Itaú Unibanco S A : Public Access Report - Liquidity Risk Management and Control Policy

ITAÚ UNIBANCO HOLDING S.A.

CNPJ 60.872.504/0001-23

Publicly-Held

NIRE 35300010230

PUBLIC ACCESS REPORT - LIQUIDITY RISK MANAGEMENT AND CONTROL POLICY

1. OBJECTIVE

Establish the liquidity risk management and control structure of Itaú Unibanco Holding SA (Itaú Unibanco), observing the applicable regulations and best market practices.

2. TARGET AUDIENCE

This policy is applicable to all financial companies controlled by Itaú Unibanco in Brazil and abroad. This policy is also applicable to all activities of the conglomerate that result in exposure to liquidity risk, with an impact on Itaú Unibanco Holding and its subsidiaries.

This policy does not apply to the liquidity risk of customer portfolios managed by the bank and/or trusteeship (e.g. funds from Wealth Management & Services - WMS).

3. INTRODUCTION

Liquidity risk is defined as the possibility of the Institution not being able to efficiently and timely honor its financial obligations. Liquidity risk may occur when there is a mismatch between cash flows (assets and liabilities) that affects its operations or produces significant losses.

Liquidity risk control is carried out by a department independent of the business departments. The objective is to compare assets (generally the most liquid) with financial obligations (generally with shorter maturities) and ensure that sufficient cash is available to meet the obligations.

Liquidity risk is controlled in accordance with the Limits Frameworkestablished by the Board of Directors and the Higher Committees.

4. GUIDELINES

The liquidity risk management and control processes must strictly observe the principles defined in this policy.

The measurement of liquidity risk must cover all financial operations of Itaú Unibanco companies, as well as possible contingent exposures (exposure situations with no expected date to occur) or unexpected exposures (changes in cash inflows or outflows). These situations are commonly caused by:

• settlement services (for example: significant decrease in tax collection, settlement of bank slips or bank transfers);
• provision of guarantees and endorsements (for example: customers who execute guarantees and/or warranties for non-payment of loans);

Corporate | Internal

- contracted and unused credit lines. (for example: increased use of overdraft or credit card limits);

• Realization of adverse events that impact technical provisions (Occurrence of incidents, redemption or portability of pension plan, redemption or inclusion in capitalization draws)
  The main measure in controlling liquidity risk should be measurement of liquid assets, which is composed of:
• cash in the country (federal government bonds, cash, BACEN deposits, any asset that can be immediately traded and converted into cash without significant loss of value);
• cash abroad (assets that can be immediately traded and converted into cash abroad without significant loss of value, such as, for example, cash, cash in other banks)
• all assets immediately convertible (D0) into means of payment.

Liquidity Risk Control includes contingency and liquidity recovery plans to clearly define actions to restore liquidity in different stress situations.

5. MAIN ROLES AND DUTIES

The Liquidity Risk control structure at Itaú Unibanco involves the parties indicated below, for which we highlight their roles in this matter.

Board of Directors

• define the institution's risk appetite and review it annually.
• review the contingency plan annually

Superior Market and Liquidity Risk Commission:

• define the powers related to liquidity risk control and review them annually.
• monitor liquidity risk indicators, taking the necessary decisions, respecting the defined risk appetite.
• submit for approval by the Board of Directors, at least annually, the liquidity contingency plan (Brazil);

Liquidity Risk Control

• Explain the composition of the reserve, in accordance with the guidelines established by higher management;
• identify, assess, monitor, control and report daily exposure to liquidity risk.
• propose liquidity risk limits;
• monitor the contingency and recovery plans, as well as the limits established for each of these plans and report any non-compliance to the competent approval authorities.
• carry out liquidity risk simulations under stress conditions.
• through the Teams' group 'Gestão de Crises_Crises reputacionais' (Crisis Management_Reputational Crises), follow up on events in social media, monitored by the marketing team. If it is suspected that there may be any impact on the bank's liquidity, monitor the liquidity maps and indicators daily and execute any action plans approved by the Crises Committee.
• periodically report the main liquidity risk controls in Brazil and the External Units, as well as situations of sudden reductions in liquidity and relevant aspects of the measures in progress to the collegiate bodies,

Treasury, Superintendence of Integrated Capital Management, CRO and the Board of Directors;

• Inform any non-compliance, both in the managerial risk appetite and in the Contingency and Recovery triggers. Also inform the Integrated Capital Management Superintendence of the daily LCR (Liquidity Cover Ratio) indicator levels, ensuring support for monitoring the Recovery Plan;

Corporate | Internal

• in relation to risk appetite metrics, monitor, analyze and report the information that makes up the Risk Appetite Report, in addition to communicating relevant aspects to those involved, such as committee decisions, requests for action plans and notices on points of attention.
• maintain specialized and adequately sized teams to support the liquidity risk processes and systems under its governance and development management.

Institutional Treasury (Brazil and International)

• centralizing the management of Itaú Unibanco's liquidity risk, ensuring adequate and sufficient levels of liquidity;

Reserve Pilot (see Glossary):

- identify, evaluate, monitor and alert on cash needs for operations carried out during the day;

GIS (Global Institutional Solutions):

-Responsible for managing the liquidity of proprietary portfolios and technical reserve portfolios of companies supervised by SUSEP.

Information Technology:

• maintain specialized and adequately sized teams to support the liquidity risk processes and systems that are under the governance and management of technology development, and for the Hosting processes defined in specific service provision agreements;

6. LIQUIDITY RISK CONTROL

The control of Liquidity Risk at Itaú Unibanco includes measuring, monitoring, controlling and reporting exposure levels, in addition to contingency plans and liquidity recovery.

The measurement of exposure to liquidity risk is based on the daily analysis of the evolution of cash flows and compliance with regulatory indices, as described below:

• Projected cash flow (Business Continuity Scenario): demonstrates cash flow expectations, considering business continuity in normal conditions;
• Portfolio Settlement Scenario (run-off): demonstrates the expected cash flows, considering the settlement of current portfolios and the discontinuation of business.
• Portfolio Settlement Scenario (Stressed) demonstrates cash flows in adverse idiosyncratic scenarios for companies regulated by Susep.
• Short-TermLiquidity Cover Ratio (LCR): demonstrates that the prudential conglomerate's high-quality liquid assets are sufficient to withstand a severe liquidity crisis, for a period of 30 days, according to premises defined by the Central Bank of Brazil; and
• Net Stable Funding Ratio (NSFR): demonstrates that the prudential conglomerate has available stable resources higher than required by cash outflows in a one-year stress scenario.
• Concentration of Funding Providers: demonstrates that the prudential conglomerate has diversified exposure to liquidity provider counterparties.
  The use of liquidity risk limits must be verified against the approved limits.
  Noncompliance with the established limits and indicators must be reported by the liquidity risk control to senior management, the relevant departments for immediate reclassification of exposure and the relevant committees.

Corporate | Internal

The contingency and recovery plans are designed to restore adequate levels of liquidity and preserve Itaú Unibanco's viability in response to stress situations. The plans must contain a list of actions to be implemented, covering volumes, deadlines and those responsible for them. The actions of the contingency plan must contemplate a gradation by level of criticality. The order of actions should be determined by the ease of implementation, taking into account the characteristics of the market.

Details of specific procedures and rules linked to this policy can be accessed at ItaúConecta/Policy and Norms/Policies (Simplified Model) / Ethics, Risks and Governance/Risks/Liquidity.

7. GLOSSARY

Reserve Pilot: structure responsible for continuously calculating the bank reserve balance and monitoring all debit and/or credit entries of the financial institution.

Funding Providers: counterparties that invest funds in the Institution through various products, such as Demand Deposits, Term Deposits, Financial Bills, among others.

Reserve: total assets that can be converted into cash immediately, according to the considerations of the markets and regulatory bodies where the unit is located.

Run-Off: scenario in which assets and liabilities expire and are not renewed.

Approved by the Board of Directors on 2024, May.

Corporate | Internal