We monitor market, credit and operational risks consistent with our capital management objectives and supported by the oversight of our board of directors. We have implemented a risk management structure that comprises policies and procedures and that encompasses the evaluation and monitoring of our operating, credit and liquidity risks (including risks related to our cash flow and the investment of funds held in payment accounts). Our risk management procedures are continuously and consistently reviewed by our management and are fundamental to our ability to achieve our strategies. We are primarily subject to the following risks: Credit risk Credit risk is defined as the possibility that a counterparty will not fulfill its obligations to us (whether pursuant to an agreement or a financial instrument), resulting in a loss of expected cash receipts or a financial loss. Our credit risk arises from our cash, cash equivalents, financial investments, acquirer and card issuer receivables, other receivables and consumer loans. ● cash and cash equivalents: credit risk related to deposits and investments in financial institutions are managed by our risk and treasury departments, with priority being given to amounts on deposit in institutions assessed “AAA” ratings by rating agencies (Moody’s, S&P or Fitch). Based on our risk assessment, our expected credit loss is not material since our accounts receivable are mainly highly liquid investments and operational accounts approved by large financial institutions that have a low overall risk level based on ratings assessed by major credit rating agencies. Moreover, these financial institutions are the legal obligors in respect of these accounts receivables. ● financial investments: these primarily relate to bonds issued by the Brazilian federal government and reverse repos collateralized by bonds issued by the Brazilian federal government. There is no significant expected credit loss recognized for these assets. ● acquirer and card issuer receivables: we recognize amounts we receive from acquirers related to our operations as a sub-acquirer and from card issuers related to our activities as an acquirer and also when our consumers use our app to make payments using an on-boarded credit card. These receivables are payable in up to twelve monthly installments. As a result, we are exposed to the risk of default by the acquirers and card issuers. As a sub-acquirer, we use Brazilian acquirers (such as Stone, Cielo and GetNet), and we seek to avoid concentration in any single acquirer and to increase financial efficiency. As an acquirer, we process transactions with a number of card issuers. We use only acquirers authorized, supervised and monitored by the Brazilian Central Bank, taking into consideration minimum equity requirements for the transaction, and which have been assessed a “AAA” domestic rating by rating agencies (Moody’s, S&P or Fitch). The acquirers may default on their financial obligations due to a lack of liquidity, operational failure or other reasons. In these situations, we can be held liable to pay receivables to businesses without having received the applicable amounts by the acquirer. Through the date of this annual report, we have not suffered any losses on receivables from acquirers. Our management does not expect that we will incur any significant losses from non-performance by these counterparties in excess of the amounts that we have recognized as chargebacks. Credit card issuers are supervised by the Brazilian Central Bank. The payment processing networks (Visa, Mastercard, Elo and others) have their own risks and guarantee models to evaluate and mitigate the default risk of the issuers, which mitigate the risk of the acquirers and the systemic risk of Brazilian payment arrangements. Furthermore, acquirers and issuers have instituted other risk mitigation measures: 287 ● amounts due within 27 days of the original transaction, including those that fall due with the date of the first installment of installment receivables, are guaranteed by the payment processor in the event that the legal obligors do not make payment. ● tools for mitigating operational failures, such as fraud prevention, among others. As of December 31, 2025, we had an amount receivable totaling R$463.7 million (R$181.6 million as of December 31, 2024) from the acquirers and R$3,273.3 million (R$3,653.8 million as of December 31, 2024) from card issuers, based on the probabilities of default attributed by the rating agencies and the risk mitigation processes presented above. ● consumer loans: includes (i) personal loans, FGTS loans and public and private payroll loans beginning in October 2023, (ii) credit card transactions made in one-payment or multiple installments with interest and without interest, beginning in January 2024, for certain consumers who meet credit performance criteria. Personal loans are the borrowing a fixed amount of money to pay for a variety of expenses and then repaying those funds in regular payments or installments over time. Payroll loans are loans for which the payments and interest are discounted either directly from the consumer’s salary from the payroll of a public or private entity or from government-paid pensions or other benefits. This linkage to the payroll, which means that the installments are automatically deducted from customers’ paychecks, is a significant credit risk enhancement. FGTS loans are collateralized by deposits held in government accounts; and (iii) prepayment of receivables from credit card transactions accepted by registered merchants. ● credit card limit risks including undraw limit risk: includes pre-approved credit card limits that were not yet taken by credit card consumers. As of December 31, 2025, we had R$7.5 billion of undrawn credit card limits off-balance. As of December 31, 2025, we had a provision for expected credit losses related to consumer loans and credit card operations in the amount of R$3,155.4 million (compared to R$864.2 million as of December 31, 2024). ● other receivables: consist mainly of transactions with related parties that are based on terms and conditions negotiated with our related companies. As of December 31, 2025, we did not record any impairment loss for these receivables as we expect them to be repaid in full. As a result of the nature of our financial services and the counterparty related to our receivables and investments, we have not observed any significant credit risk increase. Additionally, we do not have any credit-impaired financial assets. The table below presents the balance of our financial assets as well as our off-balance exposures to pre-approved credit card limits: As of December 31, 2025 2024 (in millions of R$) Cash and cash equivalents 3,863.4 7,471.7 Financial assets measured at fair value through other comprehensive income 3,000.6 3,099.1 Financial investments 3,000.6 3,099.1 Financial assets at fair value 71.5 100.1 Financial investments 42.4 45.9 Derivative instruments 29.0 54.2 Financial assets measured at amortized cost 30,154.9 13,676.4 Financial investments 2,891.1 — Trade receivables 4,146.3 3,877.2 Consumer loans 20,913.5 10,571.4 Other receivables 1,911.0 221.1 Pre-approved credit card limits (off-balance) 7,454.8 4,455.2 Total 44,252.2 29,795.6 288 Market Risk Market risk is defined as the possibility that the market value of financial instruments or investments will increase or decrease as a result of volatility and unpredictable variations in market valuations. As of December 31, 2025 and December 31, 2024, we had entered into certain derivative financial instruments strictly for economic hedging purposes. We have adopted a policy that prohibits us from entering into derivatives for speculative purposes. Such risks are identified, quantified, mitigated, regulated, and reported in accordance with our exposure to market risk guidelines defined during our governance process. Moreover, these limits are immediately and independently monitored by our commercial departments. With the purpose to monitor and control such market risks, we adopt several methods, including stress scenarios, sensitivity – delta variation (DV), exposure mismatches (GAP), and interest rate risks (IRRBB). Interest rate risk Interest rate risk is the risk of potential changes in interest rates adversely affecting the value of a company’s assets, liabilities, or future cash flows. DV01 or interest rate sensitivity refers to the effect on market valuations of cash flows when there is an increase of one basis point in the current benchmark, interest rates or in the index. Mathematically, the DV01 measures the change in the value of fixed interest rate portfolio for every one basis point (one basis point is equal to 0.01%) change in the benchmark interest rate. DV01 – As of December 31, 2025 (in R$ million) Asset Liability Derivative Amount Fixed interest rate financial instruments (3.0 ) 2.1 0.9 0.01 DV01 – As of December 31, 2024 (in R$ million) Asset Liability Derivative Amount Fixed interest rate financial instruments (1.2 ) 0.7 0.4 (0.1 ) Foreign exchange risk Foreign exchange risk is the potential financial loss that can occur due to fluctuations in the exchange rates between different currencies. 289 We are subject to payment obligations related to suppliers regarding services and software licenses that are denominated in foreign currency and checking accounts in U.S. dollars in connection with our international transactions. The existence of these exposures mitigate some of the volatility in the foreign exchange market given the fact that they move in opposite directions. Consequently, transactions and financial commitments in currencies other than the local currency are managed more effectively. The table below sets forth a sensitivity analysis of our exposure to foreign exchange variations as of December 31, 2025 and 2024, assuming all other variables remain constant. As of December 31, 2025 Basic interest rate shock Type Rate risk Total Exposure +10% -10% (in R$ million) Trade payables Dollar 3 — — As of December 31, 2024 Basic interest rate shock Type Rate risk Total Exposure +10% -10% (in R$ million) Trade payables Dollar 3 — — Hedge accounting We hold portfolios of customers’ lending at fixed interest rates, which creates market risk due to changes to the Brazilian benchmark interest rate. Therefore, with the purpose to protect the fixed rate risk from CDI variation, we entered into future DI contracts to offset the market risk, and applied hedge accounting to eliminate differences between the accounting measurement of our derivatives and hedged items which are adjusted to reflect changes in the CDI. In accordance with our hedging strategy, we adopt the “portfolio layer” method. This method allows us to use part of our portfolio of financial assets as a fair value hedge during the hedging period in the occurrence of events such as prepayment, default or sale of operations. The interest rate risk arising from layers is mitigated by purchasing DIV01 futures contracts as a hedging instrument. The number of contracts per net maturity needed to cover exposure is assessed on the basis of DV01. 290 We calculate the DV01 (delta value of a basis point) of the exposure and futures to identify the optimal hedging ratio, and monitor in a timely manner the hedge ratio, providing any rebalancing if needed. The need for the purchase or sale of new future DI contracts will be assessed, to counterbalance the hedged item’s market value adjustment, aiming to assure hedge effectiveness between 80% and 125%, as determined in our hedge documentation. The effectiveness test for hedge is performed in prospective and retrospective manners. In the prospective test, we compare the impact of a 1 basis point parallel shift on the interest rate curve (DV01) on the hedge item and on the hedge instrument market value. For the retrospective test, the market-to-market value change since the inception of the hedged item is compared to the hedge instrument. In both cases, the hedge is considered effective if the correlation is between 80% and 125%. For designated and qualifying fair value hedges, the cumulative change in the fair value of the hedging derivative and of the hedged item attributable to the hedged risk is recognized in our condensed consolidated interim financial statements of profit or loss in “Interest income and gains (losses) on financial instruments – financial assets at fair value.” In addition, the cumulative fair value of the hedged item attributable to the hedged risk is recorded as part of the carrying value of the hedged item in our consolidated statement of financial position. December 31, 2025 Fair Value Adjustment to the Hedge Object Fair value adjustment Total amount of to the hedging Type hedged item Asset Liability instrument (in R$ millions) Interest Rate Risk Interest Rate Contracts – Future – Payroll Loan 1,705.1 1.5 — (1.5 ) Interest Rate Contracts – Future – FGTS Loan 5,452.2 — (33.5 ) 33.5 Interest Rate Contracts – Future – Liabilities Pre (1,628.5 ) — (53.3 ) 53.3 Interest Rate Contracts – Future – LTN Bonds 934.1 15.7 — (15.7 ) Interest Rate Contracts – Future – Titles NTNF 1,132.40 — (8.4 ) 8.5 Interest Rate Contracts – Future – LF Sub (279.4 ) 3.0 — (3.8 ) Interest Rate Contracts - Future – Advances on energy receivables 1,056.6 — (1.2 ) 1.2 Total 8,372.5 20.3 (96.4 ) 75.5 December 31, 2024 Fair Value Adjustment to the Hedge Object Fair value adjustment Total amount of to the hedging Type hedged item Asset Liability instrument (in R$ millions) Interest Rate Contracts – Future – Payroll Loan 988.6 — (11.8 ) 11.8 Interest Rate Contracts – Future – FGTS Loan 1,766.4 — (143.2 ) 143.2 Interest Rate Contracts – Future – Liabilities Pre (587.7 ) — 17.8 (17.8 ) Interest Rate Contracts – Future – LTN Bonds 783.1 — (17.2 ) 17.2 Total 2,950.5 — (154.5 ) 154.5 291 Liquidity risk Liquidity Risk is the risk that we do not have sufficient liquid resources to honor our financial commitments due to a mismatch in terms of volume between the receipts and payments provided for in our cash flow. Our liquidity management processes include: ● cash liquidity monitoring: daily update of our administrative and operational cash flow, detailing the inflows and outflows, including the cash projection and stress scenario. ● minimum cash limits: establishing minimum cash limits, which allow preemptive actions to be taken to ensure sufficient resources to meet financial commitments. Our projected cash flow is generated and monitored daily by our treasury department to ensure that we have the required resources to meet our financial commitments and operational needs. For the projection of cash, growth assumptions and stress factors are used, which include increased losses and expenses. The information on financial liabilities is essential for the projection and management of cash flow, ensuring that we have the necessary resources to settle our obligations. As a cash management measure, our treasury invests surplus funds in highly liquid and low risk assets. We do not have assets pledged as guarantees for loans, financial operations or contractual obligations. Liquidity risk refers to our ability to meet both expected and unexpected obligations, without disrupting daily operations or incurring significant losses. In order to mitigate such risks, our management has adopted a diversified approach to financing, in addition to its main base of deposits. We have implemented a liquidity risk management policy, which involves the use of various tools and activities, such as daily cash flow forecasts, liquidity profile monitoring, and maintenance of adequate cash reserves. Stress tests are conducted to assess the impact of uncommon events on our finances and we have a contingency plan to deal with liquidity shortages during crises. Any new initiative or product is preliminarily assessed by the market and liquidity risk department. The treasury department is in charge of coordinating with other sectors to ensure the effective implementation of our liquidity management strategy. As part of our cash flow management, our treasury department invests in highly liquid, low-risk assets whenever there are resource surpluses. We do not use our assets as collateral for loans, financial transactions or contractual obligations. Detailed information on financial liabilities is essential for cash flow projections and management, ensuring that we have adequate resources to meet our obligations. For additional information regarding the contractual maturity of our lease liabilities, see note 18 to our audited consolidated financial statements included elsewhere in this annual report. 292 The table below shows our expected maturities as of the dates presented: Liabilities Maturity as of December 31, 2025 Less than 1 year More than 1 year Total (in millions of R$) Third-party funds – payment accounts 856.6 — 856.6 Third-party funds – CDBs 19,772.6 8,066.4 27,839.0 Third-party funds – Other obligations under financial instruments — 752.6 752.6 Third-party funds – Others 526.7 — 526.7 Obligations to FIDC quota holders — 815.6 815.6 Trade payables 5,482.6 14.5 5,497.1 Derivative Financial Instrument 15.8 — 15.8 Total 26,654.2 9,649 36,303.3 Liabilities Maturity as of December 31, 2024 Less than 1 year More than 1 year Total (in millions of R$) Third-party funds – payment accounts 889.3 — 889.3 Third-party funds – CDBs(1) 16,488.3 2,605.9 19,094.2 Third-party funds – Others 220.5 — 220.5 Obligations to FIDC quota holders — 704.8 704.8 Trade payables 3,319.0 46.3 3,365.3 Total 20,917.1 3,356.9 24,274.0 (1) The issuance of a daily liquidity CDB allows the counterparty to redeem the invested amount at any time until its final maturity, without any type of grace period. Therefore, it is important to evaluate and monitor the redemption behavior of these positions, so that liquidity risk management is carried out in a conservative manner. The methodology adopted provides for an Average Redemption Curve, calculated monthly and categorizing the issuances by batches. The analysis therefore reflects an average redemption behavior of our liquid liabilities. 293 Fraud Risk We are exposed to several operating risks, the most relevant of which is the risk of fraud arising from undue, illegal or criminal activity that causes a financial loss to a party in connection with a financial transaction effected through our platform. Credit card fraud includes the unauthorized use of lost, stolen, fraudulent, counterfeit, or altered cards, as well as the misuse of the user payment account. Within this context, we are exposed to losses due to transaction chargebacks (i.e., cancellations). The chargeback process begins when a user effects a transaction via credit card through our platform and, for reasons unrelated to us, contests the transaction with the card issuer, which forwards the contested transaction to the merchant acquirer, which cancels the transaction, reducing the volume of payables due to us. We have departments dedicated to preventing fraud through anti-fraud processes and strategies and the real-time monitoring of transactions that use payment wallet balances or credit cards for paying bank payment slips, or making withdrawals or transfers between consumers. As a result of this monitoring, we identify, approve or decline transactions effected through our platform.