ITAÚ UNIBANCO HOLDING S.A. CNPJ 60.872.504/0001-23 A Publicly-Held Company NIRE 35300010230 AUDIT COMMITTEE REGULATIONS These Regulations ("Regulations"), prepared on the basis best international practices, establish the rules for the functioning of the Audit Committee ("Committee"), instituted by the Extraordinary General Stockholders' Meeting of Itaú Unibanco Holding S.A. ("Itaú Unibanco") of April 28 2004, for the Itaú Unibanco Financial Conglomerate, which covers Itaú Unibanco and all its direct or indirect controlled companies ("Conglomerate"). I - Characteristics and Composition 1. The Committee shall be exclusive to the institutions authorized to operate by the Central Bank of Brazil ("BACEN") and to the companies supervised by the Superintendency of Private Insurance ("SUSEP") that are part of the Conglomerate. 2. The Committee is the body responsible for the supervision of (i) the internal controls and risk management; (ii) the internal audit department's activities; and (iii) the activities of the Conglomerate's independent audit companies and hiring and termination recommendation from the independent auditor to the Board of Directors. 2.1. The Internal Audit area shall report administratively to the Board of Directors of Itaú Unibanco, ("Board Of Directors"), while supervision by the Audit Committee pursuant to the item 2 above and other items of these Regulations shall be of a technical nature. 3. The Audit Committee reports to the Board of Directors of Itaú Unibanco ("Board of Directors") and shall be made up of, at least, three and, no more than, seven members, elected annually by the Board of Directors from among its members or professionals of recognized competence and outstanding knowledge, and at least one of the members of this Committee shall be designated as a Financial Expert and shall have proven expertise in accounting a audit. 3.1. The duties of a member of the Committee may not be delegated. 4. The Board of Directors shall terminate the term of office of any member of the Audit Committee, should his/her independence have been compromised by any circumstances of conflict or potential conflict. 5. Those who are already seventy (70) years of age on the date of the election may not be elected to the Audit Committee. 6. The election of the Committee's members shall take place at the meeting of the Board of Directors at which the members of the Executive Board of Itaú Unibanco are elected.

AUDIT COMMITTEE REGULATION page 2 6.1. None of the members of the Committee may be, or may have been, in the past twelve (12) months, (i) an officer of Itaú Unibanco or its parent company or its affiliates, subsidiaries, or direct or indirect jointly controlled entities; (ii) an employee of Itaú Unibanco or its parent company or its affiliates, subsidiaries, or direct or indirect jointly controlled entities; (iii) person in charge, officer, manager, supervisor or any other member of staff, with a managerial function, of the team involved in the audit work in the Company; or (iv) a member of the Fiscal Council of Itaú Unibanco or its parent company or its affiliates, subsidiaries, or direct or indirect jointly controlled entities. 6.1.1. Spouse, partner, or relatives in direct line, collateral line, or by affinity to the second degree of kinship with the persons mentioned in subitems (i) to (vi) above are not eligible for election as Committee members. 6.1.2. The members of the Board of Directors in a position, or potentially in a position of conflict, which affects their independence, are not eligible for election as Committee members. 6.1.3. Committee members may not hold positions, in particular, on advisory, management, or supervisory councils, in companies that may be considered competitors in the market or in which a conflict of interest may arise. 6.1.4. The members of the Audit Committee shall have a term of office of one (1) year and may be reelected up to a limit of five (5) annual terms, and may only rejoin the Audit Committee after at least three years have elapsed from the end of the last permitted reappointment. 6.1.5. Up to one third of the Audit Committee members may have their terms of office renewed, respecting the maximum tenure period of up to ten consecutive years, waiving the intervening period provided for in item 6.1.4. 6.1.6. Under no circumstances will it be allowed for a member to remain on the Audit Committee for a period exceeding (i) ten (10) consecutive years for up to one third of the members; and (ii) five (5) consecutive years for the other members. 6.1.7. The Audit Committee members shall remain in their positions until their successors take office. 7. The Board of Directors shall define the amount intended for the compensation of the members of the Audit Committee, provided that the market parameters, as well as the budget intended to cover the expenses for its operation are observed, including the engagement of experts to help the fulfillment of its duties. 7.1.1. The member of the Audit Committee shall receive no other type of compensation from the company or its parent company or its affiliates, subsidiaries, or direct or indirect jointly controlled entities, which does not relate to his/her function as a member of the Audit Committee, except in those cases in which the member of the Audit Committee is also a member of the Board of Directors and elects to receive his/her compensation for the functions performed on behalf of this Committee.

AUDIT COMMITTEE REGULATION page 3 8. The member elected to the Audit Committee may only be appointed Financial Expert should he have: (i) knowledge of generally accepted accounting principles; (ii) skills in applying these principles in the accounting procedures for provisions and reserves; (iii) experience in the preparation, auditing, analysis and evaluation of financial statements of a complexity similar to those of Itaú Unibanco or experience in the active supervision of these activities; and (iv) command of the rules for internal controls related to the preparation of financial statements. 8.1. The knowledge mentioned under item 8 must have been acquired academically or through proven professional experience in the areas of: (i) accounting; (ii) auditing or (iii) financial administration. II - Functioning 9. The Committee will meet at least twelve (12) times a year, when convened by its Chairman. 9.1. The Committee's decisions will be made by a majority of its members. 9.2. Prior distribution of the agenda of the meetings shall be made to the members of the Committee. 9.3. At the meetings of the Board of Directors held to approve the semi-annual financial statements, the Committee, through its Chairman, shall report on the work undertaken in the period and shall notify the material facts that have been observed. 9.4. The Committee shall hold a meeting with Itaú Unibanco's Fiscal Council at least once a year to discuss policies, practices and procedures related to the former's activities. 9.5. The members of the Committee shall attend a minimum of seventy-five percent (75%) of the meetings held in each term of office. 9.6. The members of the Committee may attend the meetings by conference call, video conference, or any other electronic means of communication available, which enables the simultaneous communication of the member of the Committee with those attending the meeting. 10. The Committee, upon the decision of the majority of its members, may convene any employee or member of management of a company that is part of the Conglomerate in order to provide clarifications. 11. The decisions of the meetings of the Committee shall be recorded in the form of minutes. III-Powers

AUDIT COMMITTEE REGULATION page 4 12. The Audit Committee shall meet when convened by its Chairman and shall ensure: (i) the quality and integrity of the financial statements; (ii) the compliance with the prevailing legal and regulatory requirements; (iii) the performance, independence and quality of the work of the external audit companies; (iv) the performance, independence and quality of the work of the Internal Audit area; and (v) the quality and effectiveness of the systems for internal controls and risk management. It shall be responsible for the following duties: I-Prepare the Regulations that govern the Committee's functioning by submitting these, as well as the amendments thereto, for the approval of the Board of Directors. II-With respect to the financial statements, to: a. prior to publication, revise the semi-annual and annual financial statements and the quarterly information of the Conglomerate, as well as the explanatory notes, and the management reports and the reports of the independent audit companies; b. jointly with the independent audit firm, analyze the main accounting policies, practices and principles used in the preparation of the financial statements, as well as any significant changes in the application or choice of these polices, practices and principles; c. jointly with the independent audit firm, analyze the alternative methods of accounting, in the light of generally accepted accounting principles, related to financial information, including off-balance sheet structures and pro forma or adjusted information, its effects on the financial statements and the criteria used for disclosure, as well as the accounting treatment eventually recommended by the Conglomerate's independent audit companies; d. resolve any disagreements between the independent audit firms and Management as to the financial statements and the financial reports. III-With respect to internal controls, risk management and compliance with legal, and regulatory requirements, to: a. assess the quality and effectiveness of the Conglomerate's existing internal controls and risk management systems, as well as the compliance area with the legal provisions, rules, regulations and the applicable internal rules. b. coordinate its activities with the activities of the Risk Management and Capital Committee. c. establish and disclose procedures for receiving and handling information on significant errors or fraud with respect to accounting, auditing and internal controls, as well as noncompliance with legal and regulatory provisions and internal rules, providing specific procedures for protecting whistleblowers, such as their anonymity and the confidentiality of the information;

AUDIT COMMITTEE REGULATION page 5 d. recommend to Management the correction or improvement of policies, practices and procedures identified within the scope of the Committee's functions. e. assess and express an opinion on granting of any indemnification and the payment of costs and expenses under indemnification commitments possibly entered into by Conglomerate companies, as well as the need to adopt additional prior procedures for the purpose of providing inputs for the assessment, including hiring of outside experts, except in cases in which the beneficiary of the indemnification commitment is a member of the Audit Committee, in which case any indemnification payments shall be submitted, assessed, and approved by the Related-Parties Committee. IV-With respect to the Independent Auditor and the Internal Audit, to: a. recommend to the Board of Directors the firms to be engaged in Brazil and overseas for rendering independent audit services as well as the respective fees and substitutions; b. oversee the work of the Conglomerate's Internal Audit department and independent audit firms in order to evaluate their effectiveness and verify compliance with the legislation, regulations and internal rules; c. monitor the implementation of recommendations by the independent audit companies and by the Internal Audit as well as those implemented by the Committee itself; d. recommend the approval by the Board of Directors of the policy for engaging the services to be rendered by the firms that audit the Conglomerate's financial statements. The policy shall establish the: (i) services which cannot be rendered by these audit firms because they would affect these firms' independence and/or objectivity, (ii) services, engagement for which has already been pre-approved by the Committee, and (iii) services which are subject to prior submission of the Committees approval; e. assess on an annual basis, together with the Conglomerate's independent audit firms: (i) these firms' internal control procedures; (ii) their independence; (iii) questions raised by government and regulatory authorities; (iv) the relationship between these independent audit firms and the Conglomerate; and (v) the most recent review of each firm's quality control; f. jointly with the independent auditor, review the scope, planning, and staff to be allocated for performing its work; g. decide on the engagement of employees or service providers which have been working in the teams of the independent audit firms that render or have previously rendered auditing services related to the financial statements of the Conglomerate in the previous twelve months; h. approve the plan and supervise the performance and the results of the Internal Audit area's work as well as the technical qualification of its employees;

AUDIT COMMITTEE REGULATION page 6 i. recommend the election, replacement, or removal of the officer responsible for the Internal Audit function. V-With respect to the Regulatory Agencies, to: a. discuss with Management, significant issues raised by or inspections of the regulatory agencies, and measures taken to resolve them; b. monitor the work of the government supervision and inspection agencies; VI-With respect to the External Ombudsman's Department, to: a. at the end of each six-month period, receive and review the qualitative and quantitative report with respect to the performance of the Conglomerate's External Ombudsman's Department; b. examine the report prepared by the Officer for the External Ombudsman's Department with respect to the activities of the External Ombudsman's Department as at the baseline dates of June 30 and December 31 or when a material event is identified. VII - With respect to the foreign subsidiaries and affiliated companies of Itaú Unibanco: a. monitor the functioning of the Audit Committees of these units, whenever they are in place, participating in the choice of its members. 13. The Committee may engage external specialists, ensuring the integrity and the confidentiality of the work undertaken. 13.1. The work of the external specialists does not exempt the Committee from its responsibilities. 14. The Committee shall, individually or jointly with the Conglomerate's related independent audit companies, formally communicate to BACEN or SUSEP, within no more than three business days from the time of identification, the existence or evidence of: (i) noncompliance with the legal and regulatory provisions and internal norms that place the continuity of any of the companies in the Conglomerate at risk; (ii) frauds of any value perpetrated by the management (members of the Board of Directors and Executive Board) of any of the companies in the Conglomerate; (iii) significant frauds perpetrated by the employees of any of the companies in the Conglomerate, or by third parties; and (iv) errors resulting in significant inaccuracies in the financial statements of any of the companies in the Conglomerate. 15. Management shall notify the Committee and the respective independent audit companies as to the identification of events mentioned in item 15 within no more than twenty-four hours, in accordance with the procedures established by the Committee. 16. The facts, the result of whistle-blowing, or notified infringements shall be investigated and submitted for the Committee's examination.

AUDIT COMMITTEE REGULATION page 7 17. The independent and internal auditors and the Organization's Compliance area shall from time to time supply the Committee with reports as to the conformity of adopted procedures, with the laws and regulations. 18. The Audit Committee shall prepare, at the end of each year, for the six-month periods ending on June 30 and December 31, a report on the follow-up of the activities related to the independent and internal audits and to the Internal Controls and Risk Management System, called "Audit Committee Report", and send a copy to the Board of Directors, as well as keep it available to the Central Bank of Brazil and the Superintendency of Private Insurance ("SUSEP"), for the minimum period of five years after its completion. 18.1. The reports prepared by the Committee shall include information required by the current regulations. 18.2. At least annually, the Report shall include, in addition to the mandatory information already mentioned, aspects relating to: (i) a formal appraisal of the work carried out by the internal audit, independent audit and by those responsible of the operational risk, internal controls and compliance area in the year; (ii) self-evaluation of the Committee; and (iii) professional update and training activities conducted by the members of the Committee. 19. A summary of the Audit Committee's Report shall be published containing the Committee's main information, jointly with the Conglomerate's semi-annual and annual financial statements. __________________________

Attachments

  • Original Link
  • Original Document
  • Permalink

Disclaimer

Itaú Unibanco Holding SA published this content on 11 October 2022 and is solely responsible for the information contained therein. Distributed by Public, unedited and unaltered, on 11 October 2022 11:01:05 UTC.