the capital allocation based on the exposure risk factors in the regulations issued by the Central Bank for financial institutions, which we apply to verify the risk exposure of our assets. In order to comply with the provisions of the Central Bank, our financial institutions monitor our exposure and calculate it on a daily basis, in accordance with CMN Resolution No. 4,557, and submit it daily to the Central Bank. With the formalized rules, the risk department of XP Brazil has the objective of controlling, monitoring and ensuring compliance with the pre-established limits, and may decline, in whole or in part, to receive and/or execute the requested transactions, upon immediate communication to customers, in addition to intervening in cases of non-compliance and reporting all unusual events to the committee. In addition to aforementioned controls, we adopt guidelines to control the risk of the assets that mark treasury operations so that the portfolios of the participating companies are composed of assets that have low volatility and, consequently, less exposure to risk. In the event of non-compliance with the operational limits, the treasury manager can take the necessary measures to remedy this as quickly as possible. Operating Risk Operating risk is the risk of direct or indirect losses resulting from a variety of internal factors associated with our processes, personnel, technology and infrastructure, and with external factors, except for credit, market and liquidity risks, such as those deriving from legal and regulatory requirements and from generally accepted standards of business behavior. Operating risks arise from all of our operations. Our objective is to manage operating risk to avoid financial losses and damage to our reputation, and also to seek cost efficiency, avoiding control procedures that restrict initiatives and creativity. The main responsibility for development and implementation of controls to deal with operating risks is attributed to key management within each business unit, and is supported by the development of our general standards for management of operating risks in the following areas: (1) requirements of segregation of functions, including independent authorization for transactions; (2) requirements of reconciliation and monitoring of transactions; (3) compliance with legal and regulatory requirements; (4) documentation of controls and procedures; (5) requirements of periodic assessment of the operating risks faced and the adequacy of the controls and procedures for dealing with the identified risks; (6) development of contingency plans; (7) professional training and development; and (8) ethical and business standards. Our financial institutions, in compliance with the provisions of CMN Resolution No. 4,557, have a process that encompasses institutional policies, procedures, systems and contingency plans and business continuity for the occurrence of external events, in addition to formalizing the single structure required by the Central Bank.