RISK Overview In addition to establishing and applying our local risk management policies and procedures, we have incorporated the Santander Group’s global risk management functions at various levels of our organization, including financial, credit, market, operational and compliance risk, to ensure a consistent approach worldwide. In addition, committees led by senior management are responsible for controlling risks by overseeing credit approval and compliance with the exposure policies defined and approved by the Bank’s board of directors. The Control department and Risk Consolidation department provided their respective Risk management reports to senior management. Likewise, the reports for senior management of the Santander Group’s financial entities and foreign branches are generated mainly by the risk control departments of each of those entities and branches. The presentation of such information to senior management is designed to enhance the understanding and management of risks for the Santander Group’s administrative bodies and branches. The type of information and highlights in each report varies depending on the intended audiences within senior management, such as the Santander Group, its financial entities, or its foreign branches. Information can be transmitted to senior management through our intranet risk reporting tool, by e-mail or through live presentations. Information, analyses and decisions are also disseminated through the channels described below, fostering communication among all areas of the organization: i. internal department mailboxes, which allow for the exchange of information within groups and areas; ii. periodic meetings (departmental, monthly, quarterly, off-site, conventions), which allow for regular exchange of information on an in-person basis; iii. our regulations portal, which is an internal portal within our intranet where we maintain our current risk management policies; iv. e-mail; v. video and teleconferences with Santander Spain; and vi. risk committees, including the executive risk committee for Brazil and the risk control committee. Information is prepared with the goal of improving risk management and is classified into two groups: i. Standard information: this information is generated on a regular basis and with fixed content, subject to revision, made available to senior management for select target areas, depending on the type of information included in the report. The reports are used to facilitate knowledge about the risk for which the Risk Management department is responsible, including credit use, instrument valuation and results, as well as the analyses needed to manage these risks and optimize capital. ii. Non-standard information: this includes presentations and information not included in the reports above prepared for our senior management on an ad hoc basis or upon specific request. When the request for certain information becomes more regular, such reporting is integrated into automated “Standard information.” iii. Each report varied by the nature of the information and its frequency. The nature of the information provided is either quantitative or qualitative. Quantitative Information. Quantitative information includes risk metrics that permit our senior management to better analyze situations, trends and developments in each segment, activity or portfolio, relating to planned scenarios or defined limits, with emphasis on any scenarios falling outside such limits. Quantitative information primarily addressed the liquidity and market risk (trading and banking book) which includes, among other items, measurements of positions, mark-to-market valuations, sensitivity analyses, volume analyses, measures of liquidity gaps and country risk models, impacts of risks on results, economic risks, stress test simulations and back-testing. 238 Table of Contents Qualitative Information. Qualitative information includes internal and external events relating to the economic, financial or competitive environment, and an evaluation and analysis of the causes and known or foreseeable consequences of such events. These also include measures used to prepare such models. The frequency with which quantitative and qualitative risk management information is prepared depends on the information provided, as follows: Daily information: i. liquidity and market risk: includes data on treasury limits (VaR, positions, sensitivity of linear and nonlinear econometric models) and the principal changes in the treasury portfolio. Also includes short-term liquidity and liquidity buffer calculation. Weekly information: i. focuses on generating updated high-level information in different segments (focused on solvency risk) or portfolios (focused on market risk), as well as a summary of the relevant facts and expected short-term changes; ii. is generated for our senior management, including the chief executive officer and vice president executive officers of retail, risks and finance, and an independent member of our board of directors; and iii. is drawn from our risk management framework and policies globally and is validated by local market risk areas. Monthly information: i. liquidity and market risk: facilitate the analysis of the current activity, including structural and interest rate risks; it also includes a detailed analysis of alternative measures, stress scenarios and short, long and concentration liquidity metrics. Monthly information is generally more detailed than weekly information. Risk Management Committees The following table describes the main risk committees in Brazil (which are responsible for credit decisions and for ongoing control of credit risk matters), including their responsibilities, members and frequency of meetings. Committee Main Responsibilities Members Meeting Frequency Executive Risk Committee • Enable the application, at the local level, of the Santander Group’s risk culture, aligning the Santander Brasil’s strategy, predisposition and risk tolerance level (“Main Guide”) to the mission and objective of its business areas • CEO Weekly • Approves the risk appetite secondary metrics that will be proposed to the board of directors of Santander Brasil; • Vice President Executive Officer (Chief Risk Officer) • Approve risk proposals, including credit operations (sensitive sectors, fixed income, variable income, treasury and the assets and liabilities committee, or ALCO), restructurings, payment agreements, customer limits, pre-classifications and products. • Vice President Executive Officer of Legal Affairs 239 Table of Contents Committee Main Responsibilities Members Meeting Frequency • Handle general issues related to market risk, cross-border limits, country risk, global banking operations, and market risk approvals and sales of credit portfolios or assets; • Credit Risk • Approve the main indicators of the Strategic Commercial Plans for each segment. • Corporate and Investment Banking • Authorize management tools, improvement initiatives, follow up on projects and any other relevant activities related to risk management; • Corporate Banking • Approve the policy and standards of methodological models and validate their effectiveness; • Vice President Executive of Finance (Chief Financial Officer) • Be aware of and take the necessary Legal and Corporate Affairs measures regarding risk to comply with the recommendations and directions issued by supervisory authorities in the exercise of its functions and the internal audit of the Bank; • Provide information to our board of directors and to our Executive Committee and assistance, if needed, in order to execute the tasks assigned to risk management by applicable law, the by-laws, the board of directors´ rules of procedure and the regulation of the Risk Executive Committee; • Approve the creation, modification and termination of other committees or decision bodies and their regulations and delegate to those committees or people empowerment on decision-making and risk management; Risk Control Committee • Oversee the Risk Profile and Assessment (RPA); • Chief Financial Officer Monthly 240 Table of Contents Committee Main Responsibilities Members Meeting Frequency • Conduct a full segment and regular follow up of all risks, including Conduct Risk, checking if the risk profile is set in accordance with the risk appetite, the commercial and strategic plan and the budget approved by the board of directors; • Chief Risk Officer • Finance and Strategy • Legal and Corporate Affairs • Conduct an independent and periodic control report on risk management activities, which includes: • Corporative Risks and Enterprise Risk Management • Full risk profile view of the different businesses, including among others, benchmarking of the main competitors of the Bank and monitoring of key strategic projects; • Technology and Operations • Approve the secondary metrics of Risk Appetite; • Monitor all relevant aspects of capital management and its impacts; • Approve, review and guarantee the correct and effective risk governance, including the control and decision forums, structures, policies and reports to ensure that all relevant risks are identified, managed and reported. • Approve and review the Strategic, Financial, Business Continuity and Recovery Plans and Operational Resilience. • Chief Compliance Officer • Chief Audit Executive (CAE) – Invited Member • Operational Risk and Internal Controls. • People and Culture – Invited Member. • Evaluation of stress test scenarios and assumptions, results and proposed measures; • Validate the information on risks that must be submitted to the board of directors when so required and without prejudice to the direct access to the person responsible for the risk function (Chief Risk Officer) to the board; • Comprehensive and periodic monitoring of relevant risks related to the companies in the prudential conglomerate; 241 Table of Contents Committee Main Responsibilities Members Meeting Frequency • Monitoring critical outsourcing contracts approved by the relevant forums; • Monitoring the Risk Culture Plan; • Analyze key initiatives for transforming and changing the business model (such as information technology, organizational design, capital and cost guidelines) to foster sound operational risk control, change management discipline, and the effective application of these practices. • Supervise measures taken regarding risks to comply with the recommendations and directions issued by the supervisory authorities in the exercise of its function and Santander Brasil’s audit; 242 Table of Contents Committee Main Responsibilities Members Meeting Frequency • Provide the board of directors, through our Risk and Compliance Committee, and our Executive Committee the information and assistance needed regarding risks for the fulfillment of its functions in risk management matters assigned to it by law, the board of directors´ rules of procedure and the regulation of the Risk Control Committee; and • Approve the operation of hierarchically lower-risk control committees and their respective regulations; • aspects related to capital management, including: • Present the impact of new regulations and the results of the elaboration of QIS (Quantitative Impact Study); • Review and evaluate responses to additional requests made by regulators regarding capital management issues; • Carry out the analysis and supervision of the results of the capital adequacy assessment exercises and their main components (schedule, assumptions, economic scenarios, methodologies, results, capital buffer, contingency plans and other relevant aspects) of the following processes: ICAAP, TEBU (Bottom-up Stress Test), Strategic. The Executive Risk Committee and Risk Control Committee, which are described in detail above, make decisions with regard to risk management in Brazil with representatives of our senior management, including our Chief Executive Officer (CEO), our Vice President Executive Officer of Risk Management (CRO) and other members of the Executive Committee. The main responsibilities of the Executive Risk Committee and Risk Control Committee include defining our level of risk tolerance, monitoring our loan portfolios and market conditions, as well as following up on any recommendations made by the Brazilian Central Bank. They also raise any matters to our board of directors that exceed the authority of the committee. Each of our risk management committees has certain authority and approval levels, in each case subject to Brazilian law and regulations. Decisions at the committee level are intended to be collegial in a manner to ensure that differing opinions are all considered. Credit Risk Santander Group’s risk management model is based on a prudent management, driven by the risk appetite defined by the unit and approved by the headquarters. We operate within the limits of the Santander Group’s risk management guidelines and Brazilian Central Bank regulations, in order to protect and optimize capital and promote profitability. One of our credit risk management principles is that of independence among our business areas, providing sufficient autonomy for proper risk management. Another important characteristic of our risk management is the direct involvement of senior management in the decision-making process through credit committees. Our credit risk management process, especially new loan approval and risk monitoring, is structured according to our customer and product classifications, and is divided into retail and wholesale lending. 243 Table of Contents Retail Lending In retail banking, credit requests made by individuals are analyzed by a credit approval system, which assigns a credit rating based on our policies and approved scoring model, which takes into account the credit history of the individual, the individual’s relationship with us and the type of credit requested. These requests can come from one of our many service channels, including branches, internet banking, mobile applications and ATMs. We use two distinct scoring models depending on the phase in which the customer is in with respect to their interaction with us (the “application” phase and the “behavior” phase). A credit scoring model is applied in the application phase when the customer begins a relationship with us and a behavioral scoring model is used when the customer has already had a relationship with us for a period established by our risk management policies (i.e., during the “ongoing” phase). This policy allows us to evaluate our existing customers with a more complete analysis than if we applied a pure scoring model for all customers. For financing products offered to SMEs (retail businesses), the method used to evaluate if approval should be granted is based on internally developed credit risk approval limits, as well as the customer´s creditworthiness. These approval methods include system automation, or manual individual analysis, which generates a credit risk rating based on our internal models. Additional information, such as the characteristics of the financing product being offered, including related terms and conditions, as well as collateral granted in connection therewith, is also taken into account in the approval process. Pre-approved limits on lines of credit for both individuals and SMEs are granted based on creditworthiness, as determined by our scoring criteria. Credit limits are managed based on the performance of the customers, considering each customer’s risk profile. Credit authorization limits are established and these are automatically applied to all credit requests. When an automatic credit decision results in the customer’s needs, the commercial area has the authority to submit a request for manual approval. Such approvals are subjected to review by analysts or committees, depending on the value of the loan sought. There is also a more robust model called Rating Plus which is addressed to mid-size companies a few other retail customers. This model combines the customers’ internal and external financial behavior, information obtained from their balance sheets and a questionnaire that is adapted in accordance with the companies’ individualities. The evaluation made by Rating Plus seeks to attribute an internal classification for the costumers defining their risk level in comparison with their creditworthiness. The classification as well as the credit analyses for these customers are usually made manually through specific proposals or limits. Wholesale Lending In wholesale banking, each customer is analyzed on an individual basis, Commercial and risk areas analyze the client’s needs and indicators, analyzing profitability, creditworthiness and adequacy to the risk metrics of Santander Group RAS – Risk Appetite Statement, in order to determine and submit it for approval. Wholesale lending risk appetite metrics and limits are set annually and tracked monthly through reports sent to the headquarters of the Santander Group. These limits are defined considering the risk appetite of Santander Brasil and the wider Santander Group, in line with current regulations (Brazilian Central Bank and European Central Bank), and the expectations of the commercial area. Individual and sectoral portfolio concentrations are monitored to mitigate the risk of the portfolio. Credit Monitoring Credit lines to retail customers are reviewed regularly based mainly on their credit risk rating. This process allows improvements in credit exposure to customers who present good credit quality. Additional specific early warnings are automatically generated when deterioration of a customer’s credit quality is identified. When this occurs, a process to reduce credit risk and prevent default is implemented. For larger SMEs, this includes monthly monitoring of their financial performance, the financial situation of each enterprise is discussed by specific committees in the presence of the commercial area. These processes are implemented, with the goal of continuously improving the quality of our loan portfolio. 244 Table of Contents Credit lines to wholesale customers and related credit quality are reviewed on an annual basis. When any specific concern the credit quality of a certain customer, we use a customer monitoring system known as SCAN (Santander Customer Assessment Note), which allows possible actions to be taken under the following categories: “monitoring,” “intensive monitoring,” “proactive monitoring” or “block and exit.” A customer subject to action under one of these categories will be reviewed on a quarterly or a semi-annual basis, depending on the situation. We use proprietary internal rating models to measure the credit quality of a given customer or transaction. Each rating relates to a certain probability of default or non-payment, determined on the basis of the customer’s history, with the exception of certain portfolios classified as “low default portfolios.” These ratings and models are used in our loan approval and risk monitoring processes. For a breakdown of our portfolio by internal risk rating, see “Item 4. Information on the Company—B. Business Overview—Selected Statistical Information—Allowance for Loan Losses—Internal Risk Rating.” Recovery Our business recovery area is responsible for all nonperforming portfolios. This area uses statistical tools to study the behavior of customers and then defines, implements and monitors strategies related to these portfolios, seeking to ensure maximum recovery subject to applicable Brazilian law and regulation. Customers with greater probability of payment are classified as low-risk customers and those with a low probability are classified as high risk. The aforementioned risk classification determines the intensity of collection efforts expended. The channels of operation are defined as “Mapa de Responsabilidade,” (Responsibility Map), using the time value of default versus risk value, in addition to other characteristics, to create strategies for recovery. Our credit recovery tools include daily contact through our call center, digital channels, inclusion of defaulting customers within external sources of credit protection, sending collection letters, and direct contact through our branch network. In addition to the aforementioned tools, we use the following strategies: • Internal teams specialized in restructuring and debt recovery work directly with defaulting customers with loans of higher values and/or are overdue more than 90 days. • We use specialized external firms to collect, report and assess high-risk customers. These firms are remunerated according to pre-established percentages applied to the amounts recovered. The digital channels have been increasing in importance and have made it easier for customers to renegotiate debts. Once we have exhausted all of the credit recovery resources available to us, we conduct sales of any remaining nonperforming loans. These sales are held periodically through an auction process, with the aim of obtaining optimal prices in the markets and thereby reducing the impact on us. Assets and Liabilities Committee Our asset and liability management strategy is defined by our assets and liabilities committee (ALCO), which operates under the guidelines and procedures established by the Santander Group. Members of the committee include our Chief Executive Officer, Chief Risk Officer, Vice President Executive Officer – Finance and Strategy, Vice President Executive Officer – CFO, Director – Financial Management (ALM) and the Chief Economist. The assets and liabilities committee establishes strategies, policies and procedures with the objective of managing our balance sheet and risk structure. Market Risk Types of market risk Interest rate risk Interest rate risk is the possibility that changes in interest rates could adversely affect the value of a financial instrument, a portfolio or our operations as a whole. We are exposed to interest rate risk whenever there is a mismatch between interest rate sensitive assets and liabilities, subject to any hedging we have engaged in using interest rate swaps or other off-balance sheet derivative instruments. Interest rate risk arises in connection with both our trading and non-trading activities. 245 Table of Contents Credit spread risk Credit spread risk arises due to changes in credit spread curves associated with specific issuers and debt types may adversely affect the value of a financial instrument, a portfolio or Santander Group as a whole. Exchange rate risk Exchange rate risk arises due to the sensitivity of a foreign currency position in relation to a base currency due to a potential change in exchange rates. We are exposed to foreign exchange rate risk as a result of mismatches between assets and liabilities, and off-balance sheet items denominated in different currencies, either as a result of trading or in the normal course of business. We maintain non-trading open currency positions arising from our investments in overseas subsidiaries (such as our Cayman Islands and Luxembourg branches), affiliates and their respective currency funding. Our principal non-trading currency exposure is the U.S. dollar, which, as mandated by our policies, is hedged to the real within established limits. Equity price risk Equity price risk arises due to the sensitivity of an investment position in equity markets to adverse movements in the market prices or in response to expectations of future dividends. Among other instruments, equity price risk affects positions in shares, stock market indices and derivatives using shares as the underlying asset (puts, calls, and equity swaps). Commodities price risk Commodities price risk relates to the potential negative effect of changes in commodity prices. Our exposure to this risk is mostly concentrated in derivative operations involving commodities for customers. Inflation risk Inflation risk is the risk that changes in inflation rates may adversely affect the value of a financial instrument, a portfolio or Santander Group as a whole. Volatility risk Volatility risk is the sensitivity of a portfolio to volatility in a number of risk factors, including interest rates, exchange rates and equity prices. This risk is applicable to financial instruments which have volatility as a variable in their valuation model. Other, more complex, risks to which we may be exposed include: Correlation risk Correlation risk is the sensitivity to changes in the relation between risk factors, whether of the same type (for example, between two exchange rates) or of a different nature (for example, between an interest rate and the price of a commodity). Market liquidity risk Market liquidity risk is the possibility of a Bank entity or the Santander Group as a whole finding itself unable to exit or close a position in time without affecting the market price or the cost of the transaction. This risk can be caused by a decrease in the number of market participants or institutional investors, the execution of large volumes of operations, market instability or increases of the concentration existing in certain products and currencies. Market depth is the main liquidity driver in our trading portfolio, even though our policy is to trade the most liquid assets. 246 Table of Contents Our liquidity risk also arises in non-trading activity, due to the maturity gap between assets and liabilities mostly in the retail banking business. Risk of prepayment or cancellation In certain transactions, the relevant loan agreement allows, explicitly or implicitly, voluntary prepayment prior to maturity without any penalty, which creates a risk that the cash flows received as a result of the prepayment will be reinvested at a potentially lower interest rate. This mainly affects loans or mortgage. Underwriting risk Underwriting risk occurs in the underwriting of a placement of securities or another type of debt, assuming the risk of partially owning the issue or the loan due to non-placement of all or any proportion of any issuance among potential buyers. Derivatives used in Managing Market Risks We use derivatives both in trading and non-trading activities to manage market risks. Trading derivatives are used to eliminate, reduce or modify risk in trading portfolios (interest rate, foreign exchange, commodities and equity price risk), and to provide financial services to customers. Our principal counterparties (in addition to customers) for this activity are financial institutions and the B3. Our main derivative instruments include interest rate swaps, interest rate futures, foreign exchange forwards, foreign exchange futures, foreign exchange options, cross currency swaps, commodities derivatives, equity index futures and equity options and interest rate options. With respect to non-trading activity, derivatives are used in order to manage interest rate risks and foreign exchange risks arising from asset and liability management activity. We also use interest rate and foreign exchange linear derivatives in non-trading activity. Activities subject to market risk Our market risk area is responsible for measuring, controlling and monitoring risk, in respect to the above identified areas, as a result of changes in market factors. Market risk arises due to changes and potential volatility in interest rates, exchange rates, share prices and commodities prices, as well as due to liquidity risk of the various products and markets in which we operate. The following outlines the main source of risk for which we are exposed: Trading The trading book includes financial services to customers and purchase-sale and positioning mainly in fixed income, equity and currency products. The trading book comprises our proprietary positions in financial instruments held for resale and/or bought to take advantage of current and/or expected differences between purchase and sale prices. This portfolio also includes positions in financial instruments deriving from market-making and sales activities. As a result of trading fixed income, equity, commodities and foreign exchange products, we are exposed to their respective market risks. We are also exposed to volatility when non-linear derivatives are used and credit spreads. Non-trading book (banking/structural) The non-trading book consists of market risks inherent in the balance sheet, excluding the trading portfolio. These include: i. Structural interest rate risks. This arises from mismatches in the maturities and re-pricing of all assets and liabilities. ii. Structural exchange rate risk/hedging of results and offshore investments. Exchange rate risk occurs when the currency in which the investment is made is different from the real in companies or branches that are consolidated and those that are not (structural exchange rate). In addition, exchange rate hedging of future results generated in currencies other than the real (hedging of results). 247 Table of Contents Market Risk Management Framework Our board of directors is responsible for establishing our policies, procedures and limits with respect to market risk, including which businesses to invest in and maintain. Our Risk and Compliance Committee monitors our overall performance in relation the risks we assume. Together with the local and global assets and liabilities committees, each market risk unit measures and monitors our market and liquidity risk and provides figures to the assets and liabilities committees to use in managing such risks. Market risk is regulated and controlled through certain policies, set forth in our market and liquidity risk management policies manual, as well as through specific exposure limits established for the entire Santander Group. In addition, authorized products are listed and reviewed periodically. These policies, procedures and limits on market risk are applicable to all units, businesses or portfolios susceptible to market risk, and are built on five basic pillars, which we believe are vital for correct management of market risks: i. Market and structural risk measurement, analysis and control; ii. Calculation, analysis, explanation and reconciliation of profit and loss (P&L); iii. Definition, capture, validation and distribution of market data; iv. Definition of limits, products and underlyings; and v. Consolidation of information. In turn, our market risk management is guided by the following basic principles: i. Independence of the trading and balance sheet activities; ii. Global overview of the risks taken; iii. Definition of limits and empowerment; iv. Control and oversight; v. Homogeneous aggregated metrics; vi. Homogeneous and documented methodologies; vii. Measuring risk; viii. Information consolidation; and ix. Contingency plans and technical capability. Structure of Limits Regarding Market Risk The market risk limit structure represents Santander Brasil’s risk appetite and is aligned with our global market risk management policies, which encompass all of our business units and serve to: i. identify and define the main types of risk incurred in a manner consistent with our business strategy; ii. quantify and report to our business segments with respect to appropriate risk levels and risk profile in line with senior management’s assessment of risks to help avoid any of our business segments taking undesired risks; iii. provide flexibility to our business segments to timely and efficiently establish risk positions that are responsive to market changes and our business strategies, and always within risk levels acceptable to Santander Brasil; iv. allow the individuals and teams originating new business to take prudent risks that will help attain budgeted results; v. establish investment alternatives by limiting equity requirements; and 248 Table of Contents vi. define the range of products and underlying assets within which each unit of treasury can operate, taking into consideration our risk modeling and valuation systems and our liquidity tools. This will help to constrain market risk within our defined risk strategy. Global market risk management policies define our risk limit structure while our Risk and Compliance Committee reviews and approves such policies. Business managers administer their activities within these limits. The risk limit structure covers both our trading and non-trading portfolios and includes limits on fixed income instruments, equity securities, foreign exchange and derivative instruments. Limits considered to be global limits refer to the business unit level. Our business units must comply with approved limits. Potential excesses require a range of actions carried out by the global market risk function unit including (i) providing risk-reducing suggestions and controls, which are the result of breaking “alarm” limits and (ii) taking executive actions that require risk takers to close out positions in order to reduce risk levels. The market risk limits used by us are established along different metrics intended to cover all activity subject to market risk from many perspectives, applying criteria we believe to be conservative. The principal limits include: Trading limits i. VaR and Stress VaR limits; ii. limits of equivalent positions and/or nominal; iii. sensitivity limits to interest rates; iv. vega and gamma limits; and v. limits aimed at reducing the volume of effective losses or protecting results already generated during the period: • loss trigger; and • stop loss. Structural limits i. structural interest rate risk of the balance sheet: • sensitivity limit of net interest margin (“NIM”) over a one year horizon; and • sensitivity limit of market value of equity (“MVE”); ii. structural exchange rate risk comprised of the net position in each currency; and iii. liquidity risk: limits defined for short, long and concentration metrics and considering BAU and Stress scenario. Market Risk Statistical Tools Locally, we use a variety of mathematical and statistical models, including VaR models, historical simulations and stress testing to measure, monitor, report and manage market risk. Such numbers, produced locally, also serve as input for global activities such as evaluations of RORAC, and to allocate economic capital to various activities in order to evaluate the RORAC of such activities. Trading Activity • VaR: as calculated by us, our internal VaR model is an estimate of the expected maximum loss in the market value of a given portfolio over a one-day time horizon at a 99% confidence level, subject to certain assumptions and limitations discussed below. Our standard methodology is based on historical simulation of 520 days and is calculated using the VaR methodology “full revaluation.” In order to capture recent market volatility in the model, the reported VaR is the higher between the 1% percentile and the 1% weighted percentile of the simulated PnL distribution. The first VaR figure gives the same weight to all observed values, and the second one applies an exponential declining factor to give a higher weight for the most recent observations. This methodology makes our VaR numbers react very quickly to changes in current volatility, significantly reducing the likelihood of back testing exceptions. We use VaR estimates to alert senior management whenever the statistically estimated losses in our portfolios exceed prudent levels. 249 Table of Contents 1. Assumptions and limitations: our VaR methodology should be interpreted in light of the limitations that (i) a one-day time horizon may not fully capture the market risk of positions that cannot be liquidated or hedged within one day and (ii) at present, we compute VaR at the close of business and trading positions may change substantially during the course of the trading day. 2. Calibration measures: in order to calibrate our VaR model, we use back testing, which is a comparative analysis between VaR estimates and the daily clean Profit and Loss (theoretical result generated assuming the mark-to-market daily variation of the portfolio considering only the movement of the market variables). The purpose of these tests is to verify and measure the precision of the models used to calculate VaR. • Stressed VaR: our stressed VaR model uses the same calculation methodology as VaR with the following two exceptions: (i) the stressed VaR uses a window of 260 days, instead of 520 days for the VaR; (ii) unlike when calculating the VaR the higher of the percentile uniformly weighted and the one exponentially weighted is not applied. Instead, only the uniformly weighted percentile is used. All the other aspects regarding the methodology and the inputs for calculating the stressed VaR are the same as those for the VaR. To determine the period of observation the market risk area has analyzed the history of the main market risk factors, which were chosen on the basis of expert criteria, and taking into account the most significant positions of our portfolio. • Stress Test: this is a simulation technique, which consists of estimating the potential impact on results by applying different stress scenarios to the trading portfolios and considering the same assumptions according to the relevant risk factor. These scenarios can replicate events that happened in the past (such as crisis events) or hypothetical scenarios. These results are analyzed at least monthly and, along with the VaR provide a fuller spectrum of the risk profile. • Sensitivities: our market risk sensitivity measures gauge the change (or sensitivity) of the market value of an instrument or portfolio to changes in each of the risk factors. The sensitivity of the value of an instrument to changes in market factors may be obtained through analytical approximations by partial derivatives or through a full revaluation of the portfolio. Non-trading Activities • Interest rate gap of assets and liabilities: focuses on lags or mismatches between changes in the value of assets, liabilities and off-balance sheet items. Gap analysis provides a basic representation of the balance sheet structure and allows for the detection of interest rate risk by concentration of maturities. It is also a useful tool for estimating the impact of future interest rate movements on NIM or equity. All on- and off-balance sheet items must be broken down by their flows and analyzed in terms of re-pricing and maturity. In the case of those items that do not have a contractual maturity, an internal model of analysis is used and estimates are made of their duration and sensitivity. • NIM sensitivity: measures the change in the short- and medium-term in the accruals expected over a 12-month horizon, in response to a shift in the yield curve. The yield curve is calculated by simulating the NIM, with a shift in the yield curve, as well as for the current scenario. The sensitivity is the difference between the calculation of the two margins. • MVE sensitivity: Net worth sensitivity measures the interest risk implicit in net worth (equity) over the entire life of the operation on the basis of the effect that a change in interest rates has on the current values of financial assets and liabilities. This is an additional measure to the sensitivity of the NIM. • Value at risk: The VaR for balance sheet activity and investment portfolios. • Analysis of results arising from the interest rate scenarios established by Circular No. 3,876 of the Brazilian Central Bank: there are six shock scenarios for MVE sensitivity and two for NIM sensitivity. • Liquidity risk: our ability to finance our commitments at reasonable market prices, as well as to carry out our business plans with stable sources of funding. We permanently monitor maximum gap profiles. The measures used to control liquidity risk are the liquidity gap, stress scenarios and contingency plans. 250 Table of Contents • Liquidity gap: provides information on contractual and expected cash inflows and outflows for a certain period of time, for each of the currencies in which we operate. The gap measures the net need or excess of funds at a specific date and reflects the level of liquidity maintained under normal market conditions. Analysis of scenarios/contingency plan: includes the local and external activities and consists of a formal set of preventive and corrective actions taken in times of liquidity crises. Using analysis of historical scenarios and simulations of impacts on bank liquidity, we define action plans and contingencies to establish roles and responsibilities and levels to trigger the contingency plan. Each unit should prepare its contingency plan. Additionally, Santander Spain must be periodically informed about the contingency plan of each subsidiary. The frequency with which this plan must be updated depends on market liquidity conditions. Quantitative analysis Trading activity Quantitative analysis of daily VaR in 2025 Our risk performance regarding trading activity in financial markets between 2023 and 2025, measured by daily VaR (measured at a 99% confidence level, over a one day time frame), is shown in the following graph. 251 Table of Contents During 2025, VaR fluctuated between R$17.4 million and R$96.6 million, with an average of R$33.0 million. The histogram below shows the distribution of average risk in terms of VaR in 2025, where the accumulation of days with VaR levels between R$30 million and R$50 million can be observed in 87.4% of the distribution. VaR by Risk Factor The minimum, maximum, average and year-end 2025 VaR values by risk factor were as follows: 2024 2025 Period End Low Average High Period End (in millions of R$) Trading VaR 45.4 17.4 33.0 96.6 34.0 Diversification Effect (9.8) 5.9 (16.0) (105.4) (38.0) 2024 2025 Period End Low Average High Period End (in millions of R$) Interest Rate VaR 33.7 8.7 31.1 82.1 24.8 Equity VaR 13.5 1.7 9.6 44.4 14.0 Foreign Exchange VaR 7.0 0.8 7.1 66.1 32.7 Commodity VaR 0.9 0.2 1.3 9.4 0.5 The average VaR for 2025 was R$33.0 million, with most of the risk due to interest rate positions, and Santander Brasil was relatively conservative in equity and commodities trading activity in line with the approach taken over the last few years. The average VaR of the four main risk factors, interest rates, equity prices, exchange rates, and commodities, were R$31.1 million, R$9.6 million, R$7.1 million, and R$1.3 million respectively, with a negative average diversification effect of R$33.1 million. The chart below shows the evolution of the VaR for interest rates (IR), exchange rates (FX), equity prices (EQ), and commodities (CM), at a 99% confidence level, over a day time frame and a 15-day moving average. 252 Table of Contents Risk Management of Structured Derivatives Our structured derivatives activity is mainly focused on designing investment products and managing hedging risks for customers. Our risk management is focused on ensuring that the net risk exposure is the lowest possible. These transactions include options on equities, currencies, fixed-income instruments. The chart below shows the VaR Vega performance of our structured derivatives business in 2025, 2024 and 2023. In the most recent year, this figure fluctuated around an average of R$5.0 million. In general, the periods with higher VaR Vega levels are related to episodes of significant increases in market volatility. Scenario analysis Different stress test scenarios were analyzed during 2025. A correlation break scenario generated the results presented below. 253 Table of Contents Worst Case Scenario The table below shows the maximum daily losses for each risk factor (fixed-income, equities and currencies) as of December 31, 2025, in a scenario that uses historical volatilities and simulates variations of the risk factors for +/-3 and +/-6 standard deviations on a daily basis. From this group of scenarios, we generate a table of stress test results, which identifies the largest loss per risk factor. The sum of the largest losses of each risk factor is the result of the Worst-Case Scenario, which considers the break of correlation between risk factors. Worst Case Stress Test Exchange Rate Fixed Income Equity Total (in millions of R$) Total trading (33.1) (267.0) (18.9) (319.0) The stress test shows that the economic loss suffered by the group in the marked-to-market result would be, if this scenario materialized in the market, R$319.0 million as of December 31, 2025. Non-trading Activity Quantitative Analysis of Interest Rate Risk in 2025 Convertible Currencies As of December 31, 2025, the sensitivity of net interest income at one year, to a parallel rise of 100 basis points in the local currency yield curve was R$369 million. In addition, at the end of 2025, the sensitivity of MVE to parallel rises of 100 basis points in the yield curves was R$1,664 million in the local currency yield curve. 254 Table of Contents Structural Gap The following table shows the managerial gaps between the re-pricing dates of our assets and liabilities as of December 31, 2025 in millions of reais. Gap Total 0-1 Month 1-3 Months 3-6 Months 6-12 Months 1-3 Years 3-5 Years > 5 Years Not Sensitive (in millions of R$) Money Market 227,544 145,821 266 499 1,728 1,755 1,314 4,486 71,674 Bonds 202,652 35,978 659 1,528 21,216 15,155 8,521 27,741 91,854 Loans 571,387 142,370 68,718 63,017 83,564 94,031 78,201 69,288 (27,801) Permanent 23,605 — — — — — — — 23,605 Other 264,274 68,340 — — — — — — 195,934 Total Assests 1,289,463 392,509 69,644 65,045 106,507 110,941 88,036 101,515 355,266 Money Market (6,022) (3,326) (383) (513) (438) (260) (101) — (1,000) Deposits (660,010) (423,284) (8,840) (7,136) (15,084) (20,701) (31,106) (75,967) (77,892) Loans Liability (27,881) (2,084) (5,317) (2,470) (3,849) (3,711) (4,160) (4,945) (1,345) Issues (179,620) (159,602) (1,685) (1,714) (5,745) (3,696) (3,887) (3,290) — Equity and Other (415,931) (81,959) (22,018) (22,730) (38,480) (2,444) (649) — (247,651) Total Liabilities (1,289,463) (670,255) (38,243) (34,562) (63,596) (30,812) (39,904) (84,202) (327,888) Balance Gap — (277,745) 31,400 30,483 42,911 80,129 48,131 17,313 27,378 Off- Balance Gap (44,003) 82,809 10,535 2,615 (16,866) (49,686) (21,228) (12,855) (39,326) Total Estructural Gap (44,003) (194,937) 41,935 33,098 26,045 30,442 26,904 4,457 (11,948) Accumulated Gap (44,003) (194,937) (153,002) (119,904) (93,859) (63,416) (36,513) (32,055) (44,003) The interest rate risk of our balance sheet management portfolios, measured by the sensitivity of the net margin to a parallel movement of 100 basis points, decreased R$428 million during 2025, reaching a maximum of R$888 million in February 2025. The sensitivity of the market value decreased R$979 million in the year ended December 31, 2025, reaching a maximum of R$2,687 million in January 2025. The main factors that occurred in 2025 and influenced the decrease in sensitivities were the hedging of credit production and the update of the non-performing liabilities model. Interest Rate Risk Profile as of December 31, 2025 The currency gap tables below show the managerial distribution of risk by maturity and currency in Brazil as of December 31, 2025 in millions of reais. 255 Table of Contents Total 0-1 month 1-3 months 3-6 months 6-12 months 1-3 years 3-5 years > 5 years Not Sensitive (in millions of R$) Local Currency Gap Money Market 209,247 131,021 266 499 1,728 1,755 1,314 4,486 68,177 Bonds 194,511 35,308 174 291 19,270 14,136 7,793 26,086 91,452 Loans 462,836 112,197 55,381 50,181 65,289 78,722 67,079 63,285 (29,298) Permanent 23,602 — — — — — — — 23,602 Others 198,541 39,365 — — — — — — 159,177 Total Assests 1,088,737 317,890 55,822 50,970 86,287 94,613 76,187 93,857 313,110 Money Market (6,022) (3,326) (383) (513) (438) (260) (101) — (1,000) Deposits (620,744) (408,081) (4,912) (5,710) (13,206) (19,953) (31,106) (75,967) (61,809) Loans Liability (11,361) (1,239) (1,159) (697) (1,831) (2,101) (2,197) (793) (1,345) Issues (179,620) (159,602) (1,685) (1,714) (5,745) (3,696) (3,887) (3,290) — Equity and Other (193,539) (45,309) — — — — — — (148,230) Total Liabilities (1,011,286) (617,557) (8,140) (8,634) (21,221) (26,010) (37,292) (80,049) (212,384) balance gap 77,451 (299,666) 47,682 42,337 65,066 68,603 38,895 13,808 100,727 Off- Balance Gap (80,898) 83,080 (23,888) (1,203) (15,663) (49,677) (21,375) (12,846) (39,326) Gap (3,447) (216,587) 23,794 41,134 49,403 18,927 17,520 962 61,400 accumulated gap (3,447) (216,587) (192,793) (151,658) (102,255) (83,329) (65,809) (64,847) (3,447) Total 0-1 month 1-3 months 3-6 months 6-12 months 1-3 years 3-5 years > 5 years Not Sensitive (in millions of R$) Foreign Currency Gap Money Market 18,297 14,800 — — — — — — 3,497 Bonds 8,142 670 485 1,238 1,945 1,019 728 1,654 402 Loans 108,551 30,173 13,337 12,837 18,275 15,309 11,121 6,003 1,497 Permanent 3 — — — — — — — 3 Others 65,733 28,976 — — — — — — 36,757 Total Assests 200,726 74,619 13,822 14,074 20,220 16,328 11,849 7,657 42,156 Money Market — — — — — — — — — Deposits (39,265) (15,203) (3,928) (1,426) (1,878) (748) — — (16,083) Loans Liability (16,520) (845) (4,158) (1,773) (2,017) (1,610) (1,963) (4,153) — Issues/ emissões — — — — — — — — — Equity and Other (222,392) (36,650) (22,018) (22,730) (38,480) (2,444) (649) — (99,421) Total Liabilities (278,177) (52,698) (30,103) (25,928) (42,375) (4,802) (2,613) (4,153) (115,505) balance gap (77,451) 21,921 (16,281) (11,854) (22,155) 11,526 9,236 3,505 (73,349) Off- Balance Gap 36,895 (271) 34,423 3,817 (1,203) (10) 148 (9) — Gap (40,557) 21,650 18,141 (8,036) (23,358) 11,516 9,384 3,496 (73,349) accumulated gap (40,557) 21,650 39,791 31,755 8,397 19,912 29,296 32,792 (40,557) 256 Table of Contents Market Risk: VaR Consolidated Analysis Our total daily VaR as of December 31, 2025 and 2024 broken down by trading and structural (non-trading) portfolios, is set forth below. Our VaR data for trading and non-trading portfolios were summed and thus do not reflect the diversification effect. 2025 2024 Low Average High Period End Period End (in millions of R$) Trading 17.4 33.0 96.6 34.0 45.4 Total 17.4 33.0 96.6 34.0 45.4 Note: VaR figures for trading and non-trading portfolios were added, thus disregarding the diversification effect. Our daily VaR estimates of interest rate risk, foreign exchange rate risk and equity price risk were as set forth below: Interest Rate Risk 2025 2024 Low Average High Period End Period End (in millions of R$) Interest rate risk Trading 8.7 31.1 82.1 24.8 33.7 Total 8.7 31.1 82.1 24.8 33.7 Note: VaR figures for trading and non-trading portfolios were added, thus disregarding the diversification effect. Foreign Exchange Rate Risk 2025 2024 Low Average High Period End Period End (in millions of R$) Exchange rate risk Trading 0.8 7.1 66.1 32.7 7.0 Total 0.8 7.1 66.1 32.7 7.0 Note: VaR figures for trading and non-trading portfolios were added, thus disregarding the diversification effect. Equity Price Risk 2025 2024 Low Average High Period End Period End (in millions of R$) Equity price risk Trading 1.7 9.6 44.4 14.0 13.5 Total 1.7 9.6 44.4 14.0 13.5 Note: VaR figures for trading and non-trading portfolios were added, thus disregarding the diversification effect. 257 Table of Contents Commodity Price Risk At December 31, 2025 2024 Low Average High Period End Period End (in millions of R$) Commodity price risk Trading 0.2 1.3 9.4 0.5 0.9 Total 0.2 1.3 9.4 0.5 0.9 Our daily VaR estimates by activity were as set forth below: 2025 2024 Low Average High Period End Period End (in millions of R$) Trading Interest rate risk 8.7 31.1 82.1 24.8 33.7 Exchange rate risk 0.8 7.1 66.0 32.7 7.0 Equity price risk 1.7 9.6 44.4 14.0 13.5 Commodity price risk 0.2 1.3 9.4 0.5 0.9 Total Trading 17.4 33.0 96.6 34.0 45.4 Non-trading Interest rate risk 2,520.8 3,315.9 4,788.0 2,604.8 4,527.0 Exchange rate risk — — — — — Equity price risk — — — — — Commodity price risk — — — — — Total Non-Trading 2,520.8 3,315.9 4,788.0 2,604.8 4,527.0 Total (Trading + Non-Trading) 2,538.2 3,348.9 4,884.6 2,638.8 4,572.4 Interest rate risk 2,529.5 3,347.0 4,870.1 2,629.6 4,560.7 Exchange rate risk 0.8 7.1 66.0 32.7 7.0 Equity price risk 1.7 9.6 44.4 14.0 13.5 Commodity price risk 0.2 1.3 9.4 0.5 0.9 Note: VaR figures for trading and non-trading portfolios were added, thus disregarding the diversification effect. Non-trading VAR is calculated using a 21-day timing gap instead of on a daily basis. Operational Risk We have adopted the definition of the Basel Committee and Brazilian Central Bank for operational risk, which defines operational risk as the possibility of losses resulting from inadequate processes, people and systems, failures, or from external events. This definition includes legal risk associated with the inadequacy or deficiency in executed agreements, as well as penalties for noncompliance with legal provisions and damages for third parties resulting from our activities. This definition does not include strategic risk. Operational risk events might result in financial losses, adverse effects on the continuity of our business, and negative effects on public image and customer experience. 258 Table of Contents To accomplish our operational risk objectives, we have established a risk model based on three lines, aimed at continuously improving and developing our management and control of operational risks. The three lines are: • First line: all business and support areas within Santander Brasil are responsible for identifying, managing, mitigating and reporting operational risks related to its activities; • Second line: the operational risk and internal control departments is responsible for monitoring and ensuring control over operational and technological risk management practices throughout the organization. It is also responsible for implementing and communicating our operational risk culture, defining methodologies, policies, tools, training, applicable procedures and requirements for the effective management of operational risk; • Third line: the Internal Audit department is responsible for undertaking independent reviews of the risk management activities carried out by the first and second lines, and for promoting continuous improvements in both lines. The objectives of the operational risk management model are: • to disseminate a culture of operational risk management and control, to foster the prevention of risk events and operational risks losses, and to mitigate their financial, and nonfinancial impacts; • to provide support to decision-makers within Santander Brasil; • to ensure there is sufficient coverage to cover the possible impacts of operational risk on an ongoing basis; and • to maintain control of operational risk in a manner which is consistent with business strategy. The following bodies are involved in the implementation of risk management model in order to ensure we have a structured process of operational risk management and decision maker: • Risk Control Committee (Comitê de Controle de Riscos): a committee which aims to perform a holistic and periodic monitoring of the risks to which Santander Brasil is exposed and to exercise independent control on the risk management activities; 259 Table of Contents • Senior Forum of Internal Control and Operational Risk (Fórum Sênior de Controle Interno e Risco Operacional “FSCIRO”): a senior forum aimed at ensuring and fostering the adequate monitoring, control and mitigation of operational risks; • Internal Control and Processes Forum: Executive forum with senior leadership participation, responsible for oversight, analyzing and making decisions on the internal controls environment, operational risk profile and process management. • Operational Risk Meeting (Reunião de Riscos Operacionais): an independent forum, responsible for implementing and disseminating cultural norms, methodologies, standards, policies, tools, training and procedures applicable and required for the effective and efficient management and control of operational risk. Our risk management model assists managers in achieving their strategic objectives by contributing to the decision-making process and by seeking to reduce operational risk exposure and losses. It is compliant with the applicable regulatory requirements. Cybersecurity Risk We are exposed to cybersecurity risk as part of our day-to-day operations. We rely on our technological infrastructure, detection tools, protection, event containment measures, technical team training programs, employee training and awareness initiatives, and alignment of our processes with recognized business continuity management practices to manage cybersecurity risk. For more information on our cybersecurity risks and policies, please see “Item 16K. Cybersecurity.” Social and Environmental Risk Since 2002, we have been at the forefront of social, environmental, and climate risk analysis in Brazil, and it has become part of our culture. We consider social, environmental and climate risks when deciding whether to maintain or extend credit. Our Social, Environmental and Climate Responsibility Policy, or “PRSAC,” complies with National Monetary Council Resolution No. 4,945/2021 and the SARB 14 self-regulation issued by FEBRABAN. Our PRSAC establishes guidelines for social-environmental practices applicable to business and stakeholder relations, such as relations with suppliers. These practices include social, environmental and climate risk assessment in granting or using credit, which complies with National Monetary Council Resolution No. 4,943/2021. This is carried out through the analysis of the socio-environmental practices of wholesale and core companies (empresas núcleo) SME customers, which have limits or credit risk greater than R$7 million and belong to one of 14 social, environmental and climate priorities sectors, based on their risk level. We have been signatories of the Equator Principles since 2009. The Equator Principles are a framework used by financial institutions to determine, assess, and manage environmental and social risk in projects, and are based on the Performance Standards on Social and Environmental Sustainability of International Finance Corporation (IFC) and the World Bank Group. Since 2016, climate change considerations have been progressively incorporated into our credit assessment of wholesale customers. In 2020, a water stress calculator was introduced as part of our socio-environmental assessments, incorporating the concept of customer resilience to both physical and transition risks. This tool evaluates factors such as the customer’s economic activity, location within specific hydrographic basins, and the measures adopted to reduce water consumption. Its development was grounded in an assessment of customers’ overall vulnerability to climate change, including potential impacts arising from regulatory changes and shifts in consumer preferences. Building on this foundation, we are advancing the assessment of physical climate risks across our customer base by strengthening analytical capabilities and integrating these insights into credit decision-making processes and portfolio management. We believe this ongoing evolution supports more robust risk assessments and enhances our ability to anticipate and manage the impacts of climate-related events on our exposures. In March 2023, FEBRABAN approved a protocol (Normativo SARB No. 26/2023) that set the standards for managing the risk of illegal deforestation in the bovine meat chain and defined guidelines to be adopted by its signatories, including Santander Brasil. We believe this is a major step forward as it is the first sector-wide environmental protocol for financing beef processing. Since it will apply to every major bank in Brazil, it is considered a highly effective way of sustainable change and addressing deforestation. By signing the protocol, we have aligned our commitment with that of the Brazilian financial industry to require beef processing clients with slaughterhouses in the Brazilian Amazon region to end illegal deforestation by December 2025. This applies to direct suppliers of cattle and Tier 1 indirect suppliers (supplier of the direct supplier). Under this requirement, suppliers must meet mid-term milestones, which consist of having a traceability and monitoring system, and continuously disclosing KPIs to demonstrate they are meeting their commitments. In 2021, well before the publication of the FEBRABAN protocol, we began engaging with more than a dozen beef processing clients about ending deforestation in their supply chain by 2025. This engagement led to several of them declaring commitments online in 2022 and developing plans to check on Tier 1 indirect suppliers and, led Santander Brasil to work with other banks to come up with the FEBRABAN protocol. 260 Table of Contents We believe that assessing the socio-environmental risk in our operations, also enables us to mitigate issues of operational, capital, credit, and reputational risk. Between January 1, 2025 and December 31, 2025, we conducted socio-environmental screening of 918 wholesale corporate customers, 688 Empresas Núcleo (Core Companies) customers, 668 agribusiness operations, 281 collateral assets, 166 real estate projects, and 48 major new projects, including both those subject and not subject to the Equator Principles. Furthermore, wholesale segment customers are screened for environmental, social and climate related concerns by the new customer acceptance department when they begin their commercial relationship with us. See “Item 3. Key Information—D. Risk Factors—Risks Relating to the Brazilian Financial Services Industry and Our Business—Social and environmental risks may have a material adverse effect on us.” Other Information Volatile market conditions arising from the continuation or escalation of the war in Ukraine and uncertainties following the ceasefire agreement in the Middle East, with intensifying trade tensions between the U.S. and the rest of the world, combined with global supply chain disruptions and persistently high inflation, may result in significant changes in macroeconomic conditions, foreign exchange rates, interest rates, and the prices of our securities. Additionally, in Brazil, these global challenges are compounded by domestic factors such as elevated interest rates, stricter regulatory requirements, and individuals and companies over-indebtedness, that could further exacerbate market volatility and adversely affect us. See “Item 3. Key Information—D. Risk Factors—Risks Relating to the Brazilian Financial Services Industry and Our Business” and “Item 3. Key Information—D. Risk Factors—Risks Relating to Brazil and Macroeconomic and Political Conditions in Brazil and Globally.”