B3 S A Brasil Bolsa Balcão : Corporate Risk Policy

CORPORATE RISK MANAGEMENT POLICY

24/9/2020

PUBLIC INFORMATION

CORPORATE RISK MANAGEMENT

POLICY

CONTENTS
1	PURPOSE ...................................................................................................	3
2	SCOPE ........................................................................................................	3
3	REFERENCES ............................................................................................	3
4	CONCEPTS .................................................................................................	4
5	GUIDELINES ...............................................................................................	5
6	RESPONSIBILITIES....................................................................................	8
7	FINAL PROVISIONS .................................................................................	13

2	PUBLIC INFORMATION

INFORMAÇÃO INTERNA - INTERNAL INFORMATION

CORPORATE RISK MANAGEMENT

POLICY

1 PURPOSE

The purpose of this policy is to establish the principles, guidelines and responsibilities to be observed in the process of managing corporate risks, so as to enable their adequate identification, assessment, treatment, monitoring and communication.

2 SCOPE

This Policy applies to executive officers, employees, interns, apprentices, suppliers, service providers and partners of B3 S.A. - Brasil, Bolsa, Balcão, its subsidiaries abroad, Cetip Info Tecnologia S.A, B3 Social, and other members ("the Company").

Credit, liquidity and market risks relating to the activities of the Company's clearinghouses in their role as central counterparty are covered by the clearinghouses' rulebooks and manuals, as approved by the Central Bank of Brazil, the Securities and Exchange Commission of Brazil (CVM) and, specifically in the case of rulebooks, also by B3's Board of Directors, and lie outside the scope of this Policy.

3 REFERENCES

• Corporate Bylaws.
• Code of Conduct.
• COSO - ERM: Committee of Sponsoring Organizations of the Treadway Commission - Enterprise Risk Management Framework.
• CVM Instruction 461/2007.
• Compliance and Internal Control Policy.
• Disclosure and Securities Trading Policy Manual.

3	PUBLIC INFORMATION

INFORMAÇÃO INTERNA - INTERNAL INFORMATION

CORPORATE RISK MANAGEMENT

POLICY

• Information Security Policy.
• Policy on Related Party Transactions and other Potential Conflict of Interest Situations.
• ABNT Standard NBR ISO 31000:2009 - Risk Management: Principles and Guidelines.

4 CONCEPTS

• Risk: The possibility of an event that negatively affects the Company's ability to achieve its objectives or to operate its processes.
• Corporate risk: The strategic, operational, financial and regulatory risks associated with the Company's activities and its ability to achieve its business objectives.
• Strategic risk: The possibility of implementing an unsuccessful or ineffective strategy that fails to achieve the intended returns. Additionally, issues related to the Company's image, its socio-environmental management, people and standards of ethics and of conduct are considered strategic.
• Operational risk: The possibility of losses due to faults, deficiencies or inadequacies in internal processes, people, and technological environments, or external events. Includes legal risk, associated with inadequacies or deficiencies in contracts signed by the Company, penalties due to infringement of legal provisions, and third-party claims for compensation arising from the
  Company's activities. Events involving operational risk include internal and external fraud, labor litigation and workplace health and safety noncompliance, inadequate practices relating to customers, products and services, damage to physical assets, and any events causing interruptions to the Company's activities and information technology system and infrastructure failures.
• Financial risk: The possibility of the Company being exposed to fines and

4	PUBLIC INFORMATION

INFORMAÇÃO INTERNA - INTERNAL INFORMATION