Risk and Capital Management - Pillar 3 Itaú Unibanco Holding S.A. Fourth Quarter of 2025

Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 4 Scope and main characteristics of risk management 4 Risk and Capital Governance 4 Risk Culture 6 Risk Appetite 7 Stress Testing 8 Recovery Plan 9 Capital Adequacy Assessment 10 Capital Adequacy 10 OV1: Overview of risk-weighted assets (RWA) 11 Links between financial statements and regulatory exposures 12 LIA: Explanations of differences between accounting and regulatory exposure amounts 12 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories 13 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements 13 PV1: Prudent valuation adjustments (PVA) 14 Institutions that comprise the Financial Statement of Itaú Unibanco Holding 14 Non Consolidated Institutions 18 Material Entities 18 Composition of Capital 18 CCA: Main features of regulatory capital instruments 18 CC1: Composition of regulatory capital 20 CC2: Reconciliation of regulatory capital to balance sheet 22 Macroprudential Indicators 23 CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer 23 GSIB1: Disclosure of G-SIB indicators 23 Leverage Ratio 23 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 24 LR2: Leverage ratio common disclosure 24 Liquidity Ratios 25 LIQA: Liquidity Risk Management Information 25 Framework and Treatment 25 LIQ1: Liquidity Coverage Ratio (LCR) 26 LIQ2: Net Stable Funding Ratio (NSFR) 27 Credit Risk 28 CRA: Qualitative information on credit risk management 28 CR1: Credit Quality of Assets 29 CR2: Changes in Stock of defaulted loans and debts securities 30 CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation 30 Exposure by industry 30 Exposure by remaining maturity 31 Overdue exposures 31

Exposure by geographical area in Brazil and by country 31 Largest debtors exposures 31 Restructured exposures 32 CRC: Qualitative disclosure related to Credit Risk Mitigation techniques 32 CR3: Credit Risk mitigation techniques – overview 33 CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects 34 CR5: Standardized Approach – exposures by asset classes and risk weights 36 CRE: Qualitative disclosure related to IRB models 38 CR6: IRB – Credit risk exposures by portfolio and PD range 41 CR7: IRB – Effect on RWA of credit derivatives used as CRM techniques 42 CR8: RWA flow statements of credit risk exposures under IRB 42 CR9: IRB – Backtesting of probability of default (PD) per portfolio 43 CMS1: Comparison of modelled and standardised RWA at risk level 44 CMS2: Comparison of modelled and standardised RWA for credit risk at asset class level 45 Counterparty Credit Risk (CCR) 45 CCRA: Qualitative disclosure related to CCR 45 CCR1: Analysis of CCR exposures by approach 46 CCR3: Standardized approach – CCR exposures by regulatory portfolio and risk weights 46 CCR5: Composition of collateral for CCR exposures 46 CCR6: CCR associated with credit derivatives exposures 47 CCR8: CCR associated with Exposures to central counterparties 47 Securitization Exposures 47 SECA: Qualitative disclosure requirements related to securitisation exposures 47 SEC1: Securitisation exposures in the banking book 48 SEC2: Securitisation exposures in the trading book 48 SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor 48 SEC4: Securitisation exposures in the banking book and associated capital requirements – bank acting as investor 48 Market Risk 49 MRA: Qualitative disclosure requirements related to market risk 49 MR1: Market risk under standardized approach 51 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 52 MR2: RWA flow statements of market risk exposures under an IMA 54 Exposures subject to market risk 54 MR3: IMA values for trading portfolios 55 MR4: Comparison of VaR estimates with gains/losses 55 Backtesting 55 Total Exposure associated with Derivatives 56 IRRBB 56 IRRBBA: IRRBB risk management objectives and policies 56 Framework and Treatment 57 IRRBB1 – Quantitative information on IRRBB 59

Remunaration of Directors 61 REMA: Compensation Policy 61 REM1: Remunaration awarded during financial year 72 REM2: Special Payments 72 REM3: Deferred remunaration 72 ORA – Qualitative Information on Operational Risk Management 73 OR1: Historical Operational Losses 74 OR2: Composition of Business Indicator (BI) 75 OR3: Capital Requirement for Operational Risk 75 Other Risks 76 Insurance products, pension plans and premium bonds risks 76 Social, Environmental and Climatic Risks 76 Model Risk 78 Regulatory or Compliance Risk 78 Reputational Risk 78 Cyber Risk 80 Country Risk 80 Business and Strategy Risk 81 Contagion Risk 81 Emerging Risks 81 Operational Risk 82 Crisis Management and Operational Resilience 82 Independent Validation of Risk Models 83 Glossary of Acronyms 83 Glossary of Regulations 87

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 3 a b c d e R$ million 12/31/2025 09/30/2025 06/30/2025 03/31/2025 12/31/2024 Available capital (amounts) Common Equity Tier 1 (CET1) 185,595 195,917 188,389 180,611 188,265 Common Equity Tier I (CET1) corresponds to line 1 deducting, as applicable, the amount established by: art. 4, caput, item I, paragraph “i”, and §§ 8 and 9, of CMN Resolution no. 4.955, of October 21, 2021; or art. 3, caput, item I, paragraph “i”, §§ 8 and 9, of BCB Resolution no. 199, of March 11, 2022. 185,552 195,874 188,346 180,568 188,265 Tier 1 208,161 215,466 215,381 202,344 206,196 Tier 1 considering the calculation of Principal Capital according to line 1a 208,118 215,423 215,338 202,301 206,196 Total capital 228,589 238,430 237,454 224,092 227,602 Total Capital considering the calculation of Common Equity Tier I according to line 1a 228,546 238,387 237,411 224,049 227,602 Excess of capital committed to ajusted permanent assets - - - - - Excess of resources invested in permanent assets considering Total Capital according to line 3a - - - - - Total capital detached - - - - - Risk-weighted assets (amounts) Total risk-weighted assets (RWA) 1,505,475 1,454,242 1,436,344 1,430,630 1,379,056 RWA corresponds to line 4 deducting, as applicable, the amount referring to item XII of the caput of art. 4 weighted by the Risk Weighting Factor (FPR) established in art. 82-A, both commands of Resolution 229 of May 12, 2022. 1,505,432 1,454,199 1,436,301 1,430,587 1,379,056 Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (%) 12.3% 13.5% 13.1% 12.6% 13.7% Common Equity Tier 1 ratio (CET1) considering: Numerator: corresponds to line 1a; Denominator: corresponds to line 4b 12.3% 13.5% 13.1% 12.6% 13.7% Tier 1 ratio (%) 13.8% 14.8% 15.0% 14.1% 15.0% Tier 1 ratio, considering: Numerator: corresponds to line 2a; Denominator: corresponds to line 4b 13.8% 14.8% 15.0% 14.1% 15.0% Total capital ratio (%) 15.2% 16.4% 16.5% 15.7% 16.5% Total capital ratio, considering: Numerator: corresponds to line 3a; Denominator: corresponds to line 4b 15.2% 16.4% 16.5% 15.7% 16.5% Additional CET1 buffer requirements as a percentage of RWA Capital conservation buffer requirement (%) 2.5% 2.5% 2.5% 2.5% 2.5% Countercyclical buffer requirement (%) (1) 0.1% 0.1% 0.1% 0.1% 0.1% Bank G-SIB and/or D-SIB additional requirements (%) 1.0% 1.0% 1.0% 1.0% 1.0% Total of bank CET1 specific buffer requirements (%) (2) 3.6% 3.6% 3.6% 3.6% 3.6% CET1 available after meeting the bank's minimum capital requirements (%) 3.6% 4.8% 5.0% 4.1% 4.9% CET1 available after meeting the bank's minimium capital requirements (%) considering CET1 as per line 1a 3.6% 4.8% 5.0% 4.1% 4.9% Basel III leverage ratio Total Basel III leverage ratio exposure measure 2,983,477 2,921,612 2,855,121 2,710,449 2,805,181 Total Basel III leverage ratio exposure measure corresponds to line 13 deducting, as applicable, the amount referring to item XII of the caput of art. 4 of Resolution 229 of May 12, 2022. 2,983,434 2,921,569 2,855,078 2,710,406 2,805,181 Basel III leverage ratio (%) 7.0% 7.4% 7.5% 7.5% 7.4% Basel III leverage ratio (%) considering: i. Numerator: corresponds to line 2a; ii. Denominator: corresponds to line 13a 7.0% 7.4% 7.5% 7.5% 7.4% Liquidity Coverage Ratio Total high-quality liquid assets (HQLA) 389,723 367,777 346,084 340,855 362,609 Total net cash outflow 181,290 168,176 161,856 173,512 163,863 LCR (%) 215.0% 218.7% 213.8% 196.4% 221.3% Net Stable Funding Ratio Total available stable funding 1,499,680 1,408,603 1,393,627 1,362,350 1,375,854 Total required stable funding 1,202,060 1,142,829 1,150,712 1,114,206 1,127,870 NSFR (%) 124.8% 123.3% 121.1% 122.3% 122.0% 1) The countercyclical capital buffer is fixed by the monetary authorities of the jurisdictions in which Itaú has exposure, the most relevant of which are Brazil, where the Financial Stability Committee (Comef) sets it at zero (BACEN Communiqué No. 43.228/25) and Chile, which is set at 0.5%. 2) The BACEN rules establish Capital Buffers, that corresponds to the sum of the Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,958.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 4 The Basel Index reached 15.2% on December 31, 2025, a decrease of 1.2 p.p. compared to September 30, 2025, due to the payment of dividends and interest on equity, share buybacks, and the growth of risk‑weighted assets, partially offset by the positive impact of the period’s result Besides, Itaú Unibanco has a R$ 108,151 million capital excess in relation to its minimum required Total Capital. It corresponds to 7,2 p.p. above the minimum requirement (8%) and higher than the Capital Buffer requirement of (R$ 53,686 million). Considering the Capital Buffers, the capital excess would be 3.6 p.p. The fixed assets ratio shows the commitment percentage of adjusted Total Capital with the adjusted permanent assets. Itaú Unibanco falls within the maximum limit of 50% of adjusted Total Capital, established by BACEN. On December 31, 2025, fixed assets ratio reached 19.4%, showing a surplus of R$ 69,887 million. OVA – Bank risk management approach Scope and Key Features of Risk Management Taking and managing risks is one of Itaú Unibanco’s activities, and to do so effectively, the institution must have well-established objectives for risk management. In this context, the Risk Appetite articulates the set of guidelines from the Board of Directors (BoD) regarding strategy and risk-taking, defining the nature and level of acceptable risks for the organization, while the risk culture guides the necessary attitudes for managing them. Itaú Unibanco invests in robust risk and capital management processes that permeate the entire institution and form the foundation for strategic decisions to ensure business sustainability and maximize shareholder value. Among the processes for proper risk and capital management, the following stand out: the implementation of a continuous and integrated risk management framework; the Risk Appetite Framework, which consists of the Risk Appetite Statement (RAS) from the BoD, the Risk Appetite Policy, and a set of metrics for monitoring key risks according to defined limits; the stress testing program; the establishment of a Risk Committee; and the appointment, before the Central Bank of Brazil (BACEN), of a Chief Risk Officer (CRO) with clearly defined roles, responsibilities, and independence requirements. These processes are aligned with the guidelines of the BoD and Executives, who, through collegiate bodies, define global objectives expressed in goals and limits for the risk-managing business units. The capital control and management units, in turn, support Itaú Unibanco’s management through risk and capital monitoring and analysis processes. The principles that underpin risk management, Risk Appetite, and the guidelines for how Itaú Unibanco employees should act in their daily decision-making are: • Sustainability and customer satisfaction: Itaú Unibanco's vision is to be the leading bank in sustainable performance and customer satisfaction. Therefore, it is committed to generating shared value for employees, customers, shareholders, and society, ensuring business continuity. Itaú Unibanco is focused on conducting business that benefits both the customer and the institution. • Risk culture: The institution's risk culture goes beyond policies, procedures, and processes, aiming to strengthen the individual and collective responsibility of all employees to do the right thing, at the right time, and in the right way, respecting ethical business practices. It is based on four principles (conscious risk-taking, discussion and action on institutional risks, and everyone's responsibility for risk management), which encourage open understanding and discussion of risks, keeping them within the levels determined by the Risk Appetite, and ensuring that each employee, regardless of position, area, or function, also assumes responsibility for managing the risks of their business. The Risk Culture is detailed in the "Risk Culture" section.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 5 • Risk Pricing: Itaú Unibanco operates and assumes risks in businesses that are well-known and understood, avoiding risks in which it lacks knowledge or competitive advantage, carefully evaluating the risk-return relationship. • Diversification: The institution has a low appetite for volatility in results and therefore operates on a diversified base of customers, products, and businesses, seeking risk differentiation and prioritizing less risky ventures. • Operational excellence: Itaú Unibanco aims to be an agile bank with robust and stable infrastructure to offer high-quality services. • Ethics and respect for regulations: For Itaú Unibanco, ethics are non-negotiable. The institution promotes an environment of integrity, guiding all employees to cultivate ethics in relationships and business and respect regulations, safeguarding the institution's reputation. Risk and Capital Governance The Board of Directors is the highest authority responsible for establishing guidelines, policies, and limits for risk and capital management. The Risk and Capital Management Committee (CGRC) supports the Board in fulfilling its duties related to risk and capital oversight. At the executive level, collegiate bodies chaired by Itaú Unibanco's Chief Executive Officer (CEO) are responsible for risk and capital management, exercising delegated responsibilities in these areas, and their decisions are monitored within the scope of the CGRC. To support this structure, the Risk Area has specialized departments aimed at ensuring, independently and centrally, that the institution’s risks and capital are managed in accordance with established policies and procedures. Itaú Unibanco’s risk management organizational structure complies with current regulations in Brazil and abroad. Domestically, the Bank follows the rules established by the Central Bank of Brazil (BACEN), particularly Resolution No. 4,557/17, which addresses the risk and capital management framework for financial institutions, as well as regulations from the Brazilian Securities and Exchange Commission (CVM) and the Private Insurance Superintendence (SUSEP), among other regulators and applicable standards. Internationally, Itaú Unibanco adheres to standards set by the Basel Committee on Banking Supervision, the United States Securities and Exchange Commission (SEC), and local regulations in the countries where it operates. Additionally, Itaú Unibanco complies with guidelines such as the Foreign Account Tax Compliance Act (FATCA), the Principles for Responsible Banking (PRB) of the United Nations Environment Programme – Finance Initiative, and the Guidelines for Multinational Enterprises of the Organization for Economic Cooperation and Development (OECD), among other representative examples. The Bank also adopts practices aligned with International Financial Reporting Standards (IFRS) and globally recognized corporate governance best practices. Furthermore, Itaú Unibanco has a governance framework for identifying and monitoring emerging risks—those newly identified risks with potentially material medium- to long-term impacts on the business, but for which there is still insufficient information for full assessment due to the number of unknown factors and impacts, as they are unprecedented and have not been addressed in the past. Risk management responsibilities at Itaú Unibanco are structured according to the three lines of governance model: • 1st line of governance: Business and corporate support areas are directly responsible for identifying, measuring, assessing, monitoring, reporting, controlling, and mitigating the risks they originate; • 2nd line of governance: The Risk Area aims to ensure, independently and centrally, that the institution’s risks are managed according to established policies and procedures, defining parameters for the risk management

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 7 The Risk Appetite articulates the set of guidelines from the Board of Directors (BoD) regarding strategy and risk- taking, defining the nature and level of acceptable risks for the organization while considering the capacity for effective and prudent management, strategic objectives, competitive conditions, and the regulatory environment. The Risk Appetite framework consists of the Risk Appetite Statement (RAS) from the BoD, the Risk Appetite Policy, and a set of metrics for monitoring key risks according to defined limits. Considering Itaú Unibanco’s strategic guidelines, the Risk Appetite and its dimensions are based on the following statement: “We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital.” To make the RAS tangible, the Risk Appetite is organized in six dimensions, each composed of a set of metrics associated with the key risks involved, combining complementary measurement methods to obtain a comprehensive view of our exposures to acceptable types and levels of risk: • Capitalization: Reflects the Bank’s level of protection against significant losses that could lead to regulatory non-compliance or insolvency. It establishes that Itaú Unibanco must have sufficient capital to withstand a severe recession or stress event without needing to adjust its capital structure under adverse circumstances. It is monitored through the tracking of Itaú Unibanco’s capital ratios under normal and stressed conditions, as well as the institution’s debt issuance ratings. • Liquidity: Reflects the Bank’s level of protection against a prolonged funding stress period that could lead to a liquidity shortfall and eventual bankruptcy. It establishes that Itaú Unibanco’s liquidity must endure extended periods of stress. It is monitored through the tracking of liquidity indicators. • Breakdown of results: Aims to ensure stability and sustainability of results, restricting excessive volatility and avoiding portfolio concentrations and significant deviations in pricing and provisions. It defines that business will primarily focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. It monitors Credit risk indicators, including social, environmental, and climate dimensions, Market and IRRBB risks, Underwriting risks, and Business & Profitability risks. The monitored metrics aim to ensure, through exposure concentration limits (e.g., industry sectors, counterparty quality, countries and geographic regions, and risk factors), an appropriate portfolio composition, targeting low earnings volatility and business sustainability. • Operational risk: Addresses operational risks that could compromise the Bank’s business and operations, focusing on controlling events that could negatively impact business strategy and operations. • Reputation: Addresses risks that could impact the value of our brand and the institution’s reputation among customers, employees, regulators, investors, and the general public. Risk monitoring in this dimension is carried out through ethical behavior and conservative adherence to regulatory standards. • Clients: Addresses risks that could impact customer satisfaction and experience, monitored through customer satisfaction tracking, events with direct customer impact, and suitability indicators. The metrics translate the RAS and dimensions into measurable indicators that capture the main risks incurred by the institution. They are periodically monitored and reported to the executive level, the Risk and Capital Management

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 20 CC1 - Composition of regulatory capital 1 12/31/2025 Value (R$ Thousand) Balance Sheet Reference Common Equity Tier I: instruments and reserves 1 Instruments Eligible for the Common Equity Tier I 136,909,898 (k) 2 Revenue reserves 57,481,239 (l) 3 Other revenue and other reserve 1,752,918 (m) 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 6,192,303 (j) 6 Common Equity Tier I before regulatory adjustments 202,336,358 Common Equity Tier I: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 211,633 8 Goodwill (net of related tax liability) 1,149,720 (e) 9 Intangible assets 15,632,730 (h) / (i) 10 Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution related to determination periods ended until December 31, 1998 53,059 (b) 11 Adjustments related to the market value of derivative financial instruments used to hedge the cash flows of protected items whose mark- to-market adjustments are not recorded in the books. (277,567) 12 Shortfall of provisions to expected losses - 15 Actuarial assets related to defined benefit pension funds - (d) 16 Shares or other instruments issued by the bank authorized to compose the Core Capital, acquired directly, indirectly or synthetically 12,731 (n) 17 Reciprocal cross-holdings in common equity - 18 Total value of adjustments related to net non-significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities - 19 Total value of adjustments related to net significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific adjustments - 21 Total value of adjustments related to tax credits arising from temporary differences that depend on the generation of income or future taxable income for their realization, above the limit of 10% of the Common Equity Tier I, disregarding specific deductions - 22 Amount that exceeds 15% of the Common Equity Tier I - 23 Of which: arising from net investments in the Common Equity Tier I of companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities - 25 Of which: arising from tax credits resulting from temporary differences that depend on the generation of income or future taxable income for their realization - 26 National specific regulatory adjustments (41,038) 26.a Deferred permanent assets - (g) 26.b Investment in dependence, financial institution abroad or non-financial entity that is part of the conglomerate, with respect to which the Central Bank of Brazil does not have access to information, data and documents - 26.d Increase of unauthorized capital - 26.e Excess of the amount adjusted of Common Equity Tier I - 26.f Deposit to cover capital deficiency - 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect - (i) 26.h Excess of resources invested on permanent assets - 26.i Total capital detached - 26.j Other residual differences concerning the Common Equity Tier I calculation methodology for regulatory purposes (41,038) 27 Other residual differences related to the calculation of the Common Equity Tier I for regulatory purposes - 28 Total regulatory deductions from the Common Equity Tier I 16,741,268 29 Common Equity Tier I 185,595,090 Additional Tier I Capital: instruments 30 Instruments eligible for the Additional Tier I Capital 21,542,997 31 Of which: classified as equity under applicable accounting standards - 32 Of which: classified as liabilities under applicable accounting standards 21,542,997 33 Instruments authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 34 Additional Tier 1 instruments issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 1,023,065 35 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 36 Additional Tier I Capital before regulatory adjustments 22,566,062

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 21 Additional Tier I Capital: regulatory adjustments 37 Shares or other instruments issued by the bank authorized to compose the Additional Tier I Capital, acquired directly, indirectly or synthetically - 38 Reciprocal cross-holdings in additional Tier 1 instruments - 39 Total value of adjustments related to net non-significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 40 Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 41 National specific regulatory adjustments - 41.b Non-controlling interest in Additional Tier I Capital - 41.c Other residual differences concerning the Additional Tier I Capital calculation methodology for regulatory purposes - 42 Regulatory adjustments applied to the Additional Tier I Capital due to the insufficient Tier II Capital to cover deductions - 43 Total regulatory deductions from the Additional Tier I Capital - 44 Additional Tier I Capital (AT1) 22,566,062 45 Tier I 208,161,152 Tier II: instruments and provisions 46 Instruments eligible for Tier II 19,033,726 47 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 48 Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 1,361,714 49 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect - 50 Provisions 32,568 51 Tier II before regulatory adjustments 20,428,008 Tier II: regulatory adjustments 52 Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, indirectly or synthetically - 53 Reciprocal cross-holdings in Tier 2 instruments - 54 Total value of adjustments related to net non-significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 55 Total value of adjustments related to net significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation - 56 National specific regulatory adjustments - 56.b Non-controlling interest in Tier II - 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes - 57 Total regulatory deductions from Tier II Capital - 58 Tier II 20,428,008 59 Referential Equity (Tier I + Tier II) 228,589,160 60 Total risk-weighted assets 1,505,475,690 BIS Ratios and Additional Capital Buffers 61 Common Equity Tier I Ratio 12.3% 62 Tier I Ratio 13.8% 63 BIS Ratio 15.2% 64 Additional Capital Buffers (% of RWA) 3.6% 65 Of which: capital conservation buffer requirement 2.5% 66 Of which: bank-specific countercyclical buffer requirement 0.1% 67 Of which: capital buffer for institutions that are systemically important at global level (G-SIB) 1.0% 68 Common Equity Tier 1 capital available after meeting the bank's minimum capital requirements (% of RWA) 3.6% Amounts below the limit for deduction (non-weighted by risk) 72 Total value, subject to risk weighting, of non-significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as well as non-significant investments in the Additional Tier I, Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 2,761,816 73 Total value, subject to risk weighting, of significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 17,387,089 (f) / (a) 75 Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 7,792,711 (c) Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) 82 Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect - 83 Amount excluded from the Additional Tier I Capital due to the line 82 limit - 84 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect - 85 Amount excluded from Tier II due to the line 84 limit - 1) The adjustment to equity arising from the adoption of the criteria for setting aside provisions for expected losses set out in CMN Resolution No. 4,966 impacted capital in phases, as defined in CMN Resolution No. 5,199.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ 26 LIQ1: Liquidity Coverage Ratio (LCR) 12/31/2025 (1) 09/30/2025 (1) Total unweighted value (In thousand R$) (2) Total weighted value (In thousand R$) (3) Total unweighted value (In thousand R$) (2) Total weighted value (In thousand R$) (3) High Quality Liquidity Assets (HQLA) Total High Quality Liquid Assets (HQLA) 389,722,978 367,777,276 Cash Outflows (4) . . Retail deposits and deposits from small business customers, of which: 691,564,370 72,275,461 654,107,092 67,696,023 Stable deposits 299,595,980 14,979,799 291,799,825 14,589,991 Less stable deposits 391,968,390 57,295,662 362,307,266 53,106,032 Unsecured wholesale funding, of which: 341,685,716 149,748,865 336,531,728 145,445,334 Operational deposits (all counterparties) and deposits in networks of cooperative banks 28,328,470 7,966,379 22,637,742 6,084,235 Non-operational deposits (all counterparties) 310,363,543 138,788,784 310,013,407 135,480,520 Unsecured debt 2,993,702 2,993,702 3,880,579 3,880,579 Secured wholesale funding 49,067,424 45,954,133 Additional requirements, of which: 113,531,193 30,952,335 120,749,088 28,509,122 Outflows related to derivative exposures and other collateral requirements 40,123,217 24,036,422 37,067,516 20,038,435 Outflows related to loss of funding on debt products 2,300,056 2,300,056 2,596,434 2,596,434 Credit and liquidity facilities 71,107,919 4,615,856 81,085,137 5,874,253 Other contractual funding obligations 116,425,597 116,425,597 112,120,745 112,120,745 Other contingent funding obligations 299,259,635 21,983,805 273,263,116 19,933,326 Total Cash Outflows 440,453,486 419,658,682 Cash Inflows (4) Secured lending (eg reverse repos) 171,671,279 1,355,833 146,164,463 950,802 Inflows from fully performing exposures 61,672,363 36,896,668 63,539,951 38,981,930 Other cash inflows 234,330,004 220,911,053 228,355,062 211,549,519 Total Cash Inflows 467,673,646 259,163,555 438,059,476 251,482,252 Total Adjusted Value (5) Total Adjusted Value (5) Total HQLA 389,722,978 367,777,276 Total net cash outflows 181,289,931 168,176,431 Liquidity Coverage Ratio (%) 215.0% 218.7% Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 389.7 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 181.3 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 215.0%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. __________________________________________________________________________________________ Itaú Unibanco

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 27 a b c d e Value per residual effective maturity term (R$ thousand) 12/31/2025 No Maturity (1) Lower than six months (1) Greater than or equal to six months, and lower than 1 year (1) Greater than or equal to 1 year (1) Weighted Value (In thousand R$) (2) Available Stable Funding (ASF) (3) Capital - - - 246,319,350 246,319,350 Reference Equity, gross of regulatory deductions - - - 205,742,627 205,742,627 Other capital instruments not included in line 2 - - - 40,576,723 40,576,723 Retail Funding: 189,902,572 600,943,070 4,807,660 1,474,482 733,683,519 Stable Funding 101,123,107 221,036,353 261,843 21,308 306,321,545 Less Stable Funding 88,779,465 379,906,717 4,545,817 1,453,175 427,361,974 Wholesale Funding: 71,102,512 868,962,843 100,841,970 157,551,181 429,592,822 Operational deposits and deposits of member cooperatives 18,688,552 - - - 9,344,276 Other Wholesale Funding 52,413,960 868,962,843 100,841,970 157,551,181 420,248,546 Opertions in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 171,196,045 13,407,380 1,285,529 - Other liabilities, in which: 74,114,055 113,927,347 10,468,749 84,850,425 90,084,799 Derivatives whose replacement values are lower than zero 18,958,815 - - Other liability or equity elements not included above 74,114,055 94,968,532 10,468,749 84,850,425 90,084,799 Total Available Stable Funding (ASF) 1,499,680,491 Required Stable Funding (RSF) (3) Total NSFR high quality liquid assets (HQLA) 46,950,198 Operational deposits held at other financial institutions - - - - - Performing loans and securities (financial institutions, corporates and central banks) 1,908,923 592,172,277 157,140,150 755,400,925 878,761,599 Performing loans to financial institutions secured by Level 1 HQLA - 27,831,829 - 508,016 3,291,199 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions 1,681,810 26,678,304 11,013,121 16,915,714 26,832,957 Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to sovereigns, central banks, of which: 227,113 477,498,457 101,174,396 332,898,007 491,494,463 With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644. - - - 8,770,741 5,700,982 Performing residential mortgages, of which: - 15,021,639 13,379,623 174,370,526 120,684,973 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 120,492,284 98,949,898 Securities that are not in default and do not qualify as HQLA, including exchange-traded equities - 45,142,047 31,573,011 230,708,661 236,458,007 Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent - 169,282,325 15,913,341 1,633,657 - Other assets, in which: 81,972,665 151,632,581 8,956,505 132,108,357 261,028,657 Transactions with gold and commodities, including those with expected physical settlement - - Assets posted as initial margin for derivatives contracts and participation in mutual guarantee funds of clearinghouses or providers of clearing and settlement services which acts as central counterparty. - - 19,727,477 16,768,355 Derivatives whose replacement values are higher than or equal to zero 17,958,433 - 9,748,994 4,260,921 Derivatives whose replacement values are less than zero, gross of the deduction of any collateral provided as a result of deposit of variation margin - - 959,279 959,279 All other assets not included in the above categories 81,972,665 133,674,148 8,956,505 101,672,608 239,040,102 Off-balance sheet transactions 778,961,391 8,773,622 - - 15,319,091 Total Required Stable Funding (RSF) 1,202,059,545 NSFR (%) 124.8% 1) Corresponds to the total amount of Available Stable Funding (ASF) or Required Stable funding (RSF). 2) Corresponds to the amount after application of weighting factors. 3) Corresponds to the Available Stable Funding (ASF) or Required Stable Funding (RSF). R$ thousand Total Adjusted Value (1) 12/31/2025 09/30/2025 Total Available Stable Funding (ASF) 1,499,680,491 1,408,603,125 Total Required Stable Funding (RSF) 1,202,059,545 1,142,829,435 NSFR (%) 124.8% 123.3% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. Itaú Unibanco has an Available Stable Funding (ASF) amounted to 1,499.7 billion in the 4 quarter, mainly composed of Capital, Retail Funding and Wholesale. In addition, the Required Stable Funding (RSF) amounted to 1,202.1 billion in the 4 quarter, which is mostly composed of loans and financing granted to wholesale, retail, central economies and central bank operations. The table shows that the NSFR at the end of the quarter is 124.8%, above the limit of 100%, and therefore the institution has Available Stable Funding to support the Required Stable Funding comfortably in the long- term, according to the metric. LIQ2: Net Stable Funding Ratio (NSFR)

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 30 CR2: Changes in Stock of Problem Assets R$ million Total Exposures classified as problem assets at the end of the previous period (09/30/2025) 30/09/202562,140 Value of transactions classified as problem assets in the current period 16,448 Value of exposures that are no longer characterized as problem assets in the current period (1,545) Amount written off (10,209) Other changes (7,733) Exposures classified as problem assets at end of the reporting period (12/31/2025) 31/12/202559,101 CRB: Additional disclosure related to the credit quality of assets The tables below contain additional disclosure related to the credit quality exposures reported in the table CR1. Where is informed breakdown of exposures by geographical area, industry and defaulted exposures. In addition, the total exposures by residual maturity by delay range, the total of restructured exposures and the percentage of the ten and one hundred largest exposures are reported. Exposure by industry Total Exposure Total problematic assets and debt securities R$ million 12/31/2025 R$ million 12/31/2025 Portfolio Portfolio Total Exposure (Net values) Total Exposure (Gross values) Problematic Assets Expected Credit Loss Write-off Companies 1,560,678 1,589,558 Companies 20,930 9,803 1,968 Public sector 487,555 487,763 Public sector - - 15 Energy 2,287 2,287 Energy - - - Petrochemical and Chemical 7,980 7,981 Petrochemical and Chemical - - - Sundry 477,288 477,495 Sundry - - 15 Private sector 1,073,123 1,101,795 Private sector 20,930 9,803 1,953 Sugar and Alcohol 3,980 4,067 Sugar and Alcohol 30 23 - Agribusiness and Fertilizers 40,124 40,873 Agribusiness and Fertilizers 626 266 52 Food and Beverage 54,366 55,790 Food and Beverage 974 522 111 Banks and Other Financial Institutions 111,193 111,420 Banks and Other Financial Institutions 85 26 10 Capital Assets 20,151 20,935 Capital Assets 1,046 406 32 Pulp and Paper 19,726 19,906 Pulp and Paper 71 28 2 Electronic and IT 24,230 25,067 Electronic and IT 707 400 61 Packaging 7,068 7,259 Packaging 117 72 15 Energy and Sewage 78,813 80,123 Energy and Sewage 946 495 3 Education 9,131 9,505 Education 171 96 25 Pharmaceuticals and Cosmetics 25,581 26,411 Pharmaceuticals and Cosmetics 481 254 126 Real Estate Agents 76,930 78,882 Real Estate Agents 2,532 893 141 Entertainment and Tourism 21,982 23,155 Entertainment and Tourism 617 362 125 Wood and Furniture 11,831 12,366 Wood and Furniture 348 188 57 Construction Material 13,607 14,316 Construction Material 316 197 54 Steel and Metallurgy 25,820 26,635 Steel and Metallurgy 530 270 54 Media 1,753 1,786 Media 17 10 1 Mining 13,534 13,660 Mining 105 21 7 Infrastructure Work 20,424 21,334 Infrastructure Work 194 79 45 Oil and Gas 20,924 21,514 Oil and Gas 278 160 35 Petrochemical and Chemical 27,907 28,772 Petrochemical and Chemical 416 183 16 Health Care 13,855 14,413 Health Care 236 115 30 Insurance and Reinsurance and Pension Plans 1,300 1,306 Insurance and Reinsurance and Pension Plans - - - Telecommunications 20,712 21,765 Telecommunications 123 73 5 Clothing and Footwear 11,815 12,230 Clothing and Footwear 224 129 30 Trading 6,502 6,631 Trading 83 43 12 Transportation 52,112 54,860 Transportation 1,118 539 193 Domestic Appliances 5,838 5,954 Domestic Appliances 86 37 10 Vehicles and Autoparts 47,097 48,350 Vehicles and Autoparts 557 292 75 Third Sector 1,401 1,411 Third Sector 6 4 - Publishing and Printing 6,913 7,194 Publishing and Printing 150 87 28 Commerce - Sundry 59,513 62,153 Commerce - Sundry 2,596 1,280 342 Industry - Sundry 10,486 10,615 Industry - Sundry 107 49 11 Sundry Services 146,907 150,136 Sundry Services 3,386 1,439 236 Sundry 59,597 61,001 Sundry 1,651 765 9 Individuals 981,093 1,065,081 Individuals 38,171 18,976 8,241 Total 2,541,771 2,654,639 Total 59,101 28,779 10,209

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 54 Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On December 31, 2025, VaR represented 53% of the capital requirement, while the stressed VaR represented 47%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco's portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with three different confidence intervals (99%, 97.5% and 95%), in three different historical windows (250, 500 and 750 working days). This includes nine different samples, therefore ensuring the statistical quality of the historical VaR hypothesis. Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento VaR and Stressed VaR Microinvest S.A. Soc. de Crédito a Microempreendedor VaR and Stressed VaR NC 2025 Fundo de Investimento em Direitos Creditórios VaR and Stressed VaR NC 2025 I Fundo de Investimento em Direitos Creditórios VaR and Stressed VaR Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior VaR and Stressed VaR Pont Sociedad Anónima VaR and Stressed VaR Redecard Instituição de Pagamento S.A. VaR and Stressed VaR Redecard Sociedade de Crédito Direto S.A VaR and Stressed VaR RT Itaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR Tangerina Fundo de Investimento em Direitos Creditórios - Responsabilidade Limitada VaR and Stressed VaR Tarumã 2 FIF Fundo Incentivado em Investimento em Deb de Infra RF Cred Priv Resp Limitada VaR and Stressed VaR Tarumã Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado VaR and Stressed VaR Théros Fundo de Investimento nas Cadeias Produtivas VaR and Stressed VaR TOP 2025 I Fundo de Investimento em Direitos Creditórios Responsabilidade Limitada VaR and Stressed VaR Vitex FIF Fundo Incentivado em Investimento em Debêntures de Infra RF Cred Priv Resp Limitada VaR and Stressed VaR

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 58 highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The institution uses an internal model to measure ∆EVE and ∆NII. ∆EVE results do not represent immediate impact in the stockholders’ equity. Meanwhile, ∆NII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank’s results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank’s risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for ∆EVE and ∆NII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The ∆EVE and ∆NII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the ∆EVE and ∆NII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to pre-payment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, which are primary components of the market in price formation.

Risk and Capital Management – Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 62 Corporativo | Interno risk management, the Remuneration Policy incorporates adjustment mechanisms such as malus and clawback, which allow for the reassessment or reversal of variable compensation in specific situations, ensuring alignment between performance, conduct, and the sustainability of results. Annually, the Compensation Committee evaluates and, if necessary, proposes improvements to the Compensation Policy. After this careful analysis by the Compensation Committee, the Policy is submitted to the Board of Directors' evaluation. In 2024, the Extraordinary General Stockholders’ Meeting approved the revision, formalization and ratification of the Stock Grant Plan (“Stock Grant Plan”) to consolidate general rules in connection with long-term incentive programs involving stock grant to management members and employees of the Issuer and of its direct and indirect controlled companies. Among the programs mentioned in the Stock Grant Plan, managed by the Compensation Committee and with the Issuer’s management members as target audiences, we highlight the Variable Stock-Based Compensation, the Fixed StockBased Compensation (for members of the Board of Directors only), and the Partners, those also included in the information provided along the REMA table. The Stock Grant Plan is available on: www.itau.com.br/investor-relations > Itaú Unibanco > Corporate Governance > Policies > Grant Plan. In order to bring more transparency about our compensation model, since 2020 we started to disclosure a document that consolidates the main practices and principles that guide the compensation payment to our management members. This document, named Remuneration Policy, makes public the bases of our remuneration model and is available at www.itau.com.br/investor-relations > Itaú Unibanco > Corporate Governance > Policies > Administrator Compensation Policy and Clawback. Additionally, since 2019 the Compensation Committee determined that Executive Committee members should retain the ownership of a minimum number of the Issuer’s shares equivalent to ten times the annual fixed compensation of the CEO and to five times the annual fixed compensation of the other members, which must be complied within a five-year period of after their position’s start date. On December 31, 2024, the CEO and all Executive Committee members met the minimum tenure requirement. The requirement must be accomplished up to five years after taking up their functions. The Issuer also provides a Plan for Granting Stock Option (“Stock Option Plan”) to its management members and employees, as well as to the management members and employees of its controlled companies, allowing the alignment of the interests of management members to those of stockholders, as they share the same risks and gains due to their share appreciation. No option has been granted under our Stock Option Plan since 2012. For further information on Changes in the Plan, please see Note 20 to the financial statements under IFRS. The Personnel Committee is responsible for making institutional decisions and supervising the Stock Option Plan implementation and operation. For further information on the responsibilities and functions of the Personnel Committee and the Compensation Committee, please see item 12.1 of the Reference Form available on www.itau.com.br/investor.relations > Menu > Results and Reports > Regulatory Reports > Reference Form. Compensation Policy – Compensation composition

Risk and Capital Management – Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 70 Corporativo | Interno Options may only be granted to participants if earnings are in sufficient amounts to be distributed as mandatory dividends. No option has been granted under our Stock Option Plan since 2012. For further information on Changes in the Plan, please see Note 20 to the financial statements under IFRS. For further information on the Stock Option Plan, please see the Investor Relations website: www.itau.com.br/investor-relations > Menu > Itaú Unibanco > Corporate Governance > Policies > Plan for Granting Stock Options. b) Main objectives of the plan Stock-based compensation models have the primary purpose of aligning management members’ interests with those of the Issuer's stockholders, as they share the same risks and earnings provided by their share appreciation. c) How the plan contributes to these objectives Stock-based payment models are intended to motivate management members to contribute to the Issuer’s good performance and share appreciation, as they may actively take part in the results of this appreciation. Accordingly, the institution achieves the objective of the stock-based payment models by engaging management members in the organization’s long-term strategies. Management members, in turn, take part in the appreciation of shares in the Issuer’s capital stock. d) How the plan is inserted in the Issuer’s compensation policy Stock-based payment models are in conformity with the principles pursued by the Issuer, since they (i) tie up management members to the Issuer’s projects and results in the long-term, (ii) work as tools that motivate individual development and commitment, and (iii) retain management members, as stock-based payments are made in the long term. e) How the plan is aligned with the short-, medium- and long-term interests of management members and the Issuer Stock-based payment models are aligned with the interests of the Issuer and management members, since that, by enabling management members to become stockholders of the Issuer, these are encouraged to act from the perspective of being the “owners“ of the business, therefore aligning their interests with those of the stockholders. Additionally, they motivate management members to remain at the Issuer, since general rule dictates that a member leaving the company will lose their rights to stock-based payments (please see sub item “i - Effects of the management member’s leave from the Issuer’s bodies on their rights, as provided for in the stock-based compensation plan”). f) Maximum number of shares covered by the plan In order to limit the maximum dilution to which Stockholders may be subject: the sum of (i) the shares to be used as compensation, in accordance with Resolution No. 5,177 of the National Monetary Council, including those related to the Partners Program and other stock-based compensation programs of the Issuer and its controlled companies; and (ii) the options to be granted each year may not exceed the limit of 0.5% of all Issuer’s shares that stockholders hold at the balance sheet date of the same year. In the event that the number of shares delivered and options granted, in any given year, is below the limit of 0.5% of the total shares as mentioned in the paragraph above, the resulting difference may be added for compensation or option granting purposes in any of the following seven (7) fiscal years. g) Restrictions on the transfer of shares Stock-based compensation: after receiving the shares within one, two or three years, there will be no restrictions to the share transfer. If the executive chooses to invest these shares in the Partners Program as Own Shares, these shares will become

Risk and Capital Management – Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 71 Corporativo | Interno unavailable for three and five years from the investment date. The transfer of the shares must comply with the blackout periods and other conditions established in the Company’s Policy for Trading Securities. Partners Program: after receiving the Partners Shares within three and five years from the initial investment, such shares will become unavailable for five and eight years as from the initial investment date. The transfer of the shares must comply with the blackout periods and other conditions established in the Company’s Policy for Trading Securities Stock Option Plan: the availability of shares subscribed by Beneficiaries by exercising the option may be subject to additional restrictions, according to resolutions to be adopted by the Personnel Committee upon grant. Therefore, the percentage of shares that must remain unavailable, as well as the period of this unavailability, will be defined by said Committee. As a rule, the period of this unavailability defined by the committee is two (2) years after the option is exercised. h) Criteria and events that may cause the suspension, amendment or termination of the plan Stock-based compensation: deferred shares may not be delivered in the event of a significant decrease in realized recurring net income of the Issuer or to a negative result of the applicable business area, expect when the reduction or negative result arises from extraordinary, unforeseeable events, external to Itaú Unibanco Holding, which also affect other financial institutions and are not related to the actions or omissions of the management members. The Compensation Committee may decide to apply the malus even in these cases. Additionally, the compensation model may be amended upon approval from the Compensation Committee and the Board of Directors. Partners Program: any Partners Shares still to be received may not be delivered in the event of a significant decrease in realized recurring net income of the Issuer or to a negative result of the applicable business area, expect when the reduction or negative result arises from extraordinary, unforeseeable events, external to Itaú Unibanco Holding, which also affect other financial institutions and are not related to the actions or omissions of the management members. The Compensation Committee may decide to apply the malus even in these cases. Additionally, the Partners Program may be amended upon approval from the Compensation Committee or the Personnel Committee. Stock Option Plan: the Personnel Committee may suspend the exercise of options under justifiable circumstances, such as significant market fluctuations or legal or regulatory restrictions. Additionally, the StockOption Plan may only be amended or terminated if proposed by the Personnel Committee to the Board of Directors and subsequently approved at an Extraordinary Stockholders’ Meeting. Furthermore, in December 2023 the Company adopted the Clawback policy (as an annex to the Directors' Remuneration Policy), which consists of the recovery of remuneration amounts granted or paid in excess to Directors appointed as the policy's target audience in case of restatement of financial results. The clawback policy is applied to all Long-Term Incentive programs. The policy is available on the Investor Relations website (www.itau.com.br/relacoes-com-investidores > Itaú Unibanco > Corporate Governance > Policies > Administrator Compensation Policy and Clawback. i) Effects of the management member’s leave from the Issuer’s bodies on their rights, as provided for in the stock-based compensation plan Stock-based compensation: Upon termination, the applicable rules for the granted shares that have not yet been vested will be observed. In the event of the extinction of shares not yet vested, it will occur on the date they leave the position permanently. The responsible Committee will observe the criteria established in the Compensation Policy, to ensure the compliance with the program rules Partners Program: Upon termination, the applicable rules for the granted Partner Shares that have not yet been delivered shall be observe. In the event of the extinction of the Partner Shares not yet vested, it will occur on the date they leave the position permanently. The responsible Committee will observe the criteria established in the Compensation Policy, to ensure the compliance with the program rules

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 73 ORA – Qualitative Information on Operational Risk Management The qualitative information on operational risk management covers the policies, strategies, structures, and processes adopted by Itaú Unibanco to ensure the proper management of this risk. Operational Risk management at Itaú is carried out in accordance with the guidelines established in the Operational Risk Management Policy, available on the website www.itau.com.br/relacoes-com-investidores, under the sections “Itaú Unibanco”, “Corporate Governance”, “Policies”, “Reports”. To enable this management, the institution adopts the three-lines model, published by the Institute of Internal Auditors (IIA). The First Line, represented by the Business, Support, or Community areas, is directly responsible for identifying, assessing, responding to, monitoring, and reporting operational risks. The Second Line, represented by the Risk Area (AR), ensures, independently and centrally, that risks are managed in accordance with policies and procedures, defining parameters for the risk management process and overseeing its execution. Reporting to the Risk Area, the Compliance & OPRisk Department (DCOR) supports the first line by ensuring compliance and customer centricity through monitoring the effectiveness of risk management and issuing an independent opinion on the quality of the control environment. DCOR operates independently, with direct communication with managers and employees and access to all necessary information. The Third Line, in turn, is represented by Internal Audit, a segregated and independent area, with responsibilities defined in the Internal Audit Policy. Regarding the systems, routines, and procedures used to measure operational risk, the capture and reporting of data related to operational losses are the responsibility of the Finance areas, which must ensure the integrity, consistency, and alignment of this data with the financial statements. The consolidation and maintenance of the loss database are carried out by the Risk Area, ensuring compliance with regulatory guidelines and normative requirements. Reporting areas must also collaborate with the Risk Area by providing complementary information that adequately enriches and characterizes recorded events. With respect to management reporting, the scope and context of the reports submitted to the Executive Board, the Risk Committee, and the Board of Directors include periodicity, criteria for the inclusion of relevant information, and the recording of extraordinary incidents. Communication with senior management occurs through specific governance forums. Within the Board of Directors, reporting occurs in the Risk and Capital Management Committee, established in accordance with CMN Resolution No. 4,557/2017, which supports the Board in monitoring risk management, including operational risk and internal controls. The Audit Committee, regulated by CMN Resolution No. 4,910/2021, evaluates the quality and effectiveness of internal controls and receives periodic updates on the matter. Additionally, in compliance with CMN Resolution No. 4,968, an annual report on internal control systems is submitted to the Board of Directors. For the Executive Committee, communication takes place in specific forums, such as the Compliance & OpRisk Higher Commission (CSCOR), which includes the President of Itaú Unibanco, members of the Executive Committee—including the Chief Risk Officer (CRO)—and the Internal Audit Director. This quarterly forum is responsible for understanding risks in business and support processes, evaluating the results of the Internal Controls System, and defining guidelines for the management of operational and regulatory risks. Another forum is the Compliance & OpRisk Committee (CCOR) with MCE, held three times a year, with participation from the Executive Committee member responsible for the area and the Compliance & OpRisk Director. Its responsibilities include understanding the area’s risks, responding to identified risks, monitoring action plans to improve the control environment, and addressing relevant methodological changes.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 81 Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision- making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the Risk Area in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. Step-in Risk Step-in Risk is the possibility of losses occurring for entities that are part of the Prudential Conglomerate as a result of financial support to unconsolidated entities, in a stressful situation, in the absence or in addition to the obligations provided for in the contract. Itaú Unibanco has a structure for risk management and control, a dedicated team and a policy that defines roles and responsibilities. This structure covers (i) the identification of entities in relation to the potential generation of step-in risk, (ii) the assessment of risks in relationships, (iii) the monitoring, control and mitigation of step-in risk, (iv) the assessment of impact on capital and liquidity and (v) reports. It is part of the scope of Step-in Risk governance: Related Party audiences, mainly composed of controllers (individuals and legal entities), entities related to them and controlled and related entities (as defined in Res. 4,693/18), foundations, investments in non-consolidated entities, suppliers of critical products and services, assigness, buyers and sellers of relevant assets, third parties with products distributed by Itaú Unibanco and third parties to whom Itaú Unibanco distributes products, besides all the analysis of the international Units. Emerging Risks These are newly identified risks that have a potentially material impact on business in the medium and long term, but for which there is still insufficient information for a complete assessment, due to the number of factors and impacts not yet fully understood, as they have no precedent and, therefore, have never been addressed in the past. Their causes may originate from external events, leading to the rise of new risks or the intensification of risks already monitored by ITAÚ UNIBANCO HOLDING. Once identified, such risks begin to be monitored and reassessed annually or on demand, until they no longer represent a risk or until they can be adequately measured. In the latter case, they then follow the subsequent stages of risk management. This process is ensured by the governance of ITAÚ UNIBANCO HOLDING, allowing these risks to also be incorporated into risk management procedures. Examples include Geopolitical, Climate, and CyberSecurity risks, which have or have had aspects considered as emerging risks.

Risk and Capital Management - Pillar 3 __________________________________________________________________________________________ __________________________________________________________________________________________ Itaú Unibanco 82 Operational Risk The National Monetary Council, through Resolution 4,557 of February 23, 2017, defines operational risk as “the possibility of losses resulting from external events or from failures, deficiencies, or inadequacies in internal processes, people, or systems.” This definition includes legal risk associated with inadequacies or deficiencies in contracts entered into by the Institution, sanctions resulting from non-compliance with legal requirements, and indemnities for damages to third parties arising from activities carried out by the Institution. Operational Risk management at Itaú is conducted in accordance with the guidelines of its risk governance framework and involves the following stages: Identification: Continuous identification of internal and external events that may adversely impact the achievement of strategic objectives in activities, projects, or products/services. When a relevant risk is identified, efforts must be made to extend the assessment to similar processes to ensure consistent mitigation across the bank. Assessment: Classification of residual risk, considering inherent impact and the quality of the control environment. The assessment must include potential changes in both internal and external environments, and its outcome should guide actions for responding to operational risk. Response: A structured set of decisions and actions adopted by the institution to accept, avoid, transfer, or mitigate operational risks. These responses must ensure that residual risk remains within the defined risk appetite and must be subject to continuous review and reporting to governance bodies. Monitoring: Tracking the quality of the control environment, preferably on an ongoing basis, using data analysis and exploration techniques with a granular view of customers or transactions, aiming for timely remediation of deficiencies through root-cause correction and realignment with Itaú’s risk appetite. Reporting: Issuance of an independent opinion on the quality of the control environment to the appropriate governance levels, as well as preparation of regulatory reports. In line with the principles of CMN Resolution 4,557, the document “Public Access Report – Integrated Operational Risk and Internal Controls Management Policy” is available at www.itau.com.br/relacoes-com-investidores, under the sections “Itaú Unibanco”, “Corporate Governance”, “Policies”, “Reports”. Crisis Management and Operational Resilience Itaú Unibanco's Operational Resilience Program’s purpose is to protect its employees, ensure the continuity of the critical functions of its business lines and sustain both the stability of the markets in which it operates and the confidence of its customers and strategic partners in its provision of services and products.To this end, it has policies that establish procedures, roles and responsibilities to be followed by the areas of Itaú Unibanco. The Program establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents.In order for the recovery to take place quickly and safely, PCN has defined corporate and customized actions for its business lines. In order for the BCP to reflect the priorities for resuming the business environment that supports the delivery of products and services, BIA (Business Impact Analysis) is applied. BIA identifies and assesses the impact on the business of process interruptions caused by failures due to human, natural, climatic, environmental, social and/or technological risks. Considering the dependence that some processes have on third-party services, the Operational Resilience Program conducts an assessment of the risk of unavailability of services provided with a view to resilience to threats of interruption.

Itau Unibanco Holding S.A. 6-K