ITAÚ UNIBANCO HOLDING S.A. CNPJ 60.872.504/0001-23 A Publicly-Held Company NIRE 35300010230 AUDIT COMMITTEE REGULATIONS These Regulations ('Regulations'), prepared on the basis best international practices, establish the rules for the functioning of the Audit Committee ('Committee'), instituted by the Extraordinary General Stockholders' Meeting of Itaú Unibanco Holding S.A. ('Itaú Unibanco') of April 28 2004, for the Itaú Unibanco Financial Conglomerate, which covers Itaú Unibanco and all its direct or indirect controlled companies ('Conglomerate'). I - Characteristics and Composition 1. The Committee shall be exclusive to the institutions authorized to operate by the Central Bank of Brazil ('BACEN') and to the companies supervised by the Superintendency of Private Insurance (SUSEP) that are part of the Conglomerate. 2. The Committee is the body responsible for the supervision of (i) the internal controls and risk management; (ii) the internal audit department's activities; and (iii) the activities of the Conglomerate's independent audit companies. 2.1. The Internal Audit area shall report administratively to the Board of Directors of Itaú Unibanco, in the person of its Chairman or Co-chairman, while supervision by the Audit Committee pursuant to the item 2 above and other items of these Regulations shall be of a technical nature. 3. The Committee reports to the Board of Directors of Itaú Unibanco ('Board of Directors') and shall be made up of, at least, three and, no more than, seven members, elected annually by the Board of Directors from among its members or professionals of recognized competence and outstanding knowledge, and at least one of the members of this Committee shall be designated as a Financial Expert. 3.1. The duties of a member of the Committee may not be delegated. 4. The Board of Directors shall terminate the term of office of any member of the Committee, should his/her independence have been compromised by any circumstances of conflict or potential conflict. 5. Those who are already seventy (70) years of age on the date of the election may not be elected to the Audit Committee. 6. The election of the Committee's members shall take place at the meeting of the Board of Directors at which the members of the Executive Board of Itaú Unibanco are elected. None of the members of the Committee may be, or may have been, in the past twelve months, (i) an officer of Itaú Unibanco or its controlled and affiliated companies; (ii) an employee of Itaú Unibanco or its controlled and affiliated companies; (iii) person in charge, officer, manager, supervisor or any other member of staff, with a managerial function, of the team involved in

AUDIT COMMITTEE REGULATIONS page 2 external audit work for Itaú Unibanco or its controlled and affiliated companies; (iv) a member of the Fiscal Council of Itaú Unibanco or its controlled and affiliated companies; (v) a controller of Itaú Unibanco or its controlled and affiliated companies or (vi) a natural person, holder of a direct or indirect interest of more than ten percent in the voting capital of Itaú Unibanco or its controlled and affiliated companies. 6.1.1. Spouses or relatives in direct line, collateral line or by affinity to the second degree of kinship with the persons mentioned in sub-items (i) to (vi) above are not eligible for election as Committee members. 6.1.2. The members of the Board of Directors in a position, or potentially in a position of conflict, which affects their independence, are not eligible for election as Committee members. 6.1.3. Members of the Audit Committee shall have a maximum term of office of five years, after which they may only reoccupy a seat on the Committee at least three (3) years following the expiry date of the last permitted reappointment. 6.1.4. Up to one-third (1/3) of the Audit Committee members may be reelected for a single (1) consecutive term of office of up to five (5) years, without adhering to the intervening period provided for in item 6.1.3. 6.1.5. The Audit Committee members shall remain in their positions until their successors take office. 7. The member of the Audit Committee shall receive no other type of compensation from the company or its controlled and affiliated companies which does not relate to his/her function as a member of the Audit Committee, except in those cases in which the member of the Audit Committee is also a member of the Board of Directors and opts to receive his/her compensation for the functions performed on behalf of that body. 8. The member elected to the Audit Committee may only be appointed Financial Expert should he have: (i) knowledge of generally accepted accounting principles; (ii) skills in applying these principles in the accounting procedures for provisions and reserves; (iii) experience in the preparation, auditing, analysis and evaluation of financial statements of a complexity similar to those of Itaú Unibanco or experience in the active supervision of these activities; and (iv) command of the rules for internal controls related to the preparation of financial statements 8.1. The knowledge mentioned under item 8 must have been acquired academically or through proven professional experience in the areas of: (i) accounting; (ii) auditing or (iii) financial administration. 9. The Board of Directors shall decide the compensation of the Committee's members as well as the budget for covering the functioning of the Committee, compensation that shall include an estimate for the hiring of external specialists for assisting the Committee in performing its functions.

AUDIT COMMITTEE REGULATIONS page 3 II-Functioning 10. The Committee will meet at least twelve (12) times a year, when convened by its Chairman 10.1. The Committee's decisions will be made by a majority of its members. 10.2. Prior distribution of the agenda of the meetings shall be made to the members of the Committee. 10.3. At the meetings of the Board of Directors held to approve the semi-annual financial statements, the Committee, through its Chairman, shall report on the work undertaken in the period and shall notify the material facts that have been observed. 10.4. The Committee shall hold a meeting with Itaú Unibanco's Fiscal Council at least once a year to discuss policies, practices and procedures related to the former's activities. 10.5. The members of the Committee shall attend a minimum of seventy-five percent (75%) of the meetings held in each term of office. 10.6. In extraordinary cases, the members of the Committee may attend the meetings by conference call, video conference or any other electronic means of communication available, which enables the simultaneous communication of the member of the Committee with those attending the meeting. 11. The Committee, upon the decision of the majority of its members, may convene any employee or member of management of a company that is part of the Conglomerate in order to provide clarifications. 12. The decisions of the meetings of the Committee shall be recorded in the form of minutes. III-Powers 13. It is incumbent on the Committee to vouch for (i) the quality and integrity of the financial statements; (ii) the compliance with legal and regulatory requirements; (iii) the performance, independence and quality of the work of the external audit companies; (iv) the performance, independence and quality of the work of the Internal Audit area; and (v) the quality and effectiveness of the systems for internal controls and risk management, being responsible for the following functions: I-Prepare the Regulations that discipline the Committee's functioning submitting these, as well as the respective amendments, for the approval of the Board of Directors. II-With respect to the financial statements, to: a. prior to publication, revise the semi-annual and annual financial statements and the quarterly information of the Conglomerate, as well as the explanatory notes, and the management reports and the reports of the independent audit companies;

AUDIT COMMITTEE REGULATIONS page 4 b. jointly with the independent audit company, analyze the main accounting policies, practices and principles used in the preparation of the financial statements, as well as any significant changes in the application or choice of these polices, practices and principles; c. jointly with the independent audit company, analyze the alternative methods of accounting, in the light of generally accepted accounting principles, related to financial information, including off-balance sheet structures and pro forma or adjusted information, its effects on the financial statements and the criteria used for disclosure, as well as the accounting treatment eventually recommended by the Conglomerate's independent audit companies; d. resolve any disagreements between the independent audit companies and Management as to the financial statements and the financial reports. III-With respect to internal controls, risk management and compliance with legal and regulatory requirements, to: a. assess the quality and effectiveness of the Conglomerate's existing internal controls and risk management systems, as well as the compliance area with the legal provisions, rules, regulations and the applicable internal rules. b. coordinate its activities with the activities of the Capital and Risk Management Committee. c. establish and disclose procedures for receiving and handling information on significant errors or fraud with respect to accounting, auditing and internal controls, as well as noncompliance with legal and regulatory provisions and internal rules, providing specific procedures for protecting whistle-blowers, such as their anonymity and the confidentiality of the information; d. recommend to Management the correction or improvement of policies, practices and procedures identified within the scope of the Committee's functions. IV-With respect to the Independent Auditor and the Internal Audit, to: a. recommend to the Board of Directors the companies to be engaged in Brazil and overseas for rendering independent audit services as well as the respective fees and substitutions; b. supervise the work of the Conglomerate's Internal Audit department and independent audit companies in order to evaluate their effectiveness and verify compliance with the legislation, regulations and internal rules; c. monitoring the implementation of recommendations by the independent audit companies and by the Internal Audit as well as those implemented by the Committee itself; d. recommend the approval by the Board of Directors of the policy for engaging the services to be rendered by the companies which audit the Conglomerate's financial statements. The policy shall establish the: (i) services which cannot be rendered by these companies, since they affect

AUDIT COMMITTEE REGULATIONS page 5 the companies' independence and/or objectivity, (ii) services, engagement for which has already been pre-approved by the Committee, and (iii) services which are subject to prior submission of the Committees approval; e. assess on an annual basis the Conglomerate's independent audit companies: (i) the procedures for internal quality of these companies; (ii) their independence; (iii) questions raised by government and regulatory authorities; (iv) the relationship between these independent audit companies and the Conglomerate; and (v) the most recent revision of the company's quality control (peer review): f. jointly with the Independent Auditor, revise the scope, planning and personnel to be allocated for performing its work; g. decide on the engagement of employees or service providers which have been working in the teams of the independent audit companies that render or have previously rendered auditing services related to the financial statements of the Conglomerate in the previous twelve months; h. approve the plan and supervise the performance and the results of the Internal Audit area's work as well as the technical qualification of its employees; i. recommend the election, substitution or removal of the officer responsible for the Internal Audit area. V-With respect to the Regulatory Agencies, to: a. discuss with Management, significant issues or inspections of the regulatory agencies, and measures taken to resolve them; b. monitor the work of the government supervision and inspection agencies; VI-With respect to the External Ombudsman's Department, to: a. at the end of each semester, receive and examine the qualitative and quantitative report with respect to the performance of the Conglomerate's External Ombudsman's Department; b. examine the report prepared by the Officer for the External Ombudsman's Department with respect to the activities of the External Ombudsman's Department as at the baseline dates of June 30 and December 31 or when a significant event is identified. VII - With respect to the foreign subsidiaries and affiliated companies of Itaú Unibanco: a. monitoring the functioning of the Audit Committees of these units, whenever they are in place, participating in the choice of its members. 14. The Committee may engage external specialists, ensuring the integrity and the confidentiality of the work undertaken.

14.1. The work of the external specialists does not exempt the Committee from its responsibilities. 15. The Committee shall, individually or jointly with the Conglomerate's related independent audit companies, formally communicate to BACEN or SUSEP, within no more than three business days from the time of identification, the existence or evidence of: (i) noncompliance with the legal and regulatory provisions and internal norms that place the continuity of any of the companies in the Conglomerate at risk; (ii) frauds of any value perpetrated by the management (members of the Board of Directors and Executive Board) of any of the companies in the Conglomerate; (iii) significant frauds perpetrated by the employees of any of the companies in the Conglomerate, or by third parties; and (iv) errors resulting in significant inaccuracies in the financial statements of any of the companies in the Conglomerate: 16. Management shall notify the Committee and the respective independent audit companies as to the identification of events mentioned in item 15 within no more than twenty-four hours, in accordance with the procedures established by the Committee. 17. The facts, the result of whistle-blowing, or notified infringements shall be investigated and submitted for the Committee's examination. 18. The independent and internal auditors and the Organization's Compliance area shall from time to time supply the Committee with reports as to the conformity of adopted procedures, with the laws and regulations. 19. The Committee shall prepare the 'Report of the Audit Committee' for the semesters ending June 30 and December 31. 19.1. The reports prepared by the Committee shall include information required by the current regulations. 19.2. At least annually, the Report shall include, in addition to the mandatory information already mentioned, aspects relating to: (i) a formal appraisal of the work carried out by the internal audit, independent audit and by those responsible of the operational risk, internal controls and compliance area in the year; (ii) self-evaluation of the Committee; and (iii) professional update and training activities conducted by the members of the Committee: 20. A summary of the Audit Committee's Report shall be published containing the Committee's main information, jointly with the Conglomerate's semi-annual and annual financial statements 21. The Audit Committee's Report shall be held at the disposal of BACEN and the Board of Directors for a minimum period of five years from the date of its completion. A copy of this report shall be submitted to the Board of Directors. 22. In addition, for the six months ending on June 30 and December 31, the Committee shall prepare a specific report on the activities performed in the period with respect to the companies supervised by SUSEP. This report shall be held at the disposal of SUSEP for a minimum period of five years from the date of its completion.

Attachments

  • Original document
  • Permalink

Disclaimer

Itaú Unibanco Holding SA published this content on 03 September 2021 and is solely responsible for the information contained therein. Distributed by Public, unedited and unaltered, on 03 September 2021 12:11:04 UTC.